# git rev-parse -q --verify ba422731316dde1e22dcc84b83c7349dc0ce1c3c^{commit} ba422731316dde1e22dcc84b83c7349dc0ce1c3c already have revision, skipping fetch # git checkout -q -f -B kisskb ba422731316dde1e22dcc84b83c7349dc0ce1c3c # git clean -qxdf # < git log -1 # commit ba422731316dde1e22dcc84b83c7349dc0ce1c3c # Author: Sean Christopherson # Date: Wed Jan 9 16:51:17 2019 -0800 # # mm/mmu_notifier: mm/rmap.c: Fix a mmu_notifier range bug in try_to_unmap_one # # The conversion to use a structure for mmu_notifier_invalidate_range_*() # unintentionally changed the usage in try_to_unmap_one() to init the # 'struct mmu_notifier_range' with vma->vm_start instead of @address, # i.e. it invalidates the wrong address range. Revert to the correct # address range. # # Manifests as KVM use-after-free WARNINGs and subsequent "BUG: Bad page # state in process X" errors when reclaiming from a KVM guest due to KVM # removing the wrong pages from its own mappings. # # Reported-by: leozinho29_eu@hotmail.com # Reported-by: Mike Galbraith # Reported-and-tested-by: Adam Borowski # Reviewed-by: Jérôme Glisse # Reviewed-by: Pankaj gupta # Cc: Christian König # Cc: Jan Kara # Cc: Matthew Wilcox # Cc: Ross Zwisler # Cc: Dan Williams # Cc: Paolo Bonzini # Cc: Radim Krčmář # Cc: Michal Hocko # Cc: Felix Kuehling # Cc: Ralph Campbell # Cc: John Hubbard # Cc: Andrew Morton # Fixes: ac46d4f3c432 ("mm/mmu_notifier: use structure for invalidate_range_start/end calls v2") # Signed-off-by: Sean Christopherson # Signed-off-by: Linus Torvalds # < /opt/cross/kisskb/br-xtensa-full-2016.08-613-ge98b4dd/bin/xtensa-linux-gcc --version # < /opt/cross/kisskb/br-xtensa-full-2016.08-613-ge98b4dd/bin/xtensa-linux-ld --version # < git log --format=%s --max-count=1 ba422731316dde1e22dcc84b83c7349dc0ce1c3c # < make -s -j 80 ARCH=xtensa O=/kisskb/build/linus_xtensa-allmodconfig_xtensa CROSS_COMPILE=/opt/cross/kisskb/br-xtensa-full-2016.08-613-ge98b4dd/bin/xtensa-linux- allmodconfig drivers/staging/mt7621-dts/Kconfig:4:warning: 'BUILTIN_DTB' has wrong type. 'select' only accept arguments of bool and tristate type # Added to kconfig CONFIG_BUILD_DOCSRC=n # Added to kconfig CONFIG_MODULE_SIG=n # Added to kconfig CONFIG_SAMPLES=n # yes \n | make -s -j 80 ARCH=xtensa O=/kisskb/build/linus_xtensa-allmodconfig_xtensa CROSS_COMPILE=/opt/cross/kisskb/br-xtensa-full-2016.08-613-ge98b4dd/bin/xtensa-linux- oldconfig yes: standard output: Broken pipe # make -s -j 80 ARCH=xtensa O=/kisskb/build/linus_xtensa-allmodconfig_xtensa CROSS_COMPILE=/opt/cross/kisskb/br-xtensa-full-2016.08-613-ge98b4dd/bin/xtensa-linux- drivers/staging/mt7621-dts/Kconfig:4:warning: 'BUILTIN_DTB' has wrong type. 'select' only accept arguments of bool and tristate type :1333:2: warning: #warning syscall io_pgetevents not implemented [-Wcpp] :1336:2: warning: #warning syscall rseq not implemented [-Wcpp] /kisskb/src/arch/xtensa/kernel/pci.c:45:32: warning: 'pci_ctrl_tail' defined but not used [-Wunused-variable] static struct pci_controller **pci_ctrl_tail = &pci_ctrl_head; ^ ./usr/include/asm/setup.h:17: userspace cannot reference function or variable defined in the kernel /kisskb/src/fs/cifs/cifssmb.c: In function '__cifs_reconnect_tcon': /kisskb/src/fs/cifs/cifssmb.c:186:1: warning: the frame size of 1344 bytes is larger than 1024 bytes [-Wframe-larger-than=] } ^ /kisskb/src/drivers/char/tpm/tpm2-cmd.c: In function 'tpm2_unseal_trusted': /kisskb/src/drivers/char/tpm/tpm2-cmd.c:668:2: warning: 'blob_handle' may be used uninitialized in this function [-Wmaybe-uninitialized] tpm2_flush_context_cmd(chip, blob_handle, TPM_TRANSMIT_UNLOCKED); ^ /kisskb/src/fs/cifs/smb2pdu.c: In function '__smb2_reconnect': /kisskb/src/fs/cifs/smb2pdu.c:220:1: warning: the frame size of 1344 bytes is larger than 1024 bytes [-Wframe-larger-than=] } ^ /kisskb/src/drivers/input/joystick/analog.c:172:2: warning: #warning Precise timer not defined for this architecture. [-Wcpp] #warning Precise timer not defined for this architecture. ^ /kisskb/src/drivers/i2c/i2c-core-base.c: In function 'i2c_generic_scl_recovery': /kisskb/src/drivers/i2c/i2c-core-base.c:235:5: warning: 'ret' may be used uninitialized in this function [-Wmaybe-uninitialized] if (ret == -EOPNOTSUPP) ^ In file included from /kisskb/src/arch/xtensa/include/asm/atomic.h:21:0, from /kisskb/src/include/linux/atomic.h:7, from /kisskb/src/include/asm-generic/bitops/atomic.h:5, from /kisskb/src/arch/xtensa/include/asm/bitops.h:222, from /kisskb/src/include/linux/bitops.h:19, from /kisskb/src/include/linux/kernel.h:11, from /kisskb/src/include/linux/list.h:9, from /kisskb/src/include/linux/wait.h:7, from /kisskb/src/include/linux/wait_bit.h:8, from /kisskb/src/include/linux/fs.h:6, from /kisskb/src/fs/ocfs2/file.c:27: /kisskb/src/fs/ocfs2/file.c: In function 'ocfs2_file_write_iter': /kisskb/src/arch/xtensa/include/asm/cmpxchg.h:139:3: warning: value computed is not used [-Wunused-value] ((__typeof__(*(ptr)))__xchg((unsigned long)(x),(ptr),sizeof(*(ptr)))) ^ /kisskb/src/fs/ocfs2/file.c:2386:3: note: in expansion of macro 'xchg' xchg(&iocb->ki_complete, saved_ki_complete); ^ In file included from /kisskb/src/include/linux/rwsem.h:16:0, from /kisskb/src/include/linux/notifier.h:15, from /kisskb/src/include/linux/clk.h:17, from /kisskb/src/drivers/tty/serial/sh-sci.c:24: /kisskb/src/drivers/tty/serial/sh-sci.c: In function 'sci_submit_rx': /kisskb/src/include/linux/spinlock.h:279:3: warning: 'flags' may be used uninitialized in this function [-Wmaybe-uninitialized] _raw_spin_unlock_irqrestore(lock, flags); \ ^ /kisskb/src/drivers/tty/serial/sh-sci.c:1338:16: note: 'flags' was declared here unsigned long flags; ^ /kisskb/src/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c: In function 'mlx5e_grp_sw_update_stats': /kisskb/src/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c:217:1: warning: the frame size of 1200 bytes is larger than 1024 bytes [-Wframe-larger-than=] } ^ In file included from /kisskb/src/arch/xtensa/include/asm/atomic.h:21:0, from /kisskb/src/include/linux/atomic.h:7, from /kisskb/src/include/asm-generic/bitops/atomic.h:5, from /kisskb/src/arch/xtensa/include/asm/bitops.h:222, from /kisskb/src/include/linux/bitops.h:19, from /kisskb/src/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c:11: /kisskb/src/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c: In function 'ixgbevf_xdp_setup': /kisskb/src/arch/xtensa/include/asm/cmpxchg.h:139:3: warning: value computed is not used [-Wunused-value] ((__typeof__(*(ptr)))__xchg((unsigned long)(x),(ptr),sizeof(*(ptr)))) ^ /kisskb/src/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c:4471:4: note: in expansion of macro 'xchg' xchg(&adapter->rx_ring[i]->xdp_prog, adapter->xdp_prog); ^ Completed OK # rm -rf /kisskb/build/linus_xtensa-allmodconfig_xtensa # Build took: 0:10:51.826449