# git rev-parse -q --verify a68a0262abdaa251e12c53715f48e698a18ef402^{commit} a68a0262abdaa251e12c53715f48e698a18ef402 already have revision, skipping fetch # git checkout -q -f -B kisskb a68a0262abdaa251e12c53715f48e698a18ef402 # git clean -qxdf # < git log -1 # commit a68a0262abdaa251e12c53715f48e698a18ef402 # Author: Minchan Kim # Date: Tue Dec 8 20:57:18 2020 -0800 # # mm/madvise: remove racy mm ownership check # # Jann spotted the security hole due to race of mm ownership check. # # If the task is sharing the mm_struct but goes through execve() before # mm_access(), it could skip process_madvise_behavior_valid check. That # makes *any advice hint* to reach into the remote process. # # This patch removes the mm ownership check. With it, it will lose the # ability that local process could give *any* advice hint with vector # interface for some reason (e.g., performance). Since there is no # concrete example in upstream yet, it would be better to remove the # abiliity at this moment and need to review when such new advice comes # up. # # Fixes: ecb8ac8b1f14 ("mm/madvise: introduce process_madvise() syscall: an external memory hinting API") # Reported-by: Jann Horn # Suggested-by: Jann Horn # Signed-off-by: Minchan Kim # Signed-off-by: Linus Torvalds # < /opt/cross/kisskb/korg/gcc-8.1.0-nolibc/s390-linux/bin/s390-linux-gcc --version # < /opt/cross/kisskb/korg/gcc-8.1.0-nolibc/s390-linux/bin/s390-linux-ld --version # < git log --format=%s --max-count=1 a68a0262abdaa251e12c53715f48e698a18ef402 # < make -s -j 8 ARCH=s390 O=/kisskb/build/linus_s390-allyesconfig_s390x-gcc8 CROSS_COMPILE=/opt/cross/kisskb/korg/gcc-8.1.0-nolibc/s390-linux/bin/s390-linux- allyesconfig # Added to kconfig CONFIG_BUILD_DOCSRC=n # Added to kconfig CONFIG_MODULE_SIG=n # < make -s -j 8 ARCH=s390 O=/kisskb/build/linus_s390-allyesconfig_s390x-gcc8 CROSS_COMPILE=/opt/cross/kisskb/korg/gcc-8.1.0-nolibc/s390-linux/bin/s390-linux- help # make -s -j 8 ARCH=s390 O=/kisskb/build/linus_s390-allyesconfig_s390x-gcc8 CROSS_COMPILE=/opt/cross/kisskb/korg/gcc-8.1.0-nolibc/s390-linux/bin/s390-linux- olddefconfig # make -s -j 8 ARCH=s390 O=/kisskb/build/linus_s390-allyesconfig_s390x-gcc8 CROSS_COMPILE=/opt/cross/kisskb/korg/gcc-8.1.0-nolibc/s390-linux/bin/s390-linux- /kisskb/src/drivers/gpu/drm/rockchip/cdn-dp-core.c:1124:12: warning: 'cdn_dp_resume' defined but not used [-Wunused-function] static int cdn_dp_resume(struct device *dev) ^~~~~~~~~~~~~ /kisskb/src/drivers/input/joystick/analog.c:160:2: warning: #warning Precise timer not defined for this architecture. [-Wcpp] #warning Precise timer not defined for this architecture. ^~~~~~~ In file included from /kisskb/src/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c:42: /kisskb/src/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c: In function 'mvpp2_setup_bm_pool': /kisskb/src/drivers/net/ethernet/marvell/mvpp2/mvpp2.h:760:2: warning: overflow in conversion from 'long unsigned int' to 'int' changes value from '18446744073709551584' to '-32' [-Woverflow] ((total_size) - MVPP2_SKB_HEADROOM - MVPP2_SKB_SHINFO_SIZE) ^ /kisskb/src/drivers/net/ethernet/marvell/mvpp2/mvpp2.h:864:33: note: in expansion of macro 'MVPP2_RX_MAX_PKT_SIZE' #define MVPP2_BM_SHORT_PKT_SIZE MVPP2_RX_MAX_PKT_SIZE(MVPP2_BM_SHORT_FRAME_SIZE) ^~~~~~~~~~~~~~~~~~~~~ /kisskb/src/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c:647:41: note: in expansion of macro 'MVPP2_BM_SHORT_PKT_SIZE' mvpp2_pools[MVPP2_BM_SHORT].pkt_size = MVPP2_BM_SHORT_PKT_SIZE; ^~~~~~~~~~~~~~~~~~~~~~~ Completed OK # rm -rf /kisskb/build/linus_s390-allyesconfig_s390x-gcc8 # Build took: 0:30:21.038922