Patch "mm/pagewalk.c: report holes in hugetlb ranges" has been added to the 4.13-stable tree

This is a note to let you know that I've just added the patch titled

mm/pagewalk.c: report holes in hugetlb ranges

to the 4.13-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
mm-pagewalk.c-report-holes-in-hugetlb-ranges.patch
and it can be found in the queue-4.13 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Jann Horn <[email protected]>
Date: Tue, 14 Nov 2017 01:03:44 +0100
Subject: mm/pagewalk.c: report holes in hugetlb ranges

From: Jann Horn <[email protected]>

commit 373c4557d2aa362702c4c2d41288fb1e54990b7c upstream.

This matters at least for the mincore syscall, which will otherwise copy uninitialized memory from the page allocator to userspace. It is probably also a correctness error for /proc/$pid/pagemap, but I haven't tested that.

Removing the walk->hugetlb_entry condition in walk_hugetlb_range() has no effect because the caller already checks for that.

This only reports holes in hugetlb ranges to callers who have specified a hugetlb_entry callback.

This issue was found using an AFL-based fuzzer.

v2:
- don't crash on ->pte_hole==NULL (Andrew Morton)
- add Cc stable (Andrew Morton)

---
 mm/pagewalk.c |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

@@ -187,8 +187,12 @@ static int walk_hugetlb_range(unsigned l
 	do {
 		next = hugetlb_entry_end(h, addr, end);
 		pte = huge_pte_offset(walk->mm, addr & hmask, sz);
-		if (pte && walk->hugetlb_entry)
+
+		if (pte)
 			err = walk->hugetlb_entry(pte, hmask, addr, next, walk);
+		else if (walk->pte_hole)
+			err = walk->pte_hole(addr, next, walk);
+
 		if (err)
 			break;
 	} while (addr = next, addr != end);

Patches currently in stable-queue which might be from [email protected] are

queue-4.13/mm-pagewalk.c-report-holes-in-hugetlb-ranges.patch