mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-23 01:10:04 +00:00
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux
Pull s390 fixes from Martin Schwidefsky: "Three more bug fixes for v4.13. The two memory management related fixes are quite new, they fix kernel crashes that can be triggered by user space. The third commit fixes a bug in the vfio ccw translation code" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/mm: fix BUG_ON in crst_table_upgrade s390/mm: fork vs. 5 level page tabel vfio: ccw: fix bad ptr math for TIC cda translation
This commit is contained in:
commit
bba2a5b822
3 changed files with 10 additions and 3 deletions
|
@ -44,6 +44,11 @@ static inline int init_new_context(struct task_struct *tsk,
|
|||
mm->context.asce = __pa(mm->pgd) | _ASCE_TABLE_LENGTH |
|
||||
_ASCE_USER_BITS | _ASCE_TYPE_REGION3;
|
||||
break;
|
||||
case -PAGE_SIZE:
|
||||
/* forked 5-level task, set new asce with new_mm->pgd */
|
||||
mm->context.asce = __pa(mm->pgd) | _ASCE_TABLE_LENGTH |
|
||||
_ASCE_USER_BITS | _ASCE_TYPE_REGION1;
|
||||
break;
|
||||
case 1UL << 53:
|
||||
/* forked 4-level task, set new asce with new mm->pgd */
|
||||
mm->context.asce = __pa(mm->pgd) | _ASCE_TABLE_LENGTH |
|
||||
|
|
|
@ -119,7 +119,8 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
|
|||
return addr;
|
||||
|
||||
check_asce_limit:
|
||||
if (addr + len > current->mm->context.asce_limit) {
|
||||
if (addr + len > current->mm->context.asce_limit &&
|
||||
addr + len <= TASK_SIZE) {
|
||||
rc = crst_table_upgrade(mm, addr + len);
|
||||
if (rc)
|
||||
return (unsigned long) rc;
|
||||
|
@ -183,7 +184,8 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
|
|||
}
|
||||
|
||||
check_asce_limit:
|
||||
if (addr + len > current->mm->context.asce_limit) {
|
||||
if (addr + len > current->mm->context.asce_limit &&
|
||||
addr + len <= TASK_SIZE) {
|
||||
rc = crst_table_upgrade(mm, addr + len);
|
||||
if (rc)
|
||||
return (unsigned long) rc;
|
||||
|
|
|
@ -481,7 +481,7 @@ static int ccwchain_fetch_tic(struct ccwchain *chain,
|
|||
ccw_tail = ccw_head + (iter->ch_len - 1) * sizeof(struct ccw1);
|
||||
|
||||
if ((ccw_head <= ccw->cda) && (ccw->cda <= ccw_tail)) {
|
||||
ccw->cda = (__u32) (addr_t) (iter->ch_ccw +
|
||||
ccw->cda = (__u32) (addr_t) (((char *)iter->ch_ccw) +
|
||||
(ccw->cda - ccw_head));
|
||||
return 0;
|
||||
}
|
||||
|
|
Loading…
Reference in a new issue