diff --git a/patch/kernel/sun4i-default/dirtyCOW-fix-for-3.4.112.patch b/patch/kernel/sun4i-default/dirtyCOW-fix-for-3.4.112.patch new file mode 100644 index 0000000000..af009b96a8 --- /dev/null +++ b/patch/kernel/sun4i-default/dirtyCOW-fix-for-3.4.112.patch @@ -0,0 +1,61 @@ +From 543472582a6adcef12fae4ad11da72a62f29fb74 Mon Sep 17 00:00:00 2001 +From: Sven Kayser +Date: Fri, 21 Oct 2016 20:59:39 +0000 +Subject: [PATCH] dirtyCOW fix for 3.4.112 + +--- + include/linux/mm.h | 1 + + mm/memory.c | 14 ++++++++++++-- + 2 files changed, 13 insertions(+), 2 deletions(-) + +diff --git a/include/linux/mm.h b/include/linux/mm.h +index 91b4589..e089716 100644 +--- a/include/linux/mm.h ++++ b/include/linux/mm.h +@@ -1538,6 +1538,7 @@ struct page *follow_page(struct vm_area_struct *, unsigned long address, + #define FOLL_MLOCK 0x40 /* mark page as mlocked */ + #define FOLL_SPLIT 0x80 /* don't return transhuge pages, split them */ + #define FOLL_HWPOISON 0x100 /* check page is hwpoisoned */ ++#define FOLL_COW 0x200 /* internal GUP flag */ + + typedef int (*pte_fn_t)(pte_t *pte, pgtable_t token, unsigned long addr, + void *data); +diff --git a/mm/memory.c b/mm/memory.c +index 4774579..85661b9 100644 +--- a/mm/memory.c ++++ b/mm/memory.c +@@ -1447,6 +1447,16 @@ int zap_vma_ptes(struct vm_area_struct *vma, unsigned long address, + } + EXPORT_SYMBOL_GPL(zap_vma_ptes); + ++/* ++ * FOLL_FORCE can write to even unwritable pte's, but only ++ * after we've gone through a COW cycle and they are dirty. ++ */ ++static inline bool can_follow_write_pte(pte_t pte, unsigned int flags) ++{ ++ return pte_write(pte) || ++ ((flags & FOLL_FORCE) && (flags & FOLL_COW) && pte_dirty(pte)); ++} ++ + /** + * follow_page - look up a page descriptor from a user-virtual address + * @vma: vm_area_struct mapping @address +@@ -1529,7 +1539,7 @@ struct page *follow_page(struct vm_area_struct *vma, unsigned long address, + pte = *ptep; + if (!pte_present(pte)) + goto no_page; +- if ((flags & FOLL_WRITE) && !pte_write(pte)) ++ if ((flags & FOLL_WRITE) && !can_follow_write_pte(pte, flags)) + goto unlock; + + page = vm_normal_page(vma, address, pte); +@@ -1819,7 +1829,7 @@ int __get_user_pages(struct task_struct *tsk, struct mm_struct *mm, + */ + if ((ret & VM_FAULT_WRITE) && + !(vma->vm_flags & VM_WRITE)) +- foll_flags &= ~FOLL_WRITE; ++ foll_flags |= FOLL_COW; + + cond_resched(); + } diff --git a/patch/kernel/sun5i-default/dirtyCOW-fix-for-3.4.112.patch b/patch/kernel/sun5i-default/dirtyCOW-fix-for-3.4.112.patch new file mode 100644 index 0000000000..af009b96a8 --- /dev/null +++ b/patch/kernel/sun5i-default/dirtyCOW-fix-for-3.4.112.patch @@ -0,0 +1,61 @@ +From 543472582a6adcef12fae4ad11da72a62f29fb74 Mon Sep 17 00:00:00 2001 +From: Sven Kayser +Date: Fri, 21 Oct 2016 20:59:39 +0000 +Subject: [PATCH] dirtyCOW fix for 3.4.112 + +--- + include/linux/mm.h | 1 + + mm/memory.c | 14 ++++++++++++-- + 2 files changed, 13 insertions(+), 2 deletions(-) + +diff --git a/include/linux/mm.h b/include/linux/mm.h +index 91b4589..e089716 100644 +--- a/include/linux/mm.h ++++ b/include/linux/mm.h +@@ -1538,6 +1538,7 @@ struct page *follow_page(struct vm_area_struct *, unsigned long address, + #define FOLL_MLOCK 0x40 /* mark page as mlocked */ + #define FOLL_SPLIT 0x80 /* don't return transhuge pages, split them */ + #define FOLL_HWPOISON 0x100 /* check page is hwpoisoned */ ++#define FOLL_COW 0x200 /* internal GUP flag */ + + typedef int (*pte_fn_t)(pte_t *pte, pgtable_t token, unsigned long addr, + void *data); +diff --git a/mm/memory.c b/mm/memory.c +index 4774579..85661b9 100644 +--- a/mm/memory.c ++++ b/mm/memory.c +@@ -1447,6 +1447,16 @@ int zap_vma_ptes(struct vm_area_struct *vma, unsigned long address, + } + EXPORT_SYMBOL_GPL(zap_vma_ptes); + ++/* ++ * FOLL_FORCE can write to even unwritable pte's, but only ++ * after we've gone through a COW cycle and they are dirty. ++ */ ++static inline bool can_follow_write_pte(pte_t pte, unsigned int flags) ++{ ++ return pte_write(pte) || ++ ((flags & FOLL_FORCE) && (flags & FOLL_COW) && pte_dirty(pte)); ++} ++ + /** + * follow_page - look up a page descriptor from a user-virtual address + * @vma: vm_area_struct mapping @address +@@ -1529,7 +1539,7 @@ struct page *follow_page(struct vm_area_struct *vma, unsigned long address, + pte = *ptep; + if (!pte_present(pte)) + goto no_page; +- if ((flags & FOLL_WRITE) && !pte_write(pte)) ++ if ((flags & FOLL_WRITE) && !can_follow_write_pte(pte, flags)) + goto unlock; + + page = vm_normal_page(vma, address, pte); +@@ -1819,7 +1829,7 @@ int __get_user_pages(struct task_struct *tsk, struct mm_struct *mm, + */ + if ((ret & VM_FAULT_WRITE) && + !(vma->vm_flags & VM_WRITE)) +- foll_flags &= ~FOLL_WRITE; ++ foll_flags |= FOLL_COW; + + cond_resched(); + } diff --git a/patch/kernel/sun7i-default/dirtyCOW-fix-for-3.4.112.patch b/patch/kernel/sun7i-default/dirtyCOW-fix-for-3.4.112.patch new file mode 100644 index 0000000000..af009b96a8 --- /dev/null +++ b/patch/kernel/sun7i-default/dirtyCOW-fix-for-3.4.112.patch @@ -0,0 +1,61 @@ +From 543472582a6adcef12fae4ad11da72a62f29fb74 Mon Sep 17 00:00:00 2001 +From: Sven Kayser +Date: Fri, 21 Oct 2016 20:59:39 +0000 +Subject: [PATCH] dirtyCOW fix for 3.4.112 + +--- + include/linux/mm.h | 1 + + mm/memory.c | 14 ++++++++++++-- + 2 files changed, 13 insertions(+), 2 deletions(-) + +diff --git a/include/linux/mm.h b/include/linux/mm.h +index 91b4589..e089716 100644 +--- a/include/linux/mm.h ++++ b/include/linux/mm.h +@@ -1538,6 +1538,7 @@ struct page *follow_page(struct vm_area_struct *, unsigned long address, + #define FOLL_MLOCK 0x40 /* mark page as mlocked */ + #define FOLL_SPLIT 0x80 /* don't return transhuge pages, split them */ + #define FOLL_HWPOISON 0x100 /* check page is hwpoisoned */ ++#define FOLL_COW 0x200 /* internal GUP flag */ + + typedef int (*pte_fn_t)(pte_t *pte, pgtable_t token, unsigned long addr, + void *data); +diff --git a/mm/memory.c b/mm/memory.c +index 4774579..85661b9 100644 +--- a/mm/memory.c ++++ b/mm/memory.c +@@ -1447,6 +1447,16 @@ int zap_vma_ptes(struct vm_area_struct *vma, unsigned long address, + } + EXPORT_SYMBOL_GPL(zap_vma_ptes); + ++/* ++ * FOLL_FORCE can write to even unwritable pte's, but only ++ * after we've gone through a COW cycle and they are dirty. ++ */ ++static inline bool can_follow_write_pte(pte_t pte, unsigned int flags) ++{ ++ return pte_write(pte) || ++ ((flags & FOLL_FORCE) && (flags & FOLL_COW) && pte_dirty(pte)); ++} ++ + /** + * follow_page - look up a page descriptor from a user-virtual address + * @vma: vm_area_struct mapping @address +@@ -1529,7 +1539,7 @@ struct page *follow_page(struct vm_area_struct *vma, unsigned long address, + pte = *ptep; + if (!pte_present(pte)) + goto no_page; +- if ((flags & FOLL_WRITE) && !pte_write(pte)) ++ if ((flags & FOLL_WRITE) && !can_follow_write_pte(pte, flags)) + goto unlock; + + page = vm_normal_page(vma, address, pte); +@@ -1819,7 +1829,7 @@ int __get_user_pages(struct task_struct *tsk, struct mm_struct *mm, + */ + if ((ret & VM_FAULT_WRITE) && + !(vma->vm_flags & VM_WRITE)) +- foll_flags &= ~FOLL_WRITE; ++ foll_flags |= FOLL_COW; + + cond_resched(); + } diff --git a/patch/kernel/sun8i-default/dirtyCOW-fix-for-3.4.112.patch b/patch/kernel/sun8i-default/dirtyCOW-fix-for-3.4.112.patch new file mode 100644 index 0000000000..af009b96a8 --- /dev/null +++ b/patch/kernel/sun8i-default/dirtyCOW-fix-for-3.4.112.patch @@ -0,0 +1,61 @@ +From 543472582a6adcef12fae4ad11da72a62f29fb74 Mon Sep 17 00:00:00 2001 +From: Sven Kayser +Date: Fri, 21 Oct 2016 20:59:39 +0000 +Subject: [PATCH] dirtyCOW fix for 3.4.112 + +--- + include/linux/mm.h | 1 + + mm/memory.c | 14 ++++++++++++-- + 2 files changed, 13 insertions(+), 2 deletions(-) + +diff --git a/include/linux/mm.h b/include/linux/mm.h +index 91b4589..e089716 100644 +--- a/include/linux/mm.h ++++ b/include/linux/mm.h +@@ -1538,6 +1538,7 @@ struct page *follow_page(struct vm_area_struct *, unsigned long address, + #define FOLL_MLOCK 0x40 /* mark page as mlocked */ + #define FOLL_SPLIT 0x80 /* don't return transhuge pages, split them */ + #define FOLL_HWPOISON 0x100 /* check page is hwpoisoned */ ++#define FOLL_COW 0x200 /* internal GUP flag */ + + typedef int (*pte_fn_t)(pte_t *pte, pgtable_t token, unsigned long addr, + void *data); +diff --git a/mm/memory.c b/mm/memory.c +index 4774579..85661b9 100644 +--- a/mm/memory.c ++++ b/mm/memory.c +@@ -1447,6 +1447,16 @@ int zap_vma_ptes(struct vm_area_struct *vma, unsigned long address, + } + EXPORT_SYMBOL_GPL(zap_vma_ptes); + ++/* ++ * FOLL_FORCE can write to even unwritable pte's, but only ++ * after we've gone through a COW cycle and they are dirty. ++ */ ++static inline bool can_follow_write_pte(pte_t pte, unsigned int flags) ++{ ++ return pte_write(pte) || ++ ((flags & FOLL_FORCE) && (flags & FOLL_COW) && pte_dirty(pte)); ++} ++ + /** + * follow_page - look up a page descriptor from a user-virtual address + * @vma: vm_area_struct mapping @address +@@ -1529,7 +1539,7 @@ struct page *follow_page(struct vm_area_struct *vma, unsigned long address, + pte = *ptep; + if (!pte_present(pte)) + goto no_page; +- if ((flags & FOLL_WRITE) && !pte_write(pte)) ++ if ((flags & FOLL_WRITE) && !can_follow_write_pte(pte, flags)) + goto unlock; + + page = vm_normal_page(vma, address, pte); +@@ -1819,7 +1829,7 @@ int __get_user_pages(struct task_struct *tsk, struct mm_struct *mm, + */ + if ((ret & VM_FAULT_WRITE) && + !(vma->vm_flags & VM_WRITE)) +- foll_flags &= ~FOLL_WRITE; ++ foll_flags |= FOLL_COW; + + cond_resched(); + }