1 files changed, 0 insertions, 118 deletions

diff --git a/patches/cve/CVE-2018-18397-userfaultfd-use-ENOENT-instead-of-EFAULT-if-the-atom.patch b/patches/cve/CVE-2018-18397-userfaultfd-use-ENOENT-instead-of-EFAULT-if-the-atom.patch
deleted file mode 100644
index 0d02d22..0000000
--- a/patches/cve/CVE-2018-18397-userfaultfd-use-ENOENT-instead-of-EFAULT-if-the-atom.patch
+++ /dev/null
@@ -1,118 +0,0 @@
-From 82c5a8c0debac552750a00b4fc7551c89c7b34b8 Mon Sep 17 00:00:00 2001
-From: Andrea Arcangeli <aarcange@redhat.com>
-Date: Fri, 30 Nov 2018 14:09:25 -0800
-Subject: [PATCH] userfaultfd: use ENOENT instead of EFAULT if the atomic copy
- user fails
-
-commit 9e368259ad988356c4c95150fafd1a06af095d98 upstream.
-
-Patch series "userfaultfd shmem updates".
-
-Jann found two bugs in the userfaultfd shmem MAP_SHARED backend: the
-lack of the VM_MAYWRITE check and the lack of i_size checks.
-
-Then looking into the above we also fixed the MAP_PRIVATE case.
-
-Hugh by source review also found a data loss source if UFFDIO_COPY is
-used on shmem MAP_SHARED PROT_READ mappings (the production usages
-incidentally run with PROT_READ|PROT_WRITE, so the data loss couldn't
-happen in those production usages like with QEMU).
-
-The whole patchset is marked for stable.
-
-We verified QEMU postcopy live migration with guest running on shmem
-MAP_PRIVATE run as well as before after the fix of shmem MAP_PRIVATE.
-Regardless if it's shmem or hugetlbfs or MAP_PRIVATE or MAP_SHARED, QEMU
-unconditionally invokes a punch hole if the guest mapping is filebacked
-and a MADV_DONTNEED too (needed to get rid of the MAP_PRIVATE COWs and
-for the anon backend).
-
-This patch (of 5):
-
-We internally used EFAULT to communicate with the caller, switch to
-ENOENT, so EFAULT can be used as a non internal retval.
-
-CVE: CVE-2018-18397
-Upstream-Status: Backport
-
-Link: http://lkml.kernel.org/r/20181126173452.26955-2-aarcange@redhat.com
-Fixes: 4c27fe4c4c84 ("userfaultfd: shmem: add shmem_mcopy_atomic_pte for userfaultfd support")
-Signed-off-by: Andrea Arcangeli <aarcange@redhat.com>
-Reviewed-by: Mike Rapoport <rppt@linux.ibm.com>
-Reviewed-by: Hugh Dickins <hughd@google.com>
-Cc: Mike Kravetz <mike.kravetz@oracle.com>
-Cc: Jann Horn <jannh@google.com>
-Cc: Peter Xu <peterx@redhat.com>
-Cc: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
-Cc: <stable@vger.kernel.org>
-Cc: stable@vger.kernel.org
-Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
-Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Andreas Wellving <andreas.wellving@enea.com>
----
- mm/hugetlb.c     | 2 +-
- mm/shmem.c       | 2 +-
- mm/userfaultfd.c | 6 +++---
- 3 files changed, 5 insertions(+), 5 deletions(-)
-
-diff --git a/mm/hugetlb.c b/mm/hugetlb.c
-index f46040aed2da..224cdd953a79 100644
---- a/mm/hugetlb.c
-+++ b/mm/hugetlb.c
-@@ -4037,7 +4037,7 @@ int hugetlb_mcopy_atomic_pte(struct mm_struct *dst_mm,
- 
-                /* fallback to copy_from_user outside mmap_sem */
-                if (unlikely(ret)) {
--                       ret = -EFAULT;
-+                       ret = -ENOENT;
-                        *pagep = page;
-                        /* don't free the page */
-                        goto out;
-diff --git a/mm/shmem.c b/mm/shmem.c
-index ab7ff0aeae2d..9f856ecda73b 100644
---- a/mm/shmem.c
-+++ b/mm/shmem.c
-@@ -2266,7 +2266,7 @@ static int shmem_mfill_atomic_pte(struct mm_struct *dst_mm,
-                                *pagep = page;
-                                shmem_inode_unacct_blocks(inode, 1);
-                                /* don't free the page */
--                               return -EFAULT;
-+                               return -ENOENT;
-                        }
-                } else {                /* mfill_zeropage_atomic */
-                        clear_highpage(page);
-diff --git a/mm/userfaultfd.c b/mm/userfaultfd.c
-index 81192701964d..c63c0fc5ecfa 100644
---- a/mm/userfaultfd.c
-+++ b/mm/userfaultfd.c
-@@ -49,7 +49,7 @@ static int mcopy_atomic_pte(struct mm_struct *dst_mm,
- 
-                /* fallback to copy_from_user outside mmap_sem */
-                if (unlikely(ret)) {
--                       ret = -EFAULT;
-+                       ret = -ENOENT;
-                        *pagep = page;
-                        /* don't free the page */
-                        goto out;
-@@ -275,7 +275,7 @@ static __always_inline ssize_t __mcopy_atomic_hugetlb(struct mm_struct *dst_mm,
- 
-                cond_resched();
- 
--               if (unlikely(err == -EFAULT)) {
-+               if (unlikely(err == -ENOENT)) {
-                        up_read(&dst_mm->mmap_sem);
-                        BUG_ON(!page);
- 
-@@ -521,7 +521,7 @@ static __always_inline ssize_t __mcopy_atomic(struct mm_struct *dst_mm,
-                                       src_addr, &page, zeropage);
-                cond_resched();
- 
--               if (unlikely(err == -EFAULT)) {
-+               if (unlikely(err == -ENOENT)) {
-                        void *page_kaddr;
- 
-                        up_read(&dst_mm->mmap_sem);
--- 
-2.19.2
-