{"action":"created","issue":{"url":"https://api.github.com/repos/voidlinux/void-packages/issues/5020","repository_url":"https://api.github.com/repos/voidlinux/void-packages","labels_url":"https://api.github.com/repos/voidlinux/void-packages/issues/5020/labels{/name}","comments_url":"https://api.github.com/repos/voidlinux/void-packages/issues/5020/comments","events_url":"https://api.github.com/repos/voidlinux/void-packages/issues/5020/events","html_url":"https://github.com/voidlinux/void-packages/issues/5020","id":184565982,"number":5020,"title":"CVE-2016-5195 privilege escalation bug kernel patch","user":{"login":"cavalier911","id":7050114,"avatar_url":"https://avatars.githubusercontent.com/u/7050114?v=3","gravatar_id":"","url":"https://api.github.com/users/cavalier911","html_url":"https://github.com/cavalier911","followers_url":"https://api.github.com/users/cavalier911/followers","following_url":"https://api.github.com/users/cavalier911/following{/other_user}","gists_url":"https://api.github.com/users/cavalier911/gists{/gist_id}","starred_url":"https://api.github.com/users/cavalier911/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cavalier911/subscriptions","organizations_url":"https://api.github.com/users/cavalier911/orgs","repos_url":"https://api.github.com/users/cavalier911/repos","events_url":"https://api.github.com/users/cavalier911/events{/privacy}","received_events_url":"https://api.github.com/users/cavalier911/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2016-10-21T20:47:50Z","updated_at":"2016-10-22T18:28:14Z","closed_at":"2016-10-22T18:28:14Z","body":"https://lkml.org/lkml/2016/10/19/860\r\n```\r\ndiff --git a/include/linux/mm.h b/include/linux/mm.h\r\nindex 53b0d70..55590f4 100644\r\n--- a/include/linux/mm.h\r\n+++ b/include/linux/mm.h\r\n@@ -1715,6 +1715,7 @@ static inline struct page *follow_page(struct vm_area_struct *vma,\r\n #define FOLL_HWPOISON\t0x100\t/* check page is hwpoisoned */\r\n #define FOLL_NUMA\t0x200\t/* force NUMA hinting page fault */\r\n #define FOLL_MIGRATION\t0x400\t/* wait for page to replace migration entry */\r\n+#define FOLL_COW\t0x4000\t/* internal GUP flag */\r\n \r\n typedef int (*pte_fn_t)(pte_t *pte, pgtable_t token, unsigned long addr,\r\n \t\t\tvoid *data);\r\ndiff --git a/mm/memory.c b/mm/memory.c\r\nindex 10cdade..2ca2ee1 100644\r\n--- a/mm/memory.c\r\n+++ b/mm/memory.c\r\n@@ -1462,6 +1462,16 @@ int zap_vma_ptes(struct vm_area_struct *vma, unsigned long address,\r\n }\r\n EXPORT_SYMBOL_GPL(zap_vma_ptes);\r\n \r\n+/*\r\n+ * FOLL_FORCE can write to even unwritable pte's, but only\r\n+ * after we've gone through a COW cycle and they are dirty.\r\n+ */\r\n+static inline bool can_follow_write_pte(pte_t pte, unsigned int flags)\r\n+{\r\n+\treturn pte_write(pte) ||\r\n+\t\t((flags & FOLL_FORCE) && (flags & FOLL_COW) && pte_dirty(pte));\r\n+}\r\n+\r\n /**\r\n  * follow_page_mask - look up a page descriptor from a user-virtual address\r\n  * @vma: vm_area_struct mapping @address\r\n@@ -1569,7 +1579,7 @@ split_fallthrough:\r\n \t}\r\n \tif ((flags & FOLL_NUMA) && pte_numa(pte))\r\n \t\tgoto no_page;\r\n-\tif ((flags & FOLL_WRITE) && !pte_write(pte))\r\n+\tif ((flags & FOLL_WRITE) && !can_follow_write_pte(pte, flags))\r\n \t\tgoto unlock;\r\n \r\n \tpage = vm_normal_page(vma, address, pte);\r\n@@ -1877,7 +1887,7 @@ long __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,\r\n \t\t\t\t */\r\n \t\t\t\tif ((ret & VM_FAULT_WRITE) &&\r\n \t\t\t\t    !(vma->vm_flags & VM_WRITE))\r\n-\t\t\t\t\tfoll_flags &= ~FOLL_WRITE;\r\n+\t\t\t\t\tfoll_flags |= FOLL_COW;\r\n \r\n \t\t\t\tcond_resched();\r\n \t\t\t}\r\n```"},"comment":{"url":"https://api.github.com/repos/voidlinux/void-packages/issues/comments/255545389","html_url":"https://github.com/voidlinux/void-packages/issues/5020#issuecomment-255545389","issue_url":"https://api.github.com/repos/voidlinux/void-packages/issues/5020","id":255545389,"user":{"login":"chneukirchen","id":139,"avatar_url":"https://avatars.githubusercontent.com/u/139?v=3","gravatar_id":"","url":"https://api.github.com/users/chneukirchen","html_url":"https://github.com/chneukirchen","followers_url":"https://api.github.com/users/chneukirchen/followers","following_url":"https://api.github.com/users/chneukirchen/following{/other_user}","gists_url":"https://api.github.com/users/chneukirchen/gists{/gist_id}","starred_url":"https://api.github.com/users/chneukirchen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/chneukirchen/subscriptions","organizations_url":"https://api.github.com/users/chneukirchen/orgs","repos_url":"https://api.github.com/users/chneukirchen/repos","events_url":"https://api.github.com/users/chneukirchen/events{/privacy}","received_events_url":"https://api.github.com/users/chneukirchen/received_events","type":"User","site_admin":false},"created_at":"2016-10-22T18:28:14Z","updated_at":"2016-10-22T18:28:14Z","body":"Fixed upstream."}}
{"actor":{"display_login":"chneukirchen"}}