-
Michal Hocko authored
Oleg has noticed that khugepaged will happilly collapse stack vma (as long as it is not an early stack - see is_vma_temporary_stack) and it might effectively remove the stack gap area as well because a larger part of the stack vma is usually populated. The same applies to the page fault handler. Fix this by checking stack_guard_area when revalidating a VMA in hugepage_vma_revalidate. We do not want to hook/replace is_vma_temporary_stack() check because THP might be still useful for stack, all we need is excluding the gap from collapsing into a THP. Also check the to-be-created THP in do_huge_pmd_anonymous_page to make sure it is completely outside of the gap area because we we could create THP covering the gap area. CVE-2017-1000364 Noticed-by: Oleg Nesterov <oleg@redhat.com> Signed-off-by: Michal Hocko <mhocko@suse.com> [move khugepaged.c code into huge_memory.c] Signed-off-by: Stefan Bader <stefan.bader@canonical.com>
cc9020f7