[3.8.y.z extended stable] Patch "fs/proc/base.c: fix GPF in /proc/$PID/map_files" has been added to staging queue

[Kamal Mostafa]

This is a note to let you know that I have just added a patch titled

    fs/proc/base.c: fix GPF in /proc/$PID/map_files

to the linux-3.8.y-queue branch of the 3.8.y.z extended stable tree 
which can be found at:

 http://kernel.ubuntu.com/git?p=ubuntu/linux.git;a=shortlog;h=refs/heads/linux-3.8.y-queue

This patch is scheduled to be released in version 3.8.13.21.

If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 3.8.y.z tree, see
https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable

Thanks.
-Kamal

------

>From 914a8c7a8dc7a73079c36ddad134d7e055bdface Mon Sep 17 00:00:00 2001
From: Artem Fetishev <artem_fetishev at epam.com>
Date: Mon, 10 Mar 2014 15:49:45 -0700
Subject: fs/proc/base.c: fix GPF in /proc/$PID/map_files

commit 70335abb2689c8cd5df91bf2d95a65649addf50b upstream.

The expected logic of proc_map_files_get_link() is either to return 0
and initialize 'path' or return an error and leave 'path' uninitialized.

By the time dname_to_vma_addr() returns 0 the corresponding vma may have
already be gone.  In this case the path is not initialized but the
return value is still 0.  This results in 'general protection fault'
inside d_path().

Steps to reproduce:

  CONFIG_CHECKPOINT_RESTORE=y

    fd = open(...);
    while (1) {
        mmap(fd, ...);
        munmap(fd, ...);
    }

  ls -la /proc/$PID/map_files

Addresses https://bugzilla.kernel.org/show_bug.cgi?id=68991

Signed-off-by: Artem Fetishev <artem_fetishev at epam.com>
Signed-off-by: Aleksandr Terekhov <aleksandr_terekhov at epam.com>
Reported-by: <wiebittewas at gmail.com>
Acked-by: Pavel Emelyanov <xemul at parallels.com>
Acked-by: Cyrill Gorcunov <gorcunov at openvz.org>
Reviewed-by: "Eric W. Biederman" <ebiederm at xmission.com>
Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
Signed-off-by: Kamal Mostafa <kamal at canonical.com>
---
 fs/proc/base.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/proc/base.c b/fs/proc/base.c
index 9b43ff77..78150a0 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -1784,6 +1784,7 @@ static int proc_map_files_get_link(struct dentry *dentry, struct path *path)
 	if (rc)
 		goto out_mmput;

+	rc = -ENOENT;
 	down_read(&mm->mmap_sem);
 	vma = find_exact_vma(mm, vm_start, vm_end);
 	if (vma && vma->vm_file) {
--
1.8.3.2