Question on page length clamping in hash walk fix and syscall crashes

From: Xavier Roche
Date: Thu Jul 28 2016 - 06:07:23 EST

Hi folks,

We stumble upon an issue while using an AF_ALG socket to compute a hash (crc32) directly in the kernel (using splice magic)

The issue has been fixed AFAICS by Herbert Xu in cc440a5b68873b7b98c3130d09a69a1b13acb0b7 in a rather isolated patch (three lines diff)

I could validate that the patch does indeed fix the issue we were having.

This bug seems to be more than a computation issue, as we experienced weird crashes in random syscall when it is triggered (ie. unpatched), such as fork, or futex-related primitives (!).

The issue can be reproduced with this standalone program:

Most up-to-date stable distro are using the buggy version (Centos 7: 3.10.0, Ubuntu trusty: 3.13.0, Fedora 22: 4.3.6, etc.)

Question: is the weird behavior observed (crashes inside kernel) "normal" w.r.t this issue, and how cherry-pick policy is organized w.r.t older kernel releases (LTS only ?)

[ Typically the bug does not appear in 3.14.70, 3.16.0, 3.19.0 or 4.2.0 ]

And sorry in advance if this question has already been answered, but I could not find any clear hint.