[PATCH 5/6] mempolicy: fix a memory corruption by refcount imbalance in alloc_pages_vma()
From: <hidden>
Date: 2012-05-30 09:03:28
Also in:
linux-mm, lkml
Subsystem:
memory management, memory management - memory policy and migration, the rest, tmpfs (shmem filesystem) · Maintainers:
Andrew Morton, David Hildenbrand, Linus Torvalds, Hugh Dickins
From: KOSAKI Motohiro <redacted> commit cc9a6c8776 (cpuset: mm: reduce large amounts of memory barrier related damage v3) introduced a memory corruption. shmem_alloc_page() passes pseudo vma and it has one significant unique combination, vma->vm_ops=NULL and (vma->policy->flags & MPOL_F_SHARED). Now, get_vma_policy() does NOT increase a policy ref when vma->vm_ops=NULL and mpol_cond_put() DOES decrease a policy ref when a policy has MPOL_F_SHARED. Therefore, when cpuset race is happen and alloc_pages_vma() fall in 'goto retry_cpuset' path, a policy refcount will be decreased too much and therefore it will make memory corruption. This patch fixes it. Cc: Dave Jones <redacted>, Cc: Mel Gorman <mgorman@suse.de> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Christoph Lameter <redacted>, Cc: Andrew Morton <akpm@linux-foundation.org> Cc: <redacted> Cc: Miao Xie <redacted> Cc: Peter Zijlstra <redacted> Signed-off-by: KOSAKI Motohiro <redacted> --- mm/mempolicy.c | 13 ++++++++++++- mm/shmem.c | 9 +++++---- 2 files changed, 17 insertions(+), 5 deletions(-)
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index 7fb7d51..0da0969 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c@@ -1544,18 +1544,29 @@ struct mempolicy *get_vma_policy(struct task_struct *task, struct vm_area_struct *vma, unsigned long addr) { struct mempolicy *pol = task->mempolicy; + int got_ref; if (vma) { if (vma->vm_ops && vma->vm_ops->get_policy) { struct mempolicy *vpol = vma->vm_ops->get_policy(vma, addr); - if (vpol) + if (vpol) { pol = vpol; + got_ref = 1; + } } else if (vma->vm_policy) pol = vma->vm_policy; } if (!pol) pol = &default_policy; + + /* + * shmem_alloc_page() passes MPOL_F_SHARED policy with vma->vm_ops=NULL. + * Thus, we need to take additional ref for avoiding refcount imbalance. + */ + if (!got_ref && mpol_needs_cond_ref(pol)) + mpol_get(pol); + return pol; }
diff --git a/mm/shmem.c b/mm/shmem.c
index d576b84..eb5f1eb 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c@@ -919,6 +919,7 @@ static struct page *shmem_alloc_page(gfp_t gfp, struct shmem_inode_info *info, pgoff_t index) { struct vm_area_struct pvma; + struct page *page; /* Create a pseudo vma that just contains the policy */ pvma.vm_start = 0;
@@ -926,10 +927,10 @@ static struct page *shmem_alloc_page(gfp_t gfp, pvma.vm_ops = NULL; pvma.vm_policy = mpol_shared_policy_lookup(&info->policy, index); - /* - * alloc_page_vma() will drop the shared policy reference - */ - return alloc_page_vma(gfp, &pvma, 0); + page = alloc_page_vma(gfp, &pvma, 0); + + mpol_put(pvma.vm_policy); + return page; } #else /* !CONFIG_NUMA */ #ifdef CONFIG_TMPFS
--
1.7.1