Commit-ID: 836e3bf3d85dfe29309cb62dc1714bb89801eea5
Gitweb: http://git.kernel.org/tip/836e3bf3d85dfe29309cb62dc1714bb89801eea5
Author: Peter Zijlstra <a.p.zijlstra@xxxxxxxxx>
AuthorDate: Mon, 22 Oct 2012 19:21:32 +0200
Committer: Ingo Molnar <mingo@xxxxxxxxxx>
CommitDate: Wed, 24 Oct 2012 08:52:12 +0200
numa, sched, mm: Fix NULL-ptr deref
Dan reported that there's a possible NULL pointer deref in this logic,
fix that. Further fix it to avoid a possible inf. loop (completely
unlikely in the case no vma is migratable). Also don't endlessly loop
on large length, simply truncate at the end of the address-space and
restart on the next go.
Reported-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
Signed-off-by: Peter Zijlstra <a.p.zijlstra@xxxxxxxxx>
Cc: Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxxx>
Cc: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
Cc: Peter Zijlstra <a.p.zijlstra@xxxxxxxxx>
Cc: Andrea Arcangeli <aarcange@xxxxxxxxxx>
Cc: Rik van Riel <riel@xxxxxxxxxx>
Link: http://lkml.kernel.org/n/tip-mnkio02xxtttiepsg9ek6qkw@xxxxxxxxxxxxxx
Signed-off-by: Ingo Molnar <mingo@xxxxxxxxxx>
---
kernel/sched/fair.c | 25 ++++++++-----------------
1 files changed, 8 insertions(+), 17 deletions(-)
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index 1dad296..dea3ca6 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -933,40 +933,31 @@ void task_numa_work(struct callback_head *work)
if (cmpxchg(&mm->numa_next_scan, migrate, next_scan) != migrate)
return;
-
offset = mm->numa_scan_offset;
length = sysctl_sched_numa_scan_size;
length <<= 20;
down_write(&mm->mmap_sem);
vma = find_vma(mm, offset);
-again:
if (!vma) {
ACCESS_ONCE(mm->numa_scan_seq)++;
offset = 0;
vma = mm->mmap;
}
- while (vma && !vma_migratable(vma)) {
- vma = vma->vm_next;
- if (!vma)
- goto again;
- }
-
- offset = max(offset, vma->vm_start);
- end = min(ALIGN(offset + length, HPAGE_SIZE), vma->vm_end);
- length -= end - offset;
+ for (; vma && length > 0; vma = vma->vm_next) {
+ if (!vma_migratable(vma))
+ continue;
- change_prot_none(vma, offset, end);
+ offset = max(offset, vma->vm_start);
+ end = min(ALIGN(offset + length, HPAGE_SIZE), vma->vm_end);
+ length -= end - offset;
- offset = end;
+ change_prot_none(vma, offset, end);
- if (length > 0) {
- vma = vma->vm_next;
- goto again;
+ offset = end;
}
mm->numa_scan_offset = offset;
up_write(&mm->mmap_sem);
-
}
/*
--
To unsubscribe from this list: send the line "unsubscribe linux-tip-commits" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
|