Commit-ID: 836e3bf3d85dfe29309cb62dc1714bb89801eea5 Gitweb: http://git.kernel.org/tip/836e3bf3d85dfe29309cb62dc1714bb89801eea5 Author: Peter Zijlstra <a.p.zijls...@chello.nl> AuthorDate: Mon, 22 Oct 2012 19:21:32 +0200 Committer: Ingo Molnar <mi...@kernel.org> CommitDate: Wed, 24 Oct 2012 08:52:12 +0200
numa, sched, mm: Fix NULL-ptr deref Dan reported that there's a possible NULL pointer deref in this logic, fix that. Further fix it to avoid a possible inf. loop (completely unlikely in the case no vma is migratable). Also don't endlessly loop on large length, simply truncate at the end of the address-space and restart on the next go. Reported-by: Dan Carpenter <dan.carpen...@oracle.com> Signed-off-by: Peter Zijlstra <a.p.zijls...@chello.nl> Cc: Linus Torvalds <torva...@linux-foundation.org> Cc: Andrew Morton <a...@linux-foundation.org> Cc: Peter Zijlstra <a.p.zijls...@chello.nl> Cc: Andrea Arcangeli <aarca...@redhat.com> Cc: Rik van Riel <r...@redhat.com> Link: http://lkml.kernel.org/n/tip-mnkio02xxtttiepsg9ek6...@git.kernel.org Signed-off-by: Ingo Molnar <mi...@kernel.org> --- kernel/sched/fair.c | 25 ++++++++----------------- 1 files changed, 8 insertions(+), 17 deletions(-) diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index 1dad296..dea3ca6 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -933,40 +933,31 @@ void task_numa_work(struct callback_head *work) if (cmpxchg(&mm->numa_next_scan, migrate, next_scan) != migrate) return; - offset = mm->numa_scan_offset; length = sysctl_sched_numa_scan_size; length <<= 20; down_write(&mm->mmap_sem); vma = find_vma(mm, offset); -again: if (!vma) { ACCESS_ONCE(mm->numa_scan_seq)++; offset = 0; vma = mm->mmap; } - while (vma && !vma_migratable(vma)) { - vma = vma->vm_next; - if (!vma) - goto again; - } - - offset = max(offset, vma->vm_start); - end = min(ALIGN(offset + length, HPAGE_SIZE), vma->vm_end); - length -= end - offset; + for (; vma && length > 0; vma = vma->vm_next) { + if (!vma_migratable(vma)) + continue; - change_prot_none(vma, offset, end); + offset = max(offset, vma->vm_start); + end = min(ALIGN(offset + length, HPAGE_SIZE), vma->vm_end); + length -= end - offset; - offset = end; + change_prot_none(vma, offset, end); - if (length > 0) { - vma = vma->vm_next; - goto again; + offset = end; } mm->numa_scan_offset = offset; up_write(&mm->mmap_sem); - } /* -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
