Hi,
I posted 2 patches to fix kernel panic and memory leak.
http://lkml.org/lkml/2008/2/14/282
http://lkml.org/lkml/2008/2/14/283
But, I think this patch is better than old ones.
---
From: Hiroshi Shimamoto <[email protected]>
Reading /proc/<pid>/latency or /proc/<pid>/task/<tid>/latency could cause
NULL pointer dereference.
In lstats_open(), get_proc_task() can return NULL, in which case the kernel
will oops at lstats_show_proc() because m->private is NULL.
This can be reproduced by the follwoing script.
while :
do
bash -c 'ls > ls.$$' &
pid=$!
cat /proc/$pid/latency &
cat /proc/$pid/latency &
cat /proc/$pid/latency &
cat /proc/$pid/latency
done
And the task struct which gotten by get_proc_task() is never put.
put_task_struct() should be called.
This patch changes the private is used to store inode, and the task struct
will be gotten and putted in read or write function.
Signed-off-by: Hiroshi Shimamoto <[email protected]>
---
fs/proc/base.c | 27 +++++++++++----------------
1 files changed, 11 insertions(+), 16 deletions(-)
diff --git a/fs/proc/base.c b/fs/proc/base.c
index 7c6b4ec..5de8dd5 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -314,9 +314,12 @@ static int proc_pid_schedstat(struct task_struct *task, char *buffer)
static int lstats_show_proc(struct seq_file *m, void *v)
{
int i;
- struct task_struct *task = m->private;
- seq_puts(m, "Latency Top version : v0.1\n");
+ struct inode *inode = m->private;
+ struct task_struct *task = get_proc_task(inode);
+ if (!task)
+ return -ESRCH;
+ seq_puts(m, "Latency Top version : v0.1\n");
for (i = 0; i < 32; i++) {
if (task->latency_record[i].backtrace[0]) {
int q;
@@ -341,32 +344,24 @@ static int lstats_show_proc(struct seq_file *m, void *v)
}
}
+ put_task_struct(task);
return 0;
}
static int lstats_open(struct inode *inode, struct file *file)
{
- int ret;
- struct seq_file *m;
- struct task_struct *task = get_proc_task(inode);
-
- ret = single_open(file, lstats_show_proc, NULL);
- if (!ret) {
- m = file->private_data;
- m->private = task;
- }
- return ret;
+ return single_open(file, lstats_show_proc, inode);
}
static ssize_t lstats_write(struct file *file, const char __user *buf,
size_t count, loff_t *offs)
{
- struct seq_file *m;
- struct task_struct *task;
+ struct task_struct *task = get_proc_task(file->f_dentry->d_inode);
- m = file->private_data;
- task = m->private;
+ if (!task)
+ return -ESRCH;
clear_all_latency_tracing(task);
+ put_task_struct(task);
return count;
}
--
1.5.3.8
On Thu, 14 Feb 2008 14:51:19 -0800
Hiroshi Shimamoto <[email protected]> wrote:
> Hi,
>
> I posted 2 patches to fix kernel panic and memory leak.
> http://lkml.org/lkml/2008/2/14/282
> http://lkml.org/lkml/2008/2/14/283
>
> But, I think this patch is better than old ones.
>
> ---
> From: Hiroshi Shimamoto <[email protected]>
>
> Reading /proc/<pid>/latency or /proc/<pid>/task/<tid>/latency could
> cause NULL pointer dereference.
>
> In lstats_open(), get_proc_task() can return NULL, in which case the
> kernel will oops at lstats_show_proc() because m->private is NULL.
>
> This can be reproduced by the follwoing script.
> while :
> do
> bash -c 'ls > ls.$$' &
> pid=$!
> cat /proc/$pid/latency &
> cat /proc/$pid/latency &
> cat /proc/$pid/latency &
> cat /proc/$pid/latency
> done
>
> And the task struct which gotten by get_proc_task() is never put.
> put_task_struct() should be called.
>
> This patch changes the private is used to store inode, and the task
> struct will be gotten and putted in read or write function.
>
> Signed-off-by: Hiroshi Shimamoto <[email protected]>
Fine with me; Ingo please merge
Thanks for working on this!
--
If you want to reach me at my work email, use [email protected]
For development, discussion and tips for power savings,
visit http://www.lesswatts.org
* Arjan van de Ven <[email protected]> wrote:
> On Thu, 14 Feb 2008 14:51:19 -0800
> Hiroshi Shimamoto <[email protected]> wrote:
>
> > Hi,
> >
> > I posted 2 patches to fix kernel panic and memory leak.
> > http://lkml.org/lkml/2008/2/14/282
> > http://lkml.org/lkml/2008/2/14/283
> >
> > But, I think this patch is better than old ones.
thanks Hiroshi, applied.
Ingo
Ingo Molnar wrote:
> * Arjan van de Ven <[email protected]> wrote:
>
>> On Thu, 14 Feb 2008 14:51:19 -0800
>> Hiroshi Shimamoto <[email protected]> wrote:
>>
>>> Hi,
>>>
>>> I posted 2 patches to fix kernel panic and memory leak.
>>> http://lkml.org/lkml/2008/2/14/282
>>> http://lkml.org/lkml/2008/2/14/283
>>>
>>> But, I think this patch is better than old ones.
>
> thanks Hiroshi, applied.
Hi Ingo,
I'd like to be applied new patch for latencytop fix.
I think it better than old ptaches.
Can you apply this patch for latencytop issues?
http://lkml.org/lkml/2008/2/14/451
It's replacement of old patches you applied.
It makes latency file behavior same as other proc files.
get_proc_task() and put_task_struct() are called at read time,
and returns -ESRCH if get_proc_task() failed.
If is there any problem, please let me know.
thanks,
Hiroshi Shimamoto
Hi Ingo,
Here is a delta patch against sched-devel.git tree.
These two patches in sched-devel.git tree fix the issues.
latencytop: fix kernel panic while reading latency proc file
latencytop: fix memory leak on latency proc file
However, this is more appropriate way to fix, I think.
---
From: Hiroshi Shimamoto <[email protected]>
Change getting task_struct by get_proc_task() at read or write time,
and returns -ESRCH if get_proc_task() returns NULL.
This is same behavior as other /proc files.
Signed-off-by: Hiroshi Shimamoto <[email protected]>
---
fs/proc/base.c | 40 ++++++++++++----------------------------
1 files changed, 12 insertions(+), 28 deletions(-)
diff --git a/fs/proc/base.c b/fs/proc/base.c
index 64661c3..bebf9a8 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -314,9 +314,12 @@ static int proc_pid_schedstat(struct task_struct *task, char *buffer)
static int lstats_show_proc(struct seq_file *m, void *v)
{
int i;
- struct task_struct *task = m->private;
- seq_puts(m, "Latency Top version : v0.1\n");
+ struct inode *inode = m->private;
+ struct task_struct *task = get_proc_task(inode);
+ if (!task)
+ return -ESRCH;
+ seq_puts(m, "Latency Top version : v0.1\n");
for (i = 0; i < 32; i++) {
if (task->latency_record[i].backtrace[0]) {
int q;
@@ -341,43 +344,24 @@ static int lstats_show_proc(struct seq_file *m, void *v)
}
}
+ put_task_struct(task);
return 0;
}
static int lstats_open(struct inode *inode, struct file *file)
{
- int ret;
- struct seq_file *m;
- struct task_struct *task = get_proc_task(inode);
-
- if (!task)
- return -ENOENT;
- ret = single_open(file, lstats_show_proc, NULL);
- if (!ret) {
- m = file->private_data;
- m->private = task;
- }
- return ret;
-}
-
-static int lstats_release(struct inode *inode, struct file *file)
-{
- struct seq_file *m = file->private_data;
- struct task_struct *task = m->private;
-
- put_task_struct(task);
- return single_release(inode, file);
+ return single_open(file, lstats_show_proc, inode);
}
static ssize_t lstats_write(struct file *file, const char __user *buf,
size_t count, loff_t *offs)
{
- struct seq_file *m;
- struct task_struct *task;
+ struct task_struct *task = get_proc_task(file->f_dentry->d_inode);
- m = file->private_data;
- task = m->private;
+ if (!task)
+ return -ESRCH;
clear_all_latency_tracing(task);
+ put_task_struct(task);
return count;
}
@@ -387,7 +371,7 @@ static const struct file_operations proc_lstats_operations = {
.read = seq_read,
.write = lstats_write,
.llseek = seq_lseek,
- .release = lstats_release,
+ .release = single_release,
};
#endif
--
1.5.3.8