Commit-ID: 836e3bf3d85dfe29309cb62dc1714bb89801eea5
Gitweb: http://git.kernel.org/tip/836e3bf3d85dfe29309cb62dc1714bb89801eea5
Author: Peter Zijlstra <[email protected]>
AuthorDate: Mon, 22 Oct 2012 19:21:32 +0200
Committer: Ingo Molnar <[email protected]>
CommitDate: Wed, 24 Oct 2012 08:52:12 +0200
numa, sched, mm: Fix NULL-ptr deref
Dan reported that there's a possible NULL pointer deref in this logic,
fix that. Further fix it to avoid a possible inf. loop (completely
unlikely in the case no vma is migratable). Also don't endlessly loop
on large length, simply truncate at the end of the address-space and
restart on the next go.
Reported-by: Dan Carpenter <[email protected]>
Signed-off-by: Peter Zijlstra <[email protected]>
Cc: Linus Torvalds <[email protected]>
Cc: Andrew Morton <[email protected]>
Cc: Peter Zijlstra <[email protected]>
Cc: Andrea Arcangeli <[email protected]>
Cc: Rik van Riel <[email protected]>
Link: http://lkml.kernel.org/n/[email protected]
Signed-off-by: Ingo Molnar <[email protected]>
---
kernel/sched/fair.c | 25 ++++++++-----------------
1 files changed, 8 insertions(+), 17 deletions(-)
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index 1dad296..dea3ca6 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -933,40 +933,31 @@ void task_numa_work(struct callback_head *work)
if (cmpxchg(&mm->numa_next_scan, migrate, next_scan) != migrate)
return;
-
offset = mm->numa_scan_offset;
length = sysctl_sched_numa_scan_size;
length <<= 20;
down_write(&mm->mmap_sem);
vma = find_vma(mm, offset);
-again:
if (!vma) {
ACCESS_ONCE(mm->numa_scan_seq)++;
offset = 0;
vma = mm->mmap;
}
- while (vma && !vma_migratable(vma)) {
- vma = vma->vm_next;
- if (!vma)
- goto again;
- }
-
- offset = max(offset, vma->vm_start);
- end = min(ALIGN(offset + length, HPAGE_SIZE), vma->vm_end);
- length -= end - offset;
+ for (; vma && length > 0; vma = vma->vm_next) {
+ if (!vma_migratable(vma))
+ continue;
- change_prot_none(vma, offset, end);
+ offset = max(offset, vma->vm_start);
+ end = min(ALIGN(offset + length, HPAGE_SIZE), vma->vm_end);
+ length -= end - offset;
- offset = end;
+ change_prot_none(vma, offset, end);
- if (length > 0) {
- vma = vma->vm_next;
- goto again;
+ offset = end;
}
mm->numa_scan_offset = offset;
up_write(&mm->mmap_sem);
-
}
/*