2
0
mirror of https://github.com/edk2-porting/linux-next.git synced 2024-12-24 21:24:00 +08:00
linux-next/fs/proc
David Rientjes 32f8516a8c mm, mempolicy: fix printing stack contents in numa_maps
When reading /proc/pid/numa_maps, it's possible to return the contents of
the stack where the mempolicy string should be printed if the policy gets
freed from beneath us.

This happens because mpol_to_str() may return an error the
stack-allocated buffer is then printed without ever being stored.

There are two possible error conditions in mpol_to_str():

 - if the buffer allocated is insufficient for the string to be stored,
   and

 - if the mempolicy has an invalid mode.

The first error condition is not triggered in any of the callers to
mpol_to_str(): at least 50 bytes is always allocated on the stack and this
is sufficient for the string to be written.  A future patch should convert
this into BUILD_BUG_ON() since we know the maximum strlen possible, but
that's not -rc material.

The second error condition is possible if a race occurs in dropping a
reference to a task's mempolicy causing it to be freed during the read().
The slab poison value is then used for the mode and mpol_to_str() returns
-EINVAL.

This race is only possible because get_vma_policy() believes that
mm->mmap_sem protects task->mempolicy, which isn't true.  The exit path
does not hold mm->mmap_sem when dropping the reference or setting
task->mempolicy to NULL: it uses task_lock(task) instead.

Thus, it's required for the caller of a task mempolicy to hold
task_lock(task) while grabbing the mempolicy and reading it.  Callers with
a vma policy store their mempolicy earlier and can simply increment the
reference count so it's guaranteed not to be freed.

Reported-by: Dave Jones <davej@redhat.com>
Signed-off-by: David Rientjes <rientjes@google.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2012-10-16 18:00:50 -07:00
..
array.c c/r: procfs: add arg_start/end, env_start/end and exit_code members to /proc/$pid/stat 2012-05-31 17:49:32 -07:00
base.c procfs: don't need a PATH_MAX allocation to hold a string representation of an int 2012-10-12 20:15:10 -04:00
cmdline.c proc: switch /proc/cmdline to seq_file 2008-10-23 14:29:04 +04:00
consoles.c console: rename acquire/release_console_sem() to console_lock/unlock() 2011-01-26 10:50:06 +10:00
cpuinfo.c proc: move /proc/cpuinfo code to fs/proc/cpuinfo.c 2008-10-23 15:05:11 +04:00
devices.c proc: use seq_puts()/seq_putc() where possible 2011-01-13 08:03:16 -08:00
fd.c don't leak O_CLOEXEC into ->f_flags 2012-09-26 21:10:01 -04:00
fd.h procfs: Move /proc/pid/fd[info] handling code to fd.[ch] 2012-09-26 21:10:01 -04:00
generic.c proc: use kzalloc instead of kmalloc and memset 2012-10-06 03:05:18 +09:00
inode.c proc: no need to initialize proc_inode->fd in proc_get_inode() 2012-10-06 03:05:18 +09:00
internal.h coredump: use SUID_DUMPABLE_ENABLED rather than hardcoded 1 2012-10-06 03:05:16 +09:00
interrupts.c proc: move /proc/interrupts boilerplate code to fs/proc/interrupts.c 2008-10-23 15:15:46 +04:00
Kconfig kconfig: rename CONFIG_EMBEDDED to CONFIG_EXPERT 2011-01-20 17:02:05 -08:00
kcore.c fs/proc/kcore.c: make get_sparsemem_vmemmap_info() static 2012-03-23 16:58:42 -07:00
kmsg.c procfs: Use generic_file_llseek in /proc/kmsg 2010-04-09 16:35:41 +02:00
loadavg.c sched, timers: cleanup avenrun users 2009-05-15 15:32:45 +02:00
Makefile procfs: Move /proc/pid/fd[info] handling code to fd.[ch] 2012-09-26 21:10:01 -04:00
meminfo.c fs/proc/meminfo.c: fix compilation error 2011-12-09 07:50:28 -08:00
mmu.c
namespaces.c stop passing nameidata to ->lookup() 2012-07-14 16:34:32 +04:00
nommu.c include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h 2010-03-30 22:02:32 +09:00
page.c kpageflags: fix wrong KPF_THP on non-huge compound pages 2012-10-09 16:23:00 +09:00
proc_devtree.c of: Improve prom_update_property() function 2012-07-11 15:26:51 +10:00
proc_net.c stop passing nameidata to ->lookup() 2012-07-14 16:34:32 +04:00
proc_sysctl.c rbtree: fix incorrect rbtree node insertion in fs/proc/proc_sysctl.c 2012-10-09 16:22:32 +09:00
proc_tty.c proc: use seq_puts()/seq_putc() where possible 2011-01-13 08:03:16 -08:00
root.c fs/proc/root.c: use NULL instead of 0 for pointer 2012-10-06 03:05:19 +09:00
softirqs.c proc: use seq_puts()/seq_putc() where possible 2011-01-13 08:03:16 -08:00
stat.c proc: stats: Use arch_idle_time for idle and iowait times if available 2012-03-30 15:43:33 +02:00
task_mmu.c mm, mempolicy: fix printing stack contents in numa_maps 2012-10-16 18:00:50 -07:00
task_nommu.c proc: remove mm_for_maps() 2012-05-31 17:49:28 -07:00
uptime.c Merge branch 'sched/core' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip into cputime-tip 2011-12-19 19:23:15 +01:00
version.c proc: switch /proc/version to seq_file 2008-10-23 14:19:58 +04:00
vmcore.c fadump: Introduce cleanup routine to invalidate /proc/vmcore. 2012-02-23 10:50:02 +11:00