numa, sched, mm: Fix NULL-ptr deref
Commit-ID: 836e3bf3d85dfe29309cb62dc1714bb89801eea5 Gitweb: http://git.kernel.org/tip/836e3bf3d85dfe29309cb62dc1714bb89801eea5 Author: Peter Zijlstra <[email protected]> AuthorDate: Mon, 22 Oct 2012 19:21:32 +0200 Committer: Ingo Molnar <[email protected]> CommitDate: Wed, 24 Oct 2012 08:52:12 +0200
numa, sched, mm: Fix NULL-ptr deref
Dan reported that there's a possible NULL pointer deref in this logic, fix that. Further fix it to avoid a possible inf. loop (completely unlikely in the case no vma is migratable). Also don't endlessly loop on large length, simply truncate at the end of the address-space and restart on the next go.
Reported-by Dan Carpenter <[email protected]>
Signed-off-by Peter Zijlstra <[email protected]>
Cc Linus Torvalds <[email protected]>
Cc Andrew Morton <[email protected]>
Cc Peter Zijlstra <[email protected]>
Cc Andrea Arcangeli <[email protected]>
Cc Rik van Riel <[email protected]>
Signed-off-by Ingo Molnar <[email protected]>
--- kernel/sched/fair.c | 25 ++++++++----------------- 1 files changed, 8 insertions(+), 17 deletions(-)
kernel/sched/fair.c +8 -17
@@ -933,40 +933,31 @@ void task_numa_work(struct callback_head *work)if (cmpxchg (&mm->numa_next_scan, migrate, next_scan) != migrate)return ; - offset = mm->numa_scan_offset; length = sysctl_sched_numa_scan_size; length <<=20 ;down_write (&mm->mmap_sem); vma =find_vma (mm, offset); -again:if (!vma) {ACCESS_ONCE (mm->numa_scan_seq)++; offset =0 ; vma = mm->mmap; } -while (vma && !vma_migratable (vma)) { - vma = vma->vm_next; -if (!vma) - goto again; - } - - offset =max (offset, vma->vm_start); - end =min (ALIGN (offset + length,HPAGE_SIZE ), vma->vm_end); - length -= end - offset; +for (; vma && length >0 ; vma = vma->vm_next) { +if (!vma_migratable (vma)) +continue ; -change_prot_none (vma, offset, end); + offset =max (offset, vma->vm_start); + end =min (ALIGN (offset + length,HPAGE_SIZE ), vma->vm_end); + length -= end - offset; - offset = end; +change_prot_none (vma, offset, end); -if (length >0 ) { - vma = vma->vm_next; - goto again; + offset = end; } mm->numa_scan_offset = offset;up_write (&mm->mmap_sem); - }/*