diff options
author | Paul Gortmaker <paul.gortmaker@windriver.com> | 2012-08-17 13:43:38 -0400 |
---|---|---|
committer | Paul Gortmaker <paul.gortmaker@windriver.com> | 2012-08-17 13:50:26 -0400 |
commit | 3e03049f76aadbce491c434ccd25497a5c28238b (patch) | |
tree | b98a790857335d098b9fbed0fd0039e3c892c41e | |
parent | 6dab104bd638d1dcbf1f3c82728219572bce4eea (diff) | |
download | longterm-queue-2.6.34-3e03049f76aadbce491c434ccd25497a5c28238b.tar.gz |
mm: add vmalloc check return patch.
Herton notes:
-------
> commit f5252e009d5b87071a919221e4f6624184005368 upstream.
>
> The /proc/vmallocinfo shows information about vmalloc allocations in
> vmlist that is a linklist of vm_struct. It, however, may access pages
> field of vm_struct where a page was not allocated. This results in a null
> pointer access and leads to a kernel panic.
>
> Why this happens: In __vmalloc_node_range() called from vmalloc(), newly
> allocated vm_struct is added to vmlist at __get_vm_area_node() and then,
> some fields of vm_struct such as nr_pages and pages are set at
> __vmalloc_area_node(). In other words, it is added to vmlist before it is
> fully initialized. At the same time, when the /proc/vmallocinfo is read,
> it accesses the pages field of vm_struct according to the nr_pages field
> at show_numa_info(). Thus, a null pointer access happens.
>
> The patch adds the newly allocated vm_struct to the vmlist *after* it is
> fully initialized. So, it can avoid accessing the pages field with
> unallocated page when show_numa_info() is called.
>
> Signed-off-by: Mitsuo Hayasaka <mitsuo.hayasaka.hu@hitachi.com>
> Cc: Andrew Morton <akpm@linux-foundation.org>
> Cc: David Rientjes <rientjes@google.com>
> Cc: Namhyung Kim <namhyung@gmail.com>
> Cc: "Paul E. McKenney" <paulmck@linux.vnet.ibm.com>
> Cc: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
> [PG: .34 has VMALLOC_START/END vs. start/end in f5252e009d5]
> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
[...]
commit 1368edf0647ac112d8cfa6ce47257dc950c50f5c ("mm: vmalloc: check for
page allocation failure before vmlist insertion") addresses a regression
on this change, something to consider for inclusion in this stable
update as well.
-------
Reported-by: Herton Ronaldo Krzesinski <herton.krzesinski@canonical.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
-rw-r--r-- | queue/mm-vmalloc-check-for-page-allocation-failure-before-.patch | 49 | ||||
-rw-r--r-- | queue/series | 1 |
2 files changed, 50 insertions, 0 deletions
diff --git a/queue/mm-vmalloc-check-for-page-allocation-failure-before-.patch b/queue/mm-vmalloc-check-for-page-allocation-failure-before-.patch new file mode 100644 index 0000000..567647d --- /dev/null +++ b/queue/mm-vmalloc-check-for-page-allocation-failure-before-.patch @@ -0,0 +1,49 @@ +From b977fc06307a5290bf5251a5768beb4b5210945d Mon Sep 17 00:00:00 2001 +From: Mel Gorman <mgorman@suse.de> +Date: Thu, 8 Dec 2011 14:34:30 -0800 +Subject: [PATCH] mm: vmalloc: check for page allocation failure before vmlist + insertion + +commit 1368edf0647ac112d8cfa6ce47257dc950c50f5c upstream. + +Commit f5252e00 ("mm: avoid null pointer access in vm_struct via +/proc/vmallocinfo") adds newly allocated vm_structs to the vmlist after +it is fully initialised. Unfortunately, it did not check that +__vmalloc_area_node() successfully populated the area. In the event of +allocation failure, the vmalloc area is freed but the pointer to freed +memory is inserted into the vmlist leading to a a crash later in +get_vmalloc_info(). + +This patch adds a check for ____vmalloc_area_node() failure within +__vmalloc_node_range. It does not use "goto fail" as in the previous +error path as a warning was already displayed by __vmalloc_area_node() +before it called vfree in its failure path. + +Credit goes to Luciano Chavez for doing all the real work of identifying +exactly where the problem was. + +Signed-off-by: Mel Gorman <mgorman@suse.de> +Reported-by: Luciano Chavez <lnx1138@linux.vnet.ibm.com> +Tested-by: Luciano Chavez <lnx1138@linux.vnet.ibm.com> +Reviewed-by: Rik van Riel <riel@redhat.com> +Acked-by: David Rientjes <rientjes@google.com> +Signed-off-by: Andrew Morton <akpm@linux-foundation.org> +Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/mm/vmalloc.c b/mm/vmalloc.c +index 3843789..edece35 100644 +--- a/mm/vmalloc.c ++++ b/mm/vmalloc.c +@@ -1601,6 +1601,8 @@ static void *__vmalloc_node(unsigned long size, unsigned long align, + return NULL; + + addr = __vmalloc_area_node(area, gfp_mask, prot, node, caller); ++ if (!addr) ++ return NULL; + + /* + * In this function, newly allocated vm_struct is not added +-- +1.7.12.rc2 + diff --git a/queue/series b/queue/series index f535b65..3eeab94 100644 --- a/queue/series +++ b/queue/series @@ -139,6 +139,7 @@ media-Remove-the-old-V4L1-v4lgrab.c-file.patch drm-i915-Sanity-check-pread-pwrite.patch drm-i915-Rephrase-pwrite-bounds-checking-to-avoid-an.patch mm-avoid-null-pointer-access-in-vm_struct-via-proc-v.patch +mm-vmalloc-check-for-page-allocation-failure-before-.patch kbuild-Fix-passing-Wno-options-to-gcc-4.4.patch USB-serial-pl2303-rm-duplicate-id.patch USB-Fix-Corruption-issue-in-USB-ftdi-driver-ftdi_sio.patch |