mempolicy: fix a race in shared_policy_replace()
authorMel Gorman <mgorman@suse.de>
Mon, 8 Oct 2012 23:29:17 +0000 (16:29 -0700)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 12 Oct 2012 20:38:56 +0000 (05:38 +0900)
commit04a30bd9dccbeee2cc6b035e42a37e9be0fa8c6c
tree8b8c631b4b951e9a1676464c8f033143b979f7ed
parent33efe2910bf7865a7d1fba4b06c9fa4b6fda6856
mempolicy: fix a race in shared_policy_replace()

commit b22d127a39ddd10d93deee3d96e643657ad53a49 upstream.

shared_policy_replace() use of sp_alloc() is unsafe.  1) sp_node cannot
be dereferenced if sp->lock is not held and 2) another thread can modify
sp_node between spin_unlock for allocating a new sp node and next
spin_lock.  The bug was introduced before 2.6.12-rc2.

Kosaki's original patch for this problem was to allocate an sp node and
policy within shared_policy_replace and initialise it when the lock is
reacquired.  I was not keen on this approach because it partially
duplicates sp_alloc().  As the paths were sp->lock is taken are not that
performance critical this patch converts sp->lock to sp->mutex so it can
sleep when calling sp_alloc().

[kosaki.motohiro@jp.fujitsu.com: Original patch]
Signed-off-by: Mel Gorman <mgorman@suse.de>
Acked-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
Reviewed-by: Christoph Lameter <cl@linux.com>
Cc: Josh Boyer <jwboyer@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
include/linux/mempolicy.h
mm/mempolicy.c