| From 4ad099559b00ac01c3726e5c95dc3108ef47d03e Mon Sep 17 00:00:00 2001 |
| From: Miaohe Lin <linmiaohe@huawei.com> |
| Date: Fri, 8 Apr 2022 13:09:07 -0700 |
| Subject: mm/mempolicy: fix mpol_new leak in shared_policy_replace |
| |
| From: Miaohe Lin <linmiaohe@huawei.com> |
| |
| commit 4ad099559b00ac01c3726e5c95dc3108ef47d03e upstream. |
| |
| If mpol_new is allocated but not used in restart loop, mpol_new will be |
| freed via mpol_put before returning to the caller. But refcnt is not |
| initialized yet, so mpol_put could not do the right things and might |
| leak the unused mpol_new. This would happen if mempolicy was updated on |
| the shared shmem file while the sp->lock has been dropped during the |
| memory allocation. |
| |
| This issue could be triggered easily with the below code snippet if |
| there are many processes doing the below work at the same time: |
| |
| shmid = shmget((key_t)5566, 1024 * PAGE_SIZE, 0666|IPC_CREAT); |
| shm = shmat(shmid, 0, 0); |
| loop many times { |
| mbind(shm, 1024 * PAGE_SIZE, MPOL_LOCAL, mask, maxnode, 0); |
| mbind(shm + 128 * PAGE_SIZE, 128 * PAGE_SIZE, MPOL_DEFAULT, mask, |
| maxnode, 0); |
| } |
| |
| Link: https://lkml.kernel.org/r/20220329111416.27954-1-linmiaohe@huawei.com |
| Fixes: 42288fe366c4 ("mm: mempolicy: Convert shared_policy mutex to spinlock") |
| Signed-off-by: Miaohe Lin <linmiaohe@huawei.com> |
| Acked-by: Michal Hocko <mhocko@suse.com> |
| Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com> |
| Cc: Mel Gorman <mgorman@suse.de> |
| Cc: <stable@vger.kernel.org> [3.8] |
| Signed-off-by: Andrew Morton <akpm@linux-foundation.org> |
| Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| mm/mempolicy.c | 1 + |
| 1 file changed, 1 insertion(+) |
| |
| --- a/mm/mempolicy.c |
| +++ b/mm/mempolicy.c |
| @@ -2653,6 +2653,7 @@ alloc_new: |
| mpol_new = kmem_cache_alloc(policy_cache, GFP_KERNEL); |
| if (!mpol_new) |
| goto err_out; |
| + atomic_set(&mpol_new->refcnt, 1); |
| goto restart; |
| } |
| |