numa, sched, mm: Fix NULL-ptr deref

Dan reported that there's a possible NULL pointer deref in this logic,
fix that. Further fix it to avoid a possible inf. loop (completely
unlikely in the case no vma is migratable). Also don't endlessly loop
on large length, simply truncate at the end of the address-space and
restart on the next go.

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Rik van Riel <riel@redhat.com>
Link: http://lkml.kernel.org/n/tip-mnkio02xxtttiepsg9ek6qkw@git.kernel.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>

diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index 1dad296b4dbb038474b39bc6f7a458d03ef46ba6..dea3ca6e1c67eda6ab75b862283b979ecfbed5ed 100644 (file)
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -933,40 +933,31 @@ void task_numa_work(struct callback_head *work)
        if (cmpxchg(&mm->numa_next_scan, migrate, next_scan) != migrate)
                return;
 
-
        offset = mm->numa_scan_offset;
        length = sysctl_sched_numa_scan_size;
        length <<= 20;
 
        down_write(&mm->mmap_sem);
        vma = find_vma(mm, offset);
-again:
        if (!vma) {
                ACCESS_ONCE(mm->numa_scan_seq)++;
                offset = 0;
                vma = mm->mmap;
        }
-       while (vma && !vma_migratable(vma)) {
-               vma = vma->vm_next;
-               if (!vma)
-                       goto again;
-       }
-
-       offset = max(offset, vma->vm_start);
-       end = min(ALIGN(offset + length, HPAGE_SIZE), vma->vm_end);
-       length -= end - offset;
+       for (; vma && length > 0; vma = vma->vm_next) {
+               if (!vma_migratable(vma))
+                       continue;
 
-       change_prot_none(vma, offset, end);
+               offset = max(offset, vma->vm_start);
+               end = min(ALIGN(offset + length, HPAGE_SIZE), vma->vm_end);
+               length -= end - offset;
 
-       offset = end;
+               change_prot_none(vma, offset, end);
 
-       if (length > 0) {
-               vma = vma->vm_next;
-               goto again;
+               offset = end;
        }
        mm->numa_scan_offset = offset;
        up_write(&mm->mmap_sem);
-
 }
 
 /*