From 836e3bf3d85dfe29309cb62dc1714bb89801eea5 Mon Sep 17 00:00:00 2001 From: Peter Zijlstra Date: Mon, 22 Oct 2012 19:21:32 +0200 Subject: [PATCH] numa, sched, mm: Fix NULL-ptr deref Dan reported that there's a possible NULL pointer deref in this logic, fix that. Further fix it to avoid a possible inf. loop (completely unlikely in the case no vma is migratable). Also don't endlessly loop on large length, simply truncate at the end of the address-space and restart on the next go. Reported-by: Dan Carpenter Signed-off-by: Peter Zijlstra Cc: Linus Torvalds Cc: Andrew Morton Cc: Peter Zijlstra Cc: Andrea Arcangeli Cc: Rik van Riel Link: http://lkml.kernel.org/n/tip-mnkio02xxtttiepsg9ek6qkw@git.kernel.org Signed-off-by: Ingo Molnar --- kernel/sched/fair.c | 25 ++++++++----------------- 1 file changed, 8 insertions(+), 17 deletions(-) diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index 1dad296b4dbb..dea3ca6e1c67 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -933,40 +933,31 @@ void task_numa_work(struct callback_head *work) if (cmpxchg(&mm->numa_next_scan, migrate, next_scan) != migrate) return; - offset = mm->numa_scan_offset; length = sysctl_sched_numa_scan_size; length <<= 20; down_write(&mm->mmap_sem); vma = find_vma(mm, offset); -again: if (!vma) { ACCESS_ONCE(mm->numa_scan_seq)++; offset = 0; vma = mm->mmap; } - while (vma && !vma_migratable(vma)) { - vma = vma->vm_next; - if (!vma) - goto again; - } - - offset = max(offset, vma->vm_start); - end = min(ALIGN(offset + length, HPAGE_SIZE), vma->vm_end); - length -= end - offset; + for (; vma && length > 0; vma = vma->vm_next) { + if (!vma_migratable(vma)) + continue; - change_prot_none(vma, offset, end); + offset = max(offset, vma->vm_start); + end = min(ALIGN(offset + length, HPAGE_SIZE), vma->vm_end); + length -= end - offset; - offset = end; + change_prot_none(vma, offset, end); - if (length > 0) { - vma = vma->vm_next; - goto again; + offset = end; } mm->numa_scan_offset = offset; up_write(&mm->mmap_sem); - } /* -- 2.39.5