David Rientjes 32f8516a8c mm, mempolicy: fix printing stack contents in numa_maps ... When reading /proc/pid/numa_maps, it's possible to return the contents of the stack where the mempolicy string should be printed if the policy gets freed from beneath us. This happens because mpol_to_str() may return an error the stack-allocated buffer is then printed without ever being stored. There are two possible error conditions in mpol_to_str(): - if the buffer allocated is insufficient for the string to be stored, and - if the mempolicy has an invalid mode. The first error condition is not triggered in any of the callers to mpol_to_str(): at least 50 bytes is always allocated on the stack and this is sufficient for the string to be written. A future patch should convert this into BUILD_BUG_ON() since we know the maximum strlen possible, but that's not -rc material. The second error condition is possible if a race occurs in dropping a reference to a task's mempolicy causing it to be freed during the read(). The slab poison value is then used for the mode and mpol_to_str() returns -EINVAL. This race is only possible because get_vma_policy() believes that mm->mmap_sem protects task->mempolicy, which isn't true. The exit path does not hold mm->mmap_sem when dropping the reference or setting task->mempolicy to NULL: it uses task_lock(task) instead. Thus, it's required for the caller of a task mempolicy to hold task_lock(task) while grabbing the mempolicy and reading it. Callers with a vma policy store their mempolicy earlier and can simply increment the reference count so it's guaranteed not to be freed. Reported-by: Dave Jones <davej@redhat.com> Signed-off-by: David Rientjes <rientjes@google.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>		2012-10-16 18:00:50 -07:00
..
array.c	c/r: procfs: add arg_start/end, env_start/end and exit_code members to /proc/$pid/stat	2012-05-31 17:49:32 -07:00
base.c	procfs: don't need a PATH_MAX allocation to hold a string representation of an int	2012-10-12 20:15:10 -04:00
cmdline.c
consoles.c
cpuinfo.c
devices.c
fd.c	don't leak O_CLOEXEC into ->f_flags	2012-09-26 21:10:01 -04:00
fd.h	procfs: Move /proc/pid/fd[info] handling code to fd.[ch]	2012-09-26 21:10:01 -04:00
generic.c	proc: use kzalloc instead of kmalloc and memset	2012-10-06 03:05:18 +09:00
inode.c	proc: no need to initialize proc_inode->fd in proc_get_inode()	2012-10-06 03:05:18 +09:00
internal.h	coredump: use SUID_DUMPABLE_ENABLED rather than hardcoded 1	2012-10-06 03:05:16 +09:00
interrupts.c
Kconfig
kcore.c
kmsg.c
loadavg.c
Makefile	procfs: Move /proc/pid/fd[info] handling code to fd.[ch]	2012-09-26 21:10:01 -04:00
meminfo.c
mmu.c
namespaces.c	stop passing nameidata to ->lookup()	2012-07-14 16:34:32 +04:00
nommu.c
page.c	kpageflags: fix wrong KPF_THP on non-huge compound pages	2012-10-09 16:23:00 +09:00
proc_devtree.c	of: Improve prom_update_property() function	2012-07-11 15:26:51 +10:00
proc_net.c	stop passing nameidata to ->lookup()	2012-07-14 16:34:32 +04:00
proc_sysctl.c	rbtree: fix incorrect rbtree node insertion in fs/proc/proc_sysctl.c	2012-10-09 16:22:32 +09:00
proc_tty.c
root.c	fs/proc/root.c: use NULL instead of 0 for pointer	2012-10-06 03:05:19 +09:00
softirqs.c
stat.c
task_mmu.c	mm, mempolicy: fix printing stack contents in numa_maps	2012-10-16 18:00:50 -07:00
task_nommu.c	proc: remove mm_for_maps()	2012-05-31 17:49:28 -07:00
uptime.c
version.c
vmcore.c