Messages in this thread | | | From | Andi Kleen <> | Subject | Re: [PATCH 5/6] mempolicy: fix a memory corruption by refcount imbalance in alloc_pages_vma() | Date | Wed, 30 May 2012 13:37:03 -0700 |
| |
kosaki.motohiro@gmail.com writes:
> From: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com> > > commit cc9a6c8776 (cpuset: mm: reduce large amounts of memory barrier related > damage v3) introduced a memory corruption. > > shmem_alloc_page() passes pseudo vma and it has one significant unique > combination, vma->vm_ops=NULL and (vma->policy->flags & MPOL_F_SHARED). > > Now, get_vma_policy() does NOT increase a policy ref when vma->vm_ops=NULL > and mpol_cond_put() DOES decrease a policy ref when a policy has MPOL_F_SHARED. > Therefore, when cpuset race is happen and alloc_pages_vma() fall in > 'goto retry_cpuset' path, a policy refcount will be decreased too much and > therefore it will make memory corruption. > > This patch fixes it.
Looks good.
Acked-by: Andi Kleen <ak@linux.intel.com>
-Andi
-- ak@linux.intel.com -- Speaking for myself only
| |