lkml.org 
[lkml]   [2019]   [Sep]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[RFC PATCH 2/3] Fix: sched/membarrier: READ_ONCE p->mm in membarrier_global_expedited
    Date
    Due to the lack of READ_ONCE() on p->mm, this code can in fact turn into
    a NULL deref when we hit do_exit() around exit_mm(). The first p->mm
    read is before and sees !NULL, the second is after and does observe
    NULL, which triggers a null pointer dereference.

    Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Cc: Oleg Nesterov <oleg@redhat.com>
    Cc: "Eric W. Biederman" <ebiederm@xmission.com>
    Cc: Linus Torvalds <torvalds@linux-foundation.org>
    Cc: Russell King - ARM Linux admin <linux@armlinux.org.uk>
    Cc: Chris Metcalf <cmetcalf@ezchip.com>
    Cc: Christoph Lameter <cl@linux.com>
    Cc: Kirill Tkhai <tkhai@yandex.ru>
    Cc: Mike Galbraith <efault@gmx.de>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Cc: Ingo Molnar <mingo@kernel.org>
    ---
    kernel/sched/membarrier.c | 14 +++++++++-----
    1 file changed, 9 insertions(+), 5 deletions(-)

    diff --git a/kernel/sched/membarrier.c b/kernel/sched/membarrier.c
    index aa8d75804108..02feb7c8da4f 100644
    --- a/kernel/sched/membarrier.c
    +++ b/kernel/sched/membarrier.c
    @@ -72,12 +72,16 @@ static int membarrier_global_expedited(void)

    rcu_read_lock();
    p = task_rcu_dereference(&cpu_rq(cpu)->curr);
    - if (p && p->mm && (atomic_read(&p->mm->membarrier_state) &
    + if (p) {
    + struct mm_struct *mm = READ_ONCE(p->mm);
    +
    + if (mm && (atomic_read(&mm->membarrier_state) &
    MEMBARRIER_STATE_GLOBAL_EXPEDITED)) {
    - if (!fallback)
    - __cpumask_set_cpu(cpu, tmpmask);
    - else
    - smp_call_function_single(cpu, ipi_mb, NULL, 1);
    + if (!fallback)
    + __cpumask_set_cpu(cpu, tmpmask);
    + else
    + smp_call_function_single(cpu, ipi_mb, NULL, 1);
    + }
    }
    rcu_read_unlock();
    }
    --
    2.17.1
    \
     
     \ /
      Last update: 2019-09-03 18:01    [W:3.124 / U:0.536 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site