[PATCH 1/3] cpuset: zero malloc - fix for old cpusets

[PATCH 1/3] cpuset: zero malloc - fix for old cpusets

Post by Paul Jacks » Sun, 10 Jun 2007 10:40:11


From: Paul Jackson < XXXX@XXXXX.COM >

First of three -- this one goes before the container patches,
and should be sent to Linus for 2.6.22.

The cpuset code to present a list of tasks using a cpuset to
user space could write to an array that it had kmalloc'd,
after a kmalloc request of zero size.

The problem was that the code didn't check for writes past
the allocated end of the array until -after- the first write.

This is a race condition that is likely rare -- it would only
show up if a cpuset went from being empty to having a task
in it, during the brief time between the allocation and the
first write.

Prior to roughly 2.6.22 kernels, this was also a benign
problem, because a zero kmalloc returned a few usable bytes
anyway, and no harm was done with the bogus write.

With the 2.6.22 kernel changes to make issue a warning if
code tries to write to the location returned from a zero
size allocation, this problem is no longer benign. This
cpuset code would occassionally trigger that warning.

The fix is trivial -- check before storing into the array,
not after, whether the array is big enough to hold the store.

Cc: "Eric W. Biederman" < XXXX@XXXXX.COM >
Cc: "Serge E. Hallyn" < XXXX@XXXXX.COM >
Cc: Balbir Singh < XXXX@XXXXX.COM >
Cc: Dave Hansen < XXXX@XXXXX.COM >
Cc: Herbert Poetzl < XXXX@XXXXX.COM >
Cc: Kirill Korotaev < XXXX@XXXXX.COM >
Cc: Paul Menage < XXXX@XXXXX.COM >
Cc: Srivatsa Vaddagiri < XXXX@XXXXX.COM >
Cc: Christoph Lameter < XXXX@XXXXX.COM >

Signed-off-by: Paul Jackson < XXXX@XXXXX.COM >

---

Andrew - this fix collides with the container changes, and now
that you have sent Christoph's patch to Linus to warn on writes
to zero-sized allocations, this fix should go to Linus too.

So it comes in three parts: fix the old, undo that, fix the new.

This patch should be applied first, before the container patches,
and sent to Linus for 2.6.22.

kernel/cpuset.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

--- 2.6.22-rc4-mm2.orig/kernel/cpuset.c 2007-06-08 14:44:58.899036450 -0700
+++ 2.6.22-rc4-mm2/kernel/cpuset.c 2007-06-08 14:47:00.996907442 -0700
@@ -1620,9 +1620,9 @@ static int pid_array_load(pid_t *pidarra

do_each_thread(g, p) {
if (p->cpuset == cs) {
- pidarray[n++] = p->pid;
if (unlikely(n == npids))
goto array_full;
+ pidarray[n++] = p->pid;
}
} while_each_thread(g, p);


--
I won't rest till it's the best ...
Programmer, Linux Scalability
Paul Jackson < XXXX@XXXXX.COM > 1.650.933.1373
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to XXXX@XXXXX.COM
More majordomo info at http://www.yqcomputer.com/
Please read the FAQ at http://www.yqcomputer.com/