• Oleg Nesterov's avatar
    mempolicy: fix show_numa_map() vs exec() + do_set_mempolicy() race · 498f2371
    Oleg Nesterov authored
    9e781440 "hold task->mempolicy while numa_maps scans." fixed the
    race with the exiting task but this is not enough.
    
    The current code assumes that get_vma_policy(task) should either see
    task->mempolicy == NULL or it should be equal to ->task_mempolicy saved
    by hold_task_mempolicy(), so we can never race with __mpol_put(). But
    this can only work if we can't race with do_set_mempolicy(), and thus
    we can't race with another do_set_mempolicy() or do_exit() after that.
    
    However, do_set_mempolicy()->down_write(mmap_sem) can not prevent this
    race. This task can exec, change it's ->mm, and call do_set_mempolicy()
    after that; in this case they take 2 different locks.
    
    Change hold_task_mempolicy() to use get_task_policy(), it never returns
    NULL, and change show_numa_map() to use __get_vma_policy() or fall back
    to proc_priv->task_mempolicy.
    
    Note: this is the minimal fix, we will cleanup this code later. I think
    hold_task_mempolicy() and release_task_mempolicy() should die, we can
    move this logic into show_numa_map(). Or we can move get_task_policy()
    outside of ->mmap_sem and !CONFIG_NUMA code at least.
    Signed-off-by: default avatarOleg Nesterov <oleg@redhat.com>
    Cc: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
    Cc: David Rientjes <rientjes@google.com>
    Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
    Cc: Alexander Viro <viro@zeniv.linux.org.uk>
    Cc: Cyrill Gorcunov <gorcunov@openvz.org>
    Cc: "Eric W. Biederman" <ebiederm@xmission.com>
    Cc: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Cc: Hugh Dickins <hughd@google.com>
    Cc: Andi Kleen <andi@firstfloor.org>
    Cc: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
    Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
    Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    498f2371
task_mmu.c 37.7 KB