From patchwork Fri Apr 8 20:09:07 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrew Morton X-Patchwork-Id: 12807184 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 675E3C433EF for ; Fri, 8 Apr 2022 20:09:12 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 0210E6B007E; Fri, 8 Apr 2022 16:09:12 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id EE9E76B0080; Fri, 8 Apr 2022 16:09:11 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id DD9F46B0081; Fri, 8 Apr 2022 16:09:11 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (relay.hostedemail.com [64.99.140.26]) by kanga.kvack.org (Postfix) with ESMTP id CEAE66B007E for ; Fri, 8 Apr 2022 16:09:11 -0400 (EDT) Received: from smtpin09.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay02.hostedemail.com (Postfix) with ESMTP id AF97126201 for ; Fri, 8 Apr 2022 20:09:11 +0000 (UTC) X-FDA: 79334800902.09.8C92EDA Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by imf30.hostedemail.com (Postfix) with ESMTP id 249D380006 for ; Fri, 8 Apr 2022 20:09:10 +0000 (UTC) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id E4E8CB82D20; Fri, 8 Apr 2022 20:09:09 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9C9E9C385A3; Fri, 8 Apr 2022 20:09:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linux-foundation.org; s=korg; t=1649448548; bh=jK5P+S6TBH7YF6w0YeGEccKrveX9Q4CJhIMJxTVHP90=; h=Date:To:From:In-Reply-To:Subject:From; b=D/XdaMbmMx64cu2oQEP24nMEBtaFtmZ3s/GL8tOuuyCDohC13dt16JJDbli9OhYMD wOISBiKU/I7QQsy2/fKUKl8TThyurnLdeRtNjchDLEM6+hdl8lcHT4FWGH7qgzqFhi YJXVgeoYbZChXYf6JXdFtrreg788lYzTk8FsHxno= Date: Fri, 08 Apr 2022 13:09:07 -0700 To: stable@vger.kernel.org,mhocko@suse.com,mgorman@suse.de,kosaki.motohiro@jp.fujitsu.com,linmiaohe@huawei.com,akpm@linux-foundation.org,patches@lists.linux.dev,linux-mm@kvack.org,mm-commits@vger.kernel.org,torvalds@linux-foundation.org,akpm@linux-foundation.org From: Andrew Morton In-Reply-To: <20220408130819.a89195e527ce58dfbe0700b9@linux-foundation.org> Subject: [patch 6/9] mm/mempolicy: fix mpol_new leak in shared_policy_replace Message-Id: <20220408200908.9C9E9C385A3@smtp.kernel.org> Authentication-Results: imf30.hostedemail.com; dkim=pass header.d=linux-foundation.org header.s=korg header.b="D/XdaMbm"; spf=pass (imf30.hostedemail.com: domain of akpm@linux-foundation.org designates 145.40.68.75 as permitted sender) smtp.mailfrom=akpm@linux-foundation.org; dmarc=none X-Rspam-User: X-Rspamd-Server: rspam10 X-Rspamd-Queue-Id: 249D380006 X-Stat-Signature: ewz7pxx456h8pd6dufduwcuqgkcosi6s X-HE-Tag: 1649448550-170603 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: From: Miaohe Lin Subject: mm/mempolicy: fix mpol_new leak in shared_policy_replace If mpol_new is allocated but not used in restart loop, mpol_new will be freed via mpol_put before returning to the caller. But refcnt is not initialized yet, so mpol_put could not do the right things and might leak the unused mpol_new. This would happen if mempolicy was updated on the shared shmem file while the sp->lock has been dropped during the memory allocation. This issue could be triggered easily with the below code snippet if there are many processes doing the below work at the same time: shmid = shmget((key_t)5566, 1024 * PAGE_SIZE, 0666|IPC_CREAT); shm = shmat(shmid, 0, 0); loop many times { mbind(shm, 1024 * PAGE_SIZE, MPOL_LOCAL, mask, maxnode, 0); mbind(shm + 128 * PAGE_SIZE, 128 * PAGE_SIZE, MPOL_DEFAULT, mask, maxnode, 0); } Link: https://lkml.kernel.org/r/20220329111416.27954-1-linmiaohe@huawei.com Fixes: 42288fe366c4 ("mm: mempolicy: Convert shared_policy mutex to spinlock") Signed-off-by: Miaohe Lin Acked-by: Michal Hocko Cc: KOSAKI Motohiro Cc: Mel Gorman Cc: [3.8] Signed-off-by: Andrew Morton --- mm/mempolicy.c | 1 + 1 file changed, 1 insertion(+) --- a/mm/mempolicy.c~mm-mempolicy-fix-mpol_new-leak-in-shared_policy_replace +++ a/mm/mempolicy.c @@ -2733,6 +2733,7 @@ alloc_new: mpol_new = kmem_cache_alloc(policy_cache, GFP_KERNEL); if (!mpol_new) goto err_out; + atomic_set(&mpol_new->refcnt, 1); goto restart; }