Prev: [PATCH 1/2] blackfin: ptrace: fix the unsafe usage of mm/find_vma in is_user_addr_valid()
Next: sys_personality: make sure (int)personality >= 0
From: Oleg Nesterov on 27 May 2010 16:00
Any usage of mm->context.sram_list is not safe, is_user_addr_valid()
and sram_free_with_lsl/sram_free_with_lsl can race with each other.

Change sram_free_with_lsl/sram_free_with_lsl to take mm->mmap_sem
for writing, is_user_addr_valid() was already modified to take it
for reading and it doesn't modify this list.

destroy_context() reaps this list lockless, this is OK.

This patch assumes that sram_free() doesn't need to be serialized
(afaics it does the locking correctly), and it is safe to call
sram_free(addr) after its sram_list_struct was removed from list.

Signed-off-by: Oleg Nesterov <oleg(a)redhat.com>
---

arch/blackfin/mm/sram-alloc.c | 24 ++++++++++++++++--------
1 file changed, 16 insertions(+), 8 deletions(-)

--- 34-rc1/arch/blackfin/mm/sram-alloc.c~IUAV_2_SRAM_LIST_LOCKING 2010-05-27 17:51:48.000000000 +0200
+++ 34-rc1/arch/blackfin/mm/sram-alloc.c 2010-05-27 21:31:01.000000000 +0200
@@ -702,19 +702,23 @@ EXPORT_SYMBOL(l2_sram_free);

int sram_free_with_lsl(const void *addr)
{
- struct sram_list_struct *lsl, **tmp;
+ struct sram_list_struct *lsl = NULL, **tmp;
struct mm_struct *mm = current->mm;

+ down_write(&mm->mmap_sem);
for (tmp = &mm->context.sram_list; *tmp; tmp = &(*tmp)->next)
- if ((*tmp)->addr == addr)
- goto found;
- return -1;
-found:
- lsl = *tmp;
+ if ((*tmp)->addr == addr) {
+ lsl = *tmp;
+ *tmp = lsl->next;
+ break;
+ }
+ up_write(&mm->mmap_sem);
+
+ if (!lsl)
+ return -1;
+
sram_free(addr);
- *tmp = lsl->next;
kfree(lsl);
-
return 0;
}
EXPORT_SYMBOL(sram_free_with_lsl);
@@ -749,10 +753,14 @@ void *sram_alloc_with_lsl(size_t size, u
kfree(lsl);
return NULL;
}
+
+ down_write(&mm->mmap_sem);
lsl->addr = addr;
lsl->length = size;
lsl->next = mm->context.sram_list;
mm->context.sram_list = lsl;
+ up_write(&mm->mmap_sem);
+
return addr;
}
EXPORT_SYMBOL(sram_alloc_with_lsl);

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo(a)vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
 | 
Pages: 1
Prev: [PATCH 1/2] blackfin: ptrace: fix the unsafe usage of mm/find_vma in is_user_addr_valid()
Next: sys_personality: make sure (int)personality >= 0