diff options
| author | Mel Gorman <mgorman@suse.de> | 2012-10-09 17:58:39 +0100 |
|---|---|---|
| committer | Ben Hutchings <ben@decadent.org.uk> | 2012-10-17 03:49:58 +0100 |
| commit | 507c18443d05543b9903d2341f8473dd6191f8ef (patch) | |
| tree | b6934c19d74fd39da958ed3bde1ada7371a6f437 /include | |
| parent | 23160cf41e2a7c64b0446e5a7fee8fde70e2ee77 (diff) | |
mempolicy: fix a race in shared_policy_replace()
commit b22d127a39ddd10d93deee3d96e643657ad53a49 upstream.
shared_policy_replace() use of sp_alloc() is unsafe. 1) sp_node cannot
be dereferenced if sp->lock is not held and 2) another thread can modify
sp_node between spin_unlock for allocating a new sp node and next
spin_lock. The bug was introduced before 2.6.12-rc2.
Kosaki's original patch for this problem was to allocate an sp node and
policy within shared_policy_replace and initialise it when the lock is
reacquired. I was not keen on this approach because it partially
duplicates sp_alloc(). As the paths were sp->lock is taken are not that
performance critical this patch converts sp->lock to sp->mutex so it can
sleep when calling sp_alloc().
[kosaki.motohiro@jp.fujitsu.com: Original patch]
Signed-off-by: Mel Gorman <mgorman@suse.de>
Acked-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
Reviewed-by: Christoph Lameter <cl@linux.com>
Cc: Josh Boyer <jwboyer@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Mel Gorman <mgorman@suse.de>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Diffstat (limited to 'include')
| -rw-r--r-- | include/linux/mempolicy.h | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/include/linux/mempolicy.h b/include/linux/mempolicy.h index 7978eec1b7d9..3e8f2f705b37 100644 --- a/include/linux/mempolicy.h +++ b/include/linux/mempolicy.h @@ -188,7 +188,7 @@ struct sp_node { struct shared_policy { struct rb_root root; - spinlock_t lock; + struct mutex mutex; }; void mpol_shared_policy_init(struct shared_policy *sp, struct mempolicy *mpol); |