Mel Gorman 4ffdd536f9 mempolicy: fix a memory corruption by refcount imbalance in alloc_pages_vma() ... commit 00442ad04a upstream. Commit cc9a6c8776 ("cpuset: mm: reduce large amounts of memory barrier related damage v3") introduced a potential memory corruption. shmem_alloc_page() uses a pseudo vma and it has one significant unique combination, vma->vm_ops=NULL and vma->policy->flags & MPOL_F_SHARED. get_vma_policy() does NOT increase a policy ref when vma->vm_ops=NULL and mpol_cond_put() DOES decrease a policy ref when a policy has MPOL_F_SHARED. Therefore, when a cpuset update race occurs, alloc_pages_vma() falls in 'goto retry_cpuset' path, decrements the reference count and frees the policy prematurely. Signed-off-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com> Signed-off-by: Mel Gorman <mgorman@suse.de> Reviewed-by: Christoph Lameter <cl@linux.com> Cc: Josh Boyer <jwboyer@gmail.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2012-10-13 05:47:21 +09:00
..
backing-dev.c	backing-dev: fix wakeup timer races with bdi_unregister()	2012-02-01 16:52:49 +08:00
bootmem.c	bootmem: make ___alloc_bootmem_node_nopanic() really nopanic	2012-07-17 16:21:29 -07:00
bounce.c	mm: remove the second argument of k[un]map_atomic()	2012-03-20 21:48:27 +08:00
cleancache.c	->encode_fh() API change	2012-05-29 23:28:33 -04:00
compaction.c	mm, thp: abort compaction if migration page cannot be charged to memcg	2012-07-11 16:04:43 -07:00
debug-pagealloc.c	mm, x86: Remove debug_pagealloc_enabled	2011-12-06 09:24:07 +01:00
dmapool.c	mm: fix implicit stat.h usage in dmapool.c	2011-10-31 09:20:12 -04:00
fadvise.c	fadvise: only initiate writeback for specified range with FADV_DONTNEED	2012-01-10 16:30:43 -08:00
failslab.c	switch debugfs to umode_t	2012-01-03 22:54:56 -05:00
filemap_xip.c	fs: introduce inode operation ->update_time	2012-06-01 12:07:25 -04:00
filemap.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2012-06-01 10:34:35 -07:00
fremap.c	mm: delete various needless include <linux/module.h>	2011-10-31 09:20:11 -04:00
frontswap.c	frontswap: s/put_page/store/g s/get_page/load	2012-05-15 11:34:08 -04:00
highmem.c	Merge branch 'modsplit-Oct31_2011' of git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux	2011-11-06 19:44:47 -08:00
huge_memory.c	mm/memcg: apply add/del_page to lruvec	2012-05-29 16:22:28 -07:00
hugetlb.c	hugetlb: do not use vma_hugecache_offset() for vma_prio_tree_foreach	2012-10-13 05:47:11 +09:00
hwpoison-inject.c	HWPOISON: Clean up memory_failure() vs. __memory_failure()	2012-01-03 12:06:32 -08:00
init-mm.c	atomic: use <linux/atomic.h>	2011-07-26 16:49:47 -07:00
internal.h	mm: setup pageblock_order before it's used by sparsemem	2012-08-15 07:52:45 -07:00
Kconfig	Frontswap provides a "transcendent memory" interface for swap pages.	2012-06-04 12:28:45 -07:00
Kconfig.debug	mm: more intensive memory corruption debugging	2012-01-10 16:30:42 -08:00
kmemcheck.c	kmemcheck: Fix build errors due to missing slab.h	2010-03-30 22:02:32 +09:00
kmemleak-test.c	kmemleak: remove memset by using kzalloc	2011-01-27 18:31:51 +00:00
kmemleak.c	kmemleak: Disable early logging when kmemleak is off by default	2012-01-20 16:57:05 +00:00
ksm.c	ksm: cleanup: introduce find_mergeable_vma()	2012-03-21 17:54:59 -07:00
maccess.c	mm: Map most files to use export.h instead of module.h	2011-10-31 09:20:12 -04:00
madvise.c	mm: Hold a file reference in madvise_remove	2012-07-06 10:34:38 -07:00
Makefile	Frontswap provides a "transcendent memory" interface for swap pages.	2012-06-04 12:28:45 -07:00
memblock.c	memblock: free allocated memblock_reserved_regions later	2012-07-11 16:04:50 -07:00
memcontrol.c	mm: fix kernel-doc warnings	2012-06-20 14:39:36 -07:00
memory_hotplug.c	memory hotplug: fix section info double registration bug	2012-10-02 10:39:12 -07:00
memory-failure.c	mm: fix wrong argument of migrate_huge_pages() in soft_offline_huge_page()	2012-08-15 07:52:43 -07:00
memory.c	mm/memory.c: fix kernel-doc warnings	2012-06-20 14:39:36 -07:00
mempolicy.c	mempolicy: fix a memory corruption by refcount imbalance in alloc_pages_vma()	2012-10-13 05:47:21 +09:00
mempool.c	mempool: fix first round failure behavior	2012-01-10 16:30:45 -08:00
migrate.c	mm: fix warning in __set_page_dirty_nobuffers	2012-06-03 20:05:47 -07:00
mincore.c	mm: thp: fix pmd_bad() triggering in code paths holding mmap_sem read mode	2012-03-21 17:54:54 -07:00
mlock.c	vm: avoid using find_vma_prev() unnecessarily	2012-03-06 18:23:36 -08:00
mm_init.c	mm: Map most files to use export.h instead of module.h	2011-10-31 09:20:12 -04:00
mmap.c	uprobes: Fix mmap_region()'s mm->mm_rb corruption if uprobe_mmap() fails	2012-09-14 09:59:55 -07:00
mmu_context.c	mm, counters: remove task argument to sync_mm_rss() and __sync_task_rss_stat()	2012-03-21 17:54:59 -07:00
mmu_notifier.c	mm: mmu_notifier: fix freed page still mapped in secondary MMU	2012-08-15 07:52:45 -07:00
mmzone.c	mm: add link from struct lruvec to struct zone	2012-05-29 16:22:26 -07:00
mprotect.c	Merge branch 'akpm' (Andrew's patch-bomb)	2012-03-22 09:04:48 -07:00
mremap.c	move security_mmap_addr() to saner place	2012-06-01 10:37:16 -04:00
msync.c	sanitize vfs_fsync calling conventions	2010-05-21 18:31:21 -04:00
nobootmem.c	memblock: free allocated memblock_reserved_regions later	2012-07-11 16:04:50 -07:00
nommu.c	nommu: fix compilation of nommu.c	2012-06-04 17:17:31 -04:00
oom_kill.c	mm: fix kernel-doc warnings	2012-06-20 14:39:36 -07:00
page_alloc.c	mm/page_alloc: fix the page address of higher page's buddy calculation	2012-10-02 10:39:11 -07:00
page_cgroup.c	mm: fix kernel-doc warnings	2012-06-20 14:39:36 -07:00
page_io.c	frontswap: s/put_page/store/g s/get_page/load	2012-05-15 11:34:08 -04:00
page_isolation.c	mm: page_isolation: MIGRATE_CMA isolation functions added	2012-05-21 15:09:33 +02:00
page-writeback.c	writeback: initialize global_dirty_limit	2012-05-06 13:41:58 +08:00
pagewalk.c	mm: fix kernel-doc warnings	2012-06-20 14:39:36 -07:00
percpu-km.c	percpu: clear memory allocated with the km allocator	2010-10-02 10:28:42 +03:00
percpu-vm.c	mm: fix kernel-doc warnings	2012-06-20 14:39:36 -07:00
percpu.c	kmemleak: Fix the kmemleak tracking of the percpu areas with !SMP	2012-05-09 10:13:29 -07:00
pgtable-generic.c	arch/tile: allow building Linux with transparent huge pages enabled	2012-05-25 12:48:21 -04:00
prio_tree.c	sanitize <linux/prefetch.h> usage	2011-05-20 12:50:29 -07:00
process_vm_access.c	aio/vfs: cleanup of rw_copy_check_uvector() and compat_rw_copy_check_uvector()	2012-05-31 17:49:32 -07:00
quicklist.c	mm: delete various needless include <linux/module.h>	2011-10-31 09:20:11 -04:00
readahead.c	mm: move readahead syscall to mm/readahead.c	2012-05-29 16:22:23 -07:00
rmap.c	mm: remove swap token code	2012-05-29 16:22:19 -07:00
shmem.c	shmem: cleanup shmem_add_to_page_cache	2012-07-11 16:04:48 -07:00
slab.c	slab: fix the DEADLOCK issue on l3 alien lock	2012-10-13 05:46:52 +09:00
slob.c	mm: Map most files to use export.h instead of module.h	2011-10-31 09:20:12 -04:00
slub.c	Merge branch 'slab/for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/penberg/linux	2012-06-01 16:50:23 -07:00
sparse-vmemmap.c	mm: delete various needless include <linux/module.h>	2011-10-31 09:20:11 -04:00
sparse.c	mm: setup pageblock_order before it's used by sparsemem	2012-08-15 07:52:45 -07:00
swap_state.c	mm: fix s390 BUG by __set_page_dirty_no_writeback on swap	2012-04-23 18:19:22 -07:00
swap.c	mm/memcg: apply add/del_page to lruvec	2012-05-29 16:22:28 -07:00
swapfile.c	swap: fix shmem swapping when more than 8 areas	2012-06-15 21:48:14 -07:00
truncate.c	mm: fix invalidate_complete_page2() lock ordering	2012-10-13 05:47:12 +09:00
util.c	new helper: vm_mmap_pgoff()	2012-06-01 10:37:18 -04:00
vmalloc.c	mm: fix faulty initialization in vmalloc_init()	2012-05-29 16:22:24 -07:00
vmscan.c	memcg: further prevent OOM with too many dirty pages	2012-08-15 07:52:35 -07:00
vmstat.c	mm/vmstat.c: remove debug fs entries on failure of file creation and made extfrag_debug_root dentry local	2012-05-29 16:22:19 -07:00