Christoph Lameter 3268c63ede mm: fix move/migrate_pages() race on task struct ... Migration functions perform the rcu_read_unlock too early. As a result the task pointed to may change from under us. This can result in an oops, as reported by Dave Hansen in https://lkml.org/lkml/2012/2/23/302. The following patch extend the period of the rcu_read_lock until after the permissions checks are done. We also take a refcount so that the task reference is stable when calling security check functions and performing cpuset node validation (which takes a mutex). The refcount is dropped before actual page migration occurs so there is no change to the refcounts held during page migration. Also move the determination of the mm of the task struct to immediately before the do_migrate*() calls so that it is clear that we switch from handling the task during permission checks to the mm for the actual migration. Since the determination is only done once and we then no longer use the task_struct we can be sure that we operate on a specific address space that will not change from under us. [akpm@linux-foundation.org: checkpatch fixes] Signed-off-by: Christoph Lameter <cl@linux.com> Cc: "Eric W. Biederman" <ebiederm@xmission.com> Reported-by: Dave Hansen <dave@linux.vnet.ibm.com> Cc: Mel Gorman <mel@csn.ul.ie> Cc: Johannes Weiner <hannes@cmpxchg.org> Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com> Cc: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com> Cc: Hugh Dickins <hughd@google.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>		2012-03-21 17:54:58 -07:00
..
backing-dev.c	backing-dev: fix wakeup timer races with bdi_unregister()	2012-02-01 16:52:49 +08:00
bootmem.c	mm: bootmem: try harder to free pages in bulk	2012-01-10 16:30:45 -08:00
bounce.c	mm: remove the second argument of k[un]map_atomic()	2012-03-20 21:48:27 +08:00
cleancache.c	mm: cleancache core ops functions and config	2011-05-26 10:01:36 -06:00
compaction.c	mm: compaction: make compact_control order signed	2012-03-21 17:54:56 -07:00
debug-pagealloc.c	mm, x86: Remove debug_pagealloc_enabled	2011-12-06 09:24:07 +01:00
dmapool.c	mm: fix implicit stat.h usage in dmapool.c	2011-10-31 09:20:12 -04:00
fadvise.c	fadvise: only initiate writeback for specified range with FADV_DONTNEED	2012-01-10 16:30:43 -08:00
failslab.c	switch debugfs to umode_t	2012-01-03 22:54:56 -05:00
filemap_xip.c	mm/filemap_xip.c: fix race condition in xip_file_fault()	2012-02-03 16:16:41 -08:00
filemap.c	mm: remove the second argument of k[un]map_atomic()	2012-03-20 21:48:27 +08:00
fremap.c	mm: delete various needless include <linux/module.h>	2011-10-31 09:20:11 -04:00
highmem.c	Merge branch 'modsplit-Oct31_2011' of git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux	2011-11-06 19:44:47 -08:00
huge_memory.c	thp: optimize away unnecessary page table locking	2012-03-21 17:54:57 -07:00
hugetlb.c	mm: hugetlb: bail out unmapping after serving reference page	2012-03-21 17:54:57 -07:00
hwpoison-inject.c	Fix common misspellings	2011-03-31 11:26:23 -03:00
init-mm.c	atomic: use <linux/atomic.h>	2011-07-26 16:49:47 -07:00
internal.h	mm: thp: tail page refcounting fix	2011-11-02 16:06:57 -07:00
Kconfig	Merge branch 'master' into x86/memblock	2011-11-28 09:46:22 -08:00
Kconfig.debug	mm: more intensive memory corruption debugging	2012-01-10 16:30:42 -08:00
kmemcheck.c
kmemleak-test.c	kmemleak: remove memset by using kzalloc	2011-01-27 18:31:51 +00:00
kmemleak.c	kmemleak: Disable early logging when kmemleak is off by default	2012-01-20 16:57:05 +00:00
ksm.c	mm: remove the second argument of k[un]map_atomic()	2012-03-20 21:48:27 +08:00
maccess.c	mm: Map most files to use export.h instead of module.h	2011-10-31 09:20:12 -04:00
madvise.c	fs: kill i_alloc_sem	2011-07-20 20:47:46 -04:00
Makefile	Cross Memory Attach	2011-10-31 17:30:44 -07:00
memblock.c	memblock: Fix size aligning of memblock_alloc_base_nid()	2012-03-01 10:53:18 +01:00
memcontrol.c	mm: thp: fix pmd_bad() triggering in code paths holding mmap_sem read mode	2012-03-21 17:54:54 -07:00
memory_hotplug.c	mm: compaction: introduce sync-light migration for use by compaction	2012-01-12 20:13:09 -08:00
memory-failure.c	thp: allow a hwpoisoned head page to be put back to LRU	2012-03-21 17:54:58 -07:00
memory.c	mm: make get_mm_counter static-inline	2012-03-21 17:54:55 -07:00
mempolicy.c	mm: fix move/migrate_pages() race on task struct	2012-03-21 17:54:58 -07:00
mempool.c	mempool: fix first round failure behavior	2012-01-10 16:30:45 -08:00
migrate.c	mm: fix move/migrate_pages() race on task struct	2012-03-21 17:54:58 -07:00
mincore.c	mm: thp: fix pmd_bad() triggering in code paths holding mmap_sem read mode	2012-03-21 17:54:54 -07:00
mlock.c	vm: avoid using find_vma_prev() unnecessarily	2012-03-06 18:23:36 -08:00
mm_init.c	mm: Map most files to use export.h instead of module.h	2011-10-31 09:20:12 -04:00
mmap.c	mm: search from free_area_cache for the bigger size	2012-03-21 17:54:56 -07:00
mmu_context.c	mm: Map most files to use export.h instead of module.h	2011-10-31 09:20:12 -04:00
mmu_notifier.c	mm: Map most files to use export.h instead of module.h	2011-10-31 09:20:12 -04:00
mmzone.c	mm: delete various needless include <linux/module.h>	2011-10-31 09:20:11 -04:00
mprotect.c	mm: replace PAGE_MIGRATION with IS_ENABLED(CONFIG_MIGRATION)	2012-03-21 17:54:57 -07:00
mremap.c	mremap: enforce rmap src/dst vma ordering in case of vma_merge() succeeding in copy_vma()	2012-01-10 16:30:44 -08:00
msync.c
nobootmem.c	Merge branch 'master' into x86/memblock	2011-11-28 09:46:22 -08:00
nommu.c	NOMMU: Don't need to clear vm_mm when deleting a VMA	2012-02-24 08:59:04 -08:00
oom_kill.c	mm, oom: force oom kill on sysrq+f	2012-03-21 17:54:58 -07:00
page_alloc.c	mm, oom: force oom kill on sysrq+f	2012-03-21 17:54:58 -07:00
page_cgroup.c	page_cgroup: fix horrid swap accounting regression	2012-03-06 08:18:23 -08:00
page_io.c	block: kill off REQ_UNPLUG	2011-03-10 08:52:27 +01:00
page_isolation.c
page-writeback.c	Merge branch 'writeback-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/wfg/linux	2012-01-10 16:59:59 -08:00
pagewalk.c	mm: thp: fix pmd_bad() triggering in code paths holding mmap_sem read mode	2012-03-21 17:54:54 -07:00
percpu-km.c
percpu-vm.c	percpu: use bitmap_clear	2012-01-20 09:23:16 -08:00
percpu.c	Kmemleak patches	2012-01-14 18:11:11 -08:00
pgtable-generic.c
prio_tree.c	sanitize <linux/prefetch.h> usage	2011-05-20 12:50:29 -07:00
process_vm_access.c	Fix race in process_vm_rw_core	2012-02-02 12:55:17 -08:00
quicklist.c	mm: delete various needless include <linux/module.h>	2011-10-31 09:20:11 -04:00
readahead.c	mm: Map most files to use export.h instead of module.h	2011-10-31 09:20:12 -04:00
rmap.c	rmap: anon_vma_prepare: Reduce code duplication by calling anon_vma_chain_link	2012-03-21 17:54:57 -07:00
shmem.c	tmpfs: security xattr setting on inode creation	2012-03-21 17:54:58 -07:00
slab.c	Merge branch 'slab/for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/penberg/linux	2012-01-11 18:52:23 -08:00
slob.c	mm: Map most files to use export.h instead of module.h	2011-10-31 09:20:12 -04:00
slub.c	mm,x86,um: move CMPXCHG_DOUBLE config option	2012-01-12 20:13:03 -08:00
sparse-vmemmap.c	mm: delete various needless include <linux/module.h>	2011-10-31 09:20:11 -04:00
sparse.c	mm: Map most files to use export.h instead of module.h	2011-10-31 09:20:12 -04:00
swap_state.c	mm: make swapin readahead skip over holes	2012-03-21 17:54:56 -07:00
swap.c	memcg: fix GPF when cgroup removal races with last exit	2012-03-05 15:49:43 -08:00
swapfile.c	mm: make swapin readahead skip over holes	2012-03-21 17:54:56 -07:00
thrash.c	mm/thrash.c: quiet sparse noise	2011-10-31 17:30:50 -07:00
truncate.c	mm: fix comment typo of truncate_inode_pages_range	2012-02-23 11:52:19 +01:00
util.c	procfs: mark thread stack correctly in proc/<pid>/maps	2012-03-21 17:54:58 -07:00
vmalloc.c	mm: remove the second argument of k[un]map_atomic()	2012-03-20 21:48:27 +08:00
vmscan.c	vmscan: handle isolated pages with lru lock released	2012-03-21 17:54:57 -07:00
vmstat.c	mm,x86,um: move CMPXCHG_LOCAL config option	2012-01-12 20:13:03 -08:00