From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S966106Ab2C3VcT (ORCPT ); Fri, 30 Mar 2012 17:32:19 -0400 Received: from out1-smtp.messagingengine.com ([66.111.4.25]:44941 "EHLO out1-smtp.messagingengine.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S936191Ab2C3VcM (ORCPT ); Fri, 30 Mar 2012 17:32:12 -0400 X-Sasl-enc: bMiCkB3sX4v3bKhGP4hOyqPbwEoefJodlswu9cObXHIk 1333143131 X-Mailbox-Line: From gregkh@linuxfoundation.org Fri Mar 30 12:48:57 2012 Message-Id: <20120330194857.344159667@linuxfoundation.org> User-Agent: quilt/0.60-19.1 Date: Fri, 30 Mar 2012 12:51:00 -0700 From: Greg KH To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: torvalds@linux-foundation.org, akpm@linux-foundation.org, alan@lxorguk.ukuu.org.uk, Sasha Levin , Eric Dumazet , Christoph Lameter , Pekka Enberg Subject: [ 155/175] slub: Do not hold slub_lock when calling sysfs_slab_add() In-Reply-To: <20120330195801.GA31806@kroah.com> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 3.3-stable review patch. If anyone has any objections, please let me know. ------------------ From: Christoph Lameter commit 66c4c35c6bc5a1a452b024cf0364635b28fd94e4 upstream. sysfs_slab_add() calls various sysfs functions that actually may end up in userspace doing all sorts of things. Release the slub_lock after adding the kmem_cache structure to the list. At that point the address of the kmem_cache is not known so we are guaranteed exlusive access to the following modifications to the kmem_cache structure. If the sysfs_slab_add fails then reacquire the slub_lock to remove the kmem_cache structure from the list. Reported-by: Sasha Levin Acked-by: Eric Dumazet Signed-off-by: Christoph Lameter Signed-off-by: Pekka Enberg Signed-off-by: Greg Kroah-Hartman --- mm/slub.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/mm/slub.c +++ b/mm/slub.c @@ -3929,13 +3929,14 @@ struct kmem_cache *kmem_cache_create(con if (kmem_cache_open(s, n, size, align, flags, ctor)) { list_add(&s->list, &slab_caches); + up_write(&slub_lock); if (sysfs_slab_add(s)) { + down_write(&slub_lock); list_del(&s->list); kfree(n); kfree(s); goto err; } - up_write(&slub_lock); return s; } kfree(n);