* [PATCH 1/3] cpuset: zero malloc - fix for old cpusets
@ 2007-06-09 1:34 Paul Jackson
2007-06-09 1:34 ` [PATCH 2/3] cpuset: zero malloc - revert the old cpuset fix Paul Jackson
2007-06-09 1:34 ` [PATCH 3/3] cpuset: zero malloc - fix for new containers Paul Jackson
0 siblings, 2 replies; 3+ messages in thread
From: Paul Jackson @ 2007-06-09 1:34 UTC (permalink / raw)
To: Andrew Morton
Cc: Herbert Poetzl, Serge E. Hallyn, Paul Menage, linux-kernel,
Balbir Singh, Eric W. Biederman, Srivatsa Vaddagiri,
Kirill Korotaev, Paul Jackson, Dave Hansen
From: Paul Jackson <pj@sgi.com>
First of three -- this one goes before the container patches,
and should be sent to Linus for 2.6.22.
The cpuset code to present a list of tasks using a cpuset to
user space could write to an array that it had kmalloc'd,
after a kmalloc request of zero size.
The problem was that the code didn't check for writes past
the allocated end of the array until -after- the first write.
This is a race condition that is likely rare -- it would only
show up if a cpuset went from being empty to having a task
in it, during the brief time between the allocation and the
first write.
Prior to roughly 2.6.22 kernels, this was also a benign
problem, because a zero kmalloc returned a few usable bytes
anyway, and no harm was done with the bogus write.
With the 2.6.22 kernel changes to make issue a warning if
code tries to write to the location returned from a zero
size allocation, this problem is no longer benign. This
cpuset code would occassionally trigger that warning.
The fix is trivial -- check before storing into the array,
not after, whether the array is big enough to hold the store.
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: "Serge E. Hallyn" <serue@us.ibm.com>
Cc: Balbir Singh <balbir@in.ibm.com>
Cc: Dave Hansen <haveblue@us.ibm.com>
Cc: Herbert Poetzl <herbert@13thfloor.at>
Cc: Kirill Korotaev <dev@openvz.org>
Cc: Paul Menage <menage@google.com>
Cc: Srivatsa Vaddagiri <vatsa@in.ibm.com>
Cc: Christoph Lameter <clameter@sgi.com>
Signed-off-by: Paul Jackson <pj@sgi.com>
---
Andrew - this fix collides with the container changes, and now
that you have sent Christoph's patch to Linus to warn on writes
to zero-sized allocations, this fix should go to Linus too.
So it comes in three parts: fix the old, undo that, fix the new.
This patch should be applied first, before the container patches,
and sent to Linus for 2.6.22.
kernel/cpuset.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- 2.6.22-rc4-mm2.orig/kernel/cpuset.c 2007-06-08 14:44:58.899036450 -0700
+++ 2.6.22-rc4-mm2/kernel/cpuset.c 2007-06-08 14:47:00.996907442 -0700
@@ -1620,9 +1620,9 @@ static int pid_array_load(pid_t *pidarra
do_each_thread(g, p) {
if (p->cpuset == cs) {
- pidarray[n++] = p->pid;
if (unlikely(n == npids))
goto array_full;
+ pidarray[n++] = p->pid;
}
} while_each_thread(g, p);
--
I won't rest till it's the best ...
Programmer, Linux Scalability
Paul Jackson <pj@sgi.com> 1.650.933.1373
^ permalink raw reply [flat|nested] 3+ messages in thread
* [PATCH 2/3] cpuset: zero malloc - revert the old cpuset fix
2007-06-09 1:34 [PATCH 1/3] cpuset: zero malloc - fix for old cpusets Paul Jackson
@ 2007-06-09 1:34 ` Paul Jackson
2007-06-09 1:34 ` [PATCH 3/3] cpuset: zero malloc - fix for new containers Paul Jackson
1 sibling, 0 replies; 3+ messages in thread
From: Paul Jackson @ 2007-06-09 1:34 UTC (permalink / raw)
To: Andrew Morton
Cc: Eric W. Biederman, Serge E. Hallyn, Dave Hansen, Paul Menage,
linux-kernel, Kirill Korotaev, Herbert Poetzl,
Srivatsa Vaddagiri, Paul Jackson, Balbir Singh
From: Paul Jackson <pj@sgi.com>
Second of three -- This one undoes the first one. Apply before
the container patch that changes cpusets to use containers,
in order to avoid a patch conflict.
The cpuset code to present a list of tasks using a cpuset to
user space could write to an array that it had kmalloc'd,
after a kmalloc request of zero size.
The problem was that the code didn't check for writes past
the allocated end of the array until -after- the first write.
This is a race condition that is likely rare -- it would only
show up if a cpuset went from being empty to having a task
in it, during the brief time between the allocation and the
first write.
Prior to roughly 2.6.22 kernels, this was also a benign
problem, because a zero kmalloc returned a few usable bytes
anyway, and no harm was done with the bogus write.
With the 2.6.22 kernel changes to make issue a warning if
code tries to write to the location returned from a zero
size allocation, this problem is no longer benign. This
cpuset code would occassionally trigger that warning.
The fix is trivial -- check before storing into the array,
not after, whether the array is big enough to hold the store.
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: "Serge E. Hallyn" <serue@us.ibm.com>
Cc: Balbir Singh <balbir@in.ibm.com>
Cc: Dave Hansen <haveblue@us.ibm.com>
Cc: Herbert Poetzl <herbert@13thfloor.at>
Cc: Kirill Korotaev <dev@openvz.org>
Cc: Paul Menage <menage@google.com>
Cc: Srivatsa Vaddagiri <vatsa@in.ibm.com>
Cc: Christoph Lameter <clameter@sgi.com>
Signed-off-by: Paul Jackson <pj@sgi.com>
---
Andrew,
This is the second of three in the set - it reverses the
first one, to avoid colliding with the container patches.
Apply somewhere before, or entirely merge into:
containersv10-share-css_group-arrays-between-tasks-with-same-container-memberships.patch
kernel/cpuset.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- 2.6.22-rc4-mm2.orig/kernel/cpuset.c 2007-06-08 14:57:59.091074320 -0700
+++ 2.6.22-rc4-mm2/kernel/cpuset.c 2007-06-08 15:34:24.336172342 -0700
@@ -1620,9 +1620,9 @@ static int pid_array_load(pid_t *pidarra
do_each_thread(g, p) {
if (p->cpuset == cs) {
+ pidarray[n++] = p->pid;
if (unlikely(n == npids))
goto array_full;
- pidarray[n++] = p->pid;
}
} while_each_thread(g, p);
--
I won't rest till it's the best ...
Programmer, Linux Scalability
Paul Jackson <pj@sgi.com> 1.650.933.1373
^ permalink raw reply [flat|nested] 3+ messages in thread
* [PATCH 3/3] cpuset: zero malloc - fix for new containers
2007-06-09 1:34 [PATCH 1/3] cpuset: zero malloc - fix for old cpusets Paul Jackson
2007-06-09 1:34 ` [PATCH 2/3] cpuset: zero malloc - revert the old cpuset fix Paul Jackson
@ 2007-06-09 1:34 ` Paul Jackson
1 sibling, 0 replies; 3+ messages in thread
From: Paul Jackson @ 2007-06-09 1:34 UTC (permalink / raw)
To: Andrew Morton
Cc: Herbert Poetzl, Serge E. Hallyn, Balbir Singh, Paul Menage,
Kirill Korotaev, linux-kernel, Eric W. Biederman,
Srivatsa Vaddagiri, Paul Jackson, Dave Hansen
From: Paul Jackson <pj@sgi.com>
Third of three -- This applies after the container patches,
fixing a problem that earlier patches also fixed in the older
cpuset code.
The container code to present a list of tasks using a container
to user space could write to an array that it had kmalloc'd,
after a kmalloc request of zero size.
The problem was that the code didn't check for writes past the
allocated end of the array until -after- the first write.
This is a race condition that is likely rare -- it would only show
up if a container went from being empty to having a task in it,
during the brief time between the allocation and the first write.
Prior to roughly 2.6.22 kernels, this was also a benign problem,
because a zero kmalloc returned a few usable bytes anyway,
and no harm was done with the bogus write.
With the 2.6.22 kernel changes to make issue a warning if
code tries to write to the location returned from a zero size
allocation, this problem is no longer benign. This container code
would occassionally trigger that warning.
The fix is trivial -- check before storing into the array,
not after, whether the array is big enough to hold the store.
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: "Serge E. Hallyn" <serue@us.ibm.com>
Cc: Balbir Singh <balbir@in.ibm.com>
Cc: Dave Hansen <haveblue@us.ibm.com>
Cc: Herbert Poetzl <herbert@13thfloor.at>
Cc: Kirill Korotaev <dev@openvz.org>
Cc: Paul Menage <menage@google.com>
Cc: Srivatsa Vaddagiri <vatsa@in.ibm.com>
Cc: Christoph Lameter <clameter@sgi.com>
Signed-off-by: Paul Jackson <pj@sgi.com>
---
Andrew - this is the third of three similar patches. This one
redoes the fix for the container code.
Please apply somewhere after:
containersv10-share-css_group-arrays-between-tasks-with-same-container-memberships.patch
kernel/container.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- 2.6.22-rc4-mm2.orig/kernel/container.c 2007-06-08 15:36:14.997835546 -0700
+++ 2.6.22-rc4-mm2/kernel/container.c 2007-06-08 15:37:09.606655972 -0700
@@ -1451,9 +1451,9 @@ static int pid_array_load(pid_t *pidarra
struct task_struct *tsk;
container_iter_start(cont, &it);
while ((tsk = container_iter_next(cont, &it))) {
- pidarray[n++] = pid_nr(task_pid(tsk));
if (unlikely(n == npids))
break;
+ pidarray[n++] = pid_nr(task_pid(tsk));
}
container_iter_end(cont, &it);
return n;
--
I won't rest till it's the best ...
Programmer, Linux Scalability
Paul Jackson <pj@sgi.com> 1.650.933.1373
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2007-06-09 1:35 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2007-06-09 1:34 [PATCH 1/3] cpuset: zero malloc - fix for old cpusets Paul Jackson
2007-06-09 1:34 ` [PATCH 2/3] cpuset: zero malloc - revert the old cpuset fix Paul Jackson
2007-06-09 1:34 ` [PATCH 3/3] cpuset: zero malloc - fix for new containers Paul Jackson
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).