Johannes Weiner 89dc991f0f mm: memcontrol: fix lockless reclaim hierarchy iterator ... The lockless reclaim hierarchy iterator currently has a misplaced barrier that can lead to use-after-free crashes. The reclaim hierarchy iterator consist of a sequence count and a position pointer that are read and written locklessly, with memory barriers enforcing ordering. The write side sets the position pointer first, then updates the sequence count to "publish" the new position. Likewise, the read side must read the sequence count first, then the position. If the sequence count is up to date, it's guaranteed that the position is up to date as well: writer: reader: iter->position = position if iter->sequence == expected: smp_wmb() smp_rmb() iter->sequence = sequence position = iter->position However, the read side barrier is currently misplaced, which can lead to dereferencing stale position pointers that no longer point to valid memory. Fix this. Signed-off-by: Johannes Weiner <hannes@cmpxchg.org> Reported-by: Tejun Heo <tj@kernel.org> Reviewed-by: Tejun Heo <tj@kernel.org> Acked-by: Michal Hocko <mhocko@suse.cz> Cc: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com> Cc: Glauber Costa <glommer@parallels.com> Cc: <stable@kernel.org> [3.10+] Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>		2013-06-12 16:29:46 -07:00
..
Kconfig	mmKconfig: add an option to disable bounce	2013-04-29 15:54:40 -07:00
Kconfig.debug	…
Makefile	memcg: add memory.pressure_level events	2013-04-29 15:54:38 -07:00
backing-dev.c	writeback: expose the bdi_wq workqueue	2013-04-01 19:08:06 -07:00
balloon_compaction.c	…
bootmem.c	mm: Add alloc_bootmem_low_pages_nopanic()	2013-01-29 19:32:59 -08:00
bounce.c	Merge branch 'for-3.10/core' of git://git.kernel.dk/linux-block	2013-05-08 10:13:35 -07:00
cleancache.c	mm: cleancache: clean up cleancache_enabled	2013-04-30 17:04:01 -07:00
compaction.c	mm: add & use zone_end_pfn() and zone_spans_pfn()	2013-02-23 17:50:20 -08:00
debug-pagealloc.c	…
dmapool.c	…
fadvise.c	teach SYSCALL_DEFINE<n> how to deal with long long/unsigned long long	2013-03-03 22:46:22 -05:00
failslab.c	…
filemap.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2013-05-01 17:51:54 -07:00
filemap_xip.c	lift sb_start_write() out of ->write()	2013-04-09 14:12:56 -04:00
fremap.c	Revert "mm: introduce VM_POPULATE flag to better deal with racy userspace programs"	2013-03-28 17:45:51 -07:00
frontswap.c	frontswap: fix incorrect zeroing and allocation size for frontswap_map	2013-06-12 16:29:46 -07:00
highmem.c	Some nice cleanups, and even a patch my wife did as a "live" demo for	2012-12-20 08:37:05 -08:00
huge_memory.c	mm/THP: use pmd_populate() to update the pmd with pgtable_t pointer	2013-05-24 16:22:51 -07:00
hugetlb.c	mm: migration: add migrate_entry_wait_huge()	2013-06-12 16:29:46 -07:00
hugetlb_cgroup.c	mm/hugetlb: create hugetlb cgroup file in hugetlb_init	2012-12-18 15:02:15 -08:00
hwpoison-inject.c	…
init-mm.c	…
internal.h	mm: accelerate munlock() treatment of THP pages	2013-02-27 19:10:09 -08:00
interval_tree.c	…
kmemcheck.c	…
kmemleak-test.c	…
kmemleak.c	hlist: drop the node parameter from iterators	2013-02-27 19:10:24 -08:00
ksm.c	ksm: fix m68k build: only NUMA needs pfn_to_nid	2013-03-08 15:05:34 -08:00
maccess.c	…
madvise.c	mm: madvise: complete input validation before taking lock	2013-04-29 15:54:37 -07:00
memblock.c	memblock: fix missing comment of memblock_insert_region()	2013-04-29 15:54:38 -07:00
memcontrol.c	mm: memcontrol: fix lockless reclaim hierarchy iterator	2013-06-12 16:29:46 -07:00
memory-failure.c	HWPOISON: check dirty flag to match against clean page	2013-04-29 15:54:28 -07:00
memory.c	arch, mm: Remove tlb_fast_mode()	2013-06-06 10:07:26 +09:00
memory_hotplug.c	mm/memory_hotplug.c: fix printk format warnings	2013-05-24 16:22:52 -07:00
mempolicy.c	mm/mempolicy.c: fix sp_node_init() argument ordering	2013-03-08 15:05:34 -08:00
mempool.c	…
migrate.c	mm: migration: add migrate_entry_wait_huge()	2013-06-12 16:29:46 -07:00
mincore.c	swap: make each swap partition have one address_space	2013-02-23 17:50:17 -08:00
mlock.c	Revert "mm: introduce VM_POPULATE flag to better deal with racy userspace programs"	2013-03-28 17:45:51 -07:00
mm_init.c	mm: init: report on last-nid information stored in page->flags	2013-02-23 17:50:18 -08:00
mmap.c	shm: fix null pointer deref when userspace specifies invalid hugepage size	2013-05-09 14:22:47 -07:00
mmu_context.c	mm: remove old aio use_mm() comment	2013-05-07 18:38:27 -07:00
mmu_notifier.c	mm: mmu_notifier: re-fix freed page still mapped in secondary MMU	2013-05-24 16:22:51 -07:00
mmzone.c	mm: rename page struct field helpers	2013-02-23 17:50:18 -08:00
mprotect.c	mm/mprotect.c: coding-style cleanups	2012-12-18 15:02:15 -08:00
mremap.c	mm/rmap: rename anon_vma_unlock() => anon_vma_unlock_write()	2013-02-23 17:50:17 -08:00
msync.c	…
nobootmem.c	mm, nobootmem: do memset() after memblock_reserve()	2013-04-29 15:54:39 -07:00
nommu.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/signal	2013-05-01 07:21:43 -07:00
oom_kill.c	memcg, oom: provide more precise dump info while memcg oom happening	2013-02-23 17:50:08 -08:00
page-writeback.c	mm: make snapshotting pages for stable writes a per-bio operation	2013-04-29 15:54:33 -07:00
page_alloc.c	mm/page_alloc.c: fix watermark check in __zone_watermark_ok()	2013-06-12 16:29:46 -07:00
page_cgroup.c	…
page_io.c	Merge branch 'for-3.10/core' of git://git.kernel.dk/linux-block	2013-05-08 10:13:35 -07:00
page_isolation.c	mm: fix zone_watermark_ok_safe() accounting of isolated pages	2013-01-04 16:11:46 -08:00
pagewalk.c	mm/pagewalk.c: walk_page_range should avoid VM_PFNMAP areas	2013-05-24 16:22:53 -07:00
percpu-km.c	…
percpu-vm.c	…
percpu.c	…
pgtable-generic.c	…
process_vm_access.c	Fix: compat_rw_copy_check_uvector() misuse in aio, readv, writev, and security keys	2013-03-12 11:05:45 -07:00
quicklist.c	…
readahead.c	teach SYSCALL_DEFINE<n> how to deal with long long/unsigned long long	2013-03-03 22:46:22 -05:00
rmap.c	rmap: recompute pgoff for unmapping huge page	2013-04-29 15:54:28 -07:00
shmem.c	aio: don't include aio.h in sched.h	2013-05-07 20:16:25 -07:00
slab.c	Merge branch 'slab/for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/penberg/linux	2013-05-07 08:42:20 -07:00
slab.h	slab: Common definition for kmem_cache_node	2013-02-01 12:32:09 +02:00
slab_common.c	mm/slab: Fix crash during slab init	2013-05-08 15:02:33 -07:00
slob.c	mm: rename page struct field helpers	2013-02-23 17:50:18 -08:00
slub.c	Merge branch 'slab/for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/penberg/linux	2013-05-07 08:42:20 -07:00
sparse-vmemmap.c	sparse-vmemmap: specify vmemmap population range in bytes	2013-04-29 15:54:35 -07:00
sparse.c	mm, hotplug: avoid compiling memory hotremove functions when disabled	2013-04-29 15:54:37 -07:00
swap.c	aio: don't include aio.h in sched.h	2013-05-07 20:16:25 -07:00
swap_state.c	swap: avoid read_swap_cache_async() race to deadlock while waiting on discard I/O completion	2013-06-12 16:29:45 -07:00
swapfile.c	frontswap: fix incorrect zeroing and allocation size for frontswap_map	2013-06-12 16:29:46 -07:00
truncate.c	mm: drop vmtruncate	2012-12-20 18:46:29 -05:00
util.c	swap: make each swap partition have one address_space	2013-02-23 17:50:17 -08:00
vmalloc.c	mm/vmalloc.c: add vfree comment	2013-05-07 18:38:27 -07:00
vmpressure.c	memcg: add memory.pressure_level events	2013-04-29 15:54:38 -07:00
vmscan.c	mm: thp: add split tail pages to shrink page list in page reclaim	2013-04-29 15:54:38 -07:00
vmstat.c	mm/vmstat: add note on safety of drain_zonestat	2013-04-29 15:54:38 -07:00