linux/kernel
Paul Jackson 2efe86b809 [PATCH] cpuset exit NULL dereference fix
There is a race in the kernel cpuset code, between the code
to handle notify_on_release, and the code to remove a cpuset.
The notify_on_release code can end up trying to access a
cpuset that has been removed.  In the most common case, this
causes a NULL pointer dereference from the routine cpuset_path.
However all manner of bad things are possible, in theory at least.

The existing code decrements the cpuset use count, and if the
count goes to zero, processes the notify_on_release request,
if appropriate.  However, once the count goes to zero, unless we
are holding the global cpuset_sem semaphore, there is nothing to
stop another task from immediately removing the cpuset entirely,
and recycling its memory.

The obvious fix would be to always hold the cpuset_sem
semaphore while decrementing the use count and dealing with
notify_on_release.  However we don't want to force a global
semaphore into the mainline task exit path, as that might create
a scaling problem.

The actual fix is almost as easy - since this is only an issue
for cpusets using notify_on_release, which the top level big
cpusets don't normally need to use, only take the cpuset_sem
for cpusets using notify_on_release.

This code has been run for hours without a hiccup, while running
a cpuset create/destroy stress test that could crash the existing
kernel in seconds.  This patch applies to the current -linus
git kernel.

Signed-off-by: Paul Jackson <pj@sgi.com>
Acked-by: Simon Derr <simon.derr@bull.net>
Acked-by: Dinakar Guniguntala <dino@in.ibm.com>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2005-05-27 08:07:26 -07:00
..
irq [PATCH] spurious interrupt fix 2005-05-17 07:59:18 -07:00
power [PATCH] Driver Core: pm diagnostics update, check for errors 2005-05-17 14:54:54 -07:00
acct.c Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
audit.c Merge with master.kernel.org:/pub/scm/linux/kernel/git/torvalds/linux-2.6.git 2005-05-05 13:59:37 +01:00
auditsc.c [AUDIT] LOGIN message credentials 2005-04-29 17:30:07 +01:00
capability.c Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
compat.c [PATCH] Fix get_compat_sigevent() 2005-04-16 15:24:01 -07:00
configs.c Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
cpu.c Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
cpuset.c [PATCH] cpuset exit NULL dereference fix 2005-05-27 08:07:26 -07:00
dma.c Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
exec_domain.c Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
exit.c [patch] MCA recovery module undefined symbol fix 2005-05-03 13:58:17 -07:00
extable.c Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
fork.c Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
futex.c [PATCH] convert that currently tests _NSIG directly to use valid_signal() 2005-05-01 08:59:14 -07:00
intermodule.c Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
itimer.c [PATCH] setitimer timer expires too early 2005-05-05 16:36:41 -07:00
kallsyms.c [PATCH] ppc32: platform-specific functions missing from kallsyms. 2005-05-05 16:36:31 -07:00
kfifo.c Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
kmod.c Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
kprobes.c [PATCH] kprobes: Allow multiple kprobes at the same address 2005-05-05 16:36:39 -07:00
ksysfs.c Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
kthread.c [PATCH] use smp_mb/wmb/rmb where possible 2005-05-01 08:58:47 -07:00
Makefile [PATCH] ppc64: remove hidden -fno-omit-frame-pointer for schedule.c 2005-05-05 16:36:32 -07:00
module.c [PATCH] Change synchronize_kernel to _rcu and _sched 2005-05-01 08:59:04 -07:00
panic.c [SPARC]: Stop-A printk cleanup 2005-04-24 20:38:02 -07:00
params.c [PATCH] kernel/param.c: don't use .max when .num is NULL in param_array_set() 2005-04-16 15:25:42 -07:00
pid.c Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
posix-cpu-timers.c Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
posix-timers.c Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
printk.c [PATCH] add_preferred_console() build fix 2005-05-17 07:59:19 -07:00
profile.c [PATCH] profile.c: `schedule' parsing fix 2005-05-17 07:59:21 -07:00
ptrace.c [PATCH] convert that currently tests _NSIG directly to use valid_signal() 2005-05-01 08:59:14 -07:00
rcupdate.c [PATCH] Deprecate synchronize_kernel, GPL replacement 2005-05-01 08:59:04 -07:00
resource.c [PATCH] pci enumeration on ixp2000: overflow in kernel/resource.c 2005-04-16 15:25:58 -07:00
sched.c [PATCH] cpusets+hotplug+preepmt broken 2005-05-20 15:48:19 -07:00
seccomp.c Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
signal.c [PATCH] sigkill priority fix 2005-05-24 20:08:13 -07:00
softirq.c Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
spinlock.c [PATCH] spin_unlock_bh() and preempt_check_resched() 2005-05-21 10:46:48 -07:00
stop_machine.c [PATCH] use smp_mb/wmb/rmb where possible 2005-05-01 08:58:47 -07:00
sys.c [PATCH] correctly name the Shell sort 2005-05-05 16:36:50 -07:00
sys_ni.c [PATCH] consolidate sys_shmat 2005-05-01 08:59:12 -07:00
sysctl.c [PATCH] DocBook: fix some descriptions 2005-05-01 08:59:26 -07:00
time.c [PATCH] time interpolator: Fix settimeofday inaccuracy 2005-04-28 08:13:58 -07:00
timer.c [PATCH] use smp_mb/wmb/rmb where possible 2005-05-01 08:58:47 -07:00
uid16.c Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
user.c Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
wait.c Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
workqueue.c [PATCH] re-export cancel_rearming_delayed_workqueue 2005-04-16 15:23:59 -07:00