1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2025-01-22 16:06:04 -05:00
linux/mm
Vinayak Menon 914b6dfff7 mm/kmemleak.c: wait for scan completion before disabling free
A crash is observed when kmemleak_scan accesses the object->pointer,
likely due to the following race.

  TASK A             TASK B                     TASK C
  kmemleak_write
   (with "scan" and
   NOT "scan=on")
  kmemleak_scan()
                     create_object
                     kmem_cache_alloc fails
                     kmemleak_disable
                     kmemleak_do_cleanup
                     kmemleak_free_enabled = 0
                                                kfree
                                                kmemleak_free bails out
                                                 (kmemleak_free_enabled is 0)
                                                slub frees object->pointer
  update_checksum
  crash - object->pointer
   freed (DEBUG_PAGEALLOC)

kmemleak_do_cleanup waits for the scan thread to complete, but not for
direct call to kmemleak_scan via kmemleak_write.  So add a wait for
kmemleak_scan completion before disabling kmemleak_free, and while at it
fix the comment on stop_scan_thread.

[vinmenon@codeaurora.org: fix stop_scan_thread comment]
  Link: http://lkml.kernel.org/r/1522219972-22809-1-git-send-email-vinmenon@codeaurora.org
Link: http://lkml.kernel.org/r/1522063429-18992-1-git-send-email-vinmenon@codeaurora.org
Signed-off-by: Vinayak Menon <vinmenon@codeaurora.org>
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2018-03-28 13:42:05 -10:00
..
kasan
backing-dev.c
balloon_compaction.c
bootmem.c
cleancache.c
cma.c
cma.h
cma_debug.c
compaction.c
debug.c
debug_page_ref.c
dmapool.c
early_ioremap.c
fadvise.c
failslab.c
filemap.c
frame_vector.c
frontswap.c
gup.c
gup_benchmark.c
highmem.c
hmm.c
huge_memory.c mm, thp: do not cause memcg oom for thp 2018-03-22 17:07:02 -07:00
hugetlb.c hugetlbfs: check for pgoff value overflow 2018-03-22 17:07:01 -07:00
hugetlb_cgroup.c
hwpoison-inject.c
init-mm.c
internal.h
interval_tree.c
Kconfig
Kconfig.debug
khugepaged.c mm, thp: do not cause memcg oom for thp 2018-03-22 17:07:02 -07:00
kmemleak-test.c
kmemleak.c mm/kmemleak.c: wait for scan completion before disabling free 2018-03-28 13:42:05 -10:00
ksm.c
list_lru.c
maccess.c
madvise.c
Makefile
memblock.c Revert "mm: page_alloc: skip over regions of invalid pfns where possible" 2018-03-22 17:07:01 -07:00
memcontrol.c mm/memcontrol.c: fix parameter description mismatch 2018-03-28 13:42:05 -10:00
memory-failure.c
memory.c
memory_hotplug.c
mempolicy.c mm/mempolicy.c: avoid use uninitialized preferred_node 2018-03-22 17:07:01 -07:00
mempool.c
memtest.c
migrate.c
mincore.c
mlock.c
mm_init.c
mmap.c
mmu_context.c
mmu_notifier.c
mmzone.c
mprotect.c
mremap.c
msync.c
nobootmem.c
nommu.c
oom_kill.c
page-writeback.c
page_alloc.c Revert "mm: page_alloc: skip over regions of invalid pfns where possible" 2018-03-22 17:07:01 -07:00
page_counter.c
page_ext.c
page_idle.c
page_io.c
page_isolation.c
page_owner.c mm/page_owner: fix recursion bug after changing skip entries 2018-03-28 13:42:05 -10:00
page_poison.c
page_vma_mapped.c
pagewalk.c
percpu-internal.h
percpu-km.c
percpu-stats.c
percpu-vm.c
percpu.c mm: Allow to kill tasks doing pcpu_alloc() and waiting for pcpu_balance_workfn() 2018-03-19 09:38:50 -07:00
pgtable-generic.c
process_vm_access.c
quicklist.c
readahead.c
rmap.c
rodata_test.c
shmem.c mm/shmem: do not wait for lock_page() in shmem_unused_huge_shrink() 2018-03-22 17:07:01 -07:00
slab.c mm, slab: memcg_link the SLAB's kmem_cache 2018-03-28 13:42:05 -10:00
slab.h
slab_common.c
slob.c
slub.c
sparse-vmemmap.c
sparse.c
swap.c
swap_cgroup.c
swap_slots.c
swap_state.c
swapfile.c
truncate.c
usercopy.c
userfaultfd.c
util.c
vmacache.c
vmalloc.c
vmpressure.c
vmscan.c mm/vmscan: wake up flushers for legacy cgroups too 2018-03-22 17:07:01 -07:00
vmstat.c mm/vmstat.c: fix vmstat_update() preemption BUG 2018-03-28 13:42:05 -10:00
workingset.c
z3fold.c
zbud.c
zpool.c
zsmalloc.c
zswap.c