linux-kernel - [PATCH 2/2] blackfin: use ->mmap_sem to protect mm_context_t->sram

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20100527195633.GC25935@redhat.com>
Date:	Thu, 27 May 2010 21:56:33 +0200
From:	Oleg Nesterov <oleg@...hat.com>
To:	Mike Frysinger <vapier.adi@...il.com>,
	Andrew Morton <akpm@...ux-foundation.org>
Cc:	David Howells <dhowells@...hat.com>,
	Roland McGrath <roland@...hat.com>, linux-sh@...r.kernel.org,
	Paul Mundt <lethal@...ux-sh.org>,
	uclinux-dist-devel@...ckfin.uclinux.org,
	linux-kernel@...r.kernel.org
Subject: [PATCH 2/2] blackfin: use ->mmap_sem to protect
	mm_context_t->sram_list

Any usage of mm->context.sram_list is not safe, is_user_addr_valid()
and sram_free_with_lsl/sram_free_with_lsl can race with each other.

Change sram_free_with_lsl/sram_free_with_lsl to take mm->mmap_sem
for writing, is_user_addr_valid() was already modified to take it
for reading and it doesn't modify this list.

destroy_context() reaps this list lockless, this is OK.

This patch assumes that sram_free() doesn't need to be serialized
(afaics it does the locking correctly), and it is safe to call
sram_free(addr) after its sram_list_struct was removed from list.

Signed-off-by: Oleg Nesterov <oleg@...hat.com>
---

 arch/blackfin/mm/sram-alloc.c |   24 ++++++++++++++++--------
 1 file changed, 16 insertions(+), 8 deletions(-)

--- 34-rc1/arch/blackfin/mm/sram-alloc.c~IUAV_2_SRAM_LIST_LOCKING	2010-05-27 17:51:48.000000000 +0200
+++ 34-rc1/arch/blackfin/mm/sram-alloc.c	2010-05-27 21:31:01.000000000 +0200
@@ -702,19 +702,23 @@ EXPORT_SYMBOL(l2_sram_free);
 
 int sram_free_with_lsl(const void *addr)
 {
-	struct sram_list_struct *lsl, **tmp;
+	struct sram_list_struct *lsl = NULL, **tmp;
 	struct mm_struct *mm = current->mm;
 
+	down_write(&mm->mmap_sem);
 	for (tmp = &mm->context.sram_list; *tmp; tmp = &(*tmp)->next)
-		if ((*tmp)->addr == addr)
-			goto found;
-	return -1;
-found:
-	lsl = *tmp;
+		if ((*tmp)->addr == addr) {
+			lsl = *tmp;
+			*tmp = lsl->next;
+			break;
+		}
+	up_write(&mm->mmap_sem);
+
+	if (!lsl)
+		return -1;
+
 	sram_free(addr);
-	*tmp = lsl->next;
 	kfree(lsl);
-
 	return 0;
 }
 EXPORT_SYMBOL(sram_free_with_lsl);
@@ -749,10 +753,14 @@ void *sram_alloc_with_lsl(size_t size, u
 		kfree(lsl);
 		return NULL;
 	}
+
+	down_write(&mm->mmap_sem);
 	lsl->addr = addr;
 	lsl->length = size;
 	lsl->next = mm->context.sram_list;
 	mm->context.sram_list = lsl;
+	up_write(&mm->mmap_sem);
+
 	return addr;
 }
 EXPORT_SYMBOL(sram_alloc_with_lsl);

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/