Jann Horn
837ffc9723
sched/fair: Don't free p->numa_faults with concurrent readers ...
commit 16d51a590a8ce3befb1308e0e7ab77f3b661af33 upstream.
When going through execve(), zero out the NUMA fault statistics instead of
freeing them.
During execve, the task is reachable through procfs and the scheduler. A
concurrent /proc/*/sched reader can read data from a freed ->numa_faults
allocation (confirmed by KASAN) and write it back to userspace.
I believe that it would also be possible for a use-after-free read to occur
through a race between a NUMA fault and execve(): task_numa_fault() can
lead to task_numa_compare(), which invokes task_weight() on the currently
running task of a different CPU.
Another way to fix this would be to make ->numa_faults RCU-managed or add
extra locking, but it seems easier to wipe the NUMA fault statistics on
execve.
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Petr Mladek <pmladek@suse.com>
Cc: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Will Deacon <will@kernel.org>
Fixes: 82727018b0https://lkml.kernel.org/r/20190716152047.14424-1-jannh@google.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-08-04 09:33:45 +02:00
can: dev: can_get_echo_skb(): factor out non sending code to __can_get_echo_skb()
2018-12-01 09:44:19 +01:00
libceph: wait for latest osdmap in ceph_monc_blacklist_add()
2019-03-27 14:13:02 +09:00
firmware /meson
net/ethernet/freescale/fman: fix cross-build error
2018-08-24 13:12:40 +02:00
iio: ad_sigma_delta: Properly handle SPI bus locking vs CS assertion
2019-05-31 06:48:27 -07:00
mfd: max77620: Fix swapped FPS_PERIOD_MAX_US values
2019-05-21 18:48:58 +02:00
net/mlx4: Fix the check in attaching steering rules
2018-04-13 19:48:19 +02:00
net/mlx5e: Add a lock on tir list
2019-04-17 08:36:45 +02:00
brcmfmac: Add support for bcm43364 wireless chipset
2018-08-03 07:55:22 +02:00
mtd: cfi: cmdset_0001: Do not allow read/write to suspend erase block.
2018-05-01 15:13:07 -07:00
netfilter: ipset: Correct rcu_dereference() call in ip_set_put_comment()
2018-11-27 16:09:39 +01:00
ebtables: arpreply: Add the standard target sanity check
2018-10-13 09:18:58 +02:00
hwmon: (ina2xx) fix sysfs shunt resistor read access
2018-10-03 17:01:52 -07:00
regulator: core: Limit propagation of parent voltage count and list
2018-03-22 09:17:44 +01:00
x86/speculation: Rework SMT state change
2019-05-14 19:19:36 +02:00
sunrpc: use-after-free in svc_process_common()
2019-01-16 22:12:33 +01:00
usb: gadget: composite: fix incorrect handling of OS desc requests
2018-05-25 16:13:04 +02:00
Revert "x86/acpi: Set persistent cpuid <-> nodeid mapping when booting"
2017-12-20 10:07:26 +01:00
arm/arm64: smccc-1.1: Handle function result as parameters
2018-10-03 17:01:54 -07:00
appletalk: Fix compile regression
2019-04-20 09:07:54 +02:00
audit: log 32-bit socketcalls
2017-10-08 10:26:06 +02:00
writeback: synchronize sync(2) against cgroup writeback membership switches
2019-05-21 18:49:01 +02:00
writeback: safer lock nesting
2018-04-24 09:34:18 +02:00
bio: fix improper use of smp_mb__before_atomic()
2019-05-31 06:48:11 -07:00
include/linux/bitops.h: sanitize rotate primitives
2019-06-11 12:22:36 +02:00
include/linux/bitrev.h: fix constant bitrev
2019-04-17 08:36:46 +02:00
locking/atomics, asm-generic: Move some macros from <linux/bitops.h> to a new <linux/bits.h> file
2019-05-14 19:19:34 +02:00
block: Fix transfer when chunk sectors exceeds max
2018-07-03 11:23:18 +02:00
bpf: avoid false sharing of map refcount with max_entries
2018-01-31 12:55:57 +01:00
bpf: Prevent memory disambiguation attack
2018-12-08 13:05:10 +01:00
mm: avoid returning VM_FAULT_RETRY from ->page_mkwrite handlers
2017-12-09 22:01:54 +01:00
drivers: base: cacheinfo: fix x86 with CONFIG_OF enabled
2018-01-31 12:55:51 +01:00
crypto: ccp - Fix XTS-AES-128 support on v5 CCPs
2017-09-27 14:39:20 +02:00
net: use skb_to_full_sk() in skb_update_prio()
2018-03-31 18:11:33 +02:00
cgroup: Use css_tryget() instead of css_tryget_online() in task_get_css()
2019-06-22 08:17:19 +02:00
clocksource: Use GENMASK_ULL in definition of CLOCKSOURCE_MASK
2019-02-27 10:07:01 +01:00
signal: Introduce COMPAT_SIGMINSTKSZ for use in compat_sys_sigaltstack
2018-12-21 14:11:29 +01:00
compiler.h: enable builtin overflow checkers and add fallback code
2019-01-31 08:12:35 +01:00
bug.h: work around GCC PR82365 in BUG()
2019-07-10 09:55:44 +02:00
compiler.h: enable builtin overflow checkers and add fallback code
2019-01-31 08:12:35 +01:00
compiler.h: Add read_word_at_a_time() function.
2019-08-04 09:33:32 +02:00
coredump: Ensure proper size of sparse core files
2017-07-05 14:40:26 +02:00
x86/power: Fix 'nosmt' vs hibernation triple fault during resume
2019-06-11 12:22:48 +02:00
cpufreq: Use struct kobj_attribute instead of struct global_attr
2019-03-13 14:04:51 -07:00
clocksource/drivers/exynos_mct: Increase priority over ARM arch timer
2019-08-04 09:33:22 +02:00
cpumask: Make for_each_cpu_wrap() available on UP as well
2018-05-30 07:50:26 +02:00
sched/cpuset/pm: Fix cpuset vs. suspend-resume bugs
2017-10-12 11:51:25 +02:00
access: avoid the RCU grace period for the temporary subjective credentials
2019-08-04 09:33:43 +02:00
evm: Don't deadlock if a crypto algorithm is unavailable
2018-09-26 08:36:37 +02:00
mm: introduce get_user_pages_longterm
2018-02-28 10:18:33 +01:00
do d_instantiate/unlock_new_inode combinations safely
2018-05-30 07:50:16 +02:00
dccp: fix use-after-free in dccp_feat_activate_values
2017-03-22 12:43:33 +01:00
dm: fix to_sector() for 32bit
2019-03-23 13:19:52 +01:00
Add "shutdown" to "struct class".
2017-07-15 12:16:11 +02:00
dma-iommu: Fix compilation when !CONFIG_IOMMU_DMA
2018-08-03 07:55:22 +02:00
scsi: dma-mapping: always provide dma_get_cache_alignment
2017-12-14 09:28:11 +01:00
efi/libstub: Unify command line param parsing
2019-06-11 12:22:45 +02:00
elevator: fix truncation of icq_cache_name
2018-11-10 07:42:48 -08:00
f2fs: sanity check segment count
2017-05-14 14:00:22 +02:00
fs: add a VALID_OPEN_FLAGS
2017-07-12 15:01:02 +02:00
vfs, fdtable: Prevent bounds-check bypass via speculative execution
2018-02-13 12:36:00 +01:00
dma-fence: Introduce drm_fence_set_error() helper
2017-12-09 22:01:56 +01:00
objtool, modules: Discard objtool annotation sections for modules
2018-01-17 09:38:58 +01:00
fs: stream_open - opener for stream-like files so that read and write can run simultaneously without deadlock
2019-06-11 12:22:49 +02:00
fscache: Fix dead object requeue
2017-06-17 06:41:52 +02:00
fscache: Fix the default for fscache_maybe_release_page()
2018-01-10 09:29:52 +01:00
fscrypt: remove broken support for detecting keyring key revocation
2017-03-31 10:31:46 +02:00
mtd: nand: fsl_ifc: Read ECCSTAT0 and ECCSTAT1 registers for IFC 2.0
2018-03-28 18:39:23 +02:00
dentry name snapshots
2017-08-06 18:59:43 -07:00
lib/genalloc.c: make the avail variable an atomic_long_t
2017-12-14 09:28:22 +01:00
block: get rid of blk_integrity_revalidate()
2017-05-14 14:00:22 +02:00
drbd: Avoid Clang warning about pointless switch statment
2019-02-12 19:44:56 +01:00
HID: debug: fix the ring buffer implementation
2019-02-15 08:07:39 +01:00
iio: hid-sensor: Store restore poll and hysteresis on S3
2017-05-25 15:44:41 +02:00
HID: core: move Usage Page concatenation to Main item
2019-05-31 06:48:29 -07:00
mremap: properly flush TLB before releasing the page
2018-10-20 09:51:31 +02:00
hugetlb: use same fault hash key for shared and private mappings
2019-05-31 06:48:12 -07:00
vmbus: fix missing signaling in hv_signal_on_read()
2017-10-27 10:38:08 +02:00
clockevents/drivers/i8253: Add support for PIT shutdown quirk
2018-11-21 09:26:01 +01:00
vlan: Fix reading memory beyond skb->tail in skb_vlan_tagged_multi
2018-04-29 11:32:01 +02:00
module: extend 'rodata=off' boot cmdline parameter to module mappings
2018-04-08 12:12:52 +02:00
EVM: Add support for portable signature format
2018-12-01 09:44:26 +01:00
iommu/vt-d: Fix dev iotlb pfsid use
2018-09-09 20:01:24 +02:00
net: reevalulate autoflowlabel setting after sysctl setting
2018-01-02 20:35:11 +01:00
genirq: Avoid summation loops for /proc/stat
2019-04-05 22:29:12 +02:00
jbd2: fix sphinx kernel-doc build warnings
2018-02-22 15:43:48 +01:00
time: Introduce jiffies64_to_nsecs()
2018-10-10 08:53:18 +02:00
x86: fix build warnign with 32-bit PAE
2018-02-22 15:43:55 +01:00
kasan: add a prototype of task_struct to avoid warning
2019-05-08 07:19:07 +02:00
kbuild: fix asm-offset generation to work with clang
2018-11-23 08:20:35 +01:00
vfs/proc/kcore, x86/mm/kcore: Fix SMAP fault when dumping vsyscall user page
2018-05-30 07:50:26 +02:00
linux/kernel.h: Use parentheses around argument in u64_to_user_ptr()
2019-05-10 17:52:09 +02:00
KEYS: Fix race between updating and finding a negative key
2017-10-27 10:38:11 +02:00
drivers: core: Remove glue dirs from sysfs earlier
2019-02-06 17:33:29 +01:00
x86/kprobes: Verify stack frame on kretprobe
2019-04-27 09:34:44 +02:00
kvm: fix warning for CONFIG_HAVE_KVM_EVENTFD builds
2018-05-30 07:50:30 +02:00
ahci: Disable LPM on Lenovo 50 series laptops with a too old BIOS
2018-07-17 11:37:52 +02:00
net: core: another layer of lists, around PF_MEMALLOC skb handling
2019-05-21 18:48:55 +02:00
memcg: make it work on sparse non-0-node systems
2019-06-11 12:22:42 +02:00
bpf: convert htab map to hlist_nulls
2019-05-16 19:43:40 +02:00
llist: clang: introduce member_address_is_nonnull()
2018-04-08 12:12:50 +02:00
log2: make order_base_2() behave correctly on const input value zero
2017-06-17 06:41:51 +02:00
bus: mbus: fix window size calculation for 4GB windows
2017-10-27 10:38:08 +02:00
mm: discard memblock data later
2017-08-24 17:12:19 -07:00
mm: rmap: fix huge file mmap accounting in the memcg stats
2017-04-08 09:30:35 +02:00
net: phy: micrel: add support for KSZ8795
2017-06-17 06:41:54 +02:00
mm: make page ref count overflow check tighter and more explicit
2019-06-11 12:22:45 +02:00
mm: get rid of vmacache_flush_all() entirely
2018-09-19 22:47:17 +02:00
mm: Handle 0 flags in _calc_vm_trans() macro
2017-12-20 10:07:29 +01:00
mm: drop unused pmdp_huge_get_and_clear_notify()
2017-12-14 09:28:16 +01:00
mm: fix 100% CPU kswapd busyloop on unreclaimable nodes
2018-01-31 12:55:53 +01:00
modules: mark __inittest/__exittest as __maybe_unused
2018-11-23 08:20:35 +01:00
platform-msi: Free descriptors in platform_msi_domain_free()
2019-01-09 16:16:43 +01:00
net: Add header for usage of fls64()
2019-02-23 09:05:58 +01:00
ipvlan, l3mdev: fix broken l3s mode wrt local routes
2019-02-06 17:33:27 +01:00
NFSv4: Fix EXCHANGE_ID corrupt verifier issue
2017-08-11 08:49:28 -07:00
kernel/watchdog: prevent false hardlockup on overloaded system
2017-06-17 06:41:57 +02:00
seccomp: Move speculation migitation control to arch code
2018-05-22 16:58:02 +02:00
of: fix clang -Wunsequenced for be32_to_cpu()
2019-05-25 18:26:47 +02:00
ARM: OMAP2+: gpmc-onenand: propagate error on initialization failure
2017-12-14 09:28:16 +01:00
compiler.h: enable builtin overflow checkers and add fallback code
2019-01-31 08:12:35 +01:00
mm: Fix false-positive VM_BUG_ON() in page_cache_{get,add}_speculative()
2018-03-22 09:17:44 +01:00
PCI: Change pci_host_common_probe() visibility
2018-02-25 11:05:51 +01:00
PCI: Work around Pericom PCIe-to-PCI bridge Retrain Link erratum
2019-05-25 18:26:53 +02:00
r8169: add support for NCube 8168 network card
2018-09-15 09:42:56 +02:00
KPTI: Rename to PAGE_TABLE_ISOLATION
2018-01-05 15:46:35 +01:00
perf/x86: Add check_period PMU callback
2019-02-20 10:18:31 +01:00
include/linux/pfn_t.h: force '~' to be parsed as an unary operator
2018-12-01 09:44:25 +01:00
net: stmmac: enable EEE in MII, GMII or RGMII only
2018-01-17 09:38:53 +01:00
pids: make task_tgid_nr_ns() safe
2017-08-24 17:12:21 -07:00
fs: prevent page refcount overflow in pipe_buf_get
2019-06-11 12:22:45 +02:00
time: Change posix clocks ops interfaces to use timespec64
2018-03-24 11:00:09 +01:00
posix-timers: Sanitize overrun handling
2018-11-10 07:43:01 -08:00
power: remove possible deadlock when unregistering power_supply
2018-10-03 17:01:43 -07:00
x86/uaccess, sched/preempt: Verify access_ok() context
2017-11-15 15:53:17 +01:00
device property: Fix the length used in PROPERTY_ENTRY_STRING()
2019-03-23 13:19:50 +01:00
firmware/psci: Expose SMCCC version through psci_ops
2018-04-20 08:21:05 +02:00
pstore: Allow prz to control need for locking
2017-08-06 18:59:43 -07:00
ptr_ring: wrap back ->producer in __ptr_ring_swap_queue()
2019-01-09 16:16:42 +01:00
x86/speculation: Apply IBPB more strictly to avoid cross-process data leak
2019-05-14 19:19:34 +02:00
pwm: Fix deadlock warning when removing PWM device
2019-06-22 08:17:17 +02:00
random: use chacha20 for get_random_int/long
2017-04-12 12:41:15 +02:00
bpf: convert htab map to hlist_nulls
2019-05-16 19:43:40 +02:00
rcu: Force inlining of rcu_read_lock()
2019-08-04 09:33:19 +02:00
include/linux/relay.h: fix percpu annotation in struct rchan
2019-04-05 22:29:06 +02:00
reset: remove remaining WARN_ON() in <linux/reset.h>
2018-12-08 13:05:09 +01:00
rhashtable: reorganize struct rhashtable layout
2018-10-18 09:13:25 +02:00
tracing: kdb: Fix ftdump to not sleep
2019-04-05 22:29:05 +02:00
sched/fair: Don't free p->numa_faults with concurrent readers
2019-08-04 09:33:45 +02:00
seccomp: Add filter flag to opt-out of SSB mitigation
2018-05-22 16:58:01 +02:00
serial: core: Make sure compiler barfs for 16-byte earlycon names
2018-08-03 07:55:25 +02:00
sh_eth: fix SH7757 GEther initialization
2018-01-17 09:38:53 +01:00
signals: avoid unnecessary taking of sighand->siglock
2018-05-22 16:57:57 +02:00
ptr_ring: use kmalloc_array()
2017-08-30 10:21:40 +02:00
net: create skb_gso_validate_mac_len()
2019-02-20 10:18:28 +01:00
mm, slab: make sure that KMALLOC_MAX_SIZE will fit into MAX_ORDER
2017-08-11 08:49:36 -07:00
slub: make ->cpu_partial unsigned int
2018-10-03 17:01:50 -07:00
smpboot: Place the __percpu annotation correctly
2019-05-31 06:48:17 -07:00
lib/string.c: implement a basic bcmp
2019-04-17 08:36:39 +02:00
x86/power: Fix swsusp_arch_resume prototype
2018-05-30 07:50:24 +02:00
include/linux/swap.h: use offsetof() instead of custom __swapoffset macro
2019-04-20 09:07:54 +02:00
x86/speculation/l1tf: Limit swap file size to MAX_PA/2
2018-08-15 18:14:45 +02:00
proc: Fix proc_sys_prune_dcache to hold a sb reference
2018-08-15 18:14:43 +02:00
scsi: sysfs: Introduce sysfs_{un,}break_active_protection()
2018-09-05 09:20:10 +02:00
TC: Set DMA masks for devices
2018-11-13 11:17:02 -08:00
tcp: limit payload size of sacked skbs
2019-06-17 19:53:32 +02:00
fork: unconditionally clear stack on fork
2018-08-09 12:18:00 +02:00
time: Fix CLOCK_MONOTONIC_RAW sub-nanosecond accounting
2017-06-29 13:00:30 +02:00
timers: Reinitialize per cpu bases on hotplug
2018-01-02 20:35:17 +01:00
bpf: one perf event close won't free bpf program attached by another perf event
2017-10-12 11:51:21 +02:00
tty: Don't call panic() at tty_ldisc_init()
2018-05-01 15:13:05 -07:00
tty: improve tty_insert_flip_char() fast path
2017-09-27 14:39:19 +02:00
new helper: uaccess_kernel()
2018-11-27 16:09:41 +01:00
new privimitive: iov_iter_revert()
2017-04-21 09:31:21 +02:00
USB: core: Fix bug caused by duplicate interface PM usage counter
2019-05-08 07:19:08 +02:00
Replace magic for trusting the secondary keyring with #define
2018-09-09 20:01:23 +02:00
Revert "module: Add retpoline tag to VERMAGIC"
2018-01-31 12:55:52 +01:00
vfio: New external user group/file match
2017-07-27 15:08:03 -07:00
virtio: add ability to iterate over vqs
2018-05-01 15:13:05 -07:00
virtio: Honour 'may_reduce_num' in vring_create_virtqueue
2019-04-17 08:36:47 +02:00
vsock: track pkt owner vsock
2017-12-25 14:23:37 +01:00
mm: get rid of vmacache_flush_all() entirely
2018-09-19 22:47:17 +02:00
mm: get rid of vmacache_flush_all() entirely
2018-09-19 22:47:17 +02:00
VMCI: Fix integer overflow in VMCI handle arrays
2019-07-21 09:06:03 +02:00
workqueue: avoid clang warning
2018-12-05 19:42:42 +01:00
