Sasha Levin f2a9ef8807 mm: fix NULL ptr dereference in migrate_pages ... Commit 3268c63 ("mm: fix move/migrate_pages() race on task struct") has added an odd construct where 'mm' is checked for being NULL, and if it is, it would get dereferenced anyways by mput()ing it. This would lead to the following NULL ptr deref and BUG() when calling migrate_pages() with a pid that has no mm struct: [25904.193704] BUG: unable to handle kernel NULL pointer dereference at 0000000000000050 [25904.194235] IP: [<ffffffff810b0de7>] mmput+0x27/0xf0 [25904.194235] PGD 773e6067 PUD 77da0067 PMD 0 [25904.194235] Oops: 0002 [#1] PREEMPT SMP [25904.194235] CPU 2 [25904.194235] Pid: 31608, comm: trinity Tainted: G W 3.4.0-rc2-next-20120412-sasha #69 [25904.194235] RIP: 0010:[<ffffffff810b0de7>] [<ffffffff810b0de7>] mmput+0x27/0xf0 [25904.194235] RSP: 0018:ffff880077d49e08 EFLAGS: 00010202 [25904.194235] RAX: 0000000000000286 RBX: 0000000000000000 RCX: 0000000000000000 [25904.194235] RDX: ffff880075ef8000 RSI: 000000000000023d RDI: 0000000000000286 [25904.194235] RBP: ffff880077d49e18 R08: 0000000000000001 R09: 0000000000000001 [25904.194235] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [25904.194235] R13: 00000000ffffffea R14: ffff880034287740 R15: ffff8800218d3010 [25904.194235] FS: 00007fc8b244c700(0000) GS:ffff880029800000(0000) knlGS:0000000000000000 [25904.194235] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [25904.194235] CR2: 0000000000000050 CR3: 00000000767c6000 CR4: 00000000000406e0 [25904.194235] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [25904.194235] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [25904.194235] Process trinity (pid: 31608, threadinfo ffff880077d48000, task ffff880075ef8000) [25904.194235] Stack: [25904.194235] ffff8800342876c0 0000000000000000 ffff880077d49f78 ffffffff811b8020 [25904.194235] ffffffff811b7d91 ffff880075ef8000 ffff88002256d200 0000000000000000 [25904.194235] 00000000000003ff 0000000000000000 0000000000000000 0000000000000000 [25904.194235] Call Trace: [25904.194235] [<ffffffff811b8020>] sys_migrate_pages+0x340/0x3a0 [25904.194235] [<ffffffff811b7d91>] ? sys_migrate_pages+0xb1/0x3a0 [25904.194235] [<ffffffff8266cbb9>] system_call_fastpath+0x16/0x1b [25904.194235] Code: c9 c3 66 90 55 31 d2 48 89 e5 be 3d 02 00 00 48 83 ec 10 48 89 1c 24 4c 89 64 24 08 48 89 fb 48 c7 c7 cf 0e e1 82 e8 69 18 03 00 <f0> ff 4b 50 0f 94 c0 84 c0 0f 84 aa 00 00 00 48 89 df e8 72 f1 [25904.194235] RIP [<ffffffff810b0de7>] mmput+0x27/0xf0 [25904.194235] RSP <ffff880077d49e08> [25904.194235] CR2: 0000000000000050 [25904.348999] ---[ end trace a307b3ed40206b4b ]--- Signed-off-by: Sasha Levin <levinsasha928@gmail.com> Cc: Dave Hansen <dave@linux.vnet.ibm.com> Cc: Mel Gorman <mel@csn.ul.ie> Cc: Johannes Weiner <hannes@cmpxchg.org> Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com> Cc: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com> Cc: Hugh Dickins <hughd@google.com> Cc: Christoph Lameter <cl@linux.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>		2012-04-25 21:26:34 -07:00
..
backing-dev.c	backing-dev: fix wakeup timer races with bdi_unregister()	2012-02-01 16:52:49 +08:00
bootmem.c	bootmem/sparsemem: remove limit constraint in alloc_bootmem_section	2012-03-21 17:54:58 -07:00
bounce.c	mm: remove the second argument of k[un]map_atomic()	2012-03-20 21:48:27 +08:00
cleancache.c	mm: cleancache: Use __read_mostly as appropiate.	2012-01-23 16:08:09 -05:00
compaction.c	mm: compaction: make compact_control order signed	2012-03-21 17:54:56 -07:00
debug-pagealloc.c	mm, x86: Remove debug_pagealloc_enabled	2011-12-06 09:24:07 +01:00
dmapool.c	mm: fix implicit stat.h usage in dmapool.c	2011-10-31 09:20:12 -04:00
fadvise.c	fadvise: only initiate writeback for specified range with FADV_DONTNEED	2012-01-10 16:30:43 -08:00
failslab.c	switch debugfs to umode_t	2012-01-03 22:54:56 -05:00
filemap.c	radix-tree: use iterators in find_get_pages* functions	2012-03-28 17:14:37 -07:00
filemap_xip.c	mm/filemap_xip.c: fix race condition in xip_file_fault()	2012-02-03 16:16:41 -08:00
fremap.c	mm: delete various needless include <linux/module.h>	2011-10-31 09:20:11 -04:00
highmem.c	Merge branch 'modsplit-Oct31_2011' of git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux	2011-11-06 19:44:47 -08:00
huge_memory.c	thp: optimize away unnecessary page table locking	2012-03-21 17:54:57 -07:00
hugetlb.c	mm/hugetlb: fix warning in alloc_huge_page/dequeue_huge_page_vma	2012-04-25 21:26:33 -07:00
hwpoison-inject.c	HWPOISON: Clean up memory_failure() vs. __memory_failure()	2012-01-03 12:06:32 -08:00
init-mm.c	atomic: use <linux/atomic.h>	2011-07-26 16:49:47 -07:00
internal.h	mm: thp: tail page refcounting fix	2011-11-02 16:06:57 -07:00
Kconfig	Merge branch 'master' into x86/memblock	2011-11-28 09:46:22 -08:00
Kconfig.debug	mm: more intensive memory corruption debugging	2012-01-10 16:30:42 -08:00
kmemcheck.c	kmemcheck: Fix build errors due to missing slab.h	2010-03-30 22:02:32 +09:00
kmemleak-test.c	kmemleak: remove memset by using kzalloc	2011-01-27 18:31:51 +00:00
kmemleak.c	kmemleak: Disable early logging when kmemleak is off by default	2012-01-20 16:57:05 +00:00
ksm.c	ksm: cleanup: introduce find_mergeable_vma()	2012-03-21 17:54:59 -07:00
maccess.c	mm: Map most files to use export.h instead of module.h	2011-10-31 09:20:12 -04:00
madvise.c	coredump: add VM_NODUMP, MADV_NODUMP, MADV_CLEAR_NODUMP	2012-03-23 16:58:42 -07:00
Makefile	Cross Memory Attach	2011-10-31 17:30:44 -07:00
memblock.c	memblock: memblock should be able to handle zero length operations	2012-04-20 11:18:46 -07:00
memcontrol.c	memcg: fix Bad page state after replace_page_cache	2012-04-18 23:40:57 -07:00
memory-failure.c	Merge branch 'x86-mce-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2012-03-22 09:42:04 -07:00
memory.c	coredump: remove VM_ALWAYSDUMP flag	2012-03-23 16:58:42 -07:00
memory_hotplug.c	mm: compaction: introduce sync-light migration for use by compaction	2012-01-12 20:13:09 -08:00
mempolicy.c	mm: fix NULL ptr dereference in migrate_pages	2012-04-25 21:26:34 -07:00
mempool.c	mempool: fix first round failure behavior	2012-01-10 16:30:45 -08:00
migrate.c	mm: fix move/migrate_pages() race on task struct	2012-03-21 17:54:58 -07:00
mincore.c	mm: thp: fix pmd_bad() triggering in code paths holding mmap_sem read mode	2012-03-21 17:54:54 -07:00
mlock.c	vm: avoid using find_vma_prev() unnecessarily	2012-03-06 18:23:36 -08:00
mm_init.c	mm: Map most files to use export.h instead of module.h	2011-10-31 09:20:12 -04:00
mmap.c	kill mm argument of vm_munmap()	2012-04-21 01:58:20 -04:00
mmu_context.c	mm, counters: remove task argument to sync_mm_rss() and __sync_task_rss_stat()	2012-03-21 17:54:59 -07:00
mmu_notifier.c	mm: Map most files to use export.h instead of module.h	2011-10-31 09:20:12 -04:00
mmzone.c	mm: delete various needless include <linux/module.h>	2011-10-31 09:20:11 -04:00
mprotect.c	Merge branch 'akpm' (Andrew's patch-bomb)	2012-03-22 09:04:48 -07:00
mremap.c	mm: collapse security_vm_enough_memory() variants into a single function	2012-02-14 10:45:39 +11:00
msync.c	sanitize vfs_fsync calling conventions	2010-05-21 18:31:21 -04:00
nobootmem.c	Merge branch 'master' into x86/memblock	2011-11-28 09:46:22 -08:00
nommu.c	kill mm argument of vm_munmap()	2012-04-21 01:58:20 -04:00
oom_kill.c	signal: oom_kill_task: use SEND_SIG_FORCED instead of force_sig()	2012-03-23 16:58:41 -07:00
page-writeback.c	Ext4 commits for 3.3 merge window; mostly cleanups and bug fixes	2012-03-28 10:02:55 -07:00
page_alloc.c	mm: only IPI CPUs to drain local pages if they exist	2012-03-28 17:14:35 -07:00
page_cgroup.c	page_cgroup: fix horrid swap accounting regression	2012-03-06 08:18:23 -08:00
page_io.c	block: kill off REQ_UNPLUG	2011-03-10 08:52:27 +01:00
page_isolation.c	mm: page_isolation: codeclean fix comment and rm unneeded val init	2010-10-26 16:52:11 -07:00
pagewalk.c	mm: thp: fix pmd_bad() triggering in code paths holding mmap_sem read mode	2012-03-21 17:54:54 -07:00
percpu-km.c	percpu: clear memory allocated with the km allocator	2010-10-02 10:28:42 +03:00
percpu-vm.c	percpu: use bitmap_clear	2012-01-20 09:23:16 -08:00
percpu.c	Kmemleak patches	2012-01-14 18:11:11 -08:00
pgtable-generic.c	thp: add HPAGE_PMD_* definitions for !CONFIG_TRANSPARENT_HUGEPAGE	2012-03-21 17:55:02 -07:00
prio_tree.c	sanitize <linux/prefetch.h> usage	2011-05-20 12:50:29 -07:00
process_vm_access.c	Fix race in process_vm_rw_core	2012-02-02 12:55:17 -08:00
quicklist.c	mm: delete various needless include <linux/module.h>	2011-10-31 09:20:11 -04:00
readahead.c	mm: Map most files to use export.h instead of module.h	2011-10-31 09:20:12 -04:00
rmap.c	memcg: use new logic for page stat accounting	2012-03-21 17:55:01 -07:00
shmem.c	Merge branch 'akpm' (Andrew's patch-bomb)	2012-03-22 09:04:48 -07:00
slab.c	Merge branch 'slab/for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/penberg/linux	2012-03-28 15:04:26 -07:00
slob.c	mm: Map most files to use export.h instead of module.h	2011-10-31 09:20:12 -04:00
slub.c	Merge branch 'akpm' (Andrew's patch-bomb)	2012-03-28 17:19:28 -07:00
sparse-vmemmap.c	mm: delete various needless include <linux/module.h>	2011-10-31 09:20:11 -04:00
sparse.c	bootmem/sparsemem: remove limit constraint in alloc_bootmem_section	2012-03-21 17:54:58 -07:00
swap.c	mm: drain percpu lru add/rotate page-vectors on cpu hot-unplug	2012-03-21 17:54:58 -07:00
swap_state.c	mm: make swapin readahead skip over holes	2012-03-21 17:54:56 -07:00
swapfile.c	swapon: check validity of swap_flags	2012-03-28 17:14:35 -07:00
thrash.c	mm/thrash.c: quiet sparse noise	2011-10-31 17:30:50 -07:00
truncate.c	mm for fs: add truncate_pagecache_range()	2012-03-28 17:14:35 -07:00
util.c	procfs: mark thread stack correctly in proc/<pid>/maps	2012-03-21 17:54:58 -07:00
vmalloc.c	mm: remove the second argument of k[un]map_atomic()	2012-03-20 21:48:27 +08:00
vmscan.c	mm: fix up the vmscan stat in vmstat	2012-04-25 21:26:33 -07:00
vmstat.c	mm: fix up the vmscan stat in vmstat	2012-04-25 21:26:33 -07:00