Unverified Commit 7aa5db25 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!11242 CVE-2024-43892 

Merge Pull Request from: @ci-robot 
 
PR sync from: Chen Ridong <chenridong@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/5OQLH2YHM4Q2YGQ5JOFP6G4Q3MODCCT7/ 
*** BLURB HERE ***

Shakeel Butt (1):
  memcg: protect concurrent access to mem_cgroup_idr


-- 
2.34.1
 
https://gitee.com/src-openeuler/kernel/issues/IAMMB5 
 
Link:https://gitee.com/openeuler/kernel/pulls/11242

 

Reviewed-by: default avatarLiu YongQiang <liuyongqiang13@huawei.com>
Signed-off-by: default avatarZhang Changzhong <zhangchangzhong@huawei.com>
parents 4af9fc1a a8df7a29

mm/memcontrol.c

+21 −2
Original line number Diff line number Diff line
@@ -5191,11 +5191,28 @@ static struct cftype mem_cgroup_legacy_files[] = { 
 */



static DEFINE_IDR(mem_cgroup_idr);

static DEFINE_SPINLOCK(memcg_idr_lock);



static int mem_cgroup_alloc_id(void)

{

	int ret;



	idr_preload(GFP_KERNEL);

	spin_lock(&memcg_idr_lock);

	ret = idr_alloc(&mem_cgroup_idr, NULL, 1, MEM_CGROUP_ID_MAX + 1,

			GFP_NOWAIT);

	spin_unlock(&memcg_idr_lock);

	idr_preload_end();

	return ret;

}



static void mem_cgroup_id_remove(struct mem_cgroup *memcg)

{

	if (memcg->id.id > 0) {

		spin_lock(&memcg_idr_lock);

		idr_remove(&mem_cgroup_idr, memcg->id.id);

		spin_unlock(&memcg_idr_lock);



		memcg->id.id = 0;

	}

}
@@ -5337,8 +5354,7 @@ static struct mem_cgroup *mem_cgroup_alloc(void) 
		return ERR_PTR(error);



	memcg = &memcg_ext->memcg;

	memcg->id.id = idr_alloc(&mem_cgroup_idr, NULL,

				 1, MEM_CGROUP_ID_MAX + 1, GFP_KERNEL);

	memcg->id.id = mem_cgroup_alloc_id();

	if (memcg->id.id < 0) {

		error = memcg->id.id;

		goto fail;
@@ -5379,7 +5395,10 @@ static struct mem_cgroup *mem_cgroup_alloc(void) 
	INIT_LIST_HEAD(&memcg_ext->split_queue);

	memcg_ext->split_queue_len = 0;

#endif

	spin_lock(&memcg_idr_lock);

	idr_replace(&mem_cgroup_idr, memcg, memcg->id.id);

	spin_unlock(&memcg_idr_lock);



	return memcg;

fail:

	mem_cgroup_id_remove(memcg);