https://github.com/torvalds/linux
Revision d3cb8bf6081b8b7a2dabb1264fe968fd870fa595 authored by Mel Gorman on 02 October 2014, 18:47:41 UTC, committed by Linus Torvalds on 02 October 2014, 18:57:18 UTC
A migration entry is marked as write if pte_write was true at the time the entry was created. The VMA protections are not double checked when migration entries are being removed as mprotect marks write-migration-entries as read. It means that potentially we take a spurious fault to mark PTEs write again but it's straight-forward. However, there is a race between write migrations being marked read and migrations finishing. This potentially allows a PTE to be write that should have been read. Close this race by double checking the VMA permissions using maybe_mkwrite when migration completes. [torvalds@linux-foundation.org: use maybe_mkwrite] Cc: stable@vger.kernel.org Signed-off-by: Mel Gorman <mgorman@suse.de> Acked-by: Rik van Riel <riel@redhat.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
1 parent 50dddff
Tip revision: d3cb8bf6081b8b7a2dabb1264fe968fd870fa595 authored by Mel Gorman on 02 October 2014, 18:47:41 UTC
mm: migrate: Close race between migration completion and mprotect
mm: migrate: Close race between migration completion and mprotect
Tip revision: d3cb8bf
resource-control.txt
There are a lot of kinds of objects in the kernel that don't have
individual limits or that have limits that are ineffective when a set
of processes is allowed to switch user ids. With user namespaces
enabled in a kernel for people who don't trust their users or their
users programs to play nice this problems becomes more acute.
Therefore it is recommended that memory control groups be enabled in
kernels that enable user namespaces, and it is further recommended
that userspace configure memory control groups to limit how much
memory user's they don't trust to play nice can use.
Memory control groups can be configured by installing the libcgroup
package present on most distros editing /etc/cgrules.conf,
/etc/cgconfig.conf and setting up libpam-cgroup.
Computing file changes ...
