[PATCH] cpuset: make ntasks to be a monotonic increasing value

[Lai Jiangshan]

ntasks is not a monotonic increasing value,
So maybe fudge+1 processes are created when kmalloc and killed
when kfree in every loop. And the loop will not end or
repetition a long time.

This patch prevent this kind of attack.

Signed-off-by: Lai Jiangshan <laijs@xxxxxxxxxxxxxx>
---
diff --git a/kernel/cpuset.c b/kernel/cpuset.c
index d5ab79c..65eaa2b 100644
--- a/kernel/cpuset.c
+++ b/kernel/cpuset.c
@@ -949,16 +949,20 @@ static int update_tasks_nodemask(struct cpuset *cs, const nodemask_t *oldmem)
 	 * few more lines of code, we can retry until we get a big
 	 * enough mmarray[] w/o using GFP_ATOMIC.
 	 */
+	ntasks = cgroup_task_count(cs->css.cgroup);	/* guess */
 	while (1) {
-		ntasks = cgroup_task_count(cs->css.cgroup);  /* guess */
+		int ntasks_now;
 		ntasks += fudge;
 		mmarray = kmalloc(ntasks * sizeof(*mmarray), GFP_KERNEL);
 		if (!mmarray)
 			goto done;
 		read_lock(&tasklist_lock);		/* block fork */
-		if (cgroup_task_count(cs->css.cgroup) <= ntasks)
+		ntasks_now = cgroup_task_count(cs->css.cgroup);
+		if (ntasks_now <= ntasks)
 			break;				/* got enough */
 		read_unlock(&tasklist_lock);		/* try again */
+		ntasks = ntasks_now;
+		fudge += fudge >> 3;
 		kfree(mmarray);
 	}
 


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/