ntasks is not a monotonic increasing value,
So maybe fudge+1 processes are created when kmalloc and killed
when kfree in every loop. And the loop will not end or
repetition a long time.
This patch prevent this kind of attack.
Signed-off-by: Lai Jiangshan <laijs@cn.fujitsu.com>
---
diff --git a/kernel/cpuset.c b/kernel/cpuset.c
index d5ab79c..65eaa2b 100644
--- a/kernel/cpuset.c
+++ b/kernel/cpuset.c
@@ -949,16 +949,20 @@ static int update_tasks_nodemask(struct cpuset *cs, const nodemask_t *oldmem)
* few more lines of code, we can retry until we get a big
* enough mmarray[] w/o using GFP_ATOMIC.
*/
+ ntasks = cgroup_task_count(cs->css.cgroup); /* guess */
while (1) {
- ntasks = cgroup_task_count(cs->css.cgroup); /* guess */
+ int ntasks_now;
ntasks += fudge;
mmarray = kmalloc(ntasks * sizeof(*mmarray), GFP_KERNEL);
if (!mmarray)
goto done;
read_lock(&tasklist_lock); /* block fork */
- if (cgroup_task_count(cs->css.cgroup) <= ntasks)
+ ntasks_now = cgroup_task_count(cs->css.cgroup);
+ if (ntasks_now <= ntasks)
break; /* got enough */
read_unlock(&tasklist_lock); /* try again */
+ ntasks = ntasks_now;
+ fudge += fudge >> 3;
kfree(mmarray);
}
--
