From: Jann Horn <jannh@google.com>
Date: Tue, 17 Mar 2020 01:28:45 +0100
Subject: mm: slub: add missing TID bump in kmem_cache_alloc_bulk()
Git-commit: fd4d9c7d0c71866ec0c2825189ebd2ce35bd95b8
Patch-mainline: v5.6-rc7
References: CVE-2020-29370, bsc#1179435, bsc#1167657, VM functionality
When kmem_cache_alloc_bulk() attempts to allocate N objects from a percpu
freelist of length M, and N > M > 0, it will first remove the M elements
from the percpu freelist, then call ___slab_alloc() to allocate the next
element and repopulate the percpu freelist. ___slab_alloc() can re-enable
IRQs via allocate_slab(), so the TID must be bumped before ___slab_alloc()
to properly commit the freelist head change.
Fix it by unconditionally bumping c->tid when entering the slowpath.
Cc: stable@vger.kernel.org
Fixes: ebe909e0fdb3 ("slub: improve bulk alloc strategy")
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Vlastimil Babka <vbabka@suse.cz>
---
mm/slub.c | 9 +++++++++
1 file changed, 9 insertions(+)
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -3154,6 +3154,15 @@ int kmem_cache_alloc_bulk(struct kmem_ca
if (unlikely(!object)) {
/*
+ * We may have removed an object from c->freelist using
+ * the fastpath in the previous iteration; in that case,
+ * c->tid has not been bumped yet.
+ * Since ___slab_alloc() may reenable interrupts while
+ * allocating memory, we should bump c->tid now.
+ */
+ c->tid = next_tid(c->tid);
+
+ /*
* Invoking slow path likely have side-effect
* of re-populating per CPU c->freelist
*/