lkml.org 
[lkml]   [2010]   [Apr]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    SubjectRe: Ugly rmap NULL ptr deref oopsie on hibernate (was Linux 2.6.34-rc3)
    From
    Date
    On Tue, 2010-04-06 at 10:38 -0400, Rik van Riel wrote:
    > On 04/06/2010 04:53 AM, KOSAKI Motohiro wrote:
    >
    > > Today, I've reviewed this patch carefully. but I haven't found any bug.
    >
    > > Also, I've runned stress workload with shrink_all_memory() today. but
    > > I couldn't reproduce the issue. hmm.. (perhaps I'm no lucky guy.
    > > I'm frequently fail to reproduce)
    > >
    > > I'll continue to work.
    >
    > My status with this bug is the same - I have gone through
    > the code from all angles, but have not found any other bugs
    > yet (except for that leak - which could leave invalid
    > pointers behind).

    Let's see the unlink_anon_vmas.

    1. list_for_each_entry_safe(avc,next, vma->anon_vma_chain, same_vma)
    2. anon_vma_unlink
    3. spin_lock(anon_vma->lock) <-- HERE LOCK.
    4. list_del(anon_vma_chain->same_anon_vma);

    What if anon_vma is destroyed and reuse by SLAB_XXX_RCU for another
    anon_vma object between 2 and 3?
    I mean how to make sure 3) does lock valid anon_vma?

    I hope it is culprit.


    --
    Kind regards,
    Minchan Kim




    \
     
     \ /
      Last update: 2010-04-06 17:37    [W:4.327 / U:0.064 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site