Messages in this thread | | | Date | Tue, 6 Apr 2010 16:37:51 -0700 (PDT) | From | Linus Torvalds <> | Subject | Re: Ugly rmap NULL ptr deref oopsie on hibernate (was Linux 2.6.34-rc3) |
| |
On Wed, 7 Apr 2010, Borislav Petkov wrote: > + > + if (!anon_vma->head.next) { > + printk(KERN_ERR "NULL anon_vma->head.next, page %lu\n", > + page_to_pfn(page)); > + > + object_err(anon_vma_cachep, page, (u8 *)anon_vma, "NULL next");
Oh, and since the debugging code never triggered ('head.next' wasn't actually NULL), you never got here, but the 'page' you passed in to object_error() should be the page of the slab allocation, not the page associated with the anon_vma.
So it should be something like "virt_to_head_page(anon_vma)" that you pass in to object_err().
Not that it matters. I assume it is the fact that SLAB debugging is on that actually turns the NULL into a non-NULL thing. Poisoning is not active for SLUb's with constructors or RCU-freeing, but things like redzoning still are. So enabling SLUB debugging will change the offsets within the pages of all the SLUB allocations. I wonder if that's just what caused it to now have that 0x002e2e2e002e2e2e instead of NULL.
Linus
| |