lkml.org 
[lkml]   [2010]   [Apr]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    SubjectRe: Ugly rmap NULL ptr deref oopsie on hibernate (was Linux 2.6.34-rc3)
    From
    Date
    On Tue, 2010-04-06 at 13:02 -0700, Linus Torvalds wrote:
    > - Related to the above: perhaps the RCU freeing isn't working, or
    > slub/slab/slob ends up reusing the allocations for something else than
    > anonvma's, so together with the race _and_ an unlucky re-use, you get
    > some odd crud.
    >
    > I haven't looked at the kernel config files: do they perhaps share the
    > same (odd?) SLUB/SLAB/SLOB config?

    Right, so anon_vma uses SLAB_DESTROY_BY_RCU and as the huge comment in
    rmap.c explains, that doesn't mean the objects themself get RCU grace
    period delays in freeing, only the SLAB that backs these objects does.

    So the moment you do kmem_cache_free() on the anon_vma it can be re-used
    for another allocation. The only guarantee given by RCU is that the
    backing storage doesn't go away and hence you can 'safely' deref
    pointers, you still very much have to revalidate you got the object you
    were looking for.


    \
     
     \ /
      Last update: 2010-04-07 10:47    [W:4.412 / U:0.024 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site