Messages in this thread | | | Subject | Re: Ugly rmap NULL ptr deref oopsie on hibernate (was Linux 2.6.34-rc3) | From | Peter Zijlstra <> | Date | Wed, 07 Apr 2010 10:41:55 +0200 |
| |
On Tue, 2010-04-06 at 13:02 -0700, Linus Torvalds wrote: > - Related to the above: perhaps the RCU freeing isn't working, or > slub/slab/slob ends up reusing the allocations for something else than > anonvma's, so together with the race _and_ an unlucky re-use, you get > some odd crud. > > I haven't looked at the kernel config files: do they perhaps share the > same (odd?) SLUB/SLAB/SLOB config?
Right, so anon_vma uses SLAB_DESTROY_BY_RCU and as the huge comment in rmap.c explains, that doesn't mean the objects themself get RCU grace period delays in freeing, only the SLAB that backs these objects does.
So the moment you do kmem_cache_free() on the anon_vma it can be re-used for another allocation. The only guarantee given by RCU is that the backing storage doesn't go away and hence you can 'safely' deref pointers, you still very much have to revalidate you got the object you were looking for.
| |