lkml.org 
[lkml]   [2011]   [Nov]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH V2] slub: avoid potential NULL dereference or corruption
On Tue, 22 Nov 2011, Eric Dumazet wrote:
> show_slab_objects() can trigger NULL dereferences or memory corruption.
>
> Another cpu can change its c->page to NULL or c->node to NUMA_NO_NODE
> while we use them.
>
> Use ACCESS_ONCE(c->page) and ACCESS_ONCE(c->node) to make sure this
> cannot happen.
>
> Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>

Did someone test this patch? Does it fix any of the reported issues?

> ---
> V2: remove a not needed "if (!c)" test
>
> mm/slub.c | 21 +++++++++++----------
> 1 file changed, 11 insertions(+), 10 deletions(-)
>
> diff --git a/mm/slub.c b/mm/slub.c
> index 7d2a996..9deef7d 100644
> --- a/mm/slub.c
> +++ b/mm/slub.c
> @@ -4435,30 +4435,31 @@ static ssize_t show_slab_objects(struct kmem_cache *s,
>
> for_each_possible_cpu(cpu) {
> struct kmem_cache_cpu *c = per_cpu_ptr(s->cpu_slab, cpu);
> + int node = ACCESS_ONCE(c->node);
> struct page *page;
>
> - if (!c || c->node < 0)
> + if (node < 0)
> continue;
> -
> - if (c->page) {
> - if (flags & SO_TOTAL)
> - x = c->page->objects;
> + page = ACCESS_ONCE(c->page);
> + if (page) {
> + if (flags & SO_TOTAL)
> + x = page->objects;
> else if (flags & SO_OBJECTS)
> - x = c->page->inuse;
> + x = page->inuse;
> else
> x = 1;
>
> total += x;
> - nodes[c->node] += x;
> + nodes[node] += x;
> }
> page = c->partial;
>
> if (page) {
> x = page->pobjects;
> - total += x;
> - nodes[c->node] += x;
> + total += x;
> + nodes[node] += x;
> }
> - per_cpu[c->node]++;
> + per_cpu[node]++;
> }
> }
>
>
>
>


\
 
 \ /
  Last update: 2011-11-23 09:35    [W:1.245 / U:0.992 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site