Messages in this thread | | | Date | Wed, 23 Nov 2011 10:32:21 +0200 (EET) | From | Pekka Enberg <> | Subject | Re: [PATCH V2] slub: avoid potential NULL dereference or corruption |
| |
On Tue, 22 Nov 2011, Eric Dumazet wrote: > show_slab_objects() can trigger NULL dereferences or memory corruption. > > Another cpu can change its c->page to NULL or c->node to NUMA_NO_NODE > while we use them. > > Use ACCESS_ONCE(c->page) and ACCESS_ONCE(c->node) to make sure this > cannot happen. > > Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Did someone test this patch? Does it fix any of the reported issues?
> --- > V2: remove a not needed "if (!c)" test > > mm/slub.c | 21 +++++++++++---------- > 1 file changed, 11 insertions(+), 10 deletions(-) > > diff --git a/mm/slub.c b/mm/slub.c > index 7d2a996..9deef7d 100644 > --- a/mm/slub.c > +++ b/mm/slub.c > @@ -4435,30 +4435,31 @@ static ssize_t show_slab_objects(struct kmem_cache *s, > > for_each_possible_cpu(cpu) { > struct kmem_cache_cpu *c = per_cpu_ptr(s->cpu_slab, cpu); > + int node = ACCESS_ONCE(c->node); > struct page *page; > > - if (!c || c->node < 0) > + if (node < 0) > continue; > - > - if (c->page) { > - if (flags & SO_TOTAL) > - x = c->page->objects; > + page = ACCESS_ONCE(c->page); > + if (page) { > + if (flags & SO_TOTAL) > + x = page->objects; > else if (flags & SO_OBJECTS) > - x = c->page->inuse; > + x = page->inuse; > else > x = 1; > > total += x; > - nodes[c->node] += x; > + nodes[node] += x; > } > page = c->partial; > > if (page) { > x = page->pobjects; > - total += x; > - nodes[c->node] += x; > + total += x; > + nodes[node] += x; > } > - per_cpu[c->node]++; > + per_cpu[node]++; > } > } > > > >
| |