lkml.org 
[lkml]   [2011]   [Jun]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [BUG 3.0.0-rc1] ksm: NULL pointer dereference in ksm_do_scan()
    On Fri, Jun 03, 2011 at 10:06:14AM -0700, Hugh Dickins wrote:
    > On Thu, 2 Jun 2011, Andrea Arcangeli wrote:
    > > On Thu, Jun 02, 2011 at 10:29:39AM -0700, Hugh Dickins wrote:
    > > > AndreaA, I didn't study the patch you posted half an hour ago,
    > > > since by that time I'd worked it out and was preparing patch below.
    > > > I think your patch would be for a different bug, hopefully one we
    > > > don't have, it looks more complicated than we should need for this.
    > >
    > > I didn't expect two different bugs leading to double free.
    >
    > There wasn't a double free there, just failure to cope with race
    > emptying the list, so accessing head when expecting a full entry.

    Yes, we thought it was a double free initially because of two dead
    pointers but we couldn't explain why mm was null so consistently.

    > You'll see from the "beware" comment in scan_get_next_rmap_item()
    > that this case is expected, that it sometimes reaches freeing the
    > slots before the exiting task reaches __ksm_exit().
    >
    > That race should already be handled. I believe your patch is unnecessary,
    > because get_mm_slot() is a hashlist lookup, and will return NULL once
    > either end has done the hlist_del(&mm_slot->link).

    Ok so that case is handled by get_mm_slot not succeeding. I see thanks
    for the review.


    \
     
     \ /
      Last update: 2011-06-03 20:15    [W:0.029 / U:0.136 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site