Messages in this thread | | | Date | Fri, 20 Feb 2009 07:56:27 -0800 | From | "Paul E. McKenney" <> | Subject | Re: [PATCH] mm: fix lazy vmap purging (use-after-free error) |
| |
On Fri, Feb 20, 2009 at 03:01:57PM +0100, Ingo Molnar wrote: > > * Ingo Molnar <mingo@elte.hu> wrote: > > > ah, indeed: > > > > list_del_rcu(&va->list); > > > > i suspect it could be hit big time in a workload that opens > > more than 512 files, as expand_files() uses a > > vmalloc()+vfree() pair in that case. > > hm, perhaps it's not a problem after all. The freeing is done > via rcu, and list_del_rcu() leaves the forward pointer intact. > > So how did it happen that the entry got kfree()d before the loop > was done? We are in a spinlocked section so the CPU should not > have entered rcu processing.
Good point -- is the .config file available?
Thanx, Paul
| |