Messages in this thread | | | Subject | Re: Ugly rmap NULL ptr deref oopsie on hibernate (was Linux 2.6.34-rc3) | From | Minchan Kim <> | Date | Wed, 07 Apr 2010 00:34:55 +0900 |
| |
On Tue, 2010-04-06 at 10:38 -0400, Rik van Riel wrote: > On 04/06/2010 04:53 AM, KOSAKI Motohiro wrote: > > > Today, I've reviewed this patch carefully. but I haven't found any bug. > > > Also, I've runned stress workload with shrink_all_memory() today. but > > I couldn't reproduce the issue. hmm.. (perhaps I'm no lucky guy. > > I'm frequently fail to reproduce) > > > > I'll continue to work. > > My status with this bug is the same - I have gone through > the code from all angles, but have not found any other bugs > yet (except for that leak - which could leave invalid > pointers behind).
Let's see the unlink_anon_vmas.
1. list_for_each_entry_safe(avc,next, vma->anon_vma_chain, same_vma) 2. anon_vma_unlink 3. spin_lock(anon_vma->lock) <-- HERE LOCK. 4. list_del(anon_vma_chain->same_anon_vma);
What if anon_vma is destroyed and reuse by SLAB_XXX_RCU for another anon_vma object between 2 and 3? I mean how to make sure 3) does lock valid anon_vma?
I hope it is culprit.
-- Kind regards, Minchan Kim
| |