Messages in this thread | | | Subject | Re: Ugly rmap NULL ptr deref oopsie on hibernate (was Linux 2.6.34-rc3) | From | Minchan Kim <> | Date | Wed, 07 Apr 2010 00:58:54 +0900 |
| |
On Tue, 2010-04-06 at 11:40 -0400, Rik van Riel wrote: > On 04/06/2010 11:34 AM, Minchan Kim wrote: > > > Let's see the unlink_anon_vmas. > > > > 1. list_for_each_entry_safe(avc,next, vma->anon_vma_chain, same_vma) > > 2. anon_vma_unlink > > 3. spin_lock(anon_vma->lock)<-- HERE LOCK. > > 4. list_del(anon_vma_chain->same_anon_vma); > > > > What if anon_vma is destroyed and reuse by SLAB_XXX_RCU for another > > anon_vma object between 2 and 3? > > I mean how to make sure 3) does lock valid anon_vma? > > > > I hope it is culprit. > > How can the anon_vma get destroyed and reused, when this > anon_vma_chain still has a reference to it (and the
Doesn't anon_vma_chain have a ref counter on anon_vma?
> anon_vma has not been freed yet)?
AFAIK, anon_vma can be reused without free by SLAB_XXX_RCU. So we always use it carefully by page_lock_anon_vma or manual check with RCU and page_mapped.
What am I missing?
> > What combination of circumstances is necessary for > your bug hypothetical to happen?
CPU A CPU B
unlink_anon_vmas list_for_each_entry
free_pgtable anon_vma_unlink <crazy stall> spin_lock(anon_vma); list_del(same_anon_vma) spin_unlock(anon_vma) anon_vma_unlink anon_vma_free reuse for another anon_vma spin_lock(another anon_vma) list_del(another anon_vma)
If my assumption is wrong, please correct me. Thanks, Rik.
-- Kind regards, Minchan Kim
| |