Messages in this thread Patch in this message | | | Subject | [PATCH V2] slub: avoid potential NULL dereference or corruption | From | Eric Dumazet <> | Date | Tue, 22 Nov 2011 16:02:02 +0100 |
| |
show_slab_objects() can trigger NULL dereferences or memory corruption.
Another cpu can change its c->page to NULL or c->node to NUMA_NO_NODE while we use them.
Use ACCESS_ONCE(c->page) and ACCESS_ONCE(c->node) to make sure this cannot happen.
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> --- V2: remove a not needed "if (!c)" test
mm/slub.c | 21 +++++++++++---------- 1 file changed, 11 insertions(+), 10 deletions(-)
diff --git a/mm/slub.c b/mm/slub.c index 7d2a996..9deef7d 100644 --- a/mm/slub.c +++ b/mm/slub.c @@ -4435,30 +4435,31 @@ static ssize_t show_slab_objects(struct kmem_cache *s, for_each_possible_cpu(cpu) { struct kmem_cache_cpu *c = per_cpu_ptr(s->cpu_slab, cpu); + int node = ACCESS_ONCE(c->node); struct page *page; - if (!c || c->node < 0) + if (node < 0) continue; - - if (c->page) { - if (flags & SO_TOTAL) - x = c->page->objects; + page = ACCESS_ONCE(c->page); + if (page) { + if (flags & SO_TOTAL) + x = page->objects; else if (flags & SO_OBJECTS) - x = c->page->inuse; + x = page->inuse; else x = 1; total += x; - nodes[c->node] += x; + nodes[node] += x; } page = c->partial; if (page) { x = page->pobjects; - total += x; - nodes[c->node] += x; + total += x; + nodes[node] += x; } - per_cpu[c->node]++; + per_cpu[node]++; } }
| |