Messages in this thread Patch in this message | | | Subject | [PATCH] slub: avoid potential NULL dereference or corruption | From | Eric Dumazet <> | Date | Tue, 22 Nov 2011 15:53:49 +0100 |
| |
show_slab_objects() can trigger NULL dereferences or memory corruption.
Another cpu can change its c->page to NULL or c->node to NUMA_NO_NODE while we use them.
Use ACCESS_ONCE(c->page) and ACCESS_ONCE(c->node) to make sure this cannot happen.
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> --- mm/slub.c | 22 +++++++++++++--------- 1 file changed, 13 insertions(+), 9 deletions(-)
diff --git a/mm/slub.c b/mm/slub.c index 7d2a996..e8e6714 100644 --- a/mm/slub.c +++ b/mm/slub.c @@ -4436,29 +4436,33 @@ static ssize_t show_slab_objects(struct kmem_cache *s, for_each_possible_cpu(cpu) { struct kmem_cache_cpu *c = per_cpu_ptr(s->cpu_slab, cpu); struct page *page; + int node; - if (!c || c->node < 0) + if (!c) continue; - - if (c->page) { - if (flags & SO_TOTAL) - x = c->page->objects; + node = ACCESS_ONCE(c->node); + if (node < 0) + continue; + page = ACCESS_ONCE(c->page); + if (page) { + if (flags & SO_TOTAL) + x = page->objects; else if (flags & SO_OBJECTS) - x = c->page->inuse; + x = page->inuse; else x = 1; total += x; - nodes[c->node] += x; + nodes[node] += x; } page = c->partial; if (page) { x = page->pobjects; total += x; - nodes[c->node] += x; + nodes[node] += x; } - per_cpu[c->node]++; + per_cpu[node]++; } }
| |