lkml.org 
[lkml]   [2015]   [Nov]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
Subjectpids_free double free.
One of my debian boxes got a systemd update. After rebooting,
I started seeing a use-after-free trace, followed by a lockup.

I have two slightly different traces from separate boots,
which may give some clue as to how it's getting free'd in two ways..

http://codemonkey.org.uk/junk/IMG_0474.jpg
http://codemonkey.org.uk/junk/IMG_0476.jpg

This isn't new, I booted back to 4.3, and hit slab debugging warnings
from the same code. (At the least it was broken differently)

The WARN_ON referenced in the 2nd trace is this..

static void pids_cancel(struct pids_cgroup *pids, int num)
{
/*
* A negative count (or overflow for that matter) is invalid,
* and indicates a bug in the `pids` controller proper.
*/
WARN_ON_ONCE(atomic64_add_negative(-num, &pids->counter));
}


Dave


\
 
 \ /
  Last update: 2015-11-20 05:41    [W:0.032 / U:0.116 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site