Re: Ugly rmap NULL ptr deref oopsie on hibernate (was Linux 2.6.34-rc3)
From: Rik van Riel
Date: Wed Apr 07 2010 - 10:13:55 EST
On 04/07/2010 04:36 AM, Peter Zijlstra wrote:
On Tue, 2010-04-06 at 11:28 -0700, Linus Torvalds wrote:
*before* unlink_anon_vma's has actually does that
and what we essentially have is a stale anon_vma_chain entry that still
exists on that same_vma list, and points to an anon_vma that already got
Does it matter? I really can't see that it does.
I think it does, the anon_vma thing has an RCU destroyed slab, but that
doesn't mean the anon_vma object itself is rcu delayed. The moment we
free it it can be re-used. So the above use after free is a bug.
Peter, the avc is an anon_vma_chain, which is a different
object than the anon_vma itself. There is no use after free
of an anon_vma object in unlink_anon_vmas + anon_vma_unlink.
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/