Re: [PATCH] memcg: do not expose uninitialized mem_cgroup_per_nodeto world

From: Igor Mammedov
Date: Fri Jun 03 2011 - 08:36:04 EST


On 06/02/2011 01:10 AM, Hiroyuki Kamezawa wrote:
pc = list_entry(list->prev, struct page_cgroup, lru);
Hmm, I disagree your patch is a fix for mainline. At least, a cgroup
before completion of
create() is not populated to userland and you never be able to rmdir()
it because you can't
find it.


>26: e8 7d 12 30 00 call 0x3012a8
>2b:* 8b 73 08 mov 0x8(%ebx),%esi<-- trapping
instruction
>2e: 8b 7c 24 24 mov 0x24(%esp),%edi
>32: 8b 07 mov (%edi),%eax

Hm, what is the call 0x3012a8 ?

pc = list_entry(list->prev, struct page_cgroup, lru);
if (busy == pc) {
list_move(&pc->lru, list);
busy = 0;
spin_unlock_irqrestore(&zone->lru_lock, flags);
continue;
}
spin_unlock_irqrestore(&zone->lru_lock, flags); <---- is call 0x3012a8
ret = mem_cgroup_move_parent(pc, mem, GFP_KERNEL);

and mov 0x8(%ebx),%esi
is dereferencing of 'pc' in inlined mem_cgroup_move_parent

I've looked at vmcore once more and indeed there isn't any parallel task
that touches cgroups code path.
Will investigate if it is xen to blame for incorrect data in place.

Thanks very much for your opinion.
Thanks,
-Kame

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/