Skip to content
GitLab
Projects Groups Snippets
  • /
  • Help
    • Help
    • Support
    • Community forum
    • Submit feedback
  • Sign in
  • L linux-qy
  • Project information
    • Project information
    • Activity
    • Labels
    • Members
  • Repository
    • Repository
    • Files
    • Commits
    • Branches
    • Tags
    • Contributors
    • Graph
    • Compare
    • Locked Files
  • Issues 0
    • Issues 0
    • List
    • Boards
    • Service Desk
    • Milestones
    • Iterations
    • Requirements
  • Merge requests 0
    • Merge requests 0
  • CI/CD
    • CI/CD
    • Pipelines
    • Jobs
    • Schedules
    • Test Cases
  • Deployments
    • Deployments
    • Environments
    • Releases
  • Packages and registries
    • Packages and registries
    • Container Registry
  • Monitor
    • Monitor
    • Incidents
  • Analytics
    • Analytics
    • Value stream
    • CI/CD
    • Code review
    • Insights
    • Issue
    • Repository
  • Wiki
    • Wiki
  • Snippets
    • Snippets
  • Activity
  • Graph
  • Create a new issue
  • Jobs
  • Commits
  • Issue Boards
Collapse sidebar
  • linux-arm
  • linux-qy
  • Repository
Switch branch/tag
  • linux-qy
  • mm
  • slub.c
Find file BlameHistoryPermalink
  • Laura Abbott's avatar
    mm: slub: really fix slab walking for init_on_free · aea4df4c
    Laura Abbott authored Nov 15, 2019
    Commit 1b7e816f ("mm: slub: Fix slab walking for init_on_free")
    fixed one problem with the slab walking but missed a key detail: When
    walking the list, the head and tail pointers need to be updated since we
    end up reversing the list as a result.  Without doing this, bulk free is
    broken.
    
    One way this is exposed is a NULL pointer with slub_debug=F:
    
      =============================================================================
      BUG skbuff_head_cache (Tainted: G                T): Object already free
      -----------------------------------------------------------------------------
    
      INFO: Slab 0x000000000d2d2f8f objects=16 used=3 fp=0x0000000064309071 flags=0x3fff00000000201
      BUG: kernel NULL pointer dereference, address: 0000000000000000
      Oops: 0000 [#1] PREEMPT SMP PTI
      RIP: 0010:print_trailer+0x70/0x1d5
      Call Trace:
       <IRQ>
       free_debug_processing.cold.37+0xc9/0x149
       __slab_free+0x22a/0x3d0
       kmem_cache_free_bulk+0x415/0x420
       __kfree_skb_flush+0x30/0x40
       net_rx_action+0x2dd/0x480
       __do_softirq+0xf0/0x246
       irq_exit+0x93/0xb0
       do_IRQ+0xa0/0x110
       common_interrupt+0xf/0xf
       </IRQ>
    
    Given we're now almost identical to the existing debugging code which
    correctly walks the list, combine with that.
    
    Link: https://lkml.kernel.org/r/20191104170303.GA50361@gandi.net
    Link: http://lkml.kernel.org/r/20191106222208.26815-1-labbott@redhat.com
    Fixes: 1b7e816f
    
     ("mm: slub: Fix slab walking for init_on_free")
    Signed-off-by: default avatarLaura Abbott <labbott@redhat.com>
    Reported-by: default avatarThibaut Sautereau <thibaut.sautereau@clip-os.org>
    Acked-by: default avatarDavid Rientjes <rientjes@google.com>
    Tested-by: default avatarAlexander Potapenko <glider@google.com>
    Acked-by: default avatarAlexander Potapenko <glider@google.com>
    Cc: Kees Cook <keescook@chromium.org>
    Cc: "David S. Miller" <davem@davemloft.net>
    Cc: Vlastimil Babka <vbabka@suse.cz>
    Cc: <clipos@ssi.gouv.fr>
    Cc: Christoph Lameter <cl@linux.com>
    Cc: Pekka Enberg <penberg@kernel.org>
    Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
    Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    aea4df4c