From mboxrd@z Thu Jan 1 00:00:00 1970 From: Christoph Lameter Subject: Re: FIX [1/2] slub: Do not dereference NULL pointer in node_match Date: Thu, 24 Jan 2013 15:14:43 +0000 Message-ID: <0000013c6d200e1d-03ae09c1-6fb8-42eb-ab6c-8fcae05fdb6e-000000@email.amazonses.com> References: <20130123214514.370647954@linux.com> <0000013c695fbd30-9023bc55-f780-4d44-965f-ab4507e483d5-000000@email.amazonses.com> <1358988824.3351.5.camel@kernel> Mime-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Cc: Pekka Enberg , Steven Rostedt , Thomas Gleixner , RT , Clark Williams , John Kacur , "Luis Claudio R. Goncalves" , Joonsoo Kim , Glauber Costa , linux-mm@kvack.org, David Rientjes , elezegarcia@gmail.com To: Simon Jeons Return-path: In-Reply-To: <1358988824.3351.5.camel@kernel> Sender: owner-linux-mm@kvack.org List-Id: linux-rt-users.vger.kernel.org On Wed, 23 Jan 2013, Simon Jeons wrote: > On Wed, 2013-01-23 at 21:45 +0000, Christoph Lameter wrote: > > The variables accessed in slab_alloc are volatile and therefore > > the page pointer passed to node_match can be NULL. The processing > > of data in slab_alloc is tentative until either the cmpxhchg > > succeeds or the __slab_alloc slowpath is invoked. Both are > > able to perform the same allocation from the freelist. > > > > Check for the NULL pointer in node_match. > > > > A false positive will lead to a retry of the loop in __slab_alloc. > > Hi Christoph, > > Since page_to_nid(NULL) will trigger bug, then how can run into > __slab_alloc? page = NULL -> node_match(NULL, xx) = 0 -> call into __slab_alloc. __slab_alloc() will check for !c->page which requires the assignment of a new per cpu slab page. -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: email@kvack.org