From: Waiman Long <longman@redhat.com>
To: Christoph Lameter <cl@linux.com>,
Pekka Enberg <penberg@kernel.org>,
David Rientjes <rientjes@google.com>,
Joonsoo Kim <iamjoonsoo.kim@lge.com>,
Andrew Morton <akpm@linux-foundation.org>,
Kees Cook <keescook@chromium.org>
Cc: linux-mm@kvack.org, linux-kernel@vger.kernel.org,
Changbin Du <changbin.du@gmail.com>,
Matthew Wilcox <willy@infradead.org>,
Markus Elfring <Markus.Elfring@web.de>
Subject: Re: [PATCH v3] mm/slub: Fix incorrect interpretation of s->offset
Date: Wed, 29 Apr 2020 09:55:21 -0400 [thread overview]
Message-ID: <7530523e-749c-dac7-f6ab-f52dcb20ecb9@redhat.com> (raw)
In-Reply-To: <20200429135328.26976-1-longman@redhat.com>
On 4/29/20 9:53 AM, Waiman Long wrote:
> In a couple of places in the slub memory allocator, the code uses
> "s->offset" as a check to see if the free pointer is put right after the
> object. That check is no longer true with commit 3202fa62fb43 ("slub:
> relocate freelist pointer to middle of object").
>
> As a result, echoing "1" into the validate sysfs file, e.g. of dentry,
> may cause a bunch of "Freepointer corrupt" error reports like the
> following to appear with the system in panic afterwards.
>
> [ 38.579769] =============================================================================
> [ 38.580845] BUG dentry(666:pmcd.service) (Tainted: G B): Freepointer corrupt
> [ 38.581948] -----------------------------------------------------------------------------
>
> To fix it, use the check "s->offset == s->inuse" in the new helper
Sorry, forgot to change the commit log to ">=". Anyway, this is a
serious bug that needs to be fixed before v5.7 is released.
Cheers,
Longman
next prev parent reply other threads:[~2020-04-29 13:55 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-04-29 13:53 Waiman Long
2020-04-29 13:55 ` Waiman Long [this message]
2020-04-29 15:54 ` Matthew Wilcox
2020-04-29 16:42 ` Markus Elfring
2020-04-29 18:25 ` Matthew Wilcox
2020-05-01 21:29 ` Rafael Aquini
2020-05-01 22:01 ` Kees Cook
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=7530523e-749c-dac7-f6ab-f52dcb20ecb9@redhat.com \
--to=longman@redhat.com \
--cc=Markus.Elfring@web.de \
--cc=akpm@linux-foundation.org \
--cc=changbin.du@gmail.com \
--cc=cl@linux.com \
--cc=iamjoonsoo.kim@lge.com \
--cc=keescook@chromium.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=penberg@kernel.org \
--cc=rientjes@google.com \
--cc=willy@infradead.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox