From: Pekka Enberg <penberg@cs.helsinki.fi>
To: Eric Dumazet <eric.dumazet@gmail.com>
Cc: Christoph Lameter <cl@linux.com>,
Pekka Enberg <penberg@cs.helsinki.fi>,
casteyde.christian@free.fr,
Andrew Morton <akpm@linux-foundation.org>,
netdev@vger.kernel.org, bugzilla-daemon@bugzilla.kernel.org,
bugme-daemon@bugzilla.kernel.org,
Vegard Nossum <vegardno@ifi.uio.no>
Subject: Re: [Bugme-new] [Bug 33502] New: Caught 64-bit read from uninitialized memory in __alloc_skb
Date: Tue, 10 May 2011 13:03:41 +0300 [thread overview]
Message-ID: <4DC90D7D.9030808@cs.helsinki.fi> (raw)
In-Reply-To: <1305016988.2614.6.camel@edumazet-laptop>
On 5/10/11 11:43 AM, Eric Dumazet wrote:
> Le lundi 09 mai 2011 à 15:04 -0500, Christoph Lameter a écrit :
>> On Mon, 9 May 2011, Pekka Enberg wrote:
>>
>>> On Wed, 20 Apr 2011, Eric Dumazet wrote:
>>>> [PATCH v4] slub: dont use cmpxchg_double if KMEMCHECK or DEBUG_PAGEALLOC
>>>>
>>>> Christian Casteyde reported a KMEMCHECK splat in slub code.
>>>>
>>>> Problem is now we are lockless and allow IRQ in slab_alloc(), the object
>>>> we manipulate from freelist can be allocated and freed right before we
>>>> try to read object->next.
>>>>
>>>> Same problem can happen with DEBUG_PAGEALLOC
>>>>
>>>> Just dont use cmpxchg_double() if either CONFIG_KMEMCHECK or
>>>> CONFIG_DEBUG_PAGEALLOC is defined.
>>> Christoph, Eric, is this still relevant after commit 1759415 ("slub: Remove
>>> CONFIG_CMPXCHG_LOCAL ifdeffery") in slab/next of slab.git?
>> There is still an issue and now you can no longer fix the thing through
>> CONFIG_CMPXCHG_LOCAL.
>>
>> It needs to be legal for slub to deref the counter even if the object has
>> been freed.
>>
> I am trying to follow things but honestly I am lost.
>
> Isnt commit 1759415e63 planned for 2.6.40 ?
> ( ref :
> http://git.kernel.org/?p=linux/kernel/git/penberg/slab-2.6.git;a=commitdiff;h=1759415e630e5db0dd2390df9f94892cbfb9a8a2 )
>
> How shall we fix things for 2.6.39 ? I thought my patch was OK for that.
>
>
> Its a bit hard to work with you on this stuff, for a report I made ages
> ago, I find it incredible its not yet fixed in linux-2.6.
>
Can't we fix the issue by putting kmemcheck_mark_initialized() to
set_freepointer()?
next prev parent reply other threads:[~2011-05-10 10:03 UTC|newest]
Thread overview: 66+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <bug-33502-10286@https.bugzilla.kernel.org/>
2011-04-18 22:38 ` [Bugme-new] [Bug 33502] New: Caught 64-bit read from uninitialized memory in __alloc_skb Andrew Morton
2011-04-19 2:51 ` Eric Dumazet
2011-04-19 3:09 ` Eric Dumazet
2011-04-19 3:20 ` Eric Dumazet
2011-04-19 17:10 ` Christoph Lameter
2011-04-19 20:17 ` Eric Dumazet
2011-04-19 21:18 ` Christoph Lameter
2011-04-20 5:04 ` Eric Dumazet
2011-04-20 14:04 ` Christoph Lameter
2011-04-20 5:56 ` Pekka Enberg
2011-04-20 6:04 ` Eric Dumazet
2011-04-20 7:45 ` casteyde.christian
2011-04-20 7:49 ` Pekka Enberg
2011-04-20 8:09 ` Eric Dumazet
2011-04-20 8:21 ` Pekka Enberg
2011-04-20 9:07 ` Eric Dumazet
2011-04-20 10:02 ` Eric Dumazet
2011-04-20 14:05 ` Christoph Lameter
2011-04-20 14:26 ` Eric Dumazet
2011-04-20 14:42 ` Christoph Lameter
2011-04-20 15:01 ` Eric Dumazet
2011-04-20 15:15 ` Vegard Nossum
2011-04-20 15:34 ` Eric Dumazet
2011-04-20 15:17 ` Christoph Lameter
2011-04-20 15:30 ` Eric Dumazet
2011-04-20 19:36 ` Christian Casteyde
2011-04-20 19:55 ` Eric Dumazet
2011-04-20 20:32 ` Eric Dumazet
2011-05-05 6:18 ` Eric Dumazet
2011-05-05 6:22 ` Pekka Enberg
2011-05-05 6:50 ` Eric Dumazet
2011-05-05 18:40 ` Christoph Lameter
2011-05-05 18:48 ` Eric Dumazet
2011-05-05 19:05 ` Christoph Lameter
2011-05-09 19:44 ` Pekka Enberg
2011-05-09 20:04 ` Christoph Lameter
2011-05-09 20:06 ` Pekka Enberg
2011-05-10 8:43 ` Eric Dumazet
2011-05-10 9:47 ` Pekka Enberg
2011-05-10 10:03 ` Eric Dumazet
2011-05-10 10:10 ` Pekka Enberg
2011-05-10 10:03 ` Pekka Enberg [this message]
2011-05-10 10:17 ` Eric Dumazet
2011-05-10 10:19 ` Pekka Enberg
2011-05-10 11:52 ` Eric Dumazet
2011-05-10 12:24 ` Vegard Nossum
2011-05-10 16:39 ` Christoph Lameter
2011-05-10 17:14 ` Eric Dumazet
2011-05-10 17:30 ` Christoph Lameter
2011-05-10 17:43 ` Christoph Lameter
2011-05-10 18:05 ` Eric Dumazet
2011-05-10 18:28 ` Christoph Lameter
2011-05-10 19:05 ` Christoph Lameter
2011-05-10 19:32 ` Eric Dumazet
2011-05-10 19:38 ` Christoph Lameter
2011-05-10 20:06 ` Eric Dumazet
2011-05-10 20:33 ` Christoph Lameter
2011-05-10 20:45 ` Eric Dumazet
2011-05-10 21:22 ` Christoph Lameter
2011-05-11 3:12 ` Eric Dumazet
2011-05-12 14:36 ` Christoph Lameter
2011-05-13 21:15 ` [PATCH] slub: Make CONFIG_PAGE_ALLOC work with new fastpath Christoph Lameter
2011-05-13 21:26 ` Eric Dumazet
2011-05-10 18:07 ` [Bugme-new] [Bug 33502] New: Caught 64-bit read from uninitialized memory in __alloc_skb Christoph Lameter
2011-05-10 16:33 ` Christoph Lameter
2011-04-19 17:09 ` Christoph Lameter
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4DC90D7D.9030808@cs.helsinki.fi \
--to=penberg@cs.helsinki.fi \
--cc=akpm@linux-foundation.org \
--cc=bugme-daemon@bugzilla.kernel.org \
--cc=bugzilla-daemon@bugzilla.kernel.org \
--cc=casteyde.christian@free.fr \
--cc=cl@linux.com \
--cc=eric.dumazet@gmail.com \
--cc=netdev@vger.kernel.org \
--cc=vegardno@ifi.uio.no \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.