Re: [Bugme-new] [Bug 33502] New: Caught 64-bit read from uninitialized memory in __alloc_skb

Eric Dumazet
2011-04-19T03:09:23Z

Le mardi 19 avril 2011 à 04:51 +0200, Eric Dumazet a écrit :

> Hmm, looking at mm/slub.c, I wonder what prevents "object" from pointing
> to a now freed and unreachable zone of memory. (Say we are interrupted,
> object given to interrupt handler and this one wants to change page bits
> to trap access)

Yes, I suspect this whole business is not kmemcheck compatable, or
DEBUG_PAGEALLOC

get_freepointer(s, object) can access to freed memory and kmemcheck
triggers the fault, while this_cpu_cmpxchg_double() would presumably
detect a change of tid and would not perform the freelist/tid change.