Message ID | alpine.DEB.2.00.1201170910130.4800@router.home |
---|---|
State | Not Applicable, archived |
Delegated to: | David Miller |
Headers | show |
Le mardi 17 janvier 2012 à 09:12 -0600, Christoph Lameter a écrit : > On Sun, 15 Jan 2012, Eric Dumazet wrote: > > > As soon as the slub_lock is released, another thread can come and find > > the new kmem_cache. > > Slabs are not looked up by name. A pointer to kmem_cache is passed to slab > functions and that pointer is returned from kmem_cache_create(). The risk > is someone traversing the kmem_cach list which is only done from within slub. > > > Subject: slub: Do not hold slub_lock when calling sysfs_slab_add() > > sysfs_slab_add() calls various sysfs functions that actually may > end up in userspace doing all sorts of things. > > Release the slub_lock after adding the kmem_cache structure to the list. > At that point the address of the kmem_cache is not known so we are > guaranteed exlusive access to the following modifications to the > kmem_cache structure. > > If the sysfs_slab_add fails then reacquire the slub_lock to > remove the kmem_cache structure from the list. > > Signed-off-by: Christoph Lameter <cl@linux.com> > > --- > mm/slub.c | 4 +++- > 1 file changed, 3 insertions(+), 1 deletion(-) > > Index: linux-2.6/mm/slub.c > =================================================================== > --- linux-2.6.orig/mm/slub.c 2012-01-17 03:07:11.140010438 -0600 > +++ linux-2.6/mm/slub.c 2012-01-17 03:07:19.532010264 -0600 > @@ -3929,13 +3929,15 @@ struct kmem_cache *kmem_cache_create(con > if (kmem_cache_open(s, n, > size, align, flags, ctor)) { > list_add(&s->list, &slab_caches); > + up_write(&slub_lock); > if (sysfs_slab_add(s)) { > + down_write(&slub_lock); > list_del(&s->list); > + up_write(&slub_lock); > kfree(n); > kfree(s); > goto err; > } > - up_write(&slub_lock); > return s; > } > kfree(n); Buggy patch, since "goto err;" is going to up_write(&slub_lock) again. Also Christoph, you forgot to add the very much needed : Reported-by: Sasha Levin <levinsasha928@gmail.com> -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Index: linux-2.6/mm/slub.c =================================================================== --- linux-2.6.orig/mm/slub.c 2012-01-17 03:07:11.140010438 -0600 +++ linux-2.6/mm/slub.c 2012-01-17 03:07:19.532010264 -0600 @@ -3929,13 +3929,15 @@ struct kmem_cache *kmem_cache_create(con if (kmem_cache_open(s, n, size, align, flags, ctor)) { list_add(&s->list, &slab_caches); + up_write(&slub_lock); if (sysfs_slab_add(s)) { + down_write(&slub_lock); list_del(&s->list); + up_write(&slub_lock); kfree(n); kfree(s); goto err; } - up_write(&slub_lock); return s; } kfree(n);