linux-kernel - Re: 2.6.37-rc7: NULL pointer dereference

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 29 Dec 2010 13:50:22 -0800 (PST)
From:	Hugh Dickins <hughd@...gle.com>
To:	Johannes Weiner <hannes@...xchg.org>
cc:	Minchan Kim <minchan.kim@...il.com>,
	Thomas Meyer <thomas@...3r.de>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
	linux-mm <linux-mm@...ck.org>,
	KAMEZAWA Hiroyuki <kamezawa.hiroyu@...fujitsu.com>,
	Balbir Singh <balbir@...ux.vnet.ibm.com>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Hugh Dickins <hughd@...gle.com>
Subject: Re: 2.6.37-rc7: NULL pointer dereference

On Wed, 22 Dec 2010, Johannes Weiner wrote:
> On Thu, Dec 23, 2010 at 12:37:11AM +0900, Minchan Kim wrote:
> > On Wed, Dec 22, 2010 at 9:25 PM, Thomas Meyer <thomas@...3r.de> wrote:
> > > BUG: unable to handle kernel NULL pointer dereference at 00000008
> > > IP: [<c04eae14>] __mem_cgroup_try_charge+0x234/0x430
> > > Process swapoff (pid: 8058, ti=f2e70000 task=f3e55860 task.ti=f2e70000)
> > > Call Trace:
> > >  [<c0456607>] ? ktime_get_ts+0x107/0x140
> > >  [<c04ebb89>] ? mem_cgroup_try_charge_swapin+0x49/0xb0
> > >  [<c04d9b4b>] ? unuse_mm+0x1db/0x300
> > >  [<c04dad9a>] ? sys_swapoff+0x2aa/0x890
> > >  [<c047cd58>] ? audit_syscall_entry+0x218/0x240
> > >  [<c047d043>] ? audit_syscall_exit+0x1f3/0x220
> > >  [<c0403013>] ? sysenter_do_call+0x12/0x22
> 
> This could be explained by a kernel without VM_BUG_ON(), where
> !mm->owner goes uncaught until css_tryget() reads mem.css.flags (eight
> bytes member offset on 32-bit).
> 
> Does
> 	http://marc.info/?l=linux-mm&m=128889198016021&w=2
> help?

I'm sure you're right, Hannes.  Thanks for the prod.  Sadly, Kame
and I both let the fix drift, expecting it to magick its way into
Linus's tree.  We're now at rc8: I'd better change my Acked-by to
a Signed-off-by and try sending it in immediately: will do so now.

Hugh