linux-kernel - Re: [PATCH] memcg: do not expose uninitialized mem_cgroup_per

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <BANLkTinMamg_qesEffGxKu3QkT=zyQ2MRQ@mail.gmail.com>
Date:	Fri, 3 Jun 2011 22:00:47 +0900
From:	Hiroyuki Kamezawa <kamezawa.hiroyuki@...il.com>
To:	Igor Mammedov <imammedo@...hat.com>
Cc:	Michal Hocko <mhocko@...e.cz>, linux-kernel@...r.kernel.org,
	kamezawa.hiroyu@...fujitsu.com, balbir@...ux.vnet.ibm.com,
	akpm@...ux-foundation.org, linux-mm@...ck.org,
	Paul Menage <menage@...gle.com>,
	Li Zefan <lizf@...fujitsu.com>,
	containers@...ts.linux-foundation.org
Subject: Re: [PATCH] memcg: do not expose uninitialized mem_cgroup_per_node to world

2011/6/3 Igor Mammedov <imammedo@...hat.com>:
> On 06/02/2011 01:10 AM, Hiroyuki Kamezawa wrote:
>>>
>>> pc = list_entry(list->prev, struct page_cgroup, lru);
>>
>> Hmm, I disagree your patch is a fix for mainline. At least, a cgroup
>> before completion of
>> create() is not populated to userland and you never be able to rmdir()
>> it because you can't
>> find it.
>>
>>
>>  >26:   e8 7d 12 30 00          call   0x3012a8
>>  >2b:*  8b 73 08                mov    0x8(%ebx),%esi<-- trapping
>> instruction
>>  >2e:   8b 7c 24 24             mov    0x24(%esp),%edi
>>  >32:   8b 07                   mov    (%edi),%eax
>>
>> Hm, what is the call 0x3012a8 ?
>>
>                pc = list_entry(list->prev, struct page_cgroup, lru);
>                if (busy == pc) {
>                        list_move(&pc->lru, list);
>                        busy = 0;
>                        spin_unlock_irqrestore(&zone->lru_lock, flags);
>                        continue;
>                }
>                spin_unlock_irqrestore(&zone->lru_lock, flags); <---- is
>  call 0x3012a8
>                ret = mem_cgroup_move_parent(pc, mem, GFP_KERNEL);
>
> and  mov 0x8(%ebx),%esi
> is dereferencing of 'pc' in inlined mem_cgroup_move_parent
>
Ah, thank you for input..then panicd at accessing pc->page and "pc"
was 0xfffffff4.
it means list->prev was NULL.

> I've looked at vmcore once more and indeed there isn't any parallel task
> that touches cgroups code path.
> Will investigate if it is xen to blame for incorrect data in place.
>
> Thanks very much for your opinion.

What curious to me is that the fact "list->prev" is NULL.
I can see why you doubt the initialization code ....the list pointer never
contains NULL once it's used....
it smells like memory corruption or some to me. If you have vmcore,
what the problematic mem_cgroup_per_zone(node) contains ?

Thanks,
-Kame
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/