Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932179Ab0DFXmX (ORCPT ); Tue, 6 Apr 2010 19:42:23 -0400 Received: from smtp1.linux-foundation.org ([140.211.169.13]:39737 "EHLO smtp1.linux-foundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1757782Ab0DFXmQ (ORCPT ); Tue, 6 Apr 2010 19:42:16 -0400 Date: Tue, 6 Apr 2010 16:37:51 -0700 (PDT) From: Linus Torvalds To: Borislav Petkov cc: Andrew Morton , Rik van Riel , Minchan Kim , KOSAKI Motohiro , Linux Kernel Mailing List , Lee Schermerhorn , Nick Piggin , Andrea Arcangeli , Hugh Dickins , sgunderson@bigfoot.com Subject: Re: Ugly rmap NULL ptr deref oopsie on hibernate (was Linux 2.6.34-rc3) In-Reply-To: <20100406225925.GA3446@liondog.tnic> Message-ID: References: <1270572327.1711.3.camel@barrios-desktop> <4BBB69A9.5090906@redhat.com> <20100406120315.53ad7390.akpm@linux-foundation.org> <20100406194238.GB20357@a1.tnic> <20100406205123.GC20357@a1.tnic> <20100406225925.GA3446@liondog.tnic> User-Agent: Alpine 2.00 (LFD 1167 2008-08-23) MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1260 Lines: 31 On Wed, 7 Apr 2010, Borislav Petkov wrote: > + > + if (!anon_vma->head.next) { > + printk(KERN_ERR "NULL anon_vma->head.next, page %lu\n", > + page_to_pfn(page)); > + > + object_err(anon_vma_cachep, page, (u8 *)anon_vma, "NULL next"); Oh, and since the debugging code never triggered ('head.next' wasn't actually NULL), you never got here, but the 'page' you passed in to object_error() should be the page of the slab allocation, not the page associated with the anon_vma. So it should be something like "virt_to_head_page(anon_vma)" that you pass in to object_err(). Not that it matters. I assume it is the fact that SLAB debugging is on that actually turns the NULL into a non-NULL thing. Poisoning is not active for SLUb's with constructors or RCU-freeing, but things like redzoning still are. So enabling SLUB debugging will change the offsets within the pages of all the SLUB allocations. I wonder if that's just what caused it to now have that 0x002e2e2e002e2e2e instead of NULL. Linus -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/