Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932252Ab0DGAOm (ORCPT ); Tue, 6 Apr 2010 20:14:42 -0400 Received: from smtp1.linux-foundation.org ([140.211.169.13]:51378 "EHLO smtp1.linux-foundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932182Ab0DGAOh (ORCPT ); Tue, 6 Apr 2010 20:14:37 -0400 Date: Tue, 6 Apr 2010 17:10:15 -0700 (PDT) From: Linus Torvalds To: Rik van Riel cc: Borislav Petkov , Andrew Morton , Minchan Kim , KOSAKI Motohiro , Linux Kernel Mailing List , Lee Schermerhorn , Nick Piggin , Andrea Arcangeli , Hugh Dickins , sgunderson@bigfoot.com Subject: Re: Ugly rmap NULL ptr deref oopsie on hibernate (was Linux 2.6.34-rc3) In-Reply-To: <4BBBC240.3090302@redhat.com> Message-ID: References: <1270571019.1814.163.camel@barrios-desktop> <1270572327.1711.3.camel@barrios-desktop> <4BBB69A9.5090906@redhat.com> <20100406120315.53ad7390.akpm@linux-foundation.org> <20100406194238.GB20357@a1.tnic> <20100406205123.GC20357@a1.tnic> <4BBBC240.3090302@redhat.com> User-Agent: Alpine 2.00 (LFD 1167 2008-08-23) MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1260 Lines: 36 On Tue, 6 Apr 2010, Rik van Riel wrote: > > It gets more fun. It looks like the anon_vma is only > allocated through anon_vma_alloc() and only handled > by the functions in rmap.c > > By themselves, all of those functions look alright. Yes. Very trivially so, in fact. > However, I think I may have found a possible bug in > the interplay between anon_vma_prepare() and vma_adjust(), > across several mprotect invocations. > > Let me explain what I think may be going on in small > steps, since it is quite subtle (assuming I am right). Sounds at least possible. Way more likely than any of the "trivially obvious" code being buggy, or the SLUB layer suddenly having a serious bug that only the new user could trigger. That said, the code that _really_ confuses me is the stuff that uses "anon_vma_clone()". Could you please also explain the code flow of vma_adjust() to mere mortals, please? I suspect Borislav is sleeping. But at least we have a patch for him to test when he wakes up ;) Linus -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/