memcg: avoid accessing memcg after releasing reference
Subsystems (3)
PATCH 1/1 memcg: avoid accessing memcg after releasing reference
This might cause use-after-free bug.
Signed-off-by Li Zefan <[email protected]>
---
found when reading the code.
--- mm/memcontrol.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
mm/memcontrol.c +1 -1
@@ -3186,12 +3186,12 @@ void memcg_release_cache(struct kmem_cache *s) root = s->memcg_params->root_cache; root->memcg_params->memcg_caches[id] =NULL ; -mem_cgroup_put (memcg);mutex_lock (&memcg->slab_caches_mutex);list_del (&s->memcg_params->list);mutex_unlock (&memcg->slab_caches_mutex); +mem_cgroup_put (memcg); out:kfree (s->memcg_params); }
Signature · 1 line
1.8.0.2
Quoted 3 lines · Li Zefan
This might cause use-after-free bug.
Signed-off-by Li Zefan <[email protected]>
Thank you.
Quoted 3 lines · Li Zefan
This might cause use-after-free bug.
Signed-off-by Li Zefan <[email protected]>
Acked-by Michal Hocko <[email protected]>
Quoted 28 lines
---
found when reading the code.
--- mm/memcontrol.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)mm/memcontrol.c +1
-1@@ -3186,12 +3186,12 @@ void memcg_release_cache(struct kmem_cache *s) root = s->memcg_params->root_cache; root->memcg_params->memcg_caches[id] =NULL ; -mem_cgroup_put (memcg);mutex_lock (&memcg->slab_caches_mutex);list_del (&s->memcg_params->list);mutex_unlock (&memcg->slab_caches_mutex); +mem_cgroup_put (memcg); out:kfree (s->memcg_params); }Signature · 1 line
1.8.0.2
Signature · 2 lines
Michal Hocko SUSE Labs