On Sat, 20 May 2017, Thomas Gleixner wrote: > memcg_propagate_slab_attrs() abuses the sysfs attribute file functions to > propagate settings from the root kmem_cache to a newly created > kmem_cache. It does that with: > > attr->show(root, buf); > attr->store(new, buf, strlen(bug); > > Aside of being a lazy and absurd hackery this is broken because it does not > check the return value of the show() function. > > Some of the show() functions return 0 w/o touching the buffer. That means in > such a case the store function is called with the stale content of the > previous show(). That causes nonsense like invoking kmem_cache_shrink() on > a newly created kmem_cache. In the worst case it would cause handing in an > uninitialized buffer. > > This should be rewritten proper by adding a propagate() callback to those > slub_attributes which must be propagated and avoid that insane conversion > to and from ASCII, but that's too large for a hot fix. > > Check at least the return value of the show() function, so calling store() > with stale content is prevented. > > Reported-by: Steven Rostedt <rostedt@xxxxxxxxxxx> > Signed-off-by: Thomas Gleixner <tglx@xxxxxxxxxxxxx> > Cc: stable@xxxxxxxxxxxxxxx Acked-by: David Rientjes <rientjes@xxxxxxxxxx> -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@xxxxxxxxx. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: <a href=mailto:"dont@xxxxxxxxx";> email@xxxxxxxxx </a>
