On Sat, 20 May 2017, Thomas Gleixner wrote: > memcg_propagate_slab_attrs() abuses the sysfs attribute file functions to > propagate settings from the root kmem_cache to a newly created > kmem_cache. It does that with: > > attr->show(root, buf); > attr->store(new, buf, strlen(bug); > > Aside of being a lazy and absurd hackery this is broken because it does not > check the return value of the show() function. > > Some of the show() functions return 0 w/o touching the buffer. That means in > such a case the store function is called with the stale content of the > previous show(). That causes nonsense like invoking kmem_cache_shrink() on > a newly created kmem_cache. In the worst case it would cause handing in an > uninitialized buffer. > > This should be rewritten proper by adding a propagate() callback to those > slub_attributes which must be propagated and avoid that insane conversion > to and from ASCII, but that's too large for a hot fix. > > Check at least the return value of the show() function, so calling store() > with stale content is prevented. > > Reported-by: Steven Rostedt <rost...@goodmis.org> > Signed-off-by: Thomas Gleixner <t...@linutronix.de> > Cc: sta...@vger.kernel.org
Acked-by: David Rientjes <rient...@google.com>
