Subject: [PATCH 09/16] FIX [1/2] slub: Do not dereference NULL pointer in node_match
From: Sebastian Andrzej Siewior <[email-masked]>
To: Steven Rostedt <[email-masked]>
Cc: [email-masked], [email-masked], Carsten Emde <[email-masked]>, Christoph Lameter <[email-masked]>, Pekka Enberg <[email-masked]>, Thomas Gleixner <[email-masked]>, Sebastian Andrzej Siewior <[email-masked]>
Date: Wed, 13 Feb 2013 17:12:04 +0100
List-Id: <linux-rt-users.vger.kernel.org>

From: Christoph Lameter <[email-masked]>

The variables accessed in slab_alloc are volatile and therefore
the page pointer passed to node_match can be NULL. The processing
of data in slab_alloc is tentative until either the cmpxhchg
succeeds or the __slab_alloc slowpath is invoked. Both are
able to perform the same allocation from the freelist.

Check for the NULL pointer in node_match.

A false positive will lead to a retry of the loop in __slab_alloc.

Signed-off-by: Christoph Lameter <[email-masked]>
Cc: Steven Rostedt <[email-masked]>
Cc: Pekka Enberg <[email-masked]>
Signed-off-by: Thomas Gleixner <[email-masked]>
[bigeasy@linutronix: replace page with c->page]
Signed-off-by: Sebastian Andrzej Siewior <[email-masked]>
---
 mm/slub.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Index: linux-3.2.35-rt53/mm/slub.c
===================================================================
--- linux-3.2.35-rt53.orig/mm/slub.c
+++ linux-3.2.35-rt53/mm/slub.c
@@ -2038,7 +2038,7 @@ static void flush_all(struct kmem_cache
 static inline int node_match(struct kmem_cache_cpu *c, int node)
 {
 #ifdef CONFIG_NUMA
-	if (node != NUMA_NO_NODE && c->node != node)
+	if (!c->page || (node != NUMA_NO_NODE && c->node != node))
 		return 0;
 #endif
 	return 1;