Re: 2.6.28-rc1: EIP: slab_destroy+0x84/0x142

[Alexey Dobriyan <adobriyan@gmail.com>]

On Fri, Oct 24, 2008 at 10:00:45PM -0500, Matt Mackall wrote:
> On Sat, 2008-10-25 at 06:54 +0400, Alexey Dobriyan wrote:
> > On Sat, Oct 25, 2008 at 04:24:06AM +0400, Alexey Dobriyan wrote:
> > > On Fri, Oct 24, 2008 at 06:29:47PM -0500, Christoph Lameter wrote:
> > > > On Sat, 25 Oct 2008, Alexey Dobriyan wrote:
> > > >
> > > >> Fault occured at slab_destroy in KVM guest kernel.
> > > >
> > > > Please switch on all SLAB debug options and rerun.
> > > 
> > > They're already on!
> > > 
> > > New knowledge: turning off just DEBUG_PAGEALLOC makes oops dissapear,
> > > other debugging options don't matter.
> > 
> > Here is typical scenario:
> > cache -- filp or dentry, ->buffer_size = 4096, objp = c643d000, dbg_redzone1 = c643df78.
> > 
> > Unable to handle ... at c643df7c. which is not next page.
> 
> Huh. That sounds more like an actual use-after-free. Possible that the
> object is getting freed twice?
> 
> There's a call to kernel_map_pages(..., 0) on line 2905 of slab.c.
> Commenting it out will nullify the debugging effect of DEBUG_PAGEALLOC
> without changing the layout decisions and other behavior. If that kernel
> works, that probably means your oops is a genuine use-after-free.

Commenting this code helps very much, looking further...

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>