Re: [Bluez-devel] Warnings and Oops on 2.6.23-rc6 while activily using rfcomm links (mm/slab.c)

[Cornelia Huck <cornelia.huck@de.ibm.com>]

On Thu, 27 Sep 2007 20:07:54 +0200,
Pierre-Yves Paulus <py@idlum.be> wrote:

> Another one below, complete log from power-up to reboot, with some bugs =

> and one Oops. I only trimmed the numerous "l2cap_recv_acldata" and "ACL =

> packet for unknown connection handle" lines which always fill up the log.

Hmm, looked at it, but currently I can't see what's wrong from a driver
core perspective...


> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D
> BUG kmalloc-128: Poison overwritten
> -------------------------------------------------------------------------=
----
> =

> INFO: 0xc5734f28-0xc5734f40. First byte 0x6a instead of 0x6b
> INFO: Allocated in rfcomm_dev_ioctl+0xbd/0x4e6 [rfcomm] age=3D6110 cpu=3D=
0 =

> pid=3D3677
> INFO: Freed in rfcomm_dev_destruct+0x59/0x65 [rfcomm] age=3D3157 cpu=3D0 =

> pid=3D3927
> INFO: Slab 0xc10ae680 used=3D21 fp=3D0xc5734f20 flags=3D0x400000c2
> INFO: Object 0xc5734f20 @offset=3D3872 fp=3D0xc57342c0
> =

> Bytes b4 0xc5734f10:  05 00 00 00 f8 23 0f 00 5a 5a 5a 5a 5a 5a 5a 5a =

> ....=F8#..ZZZZZZZZ
>    Object 0xc5734f20:  6b 6b 6b 6b 6b 6b 6b 6b 6a 6b 6b 6b 6b 6b 6b 6b =

                                                 ^^

This looks suspiciously like someone tried to decrease a refcount on a
freed kobject. Unfortunately, we only see this after the fact with slub
debugging turned on :( So could you please turn it off again (but leave
kobject debugging on) and try with the following silly debug patch:

---
 lib/kobject.c |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

--- linux-2.6.orig/lib/kobject.c
+++ linux-2.6/lib/kobject.c
@@ -502,8 +502,12 @@ static void kobject_release(struct kref =

  */
 void kobject_put(struct kobject * kobj)
 {
-	if (kobj)
+	if (kobj) {
+		if (!atomic_read(&kobj->kref.refcount))
+			pr_debug("%s: kobject %s@%p already has zero refcount!\n",
+				 __FUNCTION__, kobj->name, kobj);
 		kref_put(&kobj->kref, kobject_release);
+	}
 }
 =

 =


-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2005.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Bluez-devel mailing list
Bluez-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/bluez-devel