From: Pekka Enberg <penberg@kernel.org>
To: Markus Trippelsdorf <markus@trippelsdorf.de>
Cc: Christoph Lameter <cl@linux.com>,
Eric Dumazet <eric.dumazet@gmail.com>,
"Alex,Shi" <alex.shi@intel.com>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
"linux-mm@kvack.org" <linux-mm@kvack.org>,
Matt Mackall <mpm@selenic.com>,
"netdev@vger.kernel.org" <netdev@vger.kernel.org>,
tj@kernel.org, dri-devel@lists.freedesktop.org,
Alex Deucher <alexander.deucher@amd.com>,
Dave Airlie <airlied@redhat.com>
Subject: Re: WARNING: at mm/slub.c:3357, kernel BUG at mm/slub.c:3413
Date: Thu, 1 Dec 2011 10:53:11 +0200 (EET) [thread overview]
Message-ID: <alpine.LFD.2.02.1112011053070.4549@tux.localdomain> (raw)
In-Reply-To: <20111201084437.GA1529@x4.trippels.de>
On Thu, 1 Dec 2011, Markus Trippelsdorf wrote:
> On 2011.11.24 at 09:50 +0100, Markus Trippelsdorf wrote:
>> On 2011.11.23 at 10:06 -0600, Christoph Lameter wrote:
>>> On Wed, 23 Nov 2011, Markus Trippelsdorf wrote:
>>>
>>>>> FIX idr_layer_cache: Marking all objects used
>>>>
>>>> Yesterday I couldn't reproduce the issue at all. But today I've hit
>>>> exactly the same spot again. (CCing the drm list)
>>>
>>> Well this is looks like write after free.
>>>
>>>> =============================================================================
>>>> BUG idr_layer_cache: Poison overwritten
>>>> -----------------------------------------------------------------------------
>>>> Object ffff8802156487c0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
>>>> Object ffff8802156487d0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
>>>> Object ffff8802156487e0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
>>>> Object ffff8802156487f0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
>>>> Object ffff880215648800: 00 00 00 00 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b ....kkkkkkkkkkkk
>>>> Object ffff880215648810: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
>>>
>>> And its an integer sized write of 0. If you look at the struct definition
>>> and lookup the offset you should be able to locate the field that
>>> was modified.
>
> It also happens with CONFIG_SLAB.
> (If someone wants to reproduce the issue, just run a kexec boot loop and
> the bug will occur after a few (~10) iterations.)
>
> Dec 1 05:04:52 x4 kernel: [drm] Initialized drm 1.1.0 20060810
> Dec 1 05:04:52 x4 kernel: [drm] radeon defaulting to kernel modesetting.
> Dec 1 05:04:52 x4 kernel: [drm] radeon kernel modesetting enabled.
> Dec 1 05:04:52 x4 kernel: radeon 0000:01:05.0: PCI INT A -> GSI 18 (level, low) -> IRQ 18
> Dec 1 05:04:52 x4 kernel: radeon 0000:01:05.0: setting latency timer to 64
> Dec 1 05:04:52 x4 kernel: [drm] initializing kernel modesetting (RS780 0x1002:0x9614 0x1043:0x834D).
> Dec 1 05:04:52 x4 kernel: [drm] register mmio base: 0xFBEE0000
> Dec 1 05:04:52 x4 kernel: [drm] register mmio size: 65536
> Dec 1 05:04:52 x4 kernel: ATOM BIOS: 113
> Dec 1 05:04:52 x4 kernel: radeon 0000:01:05.0: VRAM: 128M 0x00000000C0000000 - 0x00000000C7FFFFFF (128M used)
> Dec 1 05:04:52 x4 kernel: radeon 0000:01:05.0: GTT: 512M 0x00000000A0000000 - 0x00000000BFFFFFFF
> Dec 1 05:04:52 x4 kernel: [drm] Detected VRAM RAM=128M, BAR=128M
> Dec 1 05:04:52 x4 kernel: [drm] RAM width 32bits DDR
> Dec 1 05:04:52 x4 kernel: [TTM] Zone kernel: Available graphics memory: 4090750 kiB.
> Dec 1 05:04:52 x4 kernel: [TTM] Zone dma32: Available graphics memory: 2097152 kiB.
> Dec 1 05:04:52 x4 kernel: [TTM] Initializing pool allocator.
> Dec 1 05:04:52 x4 kernel: [drm] radeon: 128M of VRAM memory ready
> Dec 1 05:04:52 x4 kernel: [drm] radeon: 512M of GTT memory ready.
> Dec 1 05:04:52 x4 kernel: [drm] Supports vblank timestamp caching Rev 1 (10.10.2010).
> Dec 1 05:04:52 x4 kernel: [drm] Driver supports precise vblank timestamp query.
> Dec 1 05:04:52 x4 kernel: [drm] radeon: irq initialized.
> Dec 1 05:04:52 x4 kernel: [drm] GART: num cpu pages 131072, num gpu pages 131072
> Dec 1 05:04:52 x4 kernel: [drm] Loading RS780 Microcode
> Dec 1 05:04:52 x4 kernel: [drm] PCIE GART of 512M enabled (table at 0x00000000C0040000).
> Dec 1 05:04:52 x4 kernel: radeon 0000:01:05.0: WB enabled
> Dec 1 05:04:52 x4 kernel: Slab corruption: size-1024 start=ffff880216cbc730, len=1024
> Dec 1 05:04:52 x4 kernel: Redzone: 0x9f911029d74e35b/0x9f911029d74e35b.
> Dec 1 05:04:52 x4 kernel: Last user: [< (null)>](0x0)
> Dec 1 05:04:52 x4 kernel: 0d0: 00 00 00 00 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b ....kkkkkkkkkkkk
> Dec 1 05:04:52 x4 kernel: Prev obj: start=ffff880216cbc318, len=1024
> Dec 1 05:04:52 x4 kernel: Redzone: 0x9f911029d74e35b/0x9f911029d74e35b.
> Dec 1 05:04:52 x4 kernel: Last user: [< (null)>](0x0)
> Dec 1 05:04:52 x4 kernel: 000: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
> Dec 1 05:04:52 x4 kernel: 010: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
> Dec 1 05:04:52 x4 kernel: Next obj: start=ffff880216cbcb48, len=1024
> Dec 1 05:04:52 x4 kernel: Redzone: 0xd84156c5635688c0/0xd84156c5635688c0.
> Dec 1 05:04:52 x4 kernel: Last user: [<ffffffff81299874>](radeon_bo_create+0xb4/0x240)
> Dec 1 05:04:52 x4 kernel: 000: 48 cb cb 16 02 88 ff ff 48 cb cb 16 02 88 ff ff H.......H.......
> Dec 1 05:04:52 x4 kernel: 010: 02 00 27 00 00 00 00 00 00 00 00 00 00 00 00 00 ..'.............
> Dec 1 05:04:52 x4 kernel: [drm] ring test succeeded in 0 usecs
> Dec 1 05:04:52 x4 kernel: [drm] radeon: ib pool ready.
> Dec 1 05:04:52 x4 kernel: [drm] ib test succeeded in 0 usecs
> Dec 1 05:04:52 x4 kernel: [drm] Radeon Display Connectors
> Dec 1 05:04:52 x4 kernel: [drm] Connector 0:
> Dec 1 05:04:52 x4 kernel: [drm] VGA
> Dec 1 05:04:52 x4 kernel: [drm] DDC: 0x7e40 0x7e40 0x7e44 0x7e44 0x7e48 0x7e48 0x7e4c 0x7e4c
> Dec 1 05:04:52 x4 kernel: [drm] Encoders:
> Dec 1 05:04:52 x4 kernel: [drm] CRT1: INTERNAL_KLDSCP_DAC1
> Dec 1 05:04:52 x4 kernel: [drm] Connector 1:
> Dec 1 05:04:52 x4 kernel: [drm] DVI-D
> Dec 1 05:04:52 x4 kernel: [drm] HPD3
> Dec 1 05:04:52 x4 kernel: [drm] DDC: 0x7e50 0x7e50 0x7e54 0x7e54 0x7e58 0x7e58 0x7e5c 0x7e5c
> Dec 1 05:04:52 x4 kernel: [drm] Encoders:
> Dec 1 05:04:52 x4 kernel: [drm] DFP3: INTERNAL_KLDSCP_LVTMA
> Dec 1 05:04:52 x4 kernel: [drm] radeon: power management initialized
> Dec 1 05:04:52 x4 kernel: [drm] fb mappable at 0xF0142000
> Dec 1 05:04:52 x4 kernel: [drm] vram apper at 0xF0000000
> Dec 1 05:04:52 x4 kernel: [drm] size 7299072
> Dec 1 05:04:52 x4 kernel: [drm] fb depth is 24
> Dec 1 05:04:52 x4 kernel: [drm] pitch is 6912
> Dec 1 05:04:52 x4 kernel: fbcon: radeondrmfb (fb0) is primary device
> Dec 1 05:04:52 x4 kernel: Console: switching to colour frame buffer device 131x105
> Dec 1 05:04:52 x4 kernel: fb0: radeondrmfb frame buffer device
> Dec 1 05:04:52 x4 kernel: drm: registered panic notifier
> Dec 1 05:04:52 x4 kernel: [drm] Initialized radeon 2.12.0 20080528 for 0000:01:05.0 on minor 0
>
>
> Dec 1 05:09:35 x4 kernel: radeon 0000:01:05.0: WB enabled
> Dec 1 05:09:35 x4 kernel: [drm] ring test succeeded in 1 usecs
> Dec 1 05:09:35 x4 kernel: [drm] radeon: ib pool ready.
> Dec 1 05:09:35 x4 kernel: [drm] ib test succeeded in 0 usecs
> Dec 1 05:09:35 x4 kernel: Slab corruption: size-512 start=ffff880216f7e760, len=512
> Dec 1 05:09:35 x4 kernel: Redzone: 0x9f911029d74e35b/0x9f911029d74e35b.
> Dec 1 05:09:35 x4 kernel: Last user: [< (null)>](0x0)
> Dec 1 05:09:35 x4 kernel: 0a0: 00 00 00 00 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b ....kkkkkkkkkkkk
> Dec 1 05:09:35 x4 kernel: Prev obj: start=ffff880216f7e548, len=512
> Dec 1 05:09:35 x4 kernel: Redzone: 0x9f911029d74e35b/0x9f911029d74e35b.
> Dec 1 05:09:35 x4 kernel: Last user: [< (null)>](0x0)
> Dec 1 05:09:35 x4 kernel: 000: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
> Dec 1 05:09:35 x4 kernel: 010: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
> Dec 1 05:09:35 x4 kernel: Next obj: start=ffff880216f7e978, len=512
> Dec 1 05:09:35 x4 kernel: Redzone: 0xd84156c5635688c0/0xd84156c5635688c0.
> Dec 1 05:09:35 x4 kernel: Last user: [<ffffffff812e519d>](radeon_add_atom_encoder+0x7d/0x280)
> Dec 1 05:09:35 x4 kernel: 000: f8 d3 f6 16 02 88 ff ff 18 d8 f6 16 02 88 ff ff ................
> Dec 1 05:09:35 x4 kernel: 010: 18 d8 f6 16 02 88 ff ff 0c 00 00 00 e0 e0 e0 e0 ................
> Dec 1 05:09:35 x4 kernel: [drm] Radeon Display Connectors
> Dec 1 05:09:35 x4 kernel: [drm] Connector 0:
> Dec 1 05:09:35 x4 kernel: [drm] VGA
> Dec 1 05:09:35 x4 kernel: [drm] DDC: 0x7e40 0x7e40 0x7e44 0x7e44 0x7e48 0x7e48 0x7e4c 0x7e4c
> Dec 1 05:09:35 x4 kernel: [drm] Encoders:
> Dec 1 05:09:35 x4 kernel: [drm] CRT1: INTERNAL_KLDSCP_DAC1
> Dec 1 05:09:35 x4 kernel: [drm] Connector 1:
> Dec 1 05:09:35 x4 kernel: [drm] DVI-D
> Dec 1 05:09:35 x4 kernel: [drm] HPD3
> Dec 1 05:09:35 x4 kernel: [drm] DDC: 0x7e50 0x7e50 0x7e54 0x7e54 0x7e58 0x7e58 0x7e5c 0x7e5c
> Dec 1 05:09:35 x4 kernel: [drm] Encoders:
> Dec 1 05:09:35 x4 kernel: [drm] DFP3: INTERNAL_KLDSCP_LVTMA
> Dec 1 05:09:35 x4 kernel: [drm] radeon: power management initialized
> Dec 1 05:09:35 x4 kernel: [drm] fb mappable at 0xF0142000
> Dec 1 05:09:35 x4 kernel: [drm] vram apper at 0xF0000000
> Dec 1 05:09:35 x4 kernel: [drm] size 7299072
> Dec 1 05:09:35 x4 kernel: [drm] fb depth is 24
> Dec 1 05:09:35 x4 kernel: [drm] pitch is 6912
> Dec 1 05:09:35 x4 kernel: fbcon: radeondrmfb (fb0) is primary device
> Dec 1 05:09:35 x4 kernel: Console: switching to colour frame buffer device 131x105
> Dec 1 05:09:35 x4 kernel: fb0: radeondrmfb frame buffer device
> Dec 1 05:09:35 x4 kernel: drm: registered panic notifier
> Dec 1 05:09:35 x4 kernel: [drm] Initialized radeon 2.12.0 20080528 for 0000:01:05.0 on minor 0
The SLAB debugging output points to DRM and more specifically to the
radeon driver.
Dave, Alex, could you please take a look at this or fix up the CC to
include the right people?
Pekka
--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Fight unfair telecom internet charges in Canada: sign http://stopthemeter.ca/
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>
next prev parent reply other threads:[~2011-12-01 8:53 UTC|newest]
Thread overview: 109+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-11-18 7:25 WARNING: at mm/slub.c:3357, kernel BUG at mm/slub.c:3413 Markus Trippelsdorf
2011-11-18 7:55 ` Markus Trippelsdorf
2011-11-18 8:43 ` Alex,Shi
2011-11-18 8:54 ` Markus Trippelsdorf
2011-11-18 8:57 ` Markus Trippelsdorf
2011-11-18 12:02 ` Markus Trippelsdorf
2011-11-21 0:44 ` Alex,Shi
2011-11-21 7:29 ` Markus Trippelsdorf
2011-11-21 8:05 ` Markus Trippelsdorf
2011-11-21 8:24 ` Markus Trippelsdorf
2011-11-21 8:56 ` Eric Dumazet
2011-11-21 9:16 ` Eric Dumazet
2011-11-21 13:15 ` Markus Trippelsdorf
2011-11-21 14:16 ` Eric Dumazet
2011-11-21 14:21 ` Markus Trippelsdorf
2011-11-21 15:36 ` Markus Trippelsdorf
2011-11-21 15:48 ` Eric Dumazet
2011-11-21 16:10 ` Markus Trippelsdorf
2011-11-21 16:34 ` Markus Trippelsdorf
2011-11-22 8:36 ` Markus Trippelsdorf
2011-12-19 3:21 ` Eric W. Biederman
2011-12-19 9:19 ` Markus Trippelsdorf
2011-12-19 9:06 ` Eric W. Biederman
2011-11-21 16:52 ` Eric Dumazet
2011-11-21 17:15 ` Eric Dumazet
2011-11-21 17:35 ` Markus Trippelsdorf
2011-11-21 18:39 ` Eric Dumazet
2011-11-21 18:52 ` Markus Trippelsdorf
2011-11-21 19:51 ` Markus Trippelsdorf
2011-11-21 20:27 ` Benjamin Herrenschmidt
2011-11-21 21:30 ` Pekka Enberg
2011-11-21 21:43 ` Christoph Lameter
2011-11-22 0:21 ` Christian Kujau
2011-11-22 0:42 ` Christian Kujau
2011-11-22 2:17 ` Benjamin Herrenschmidt
2011-11-22 8:37 ` Christian Kujau
2011-11-22 3:18 ` Christoph Lameter
2011-11-22 7:48 ` Eric Dumazet
2011-11-22 7:51 ` Markus Trippelsdorf
2011-11-22 8:27 ` Eric Dumazet
2011-11-23 7:13 ` Markus Trippelsdorf
2011-11-23 7:20 ` Eric Dumazet
2011-11-22 8:39 ` Christian Kujau
2011-11-22 22:16 ` Benjamin Herrenschmidt
2011-11-22 22:31 ` Eric Dumazet
2011-11-22 22:32 ` Christoph Lameter
2011-11-22 21:58 ` Benjamin Herrenschmidt
2011-11-22 23:12 ` Christian Kujau
2011-11-23 0:18 ` Benjamin Herrenschmidt
2011-11-23 1:22 ` Christian Kujau
2011-11-23 1:43 ` Benjamin Herrenschmidt
2011-11-23 5:51 ` Christian Kujau
2011-11-23 6:59 ` Pekka Enberg
2011-11-23 15:14 ` slub: use irqsafe_cpu_cmpxchg for put_cpu_partial Christoph Lameter
2011-11-23 16:04 ` Eric Dumazet
2011-11-23 18:33 ` Christian Kujau
2011-11-24 6:45 ` Pekka Enberg
2011-11-23 23:15 ` David Rientjes
2011-11-22 8:45 ` WARNING: at mm/slub.c:3357, kernel BUG at mm/slub.c:3413 Markus Trippelsdorf
2011-11-22 9:25 ` Eric Dumazet
2011-11-22 9:27 ` Eric Dumazet
2011-11-22 9:38 ` Eric Dumazet
2011-11-22 9:46 ` Eric Dumazet
2011-11-22 14:46 ` Christoph Lameter
2011-11-22 14:52 ` Eric Dumazet
2011-11-22 15:02 ` Christoph Lameter
2011-11-22 15:07 ` Christoph Lameter
2011-11-22 16:20 ` Christoph Lameter
2011-11-22 16:32 ` Eric Dumazet
2011-11-22 16:36 ` Christoph Lameter
2011-11-22 16:41 ` Christoph Lameter
2011-11-22 16:53 ` slub: Lockout validation scans during freeing of object Christoph Lameter
2011-11-22 17:21 ` Eric Dumazet
2011-11-22 17:40 ` Christoph Lameter
2011-11-22 18:55 ` Markus Trippelsdorf
2011-11-22 19:20 ` Christoph Lameter
2011-11-22 19:32 ` Markus Trippelsdorf
2011-11-22 19:46 ` Christoph Lameter
2011-11-22 17:59 ` Christoph Lameter
2011-11-22 11:21 ` WARNING: at mm/slub.c:3357, kernel BUG at mm/slub.c:3413 Markus Trippelsdorf
2011-11-22 14:50 ` Christoph Lameter
2011-11-22 14:44 ` Christoph Lameter
2011-11-21 15:51 ` Markus Trippelsdorf
2011-11-23 16:03 ` Markus Trippelsdorf
2011-11-23 16:06 ` Christoph Lameter
2011-11-24 8:50 ` Markus Trippelsdorf
2011-12-01 8:44 ` Markus Trippelsdorf
2011-12-01 8:53 ` Pekka Enberg [this message]
2011-12-02 19:43 ` Jerome Glisse
2011-12-02 20:06 ` Markus Trippelsdorf
2011-12-02 20:48 ` Markus Trippelsdorf
2011-12-07 14:32 ` Robert Richter
2011-12-07 14:39 ` Markus Trippelsdorf
2011-12-02 23:04 ` Jerome Glisse
2011-12-03 9:28 ` Markus Trippelsdorf
2011-12-03 12:20 ` Dave Airlie
2011-12-03 12:29 ` Markus Trippelsdorf
2011-12-03 19:31 ` Jerome Glisse
2011-12-03 19:32 ` Jerome Glisse
2011-12-04 1:02 ` Markus Trippelsdorf
2011-12-04 17:32 ` Jerome Glisse
2011-12-05 17:10 ` Jerome Glisse
2011-12-05 18:15 ` Markus Trippelsdorf
2011-12-05 18:43 ` Jerome Glisse
2011-12-05 19:11 ` Jerome Glisse
2011-12-05 19:27 ` Markus Trippelsdorf
2011-12-05 20:10 ` Pekka Enberg
2011-12-05 20:20 ` Jerome Glisse
2011-12-05 10:44 ` David Laight
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=alpine.LFD.2.02.1112011053070.4549@tux.localdomain \
--to=penberg@kernel.org \
--cc=airlied@redhat.com \
--cc=alex.shi@intel.com \
--cc=alexander.deucher@amd.com \
--cc=cl@linux.com \
--cc=dri-devel@lists.freedesktop.org \
--cc=eric.dumazet@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=markus@trippelsdorf.de \
--cc=mpm@selenic.com \
--cc=netdev@vger.kernel.org \
--cc=tj@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).