Re: [Oops] 2.6.10: PREEMPT SMP

[David Howells <dhowells@redhat.com>]

Xavier Bestel <xavier.bestel@free.fr> wrote:

> I just got this Oops with 2.6.10 (debian/sid stock kernel).
> 
> Kernel is tainted by VMWare, but it wasn't used (machine powered on
> remotely and used just to run gaim though ssh). I can perhaps try to
> reproduce it without it though if you need.

Hmmm... I see it involves the key stuff I wrote.

I don't think it can be a problem with preemption interfering with the key
management code accessing the key tree; every access to the tree outside of
the bootup initialisation is made with the appropriate spinlock held - and
that disables preemption.

It seems unlikely to be a double free... keys aren't freed the moment their
usage count reaches zero; a separate daemon is enlisted to go through the tree
when there's something to dispose of and extract and free all unused keys.

However, it's not impossible that there's a race there that I can't see
(though it doesn't look likely). Are you willing to try patching your kernel
with something? If so, if you can look through security/keys/key.c, and every
time you see a line saying:

	kmem_cache_free(key_jar, key);

insert this line before it:

	memset(key, 0xbb, sizeof(*key);

This will corrupt the memory that held the dead key before freeing it. Then if
something is touching a dead key, the pattern 0xbbbbbbbb or similar will crop
up in a register or on the stack, and the kernel will very likely crash.

David