Re: 2.6.22-rc2-mm1

[Andrew Morton <akpm@linux-foundation.org>]

On Wed, 23 May 2007 23:05:24 +0200
Michal Piotrowski <michal.k.k.piotrowski@gmail.com> wrote:

> Christoph Lameter napisa__(a):
> > On Wed, 23 May 2007, Michal Piotrowski wrote:
> > 
> >> Christoph, this looks like a bug in SLUB.
> > 
> > Please boot with slub_debug to find the bad code that overwrites a slab 
> > object after it was freed.
> > 
> > 
> 
> [   19.096577] Real Time Clock Driver v1.12ac
> [   21.650315] *** SLUB kmalloc-8: Redzone Active@0xc90f6d20 slab 0xc528c530
> [   21.657365]     offset=3360 flags=0x400000c3 inuse=61 freelist=0xc90f6d58
> [   21.664349]   Bytes b4 0xc90f6d10:  00 00 00 00 00 00 00 00 5a 5a 5a 5a 5a 5a 5a 5a ........ZZZZZZZZ
> [   21.674305]     Object 0xc90f6d20:  31 30 31 39 2e 30 30 35                         1019.005        
> [   21.684259]    Redzone 0xc90f6d28:  00 cc cc cc                                     .______            
> [   21.694265] FreePointer 0xc90f6d2c -> 0xc90f6d58
> [   21.699061] Last alloc: get_modalias+0x61/0xf5 jiffies_ago=53 cpu=1 pid=554
> [   21.706362]     Filler 0xc90f6d50:  5a 5a 5a 5a 5a 5a 5a 5a                         ZZZZZZZZ        

argh, I never 100% understood the slab gobbledygook, and now we have slub
gobbledygook.  I _hope_ what that's saying is that the 00 at 0xc90f6d28
wasn't supposed to be there.

Obvious bug:

--- a/drivers/firmware/dmi-id.c~a
+++ a/drivers/firmware/dmi-id.c
@@ -94,7 +94,7 @@ static ssize_t get_modalias(char *buffer
 		if (!c)
 			continue;
 
-		t = kmalloc(strlen(c), GFP_KERNEL);
+		t = kmalloc(strlen(c) + 1, GFP_KERNEL);
 		if (!t)
 			break;
 		ascii_filter(t, c);
_


> Here is another one

Same deal.