From: Eric Wong <normalperson@yhbt.net>
To: Sasha Levin <sasha.levin@oracle.com>
Cc: Peter Zijlstra <peterz@infradead.org>,
Ingo Molnar <mingo@kernel.org>,
acme@ghostprotocols.net, LKML <linux-kernel@vger.kernel.org>,
Thomas Gleixner <tglx@linutronix.de>,
Dave Jones <davej@redhat.com>,
edumazet@google.com, viro@zeniv.linux.org.uk, jbaron@akamai.com
Subject: Re: eventpoll __list_del_entry corruption
Date: Mon, 16 Jun 2014 09:44:32 +0000 [thread overview]
Message-ID: <20140616094432.GA28074@dcvr.yhbt.net> (raw)
In-Reply-To: <53750472.1040703@oracle.com>
Sasha Levin <sasha.levin@oracle.com> wrote:
> On 05/15/2014 02:11 PM, Peter Zijlstra wrote:
> > On Mon, May 12, 2014 at 11:42:33AM -0400, Sasha Levin wrote:
> >> Hi all,
> >>
> >> While fuzzing with trinity inside a KVM tools guest running the latest -next
> >> kernel I've stumbled on the following spew. Maybe related to the very recent
> >> change in freeing on task exit?
> > [ 5823.690004] [<ffffffff8109a544>] do_exit+0x2d4/0xa90
> > [ 5823.690004] [<ffffffff813825c4>] ? lockdep_sys_exit_thunk+0x35/0x67
> > [ 5823.690004] [<ffffffff8109ae2c>] do_group_exit+0x4c/0xc0
> > [ 5823.690004] [<ffffffff8109aeb7>] SyS_exit_group+0x17/0x20
> > [ 5823.690004] [<ffffffff8168a2c2>] system_call_fastpath+0x16/0x1b
> > [ 5823.690004] ---[ end trace 515b7fa3169c0906 ]---
>
> Dave reported something similar to that last year(!) and that never got fixed
> AFAIK: https://lkml.org/lkml/2013/10/14/353.
Both stack traces happen during exit, so it may be a destruction
ordering problem when the eventpoll and files it references are
all released together.
I've never seen this in normal use, perhaps because I'm in the habit of
closing all descriptors before exit to keep valgrind happy :)
next prev parent reply other threads:[~2014-06-16 9:52 UTC|newest]
Thread overview: 46+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-05-12 15:42 perf: use after free in perf_remove_from_context Sasha Levin
2014-05-14 16:29 ` Peter Zijlstra
2014-05-14 16:32 ` Sasha Levin
2014-05-14 16:35 ` Peter Zijlstra
2014-05-14 16:38 ` Sasha Levin
2014-05-14 16:52 ` Peter Zijlstra
2014-05-14 17:09 ` Sasha Levin
2014-05-14 17:20 ` Dave Jones
2014-05-14 18:37 ` Peter Zijlstra
2014-05-28 23:52 ` Sasha Levin
2014-05-29 2:31 ` Sasha Levin
2014-05-29 7:59 ` Peter Zijlstra
2014-05-29 7:57 ` Peter Zijlstra
2014-05-29 14:47 ` Sasha Levin
2014-05-29 15:07 ` Peter Zijlstra
2014-05-29 16:44 ` Sasha Levin
2014-05-29 16:50 ` Peter Zijlstra
2014-05-29 16:52 ` Sasha Levin
2014-05-29 17:00 ` Peter Zijlstra
2014-05-29 22:37 ` Sasha Levin
2014-06-05 14:38 ` [tip:perf/core] perf: Fix use after free in perf_remove_from_context() tip-bot for Peter Zijlstra
2014-05-15 18:11 ` eventpoll __list_del_entry corruption (was: perf: use after free in perf_remove_from_context) Peter Zijlstra
2014-05-15 18:16 ` eventpoll __list_del_entry corruption Sasha Levin
2014-06-16 9:44 ` Eric Wong [this message]
2014-05-21 8:25 ` BUG at /usr/src/linux-2.6/mm/filemap.c:202 (was: perf: use after free in perf_remove_from_context) Peter Zijlstra
2014-05-21 13:02 ` BUG at /usr/src/linux-2.6/mm/filemap.c:202 Sasha Levin
2014-06-03 15:07 ` eventpoll __list_del_entry corruption Jason Baron
2014-06-03 15:11 ` Peter Zijlstra
2014-05-16 15:34 ` BUG_ON drivers/char/random.c:986 (Was: perf: use after free in perf_remove_from_context) Peter Zijlstra
2014-05-16 16:06 ` H. Peter Anvin
2014-05-16 16:21 ` Peter Zijlstra
2014-05-17 0:46 ` Hannes Frederic Sowa
2014-05-17 2:18 ` Theodore Ts'o
2014-05-17 16:24 ` Sasha Levin
2014-05-17 17:00 ` Peter Zijlstra
2014-07-15 4:36 ` BUG_ON drivers/char/random.c:986 Dave Jones
2014-07-15 20:29 ` Hannes Frederic Sowa
2014-07-16 8:33 ` Theodore Ts'o
2014-07-16 19:18 ` [PATCH] random: check for increase of entropy_count because of signed conversion Hannes Frederic Sowa
2014-07-18 21:25 ` Theodore Ts'o
2014-07-18 21:43 ` Hannes Frederic Sowa
2014-07-18 21:50 ` Theodore Ts'o
2014-07-18 22:07 ` Theodore Ts'o
2014-07-18 23:35 ` Hannes Frederic Sowa
2014-07-19 5:42 ` Theodore Ts'o
2014-07-19 6:20 ` Hannes Frederic Sowa
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20140616094432.GA28074@dcvr.yhbt.net \
--to=normalperson@yhbt.net \
--cc=acme@ghostprotocols.net \
--cc=davej@redhat.com \
--cc=edumazet@google.com \
--cc=jbaron@akamai.com \
--cc=linux-kernel@vger.kernel.org \
--cc=mingo@kernel.org \
--cc=peterz@infradead.org \
--cc=sasha.levin@oracle.com \
--cc=tglx@linutronix.de \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox