From: Pekka Enberg <penberg@kernel.org>
To: Eric Dumazet <eric.dumazet@gmail.com>
Cc: Andrew Morton <akpm@linux-foundation.org>,
netdev@vger.kernel.org, bugzilla-daemon@bugzilla.kernel.org,
bugme-daemon@bugzilla.kernel.org, casteyde.christian@free.fr,
Changli Gao <xiaosuo@gmail.com>,
Vegard Nossum <vegardno@ifi.uio.no>
Subject: Re: [Bugme-new] [Bug 27212] New: Warning kmemcheck: Caught 64-bit read from uninitialized memory in netlink_broadcast_filtered
Date: Fri, 21 Jan 2011 09:49:45 +0200 [thread overview]
Message-ID: <4D393A99.9060104@kernel.org> (raw)
In-Reply-To: <1295556085.2613.22.camel@edumazet-laptop>
On 1/20/11 10:41 PM, Eric Dumazet wrote:
> Le jeudi 20 janvier 2011 à 12:25 -0800, Andrew Morton a écrit :
>> (switched to email. Please respond via emailed reply-to-all, not via the
>> bugzilla web interface).
>>
>> On Thu, 20 Jan 2011 20:08:32 GMT
>> bugzilla-daemon@bugzilla.kernel.org wrote:
>>
>>> https://bugzilla.kernel.org/show_bug.cgi?id=27212
>>>
>>> Summary: Warning kmemcheck: Caught 64-bit read from
>>> uninitialized memory in netlink_broadcast_filtered
>>> Product: Other
>>> Version: 2.5
>>> Kernel Version: 2.6.38-rc1
>>> Platform: All
>>> OS/Version: Linux
>>> Tree: Mainline
>>> Status: NEW
>>> Severity: normal
>>> Priority: P1
>>> Component: Other
>>> AssignedTo: other_other@kernel-bugs.osdl.org
>>> ReportedBy: casteyde.christian@free.fr
>>> Regression: Yes
>>>
>>>
>>> Athlon 64 X2 3000 in 64bits
>>> Slackware64 13.1
>>> Kernel compiled with kmemcheck and other debug options
>>>
>>> At boot I got the following warning:
>>>
>>> PCI: Using ACPI for IRQ routing
>>> PCI: pci_cache_line_size set to 64 bytes
>>> pci 0000:00:00.0: address space collision: [mem 0xe0000000-0xefffffff pref]
>>> conflicts with GART [mem 0x
>>> e0000000-0xefffffff]
>>> reserve RAM buffer: 000000000009fc00 - 000000000009ffff
>>> reserve RAM buffer: 000000003ffb0000 - 000000003fffffff
>>> WARNING: kmemcheck: Caught 64-bit read from uninitialized memory
>>> (ffff88003e170eb0)
>>> 0000000000000000010000000000000000000000000000000000000000000000
>>> i i i i i i i i i i i i u u u u u u u u u u u u u u u u u u u u
>>> ^
>>>
>>> Pid: 1, comm: swapper Not tainted 2.6.38-rc1 #2 K8 Combo-Z/K8 Combo-Z
>>> RIP: 0010:[<ffffffff8127ad72>] [<ffffffff8127ad72>] memmove+0x122/0x1a0
>>> RSP: 0018:ffff88003e0b3c60 EFLAGS: 00010202
>>> RAX: ffff88003e170080 RBX: ffff88003e27b500 RCX: 0000000000000020
>>> RDX: 0000000000000018 RSI: ffff88003e170ea0 RDI: ffff88003e1700a0
>>> RBP: ffff88003e0b3c60 R08: 0000000000000001 R09: 0000000000000001
>>> R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
>>> R13: 0000000000000080 R14: 0000000000000000 R15: 0000000000000001
>>> FS: 0000000000000000(0000) GS:ffff88003fc00000(0000) knlGS:0000000000000000
>>> CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
>>> CR2: ffff88003e018abc CR3: 0000000001a1c000 CR4: 00000000000006f0
>>> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
>>> DR3: 0000000000000000 DR6: 00000000ffff4ff0 DR7: 0000000000000400
>>> [<ffffffff814741c2>] pskb_expand_head+0xc2/0x2a0
>>> [<ffffffff81498fa7>] netlink_broadcast_filtered+0xa7/0x4a0
>>> [<ffffffff814993b8>] netlink_broadcast+0x18/0x20
>>> [<ffffffff8149b884>] genlmsg_mcast+0x144/0x180
>>> [<ffffffff8149bc4a>] genl_ctrl_event+0xca/0x450
>>> [<ffffffff8149c75d>] genl_register_mc_group+0x10d/0x2a0
>>> [<ffffffff81ad9da4>] genl_init+0x6c/0x84
>>> [<ffffffff810001de>] do_one_initcall+0x3e/0x170
>>> [<ffffffff81aae6ea>] kernel_init+0x197/0x21b
>>> [<ffffffff81003254>] kernel_thread_helper+0x4/0x10
>>> [<ffffffffffffffff>] 0xffffffffffffffff
>>> pnp: PnP ACPI init
>>> ACPI: bus type pnp registered
>>> pnp 00:00: [bus 00-ff]
>>> pnp 00:00: [io 0x0cf8-0x0cff]
>>>
>>> This is specific to 2.6.38-rc1.
>>>
> Likely a false positive after commit ca44ac38
> (net: don't reallocate skb->head unless the current one hasn't the
> needed extra size or is shared)
>
> ksize() allows us to use a bit more than what was asked at kmalloc()
> time, because of discrete kmem caches sizes.
>
> We probably need to instruct kmemcheck of this.
It actually looks like a bug in SLUB+kmemcheck. The
kmemcheck_slab_alloc() call in slab_post_alloc_hook() should use ksize()
instead of s->objsize. SLAB seems to do the right thing already. Anyone
care to send a patch my way?
Pekka
next prev parent reply other threads:[~2011-01-21 7:49 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <bug-27212-10286@https.bugzilla.kernel.org/>
2011-01-20 20:25 ` [Bugme-new] [Bug 27212] New: Warning kmemcheck: Caught 64-bit read from uninitialized memory in netlink_broadcast_filtered Andrew Morton
2011-01-20 20:41 ` Eric Dumazet
2011-01-21 7:49 ` Pekka Enberg [this message]
2011-02-14 17:35 ` Eric Dumazet
2011-02-14 19:43 ` David Miller
2011-02-15 5:48 ` Pekka Enberg
2011-02-15 16:40 ` Christoph Lameter
2011-02-15 22:21 ` David Rientjes
2011-01-26 9:18 ` Eric Dumazet
2011-01-27 22:41 ` David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4D393A99.9060104@kernel.org \
--to=penberg@kernel.org \
--cc=akpm@linux-foundation.org \
--cc=bugme-daemon@bugzilla.kernel.org \
--cc=bugzilla-daemon@bugzilla.kernel.org \
--cc=casteyde.christian@free.fr \
--cc=eric.dumazet@gmail.com \
--cc=netdev@vger.kernel.org \
--cc=vegardno@ifi.uio.no \
--cc=xiaosuo@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).