Messages in this thread Patch in this message |  | | | Date | Wed, 23 May 2007 15:01:22 -0700 | | From | Andrew Morton <> | | Subject | Re: 2.6.22-rc2-mm1 |
| |
On Wed, 23 May 2007 23:05:24 +0200 Michal Piotrowski <michal.k.k.piotrowski@gmail.com> wrote:
> Christoph Lameter napisa__(a): > > On Wed, 23 May 2007, Michal Piotrowski wrote: > > > >> Christoph, this looks like a bug in SLUB. > > > > Please boot with slub_debug to find the bad code that overwrites a slab > > object after it was freed. > > > > > > [ 19.096577] Real Time Clock Driver v1.12ac > [ 21.650315] *** SLUB kmalloc-8: Redzone Active@0xc90f6d20 slab 0xc528c530 > [ 21.657365] offset=3360 flags=0x400000c3 inuse=61 freelist=0xc90f6d58 > [ 21.664349] Bytes b4 0xc90f6d10: 00 00 00 00 00 00 00 00 5a 5a 5a 5a 5a 5a 5a 5a ........ZZZZZZZZ > [ 21.674305] Object 0xc90f6d20: 31 30 31 39 2e 30 30 35 1019.005 > [ 21.684259] Redzone 0xc90f6d28: 00 cc cc cc .______ > [ 21.694265] FreePointer 0xc90f6d2c -> 0xc90f6d58 > [ 21.699061] Last alloc: get_modalias+0x61/0xf5 jiffies_ago=53 cpu=1 pid=554 > [ 21.706362] Filler 0xc90f6d50: 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZ
argh, I never 100% understood the slab gobbledygook, and now we have slub gobbledygook. I _hope_ what that's saying is that the 00 at 0xc90f6d28 wasn't supposed to be there.
Obvious bug:
--- a/drivers/firmware/dmi-id.c~a +++ a/drivers/firmware/dmi-id.c @@ -94,7 +94,7 @@ static ssize_t get_modalias(char *buffer if (!c) continue; - t = kmalloc(strlen(c), GFP_KERNEL); + t = kmalloc(strlen(c) + 1, GFP_KERNEL); if (!t) break; ascii_filter(t, c); _
> Here is another one
Same deal.
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
|  |