Messages in this thread | | | Date | Wed, 4 Jun 2008 21:23:56 -0700 | From | "Paul E. McKenney" <> | Subject | Re: 2.6.26-rc4: RIP __call_for_each_cic+0x20/0x50 |
| |
On Wed, Jun 04, 2008 at 11:32:03AM -0700, Linus Torvalds wrote: > > > On Tue, 3 Jun 2008, Paul E. McKenney wrote: > > > > The fact that put_io_context() was called from exit_io_context() means > > that this is the last thread of a process exiting. The fact that > > cfq_free_io_context() was called (via cfq_dtor()) from put_io_context() > > means that this was the last reference to the io_context. Yet when > > we traverse the cic_list, part of it is corrupted -- ascii "k"s through > > RAX and RBX. > > The "ascii 'k's" are just the slab POISON_FREE byte (0x6b). > > IOW, something simply kfree'd the memory too early, causing the list > traversal to then break.
Hence the CFQ code perhaps just an innocent bystander in the wrong place at the wrong time. Fair enough!
Thanx, Paul
| |