[lkml]   [2007]   [Sep]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    Patch in this message
    SubjectRe: Warnings and Oops on 2.6.23-rc6 while activily using rfcomm links (mm/slab.c)
    On Thu, 27 Sep 2007 20:07:54 +0200,
    Pierre-Yves Paulus <> wrote:

    > Another one below, complete log from power-up to reboot, with some bugs
    > and one Oops. I only trimmed the numerous "l2cap_recv_acldata" and "ACL
    > packet for unknown connection handle" lines which always fill up the log.

    Hmm, looked at it, but currently I can't see what's wrong from a driver
    core perspective...

    > =============================================================================
    > BUG kmalloc-128: Poison overwritten
    > -----------------------------------------------------------------------------
    > INFO: 0xc5734f28-0xc5734f40. First byte 0x6a instead of 0x6b
    > INFO: Allocated in rfcomm_dev_ioctl+0xbd/0x4e6 [rfcomm] age=6110 cpu=0
    > pid=3677
    > INFO: Freed in rfcomm_dev_destruct+0x59/0x65 [rfcomm] age=3157 cpu=0
    > pid=3927
    > INFO: Slab 0xc10ae680 used=21 fp=0xc5734f20 flags=0x400000c2
    > INFO: Object 0xc5734f20 @offset=3872 fp=0xc57342c0
    > Bytes b4 0xc5734f10: 05 00 00 00 f8 23 0f 00 5a 5a 5a 5a 5a 5a 5a 5a
    > ....ø#..ZZZZZZZZ
    > Object 0xc5734f20: 6b 6b 6b 6b 6b 6b 6b 6b 6a 6b 6b 6b 6b 6b 6b 6b

    This looks suspiciously like someone tried to decrease a refcount on a
    freed kobject. Unfortunately, we only see this after the fact with slub
    debugging turned on :( So could you please turn it off again (but leave
    kobject debugging on) and try with the following silly debug patch:

    lib/kobject.c | 6 +++++-
    1 file changed, 5 insertions(+), 1 deletion(-)

    --- linux-2.6.orig/lib/kobject.c
    +++ linux-2.6/lib/kobject.c
    @@ -502,8 +502,12 @@ static void kobject_release(struct kref
    void kobject_put(struct kobject * kobj)
    - if (kobj)
    + if (kobj) {
    + if (!atomic_read(&kobj->kref.refcount))
    + pr_debug("%s: kobject %s@%p already has zero refcount!\n",
    + __FUNCTION__, kobj->name, kobj);
    kref_put(&kobj->kref, kobject_release);
    + }

    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    More majordomo info at
    Please read the FAQ at
     \ /
      Last update: 2007-09-28 08:57    [W:0.026 / U:1.904 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site