Messages in this thread | | | Date | Wed, 4 Jun 2008 11:32:03 -0700 (PDT) | From | Linus Torvalds <> | Subject | Re: 2.6.26-rc4: RIP __call_for_each_cic+0x20/0x50 |
| |
On Tue, 3 Jun 2008, Paul E. McKenney wrote: > > The fact that put_io_context() was called from exit_io_context() means > that this is the last thread of a process exiting. The fact that > cfq_free_io_context() was called (via cfq_dtor()) from put_io_context() > means that this was the last reference to the io_context. Yet when > we traverse the cic_list, part of it is corrupted -- ascii "k"s through > RAX and RBX.
The "ascii 'k's" are just the slab POISON_FREE byte (0x6b).
IOW, something simply kfree'd the memory too early, causing the list traversal to then break.
Linus
| |