Messages in this thread | | | Date | Fri, 18 Jul 2008 17:44:44 +0300 | From | "Pekka Enberg" <> | Subject | Re: [bug, netconsole, SLUB] BUG skbuff_head_cache: Poison overwritten |
| |
Hi Evgeniy,
On Fri, Jul 18, 2008 at 12:02:26PM +0300, Pekka Enberg (penberg@cs.helsinki.fi) wrote: >> > Out of curiosity, why does it scream at allocation time? >> >> Because it's checking for use-after-free errors. The object is >> poisoned with POISON_FREE when it's free'd and we verify the poison >> values at allocation time.
On Fri, Jul 18, 2008 at 1:16 PM, Evgeniy Polyakov <johnpol@2ka.mipt.ru> wrote: > Does it also scream on double free event? Just to closer guilty > circles... 0x9c offset is somewhere at the very end of the skbuff > structure, likely skb->users.
Yeah. See the free_debug_processing() function in mm/slub.c for details (the on_freelist() part). However, if you look at slab_free() you can see that in the SLUB fast-path we don't do any of these debugging checks. So you can end up with slab corruption without a nice error message.
Pekka
| |