Messages in this thread Patch in this message | | | Date | Sun, 7 Aug 2011 21:58:16 +0300 (EEST) | From | Pekka Enberg <> | Subject | Re: list corruption in the last few days. (block ? crypto ?) |
| |
On Sat, 6 Aug 2011, Linus Torvalds wrote: > Anybody has any ideas on this one? I'm back home, no more diving :(, > ready to make -rc1, but I'd *prefer* to have a handle on this one. > > Of course, the fact that it apparently only happens with SLUB > debugging on means that the impact is less, but on the other hand I > really like all the people who enable debug features and help us test > with those on. So..
Christoph, I've been reading the code and spotted two potential issues in __slab_free(). The first one seems like an off-by-one where our comparison in deactivate_slab() doesn't match __slab_free.
The other one is remove_full() call in __slab_free() that can get called even if cache debugging is not enabled.
Hmm?
Pekka
diff --git a/mm/slub.c b/mm/slub.c index eb5a8f9..cee8c20 100644 --- a/mm/slub.c +++ b/mm/slub.c @@ -2368,7 +2368,7 @@ static void __slab_free(struct kmem_cache *s, struct page *page, if (was_frozen) stat(s, FREE_FROZEN); else { - if (unlikely(!inuse && n->nr_partial > s->min_partial)) + if (unlikely(!inuse && n->nr_partial >= s->min_partial)) goto slab_empty;
/* @@ -2376,7 +2376,8 @@ static void __slab_free(struct kmem_cache *s, struct page *page, * then add it. */ if (unlikely(!prior)) { - remove_full(s, page); + if (kmem_cache_debug(s)) + remove_full(s, page); add_partial(n, page, 0); stat(s, FREE_ADD_PARTIAL); }
| |