lkml.org 
[lkml]   [2011]   [Aug]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
SubjectRe: list corruption in the last few days. (block ? crypto ?)
On Sat, 6 Aug 2011, Linus Torvalds wrote:
> Anybody has any ideas on this one? I'm back home, no more diving :(,
> ready to make -rc1, but I'd *prefer* to have a handle on this one.
>
> Of course, the fact that it apparently only happens with SLUB
> debugging on means that the impact is less, but on the other hand I
> really like all the people who enable debug features and help us test
> with those on. So..

Christoph, I've been reading the code and spotted two potential issues in
__slab_free(). The first one seems like an off-by-one where our comparison
in deactivate_slab() doesn't match __slab_free.

The other one is remove_full() call in __slab_free() that can get called
even if cache debugging is not enabled.

Hmm?

Pekka

diff --git a/mm/slub.c b/mm/slub.c
index eb5a8f9..cee8c20 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -2368,7 +2368,7 @@ static void __slab_free(struct kmem_cache *s, struct page *page,
if (was_frozen)
stat(s, FREE_FROZEN);
else {
- if (unlikely(!inuse && n->nr_partial > s->min_partial))
+ if (unlikely(!inuse && n->nr_partial >= s->min_partial))
goto slab_empty;

/*
@@ -2376,7 +2376,8 @@ static void __slab_free(struct kmem_cache *s, struct page *page,
* then add it.
*/
if (unlikely(!prior)) {
- remove_full(s, page);
+ if (kmem_cache_debug(s))
+ remove_full(s, page);
add_partial(n, page, 0);
stat(s, FREE_ADD_PARTIAL);
}

\
 
 \ /
  Last update: 2011-08-07 21:01    [W:0.114 / U:0.508 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site