lkml.org 
[lkml]   [2012]   [Jan]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: Slab corruption in floppy driver module
    On Tue, Jan 24, 2012 at 06:49:37PM +0530, Suresh Jayaraman wrote:

    [..]

    > [ 33.372026] ffff88041dd9be08 ffffffff8134f517 ffff88041dd9be28
    > ffff88041da9bc68
    > [ 33.372026] Call Trace:
    > [ 33.372026] [<ffffffff81243a15>] blk_put_queue+0x15/0x20
    > [ 33.372026] [<ffffffff8124d4ff>] disk_release+0x8f/0xd0
    > [ 33.372026] [<ffffffff8134f517>] device_release+0x27/0xa0
    > [ 33.372026] [<ffffffff812754fd>] kobject_cleanup+0x6d/0x1b0
    > [ 33.372026] [<ffffffff8127564d>] kobject_release+0xd/0x10
    > [ 33.372026] [<ffffffff81276b17>] kref_put+0x37/0x70
    > [ 33.372026] [<ffffffff81275387>] kobject_put+0x27/0x60
    > [ 33.372026] [<ffffffff8124dbf7>] put_disk+0x17/0x20
    > [ 33.372026] [<ffffffffa00fa92c>] floppy_init+0x1c1/0x675 [floppy]
    > [ 33.372026] [<ffffffffa00fae37>] floppy_module_init+0x57/0x220 [floppy]
    > [ 33.372026] [<ffffffff810001d3>] do_one_initcall+0x43/0x180
    > [ 33.372026] [<ffffffff810a526d>] sys_init_module+0xcd/0x240
    > [ 33.372026] [<ffffffff8148d4c2>] system_call_fastpath+0x16/0x1b
    > [ 33.372026] [<00007f86dce3406a>] 0x7f86dce34069
    > [ 33.372026] Code: eb cc 48 89 fe 31 c0 48 c7 c7 60 aa 7a 81 e8 26 c4 20 00
    > e8 92 c1 20 00 eb 8e 55 48 89 e5 53 48 89 fb 48 83 ec 08 48 85 ff 74 16 <f6> 47
    > 3c 01 74 19 48 8d 7b 38 48 c7 c6 40 56 27 81 e8 59 17 00
    > [ 33.372026] RIP [<ffffffff81275371>] kobject_put+0x11/0x60
    > [ 33.372026] RSP <ffff88041dd9bda8>
    > [ 33.372026] CR2: ffff88041d986c9c
    > [ 33.372026] ---[ end trace f624c17dc6e4672a ]---
    > --- cut-here ---
    >
    > What seems to be happening is after commit f992ae80, add_disk takes a
    > extra reference to the queue which is supposed to be put in disk_release().
    > In floppy_init() when there were "no floppy controllers found" the control
    > goes to out_flush_work. Note that add_disk() is not being called at all and
    > so extra reference not taken. We try to put_disk() and the call sequence is
    > put_disk()
    > kobject_put()
    > kref_put()
    > kobject_release()
    > kobject_cleanup()
    > device_release()
    > disk_release()
    > blk_put_queue() <-- put without a get
    > kobject_put()
    >
    >
    > Reverting f992ae80 makes the oops and the slab corruption messages disappear.
    > The "no floppy controllers found" message was found in the dmesg.

    I am wondering if extra queue reference for gendisk should be taken by driver
    and not by add_disk(). Why? Because disk->queue association is setup by
    driver and not by add_disk(). That way even if we don't call, add_disk(),
    we should be fine.

    Thanks
    Vivek


    \
     
     \ /
      Last update: 2012-01-24 23:35    [W:3.230 / U:0.192 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site