lkml.org 
[lkml]   [2012]   [Jan]   [25]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: Slab corruption in floppy driver module
Date
Vivek Goyal <vgoyal@redhat.com> writes:

> On Tue, Jan 24, 2012 at 06:49:37PM +0530, Suresh Jayaraman wrote:
>
> [..]
>
>> [ 33.372026] ffff88041dd9be08 ffffffff8134f517 ffff88041dd9be28
>> ffff88041da9bc68
>> [ 33.372026] Call Trace:
>> [ 33.372026] [<ffffffff81243a15>] blk_put_queue+0x15/0x20
>> [ 33.372026] [<ffffffff8124d4ff>] disk_release+0x8f/0xd0
>> [ 33.372026] [<ffffffff8134f517>] device_release+0x27/0xa0
>> [ 33.372026] [<ffffffff812754fd>] kobject_cleanup+0x6d/0x1b0
>> [ 33.372026] [<ffffffff8127564d>] kobject_release+0xd/0x10
>> [ 33.372026] [<ffffffff81276b17>] kref_put+0x37/0x70
>> [ 33.372026] [<ffffffff81275387>] kobject_put+0x27/0x60
>> [ 33.372026] [<ffffffff8124dbf7>] put_disk+0x17/0x20
>> [ 33.372026] [<ffffffffa00fa92c>] floppy_init+0x1c1/0x675 [floppy]
>> [ 33.372026] [<ffffffffa00fae37>] floppy_module_init+0x57/0x220 [floppy]
>> [ 33.372026] [<ffffffff810001d3>] do_one_initcall+0x43/0x180
>> [ 33.372026] [<ffffffff810a526d>] sys_init_module+0xcd/0x240
>> [ 33.372026] [<ffffffff8148d4c2>] system_call_fastpath+0x16/0x1b
>> [ 33.372026] [<00007f86dce3406a>] 0x7f86dce34069
>> [ 33.372026] Code: eb cc 48 89 fe 31 c0 48 c7 c7 60 aa 7a 81 e8 26 c4 20 00
>> e8 92 c1 20 00 eb 8e 55 48 89 e5 53 48 89 fb 48 83 ec 08 48 85 ff 74 16 <f6> 47
>> 3c 01 74 19 48 8d 7b 38 48 c7 c6 40 56 27 81 e8 59 17 00
>> [ 33.372026] RIP [<ffffffff81275371>] kobject_put+0x11/0x60
>> [ 33.372026] RSP <ffff88041dd9bda8>
>> [ 33.372026] CR2: ffff88041d986c9c
>> [ 33.372026] ---[ end trace f624c17dc6e4672a ]---
>> --- cut-here ---
>>
>> What seems to be happening is after commit f992ae80, add_disk takes a
>> extra reference to the queue which is supposed to be put in disk_release().
>> In floppy_init() when there were "no floppy controllers found" the control
>> goes to out_flush_work. Note that add_disk() is not being called at all and
>> so extra reference not taken. We try to put_disk() and the call sequence is
>> put_disk()
>> kobject_put()
>> kref_put()
>> kobject_release()
>> kobject_cleanup()
>> device_release()
>> disk_release()
>> blk_put_queue() <-- put without a get
>> kobject_put()
>>
>>
>> Reverting f992ae80 makes the oops and the slab corruption messages disappear.
>> The "no floppy controllers found" message was found in the dmesg.
>
> I am wondering if extra queue reference for gendisk should be taken by driver
> and not by add_disk(). Why? Because disk->queue association is setup by
> driver and not by add_disk(). That way even if we don't call, add_disk(),
> we should be fine.

I also noticed this problem about two weeks ago
(https://lkml.org/lkml/2012/1/10/177) -- the mentioned commit 523e1d399c
seems to be identical to f992ae80.

Perhaps, it is helpful to notice that I also played with this on a
machine that _has_ a floppy controler and if the floppy driver is loaded
as a module on boot, then unloaded and reloaded it also outputs error
messages, i.e. re-loading the module also causes problems.

Thanks,

Dirk


\
 
 \ /
  Last update: 2012-01-25 09:03    [W:2.040 / U:0.852 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site