Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753784AbaDVInB (ORCPT ); Tue, 22 Apr 2014 04:43:01 -0400 Received: from mail-qc0-f182.google.com ([209.85.216.182]:46590 "EHLO mail-qc0-f182.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752225AbaDVImx (ORCPT ); Tue, 22 Apr 2014 04:42:53 -0400 MIME-Version: 1.0 X-Originating-IP: [46.139.80.5] In-Reply-To: <20140421155020.GB13709@redhat.com> References: <20140415145749.GF10187@tucsk.piliscsaba.szeredi.hu> <20140416180422.GA20907@redhat.com> <20140421155020.GB13709@redhat.com> Date: Tue, 22 Apr 2014 10:42:52 +0200 Message-ID: Subject: Re: [PATCH] vfs: rw_copy_check_uvector() - free iov on error From: Miklos Szeredi To: Dave Jones , Miklos Szeredi , Al Viro , Kernel Mailing List , Linux-Fsdevel Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Mon, Apr 21, 2014 at 5:50 PM, Dave Jones wrote: > On Wed, Apr 16, 2014 at 02:04:22PM -0400, Dave Jones wrote: > > On Tue, Apr 15, 2014 at 04:57:49PM +0200, Miklos Szeredi wrote: > > > > > Some callers (aio_run_iocb, vmsplice_to_user) forget to free the iov on > > > error. This seems to be a recurring problem, with most callers being buggy > > > initially. > > > > Your patch looks a lot more complete than the quick hack I did a few > > days ago when coverity first started nagging about this, but in testing > > I've found that something really ugly starts showing up when you patch this > > > > The symptoms vary, but always are some kind of slab corruption. > > Here's the last example: > > > > ============================================================================= > > BUG kmalloc-256 (Not tainted): Invalid object pointer 0xffff8802407adc60 > > ----------------------------------------------------------------------------- > > > > Disabling lock debugging due to kernel taint > > INFO: Slab 0xffffea000901eb00 objects=28 used=22 fp=0xffff8802407ad6d0 flags=0x20000000004081 > > CPU: 1 PID: 1185 Comm: trinity-c1 Tainted: G B 3.15.0-rc1+ #191 > > ffff880243c073c0 00000000f952f249 ffff8800a1a2bc10 ffffffffbd74686d > > ffffea000901eb00 ffff8800a1a2bce8 ffffffffbd1b0cd4 ffffffff00000020 > > ffff8800a1a2bcf8 ffff8800a1a2bca8 61766e4943c00a18 656a626f2064696c > > Call Trace: > > [] dump_stack+0x4e/0x7a > > [] slab_err+0xb4/0xe0 > > [] ? put_lock_stats.isra.23+0xe/0x30 > > [] ? slab_pad_check.part.44+0xa6/0x170 > > [] free_debug_processing+0x88/0x22a > > [] ? compat_do_readv_writev+0xe1/0x250 > > [] __slab_free+0x4c/0x2c3 > > [] ? do_sync_readv_writev+0x59/0xa0 > > [] kfree+0x214/0x220 > > [] ? compat_do_readv_writev+0xe1/0x250 > > [] compat_do_readv_writev+0xe1/0x250 > > [] ? lock_release_holdtime.part.24+0xe6/0x160 > > [] ? get_parent_ip+0xd/0x50 > > [] ? preempt_count_sub+0x6b/0xf0 > > [] ? _raw_spin_unlock+0x31/0x50 > > [] ? __this_cpu_preempt_check+0x13/0x20 > > [] compat_writev+0x3a/0x80 > > [] compat_SyS_writev+0x58/0xd0 > > [] ia32_do_call+0x13/0x13 > > FIX kmalloc-256: Object at 0xffff8802407adc60 not freed > > > > > > I also had an incomplete trace that showed vmsplice causing a bug in mm/slub.c:3396 > > on an earlier run. > > > > The crash happens very quickly (within a few seconds of running trinity) for me. > > Al, Miklos ? I probably am blind, but I can't see how that will cause slab corruption. Have you verified that it's just that single patch and no other change? Thanks, Miklos -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/