Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755631AbaFJUJG (ORCPT ); Tue, 10 Jun 2014 16:09:06 -0400 Received: from qmta14.emeryville.ca.mail.comcast.net ([76.96.27.212]:38939 "EHLO qmta14.emeryville.ca.mail.comcast.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755196AbaFJTwS (ORCPT ); Tue, 10 Jun 2014 15:52:18 -0400 Date: Tue, 10 Jun 2014 14:52:15 -0500 (CDT) From: Christoph Lameter To: Joe Lawrence cc: linux-kernel@vger.kernel.org, Tejun Heo , Vivek Goyal Subject: Re: docker crashes rcuos in __blkg_release_rcu In-Reply-To: Message-ID: References: Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Sun, 8 Jun 2014, Joe Lawrence wrote: > > .tickets is offset 0 from arch_spinlock_t, so RDI should be the > arch_spinlock_t lock: > RDI: 6b6b6b6b6b6b6b6b Slub has overwritten the object when it was freed with 0x6b. So this is an access after free. It works without debug because the object may still linger around (but there is no guarantee that the memory has not been reused). -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/