Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1758684AbYGUKHb (ORCPT ); Mon, 21 Jul 2008 06:07:31 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1756408AbYGUKHS (ORCPT ); Mon, 21 Jul 2008 06:07:18 -0400 Received: from relay.2ka.mipt.ru ([194.85.80.65]:60798 "EHLO 2ka.mipt.ru" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752372AbYGUKHR (ORCPT ); Mon, 21 Jul 2008 06:07:17 -0400 Date: Mon, 21 Jul 2008 14:06:27 +0400 From: Evgeniy Polyakov To: Pekka Enberg Cc: Ingo Molnar , linux-kernel@vger.kernel.org, netdev@vger.kernel.org, Vegard Nossum , "Rafael J. Wysocki" , cl@linux-foundation.org, davem@davemloft.net Subject: Re: [bug, netconsole, SLUB] BUG skbuff_head_cache: Poison overwritten Message-ID: <20080721100627.GA5953@2ka.mipt.ru> References: <20080717214222.GA29449@elte.hu> <20080718091146.GQ6875@elte.hu> <20080721094110.GA16029@elte.hu> <84144f020807210252k68d5cf65i8c7ae3c11cecc046@mail.gmail.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <84144f020807210252k68d5cf65i8c7ae3c11cecc046@mail.gmail.com> User-Agent: Mutt/1.5.9i Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1720 Lines: 40 Hi. On Mon, Jul 21, 2008 at 12:52:45PM +0300, Pekka Enberg (penberg@cs.helsinki.fi) wrote: > On Mon, Jul 21, 2008 at 12:41 PM, Ingo Molnar wrote: > > update about this problem: just triggered another colorful crash, see > > below. This was with the 4K object dump patch already, maybe the dump > > gives a clue? > > ...to point out the obvious: > > > ============================================================================= > > BUG skbuff_head_cache: Poison overwritten > > ----------------------------------------------------------------------------- > > > > INFO: 0xf7ccc100-0xf7ccc103. First byte 0x0 instead of 0x6b > > INFO: Allocated in __alloc_skb+0x30/0x10e age=1 cpu=1 pid=1 > > INFO: Freed in __kfree_skb+0x63/0x66 age=1 cpu=0 pid=0 > > INFO: Slab 0xc1c34ca0 objects=16 used=1 fp=0xf7ccc100 flags=0x400000c3 > > INFO: Object 0xf7ccc100 @offset=256 fp=0xf7ccc200 > > > > Bytes b4 0xf7ccc0f0: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZZZZZZZZZ > > Object 0xf7ccc100: 00 00 00 00 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b ....kkkkkkkkkkkk > > Use after free where first four bytes are zeroed. Not that obvious... skb->next is cleared in lots of places, in xmit network helper for example, but since rest of the packet was not modified, it means given skb was not freed, so it will not help. Ingo do you see other similar dumps with last byte modified? That's the one which can help to determine the reason. -- Evgeniy Polyakov -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/