Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932931Ab1CXGny (ORCPT ); Thu, 24 Mar 2011 02:43:54 -0400 Received: from cantor2.suse.de ([195.135.220.15]:38558 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932228Ab1CXGnx (ORCPT ); Thu, 24 Mar 2011 02:43:53 -0400 Date: Thu, 24 Mar 2011 07:43:52 +0100 Message-ID: From: Takashi Iwai To: Russ Dill Cc: linux-kernel@vger.kernel.org Subject: Re: snd_card_disconnect race (sound/core/init.c) In-Reply-To: References: User-Agent: Wanderlust/2.15.6 (Almost Unreal) SEMI/1.14.6 (Maruoka) FLIM/1.14.9 (=?UTF-8?B?R29qxY0=?=) APEL/10.7 Emacs/23.2 (x86_64-suse-linux-gnu) MULE/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Content-Type: text/plain; charset=US-ASCII Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2220 Lines: 54 At Wed, 23 Mar 2011 18:40:58 -0700, Russ Dill wrote: > > With slub poisoning on, I'm seeing an oops in snd_disconnect_release > with slub poison (6b6b6b6b). Investigating, snd_card_disconnect looks > to be the possible culprit: > > 333 spin_lock(&card->files_lock); > 334 mfile = card->files; > 335 while (mfile) { > 336 file = mfile->file; > 337 > 338 /* it's critical part, use endless loop */ > 339 /* we have no room to fail */ > 340 mfile->disconnected_f_op = mfile->file->f_op; > 341 > 342 spin_lock(&shutdown_lock); > 343 list_add(&mfile->shutdown_list, &shutdown_files); > 344 spin_unlock(&shutdown_lock); > 345 > 346 mfile->file->f_op = &snd_shutdown_f_ops; > 347 fops_get(mfile->file->f_op); > 348 > 349 mfile = mfile->next; > 350 } > 351 spin_unlock(&card->files_lock); > > I'm not aware of any locking that would prevent the original release > function running concurrently if it were started before line 346 was > executed. The original release functions (such as snd_hwdep_release) > call snd_card_remove_file which frees the mfile object which would > have been just added to the shutdown_files list leading to a use of > freed (or in my case poisoned) memory later on down the line when the > shutdown_files gets walked again. > > It seems that 118dd6bf (ALSA: Clean up snd_monitor_file management, > v2.6.30) may have either introduced this problem or made it worse > since snd_card_file_remove previously removed items from the > shutdown_files list before freeing them. > > I'm currently experiencing these crashes on 2.6.32.26, but I can't > find any changes that would cause them not to occur on later kernel > versions. Which device are you using? USB-audio had a known problem at disconnection, for example, and it was fixed recently. Takashi -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/