On Mon, Apr 21, 2014 at 5:50 PM, Dave Jones <davej@xxxxxxxxxx> wrote: > On Wed, Apr 16, 2014 at 02:04:22PM -0400, Dave Jones wrote: > > On Tue, Apr 15, 2014 at 04:57:49PM +0200, Miklos Szeredi wrote: > > > > > Some callers (aio_run_iocb, vmsplice_to_user) forget to free the iov on > > > error. This seems to be a recurring problem, with most callers being buggy > > > initially. > > > > Your patch looks a lot more complete than the quick hack I did a few > > days ago when coverity first started nagging about this, but in testing > > I've found that something really ugly starts showing up when you patch this > > > > The symptoms vary, but always are some kind of slab corruption. > > Here's the last example: > > > > ============================================================================= > > BUG kmalloc-256 (Not tainted): Invalid object pointer 0xffff8802407adc60 > > ----------------------------------------------------------------------------- > > > > Disabling lock debugging due to kernel taint > > INFO: Slab 0xffffea000901eb00 objects=28 used=22 fp=0xffff8802407ad6d0 flags=0x20000000004081 > > CPU: 1 PID: 1185 Comm: trinity-c1 Tainted: G B 3.15.0-rc1+ #191 > > ffff880243c073c0 00000000f952f249 ffff8800a1a2bc10 ffffffffbd74686d > > ffffea000901eb00 ffff8800a1a2bce8 ffffffffbd1b0cd4 ffffffff00000020 > > ffff8800a1a2bcf8 ffff8800a1a2bca8 61766e4943c00a18 656a626f2064696c > > Call Trace: > > [<ffffffffbd74686d>] dump_stack+0x4e/0x7a > > [<ffffffffbd1b0cd4>] slab_err+0xb4/0xe0 > > [<ffffffffbd0bf3ae>] ? put_lock_stats.isra.23+0xe/0x30 > > [<ffffffffbd1b0da6>] ? slab_pad_check.part.44+0xa6/0x170 > > [<ffffffffbd744e7f>] free_debug_processing+0x88/0x22a > > [<ffffffffbd1c7041>] ? compat_do_readv_writev+0xe1/0x250 > > [<ffffffffbd74506d>] __slab_free+0x4c/0x2c3 > > [<ffffffffbd1c6679>] ? do_sync_readv_writev+0x59/0xa0 > > [<ffffffffbd1b2614>] kfree+0x214/0x220 > > [<ffffffffbd1c7041>] ? compat_do_readv_writev+0xe1/0x250 > > [<ffffffffbd1c7041>] compat_do_readv_writev+0xe1/0x250 > > [<ffffffffbd0bf716>] ? lock_release_holdtime.part.24+0xe6/0x160 > > [<ffffffffbd0a3ccd>] ? get_parent_ip+0xd/0x50 > > [<ffffffffbd75642b>] ? preempt_count_sub+0x6b/0xf0 > > [<ffffffffbd751a01>] ? _raw_spin_unlock+0x31/0x50 > > [<ffffffffbd349883>] ? __this_cpu_preempt_check+0x13/0x20 > > [<ffffffffbd1c730a>] compat_writev+0x3a/0x80 > > [<ffffffffbd1c85d8>] compat_SyS_writev+0x58/0xd0 > > [<ffffffffbd75c6a9>] ia32_do_call+0x13/0x13 > > FIX kmalloc-256: Object at 0xffff8802407adc60 not freed > > > > > > I also had an incomplete trace that showed vmsplice causing a bug in mm/slub.c:3396 > > on an earlier run. > > > > The crash happens very quickly (within a few seconds of running trinity) for me. > > Al, Miklos ? I probably am blind, but I can't see how that will cause slab corruption. Have you verified that it's just that single patch and no other change? Thanks, Miklos -- To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
