From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S965878AbXCLOTf (ORCPT ); Mon, 12 Mar 2007 10:19:35 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S965884AbXCLOTf (ORCPT ); Mon, 12 Mar 2007 10:19:35 -0400 Received: from nf-out-0910.google.com ([64.233.182.185]:16774 "EHLO nf-out-0910.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S965878AbXCLOTd (ORCPT ); Mon, 12 Mar 2007 10:19:33 -0400 Date: Mon, 12 Mar 2007 16:20:13 +0200 From: "Michael S. Tsirkin" To: Ingo Molnar Cc: Peter Zijlstra , Linux Kernel Mailing List , general@lists.openfabrics.org, Roland Dreier , netdev@vger.kernel.org Subject: Re: lockdep question (was Re: IPoIB caused a kernel: BUG: softlockup detected on CPU#0!) Message-ID: <20070312142013.GC21643@mellanox.co.il> Reply-To: "Michael S. Tsirkin" References: <45E552FC.4040305@mellanox.co.il> <20070311135051.GA31985@mellanox.co.il> <1173626719.5182.10.camel@lappy> <20070311161231.GC13817@mellanox.co.il> <20070311184819.GA2567@elte.hu> <20070312132826.GB20549@mellanox.co.il> <20070312135112.GA18158@elte.hu> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20070312135112.GA18158@elte.hu> User-Agent: Mutt/1.5.11 Sender: linux-kernel-owner@vger.kernel.org X-Mailing-List: linux-kernel@vger.kernel.org > Quoting Ingo Molnar : > Subject: Re: lockdep question (was Re: IPoIB caused a kernel: BUG: softlockup detected on CPU#0!) > > > * Michael S. Tsirkin wrote: > > > > could you turn on CONFIG_SLAB_DEBUG as well? > > > > > > that should catch certain types of use-after-free accesses, and > > > lockdep will also warn if a still locked object is freed. > > > > Hmm, no, this does not look like use-after-free. I enabled > > CONFIG_SLAB_DEBUG, and I still see the same message, so the memory was > > not overwritten by slab debugger. > > that's still not conclusive - the memory might not have been allocated > by slab again to detect it. Your magic-number check definitely shows > some sort of corruption going on, right? Not necessarily in such a direct way. I currently think we are somehow getting neighbours where neigh->dev points to a loopback device - that's type 772, and this seems to make sense. I printed out the device name and sure enough it is "lo". Is it true that sticking the following static int ipoib_neigh_setup_dev(struct net_device *dev, struct neigh_parms *parms) { parms->neigh_destructor = ipoib_neigh_destructor; return 0; } in dev->neigh_setup, as ipoib does, guarantees that neighbour->dev will point to the current device for any neighbour which ipoib_neigh_destructor gets? That's the assumption IPoIB makes, and it seems broken in this instance. How could that be? -- MST