mirror of https://lore.kernel.org/lkml/
 help / color / mirror / Atom feed
From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org, stable@kernel.org
Cc: stable-review@kernel.org, torvalds@linux-foundation.org,
	akpm@linux-foundation.org, alan@lxorguk.ukuu.org.uk,
	Pekka Enberg <penberg@kernel.org>
Subject: [10/63] Revert "slab: Fix missing DEBUG_SLAB last user"
Date: Fri, 25 Mar 2011 16:43:46 -0700	[thread overview]
Message-ID: <20110325234508.912004151@clark.kroah.org> (raw)
In-Reply-To: <20110325234526.GA18017@kroah.com>

2.6.38-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Pekka Enberg <penberg@kernel.org>

commit 3ff84a7f36554b257cd57325b1a7c1fa4b49fbe3 upstream.

This reverts commit 5c5e3b33b7cb959a401f823707bee006caadd76e.

The commit breaks ARM thusly:

| Mount-cache hash table entries: 512
| slab error in verify_redzone_free(): cache `idr_layer_cache': memory outside object was overwritten
| Backtrace:
| [<c0227088>] (dump_backtrace+0x0/0x110) from [<c0431afc>] (dump_stack+0x18/0x1c)
| [<c0431ae4>] (dump_stack+0x0/0x1c) from [<c0293304>] (__slab_error+0x28/0x30)
| [<c02932dc>] (__slab_error+0x0/0x30) from [<c0293a74>] (cache_free_debugcheck+0x1c0/0x2b8)
| [<c02938b4>] (cache_free_debugcheck+0x0/0x2b8) from [<c0293f78>] (kmem_cache_free+0x3c/0xc0)
| [<c0293f3c>] (kmem_cache_free+0x0/0xc0) from [<c032b1c8>] (ida_get_new_above+0x19c/0x1c0)
| [<c032b02c>] (ida_get_new_above+0x0/0x1c0) from [<c02af7ec>] (alloc_vfsmnt+0x54/0x144)
| [<c02af798>] (alloc_vfsmnt+0x0/0x144) from [<c0299830>] (vfs_kern_mount+0x30/0xec)
| [<c0299800>] (vfs_kern_mount+0x0/0xec) from [<c0299908>] (kern_mount_data+0x1c/0x20)
| [<c02998ec>] (kern_mount_data+0x0/0x20) from [<c02146c4>] (sysfs_init+0x68/0xc8)
| [<c021465c>] (sysfs_init+0x0/0xc8) from [<c02137d4>] (mnt_init+0x90/0x1b0)
| [<c0213744>] (mnt_init+0x0/0x1b0) from [<c0213388>] (vfs_caches_init+0x100/0x140)
| [<c0213288>] (vfs_caches_init+0x0/0x140) from [<c0208c0c>] (start_kernel+0x2e8/0x368)
| [<c0208924>] (start_kernel+0x0/0x368) from [<c0208034>] (__enable_mmu+0x0/0x2c)
| c0113268: redzone 1:0xd84156c5c032b3ac, redzone 2:0xd84156c5635688c0.
| slab error in cache_alloc_debugcheck_after(): cache `idr_layer_cache': double free, or memory outside object was overwritten
| ...
| c011307c: redzone 1:0x9f91102ffffffff, redzone 2:0x9f911029d74e35b
| slab: Internal list corruption detected in cache 'idr_layer_cache'(24), slabp c0113000(16). Hexdump:
|
| 000: 20 4f 10 c0 20 4f 10 c0 7c 00 00 00 7c 30 11 c0
| 010: 10 00 00 00 10 00 00 00 00 00 c9 17 fe ff ff ff
| 020: fe ff ff ff fe ff ff ff fe ff ff ff fe ff ff ff
| 030: fe ff ff ff fe ff ff ff fe ff ff ff fe ff ff ff
| 040: fe ff ff ff fe ff ff ff fe ff ff ff fe ff ff ff
| 050: fe ff ff ff fe ff ff ff fe ff ff ff 11 00 00 00
| 060: 12 00 00 00 13 00 00 00 14 00 00 00 15 00 00 00
| 070: 16 00 00 00 17 00 00 00 c0 88 56 63
| kernel BUG at /home/rmk/git/linux-2.6-rmk/mm/slab.c:2928!

Reference: https://lkml.org/lkml/2011/2/7/238
Reported-and-analyzed-by: Russell King <rmk@arm.linux.org.uk>
Signed-off-by: Pekka Enberg <penberg@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 mm/slab.c |    8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

--- a/mm/slab.c
+++ b/mm/slab.c
@@ -2288,8 +2288,8 @@ kmem_cache_create (const char *name, siz
 	if (ralign < align) {
 		ralign = align;
 	}
-	/* disable debug if not aligning with REDZONE_ALIGN */
-	if (ralign & (__alignof__(unsigned long long) - 1))
+	/* disable debug if necessary */
+	if (ralign > __alignof__(unsigned long long))
 		flags &= ~(SLAB_RED_ZONE | SLAB_STORE_USER);
 	/*
 	 * 4) Store it.
@@ -2315,8 +2315,8 @@ kmem_cache_create (const char *name, siz
 	 */
 	if (flags & SLAB_RED_ZONE) {
 		/* add space for red zone words */
-		cachep->obj_offset += align;
-		size += align + sizeof(unsigned long long);
+		cachep->obj_offset += sizeof(unsigned long long);
+		size += 2 * sizeof(unsigned long long);
 	}
 	if (flags & SLAB_STORE_USER) {
 		/* user store requires one word storage behind the end of



  parent reply	other threads:[~2011-03-26  0:29 UTC|newest]

Thread overview: 64+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2011-03-25 23:45 [00/63] 2.6.38.2-stable review Greg KH
2011-03-25 23:43 ` [01/63] ALSA: HDA: Realtek: Avoid unnecessary volume control index on Surround/Side Greg KH
2011-03-25 23:43 ` [02/63] ALSA: hda - VIA: Fix stereo mixer recording no sound issue Greg KH
2011-03-25 23:43 ` [03/63] ALSA: hda - VIA: Fix independent headphone " Greg KH
2011-03-25 23:43 ` [04/63] ALSA: hda - VIA: Add missing support for VT1718S in A-A path Greg KH
2011-03-25 23:43 ` [05/63] ALSA: hda - VIA: Fix invalid A-A path volume adjust issue Greg KH
2011-03-25 23:43 ` [06/63] ALSA: hda - VIA: Fix codec type for VT1708BCE at the right timing Greg KH
2011-03-25 23:43 ` [07/63] ALSA: hda - VIA: Fix VT1708 cant build up Headphone control issue Greg KH
2011-03-25 23:43 ` [08/63] ASoC: mini2440: Fix uda134x codec problem Greg KH
2011-03-25 23:43 ` [09/63] ethtool: Compat handling for struct ethtool_rxnfc Greg KH
2011-03-25 23:43 ` Greg KH [this message]
2011-03-25 23:43 ` [11/63] aio: wake all waiters when destroying ctx Greg KH
2011-03-25 23:43 ` [12/63] cgroups: if you list_empty() a head then dont list_del() it Greg KH
2011-03-25 23:43 ` [13/63] shmem: let shared anonymous be nonlinear again Greg KH
2011-03-25 23:43 ` [14/63] mm: swap: unlock swapfile inode mutex before closing file on bad swapfiles Greg KH
2011-03-25 23:43 ` [15/63] mm: compaction: prevent kswapd compacting memory to reduce CPU usage Greg KH
2011-03-25 23:43 ` [16/63] oom: prevent unnecessary oom kills or kernel panics Greg KH
2011-03-25 23:43 ` [17/63] oom: skip zombies when iterating tasklist Greg KH
2011-03-25 23:43 ` [18/63] oom: avoid deferring oom killer if exiting task is being traced Greg KH
2011-03-25 23:43 ` [19/63] PCI hotplug: acpiphp: set current_state to D0 in register_slot Greg KH
2011-03-25 23:43 ` [20/63] Input: xen-kbdfront - advertise either absolute or relative coordinates Greg KH
2011-03-25 23:43 ` [21/63] xen: set max_pfn_mapped to the last pfn mapped Greg KH
2011-03-25 23:43 ` [22/63] Prevent rt_sigqueueinfo and rt_tgsigqueueinfo from spoofing the signal code Greg KH
2011-03-25 23:43 ` [23/63] ALSA: HDA: Fix internal mic on Dell E5420/E5520 Greg KH
2011-03-25 23:44 ` [24/63] mm: PageBuddy and mapcount robustness Greg KH
2011-03-25 23:44 ` [25/63] ext3: skip orphan cleanup on rocompat fs Greg KH
2011-03-25 23:44 ` [26/63] x86: Fix binutils-2.21 symbol related build failures Greg KH
2011-03-25 23:44 ` [27/63] sysctl: restrict write access to dmesg_restrict Greg KH
2011-03-25 23:44 ` [28/63] procfs: fix /proc/<pid>/maps heap check Greg KH
2011-03-25 23:44 ` [29/63] proc: protect mm start_code/end_code in /proc/pid/stat Greg KH
2011-03-25 23:44 ` [30/63] fbcon: Bugfix soft cursor detection in Tile Blitting Greg KH
2011-03-25 23:44 ` [31/63] nfsd41: modify the members value of nfsd4_op_flags Greg KH
2011-03-25 23:44 ` [32/63] nfsd4: minor nfs4state.c reshuffling Greg KH
2011-03-25 23:44 ` [33/63] nfsd4: fix struct file leak Greg KH
2011-03-25 23:44 ` [34/63] nfsd: wrong index used in inner loop Greg KH
2011-03-25 23:44 ` [35/63] [media] uvcvideo: Fix uvc_fixup_video_ctrl() format search Greg KH
2011-03-25 23:44 ` [36/63] [media] uvcvideo: Fix descriptor parsing for video output devices Greg KH
2011-03-25 23:44 ` [37/63] sh: Fix ptrace fpu state initialisation Greg KH
2011-03-25 23:44 ` [38/63] sh: Fix ptrace hw_breakpoint handling Greg KH
2011-03-25 23:44 ` [39/63] USB: Do not pass negative length to snoop_urb() Greg KH
2011-03-25 23:44 ` [40/63] ehci-hcd: Bug fix: dont set a QHs Halt bit Greg KH
2011-03-25 23:44 ` [41/63] usb: musb: blackfin: fix typo in platform driver name Greg KH
2011-03-25 23:44 ` [42/63] usb: musb: blackfin: fix typo in new dev_pm_ops struct Greg KH
2011-03-25 23:44 ` [43/63] usb: musb: blackfin: fix typo in new bfin_musb_vbus_status func Greg KH
2011-03-25 23:44 ` [44/63] USB: uss720 fixup refcount position Greg KH
2011-03-25 23:44 ` [45/63] USB: Fix bad dma problem on WDM device disconnect Greg KH
2011-03-25 23:44 ` [46/63] USB: cdc-acm: fix memory corruption / panic Greg KH
2011-03-25 23:44 ` [47/63] USB: cdc-acm: fix potential null-pointer dereference Greg KH
2011-03-25 23:44 ` [48/63] USB: cdc-acm: fix potential null-pointer dereference on disconnect Greg KH
2011-03-25 23:44 ` [49/63] fix deadlock in pivot_root() Greg KH
2011-03-25 23:44 ` [50/63] fs: assign sb->s_bdi to default_backing_dev_info if the bdi is going away Greg KH
2011-03-25 23:44 ` [51/63] x86: Cleanup highmap after brk is concluded Greg KH
2011-03-25 23:44 ` [52/63] drm: check for modesetting on modeset ioctls Greg KH
2011-03-25 23:44 ` [53/63] drm/i915: Disable pagefaults along execbuffer relocation fast path Greg KH
2011-03-25 23:44 ` [54/63] drm/i915: Prevent racy removal of request from client list Greg KH
2011-03-25 23:44 ` [55/63] drm: Fix use-after-free in drm_gem_vm_close() Greg KH
2011-03-25 23:44 ` [56/63] drm/radeon/kms: prefer legacy pll algo for tv-out Greg KH
2011-03-25 23:44 ` [57/63] drm/radeon/kms: fix hardcoded EDID handling Greg KH
2011-03-25 23:44 ` [58/63] perf: Fix tear-down of inherited group events Greg KH
2011-03-25 23:44 ` [59/63] NFS: Fix a hang/infinite loop in nfs_wb_page() Greg KH
2011-03-25 23:44 ` [60/63] SUNRPC: Never reuse the socket port after an xs_close() Greg KH
2011-03-25 23:44 ` [61/63] fs: call security_d_instantiate in d_obtain_alias V2 Greg KH
2011-03-25 23:44 ` [62/63] dcdbas: force SMI to happen when expected Greg KH
2011-03-25 23:44 ` [63/63] ext4: skip orphan cleanup if fs has unknown ROCOMPAT features Greg KH

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20110325234508.912004151@clark.kroah.org \
    --to=gregkh@suse.de \
    --cc=akpm@linux-foundation.org \
    --cc=alan@lxorguk.ukuu.org.uk \
    --cc=linux-kernel@vger.kernel.org \
    --cc=penberg@kernel.org \
    --cc=stable-review@kernel.org \
    --cc=stable@kernel.org \
    --cc=torvalds@linux-foundation.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox

all inboxes | Powered by JetHome®