Andrew Morton wrote:

>This is a bad, bad bug.  How are you triggering it?
>
>Manfred, would it be possible to add builtin_return_address(0) into each
>object, so we can find out who did the initial kmalloc (or kfree, even)?
>
>It'll probably require CONFIG_FRAME_POINTER.
>  
>
No, CONFIG_FRAME_POINTER is only needed for __builtin_return_address(x, 
x>0). _address(0) always works.

I've attached a patch that records the last kfree address and prints 
that if a poison check fails.

Zwane, could you try to reproduce the bug?

If this doesn't help, we must implement the brute force approach: Use 
one page for each object and unmap it with change_page_addr from the 
linear mapping. Solaris can do that to hunt such bugs.

patch against 2.5.64+use_after_free_check.patch.

--
    Manfred