From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754123AbYIDGOR (ORCPT ); Thu, 4 Sep 2008 02:14:17 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1751619AbYIDGN7 (ORCPT ); Thu, 4 Sep 2008 02:13:59 -0400 Received: from wa-out-1112.google.com ([209.85.146.178]:58959 "EHLO wa-out-1112.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751310AbYIDGN6 (ORCPT ); Thu, 4 Sep 2008 02:13:58 -0400 DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:sender:to:subject:cc:in-reply-to:mime-version :content-type:content-transfer-encoding:content-disposition :references:x-google-sender-auth; b=dbY5XInG/9wNKOD2WMrhWNEOT6CDDi2Dck6Ppghl+13qvht1UJkQpN/3lUEmJplkky Uv0c9jJsh2IL4BBWOGbQ/L91X1qHduOpqQRaT0e/IunfPvVS1Z+mGQ2X/kvJRtkDvNdy rm2vhHSNZXOhhqWPM6wsevTB84qhce2hwS6sY= Message-ID: <84144f020809032313k7e29720bn4286ad0097397a7d@mail.gmail.com> Date: Thu, 4 Sep 2008 09:13:56 +0300 From: "Pekka Enberg" To: "Marcin Slusarz" Subject: Re: slab error in verify_redzone_free (2.6.27-rc5) Cc: LKML , "Andrew Morton" , linux-ext4@vger.kernel.org In-Reply-To: <20080903214642.GA9938@joi> MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Content-Disposition: inline References: <20080903214642.GA9938@joi> X-Google-Sender-Auth: 9c7b65c2d0705702 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Hi Marcin, (I'm cc'ing the ext3 developers) On Thu, Sep 4, 2008 at 12:46 AM, Marcin Slusarz wrote: > Sep 1 20:22:07 [kernel] [ 8541.403598] slab error in verify_redzone_free(): cache `ext3_inode_cache': memory outside object was overwritten > Sep 1 20:22:07 [kernel] [ 8541.403613] Pid: 206, comm: kswapd0 Not tainted 2.6.27-rc5 #362 > Sep 1 20:22:07 [kernel] [ 8541.403620] > Sep 1 20:22:07 [kernel] [ 8541.403621] Call Trace: > Sep 1 20:22:07 [kernel] [ 8541.403635] [] __slab_error+0x26/0x28 > Sep 1 20:22:07 [kernel] [ 8541.403640] [] cache_free_debugcheck+0x13a/0x1fc > Sep 1 20:22:07 [kernel] [ 8541.403646] [] ? ext3_destroy_inode+0x80/0x87 > Sep 1 20:22:07 [kernel] [ 8541.403649] [] kmem_cache_free+0x4e/0xad > Sep 1 20:22:07 [kernel] [ 8541.403653] [] ext3_destroy_inode+0x80/0x87 > Sep 1 20:22:07 [kernel] [ 8541.403657] [] destroy_inode+0x37/0x4c > Sep 1 20:22:07 [kernel] [ 8541.403661] [] dispose_list+0xcf/0x103 > Sep 1 20:22:07 [kernel] [ 8541.403664] [] shrink_icache_memory+0x1d6/0x208 > Sep 1 20:22:07 [kernel] [ 8541.403669] [] shrink_slab+0xeb/0x181 > Sep 1 20:22:07 [kernel] [ 8541.403673] [] kswapd+0x317/0x4b4 > Sep 1 20:22:07 [kernel] [ 8541.403677] [] ? isolate_pages_global+0x0/0x39 > Sep 1 20:22:07 [kernel] [ 8541.403684] [] ? autoremove_wake_function+0x0/0x3d > Sep 1 20:22:07 [kernel] [ 8541.403688] [] ? kswapd+0x0/0x4b4 > Sep 1 20:22:07 [kernel] [ 8541.403692] [] kthread+0x4e/0x7b > Sep 1 20:22:07 [kernel] [ 8541.403696] [] child_rip+0xa/0x11 > Sep 1 20:22:07 [kernel] [ 8541.403701] [] ? finish_task_switch+0x5f/0xa5 > Sep 1 20:22:07 [kernel] [ 8541.403705] [] ? finish_task_switch+0x0/0xa5 > Sep 1 20:22:07 [kernel] [ 8541.403708] [] ? restore_args+0x0/0x30 > Sep 1 20:22:07 [kernel] [ 8541.403713] [] ? kthread+0x0/0x7b > Sep 1 20:22:07 [kernel] [ 8541.403716] [] ? child_rip+0x0/0x11 > Sep 1 20:22:07 [kernel] [ 8541.403718] > Sep 1 20:22:07 [kernel] [ 8541.403721] ffff88000000f9d8: redzone 1:0xd84156c5635688c0, redzone 2:0x43220000ff3e0001. > > Full log and .config is here: http://www.kadu.net/~joi/kernel/2008.09.03/ > I don't remember what I was doing while this happened - I noticed this error today... OK, so redzone1 looks good ("RED_ACTIVE") whereas redzone2, which is the red-zone at the end of an object, has a bogus value. So looks like a simple buffer overflow in the ext3_inode_cachep cache. If you can reproduce this, you could try CONFIG_SLUB which shows us the full corruption that can give us a better clue why this is happening. Pekka