mirror of https://lore.kernel.org/lkml/
 help / color / mirror / Atom feed
From: "young dave" <hidave.darkstar@gmail.com>
To: "clameter@sgi.com" <clameter@sgi.com>
Cc: "Andrew Morton" <akpm@linux-foundation.org>,
	"Linux Kernel Mailing List" <linux-kernel@vger.kernel.org>
Subject: [BUG] 2.6.22-rc3-mm1 remove bluetooth usb adapter caused kmalloc bug
Date: Wed, 6 Jun 2007 01:56:01 +0000	[thread overview]
Message-ID: <a8e1da0706051856g242dad96rf4286283192b06c4@mail.gmail.com> (raw)

Hi,
when I remove the usb bluetooth adapter , the kernel reporting bug:

/* this two line is printk message I printed in net/bluetooth/hci_core.c */

#before free dev: c3758430
#after free dev

=============================================================================
BUG kmalloc-1024: Poison overwritten
-----------------------------------------------------------------------------

INFO: 0xc3758440-0xc3758440. First byte 0x6a instead of 0x6b
INFO: Allocated in hci_alloc_dev+0x1f/0x80 [bluetooth] age=6094 cpu=0 pid=9586
INFO: Freed in device_release+0x82/0x90 age=0 cpu=0 pid=7
INFO: Slab 0xc106eb00 used=6 fp=0xc3758430 flags=0x400020c3
INFO: Object 0xc3758430 @offset=1072 fp=0xc375b240

Bytes b4 0xc3758420:  00 00 00 00 b9 ea 09 00 5a 5a 5a 5a 5a 5a 5a 5a
....¹ê..ZZZZZZZZ
  Object 0xc3758430:  6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b
kkkkkkkkkkkkkkkk
  Object 0xc3758440:  6a 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b
jkkkkkkkkkkkkkkk
  Object 0xc3758450:  6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b
kkkkkkkkkkkkkkkk
  Object 0xc3758460:  6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b
kkkkkkkkkkkkkkkk
  Object 0xc3758470:  6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b
kkkkkkkkkkkkkkkk
  Object 0xc3758480:  6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b
kkkkkkkkkkkkkkkk
  Object 0xc3758490:  6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b
kkkkkkkkkkkkkkkk
  Object 0xc37584a0:  6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b
kkkkkkkkkkkkkkkk
 Redzone 0xc3758830:  bb bb bb bb
»»»»
 Padding 0xc3758858:  5a 5a 5a 5a 5a 5a 5a 5a
ZZZZZZZZ
 [<c016db1a>] check_bytes_and_report+0xaa/0xe0
 [<c016de48>] check_object+0x198/0x1e0
 [<c016e2ac>] alloc_debug_processing+0x9c/0x130
 [<c016ed9a>] __slab_alloc+0x10a/0x220
 [<c03c412a>] pskb_expand_head+0x4a/0x140
 [<c016fa12>] __kmalloc+0x72/0x80
 [<c03c412a>] pskb_expand_head+0x4a/0x140
 [<c03c412a>] pskb_expand_head+0x4a/0x140
 [<c016e2d6>] alloc_debug_processing+0xc6/0x130
 [<c03dbcc8>] netlink_broadcast+0x68/0x370
 [<c02727fd>] kobject_uevent_env+0x32d/0x4e0
 [<c02728e4>] kobject_uevent_env+0x414/0x4e0
 [<c01858df>] d_kill+0x3f/0x60
 [<c018591a>] dput+0x1a/0xf0
 [<c02dbd7c>] device_del+0x1ac/0x2e0
 [<c0360e88>] usb_disable_device+0x78/0xf0
 [<c035b923>] usb_disconnect+0x93/0xf0
 [<c035cb02>] hub_port_connect_change+0x2f2/0x3b0
 [<c035cdd2>] hub_events+0x212/0x420
 [<c0138470>] autoremove_wake_function+0x0/0x50
 [<c035d005>] hub_thread+0x25/0x110
 [<c0138470>] autoremove_wake_function+0x0/0x50
 [<c0138470>] autoremove_wake_function+0x0/0x50
 [<c035cfe0>] hub_thread+0x0/0x110
 [<c0137e99>] kthread+0x59/0xa0
 [<c0137e40>] kthread+0x0/0xa0
 [<c0104df3>] kernel_thread_helper+0x7/0x14
 =======================
FIX kmalloc-1024: Restoring 0xc3758440-0xc3758440=0x6b

FIX kmalloc-1024: Marking all objects used

             reply	other threads:[~2007-06-06  1:56 UTC|newest]

Thread overview: 9+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2007-06-06  1:56 young dave [this message]
2007-06-06  2:42 ` Andrew Morton
2007-06-06  2:51   ` young dave
2007-06-06  3:27   ` young dave
2007-06-06  4:30     ` Andrew Morton
2007-06-06  6:55   ` Jiri Kosina
2007-06-06  5:15 ` Christoph Lameter
2007-06-06  5:55   ` young dave
2007-06-06  7:18   ` dave young

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=a8e1da0706051856g242dad96rf4286283192b06c4@mail.gmail.com \
    --to=hidave.darkstar@gmail.com \
    --cc=akpm@linux-foundation.org \
    --cc=clameter@sgi.com \
    --cc=linux-kernel@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox

all inboxes | Powered by JetHome®