Re: list corruption in the last few days. (block ? crypto ?)

[Pekka Enberg <penberg@kernel.org>]

On Sat, 6 Aug 2011, Linus Torvalds wrote:
> Anybody has any ideas on this one? I'm back home, no more diving :(,
> ready to make -rc1, but I'd *prefer* to have a handle on this one.
>
> Of course, the fact that it apparently only happens with SLUB
> debugging on means that the impact is less, but on the other hand I
> really like all the people who enable debug features and help us test
> with those on. So..

Christoph, I've been reading the code and spotted two potential issues in 
__slab_free(). The first one seems like an off-by-one where our comparison 
in deactivate_slab() doesn't match __slab_free.

The other one is remove_full() call in __slab_free() that can get called 
even if cache debugging is not enabled.

Hmm?

 			Pekka

diff --git a/mm/slub.c b/mm/slub.c
index eb5a8f9..cee8c20 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -2368,7 +2368,7 @@ static void __slab_free(struct kmem_cache *s, struct page *page,
  	if (was_frozen)
  		stat(s, FREE_FROZEN);
  	else {
-		if (unlikely(!inuse && n->nr_partial > s->min_partial))
+		if (unlikely(!inuse && n->nr_partial >= s->min_partial))
                          goto slab_empty;

  		/*
@@ -2376,7 +2376,8 @@ static void __slab_free(struct kmem_cache *s, struct page *page,
  		 * then add it.
  		 */
  		if (unlikely(!prior)) {
-			remove_full(s, page);
+			if (kmem_cache_debug(s))
+				remove_full(s, page);
  			add_partial(n, page, 0);
  			stat(s, FREE_ADD_PARTIAL);
  		}