[ath9k-devel] skbuff_head_cache: Poison overwritten

[ath9k-devel] skbuff_head_cache: Poison overwritten

[Francesco Tenerini]

Hello,

I was looking for memory leak in AP mode when I've found a lot of
"skbuff_head_cache: Poison overwritten".
I'm using a ubiquiti bulletM5, with openwrt (trunk r22176), kernel
2.6.31.14, compact-wireless-2010-07-06.
The BUG messages begins when a STA connect the AP (hostapd v0.8.x, no
encryption).

Here's some examples:

=============================================================================
BUG skbuff_head_cache: Poison overwritten
-----------------------------------------------------------------------------

INFO: 0x8144cc7e-0x8144cc7e. First byte 0x7b instead of 0x6b
INFO: Allocated in __alloc_skb+0x58/0x150 age=40399 cpu=0 pid=510
INFO: Freed in llc_rcv+0x31c/0x36c age=437 cpu=0 pid=0
INFO: Slab 0x81028980 objects=18 used=17 fp=0x8144cc40 flags=0x00c2
INFO: Object 0x8144cc40 @offset=3136 fp=0x(null)

Bytes b4 0x8144cc30: 00 00 00 00 00 00 37 a4 5a 5a 5a 5a 5a 5a 5a 5a
......7?ZZZZZZZZ
Object 0x8144cc40: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b
kkkkkkkkkkkkkkkk
Object 0x8144cc50: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b
kkkkkkkkkkkkkkkk
Object 0x8144cc60: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b
kkkkkkkkkkkkkkkk
Object 0x8144cc70: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 7b 6b
kkkkkkkkkkkkkk{k
Object 0x8144cc80: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b
kkkkkkkkkkkkkkkk
Object 0x8144cc90: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b
kkkkkkkkkkkkkkkk
Object 0x8144cca0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b
kkkkkkkkkkkkkkkk
Object 0x8144ccb0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b
kkkkkkkkkkkkkkkk
Object 0x8144ccc0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b
kkkkkkkkkkkkkkkk
Object 0x8144ccd0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b
kkkkkkkkkkkkkkkk
Object 0x8144cce0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b a5
kkkkkkkkkkkkkkk?
Redzone 0x8144ccf0: bb bb bb bb ????
Padding 0x8144cd18: 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZ
Call Trace:
[<800681dc>] dump_stack+0x8/0x34
[<800d6d84>] check_bytes_and_report+0xd8/0x120
[<800d6ed4>] check_object+0x108/0x278
[<800d88f0>] __slab_alloc+0x478/0x5a0
[<800d9388>] kmem_cache_alloc+0x6c/0xc4
[<801ca2dc>] __alloc_skb+0x58/0x150
[<814b4038>] ath_rxbuf_alloc+0x38/0xd4 [ath]
[<815e5ab0>] ath_rx_tasklet+0x788/0xc60 [ath9k]
[<815e40a8>] ath9k_tasklet+0xc4/0x17c [ath9k]
[<80081d68>] tasklet_action+0x88/0xe4
[<8008255c>] __do_softirq+0xb0/0x148
[<8008263c>] do_softirq+0x48/0x6c
[<8006082c>] ret_from_irq+0x0/0x4
[<80060a20>] r4k_wait+0x20/0x40
[<8006c6ac>] cpu_idle+0x24/0x44
[<802c8a54>] start_kernel+0x348/0x360

FIX skbuff_head_cache: Restoring 0x8144cc7e-0x8144cc7e=0x6b

FIX skbuff_head_cache: Marking all objects used
=============================================================================
BUG skbuff_head_cache: Poison overwritten
-----------------------------------------------------------------------------

INFO: 0x8146ad5e-0x8146ad5e. First byte 0x7b instead of 0x6b
INFO: Allocated in __alloc_skb+0x58/0x150 age=41647 cpu=0 pid=510
INFO: Freed in llc_rcv+0x31c/0x36c age=0 cpu=0 pid=0
INFO: Slab 0x81028d40 objects=18 used=15 fp=0x8146ad20 flags=0x00c2
INFO: Object 0x8146ad20 @offset=3360 fp=0x8146ac40

Bytes b4 0x8146ad10: 00 00 00 00 00 00 3e 3d 5a 5a 5a 5a 5a 5a 5a 5a
......>=ZZZZZZZZ
Object 0x8146ad20: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b
kkkkkkkkkkkkkkkk
Object 0x8146ad30: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b
kkkkkkkkkkkkkkkk
Object 0x8146ad40: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b
kkkkkkkkkkkkkkkk
Object 0x8146ad50: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 7b 6b
kkkkkkkkkkkkkk{k
Object 0x8146ad60: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b
kkkkkkkkkkkkkkkk
Object 0x8146ad70: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b
kkkkkkkkkkkkkkkk
Object 0x8146ad80: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b
kkkkkkkkkkkkkkkk
Object 0x8146ad90: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b
kkkkkkkkkkkkkkkk
Object 0x8146ada0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b
kkkkkkkkkkkkkkkk
Object 0x8146adb0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b
kkkkkkkkkkkkkkkk
Object 0x8146adc0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b a5
kkkkkkkkkkkkkkk?
Redzone 0x8146add0: bb bb bb bb ????
Padding 0x8146adf8: 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZ
Call Trace:
[<800681dc>] dump_stack+0x8/0x34
[<800d6d84>] check_bytes_and_report+0xd8/0x120
[<800d6ed4>] check_object+0x108/0x278
[<800d88f0>] __slab_alloc+0x478/0x5a0
[<800d9388>] kmem_cache_alloc+0x6c/0xc4
[<801c8f6c>] skb_clone+0x74/0xb4
[<8023b444>] packet_rcv+0x11c/0x38c
[<801d1d10>] netif_receive_skb+0x47c/0x530
[<81501810>] ieee80211_tx_status+0x7b4/0x7ec [mac80211]
[<815e6c4c>] ath_tx_complete_buf+0x1cc/0x258 [ath9k]
[<815e9980>] ath_tx_tasklet+0x2ec/0x384 [ath9k]
[<815e40e4>] ath9k_tasklet+0x100/0x17c [ath9k]
[<80081d68>] tasklet_action+0x88/0xe4
[<8008255c>] __do_softirq+0xb0/0x148
[<8008263c>] do_softirq+0x48/0x6c
[<8006082c>] ret_from_irq+0x0/0x4
[<80060a20>] r4k_wait+0x20/0x40
[<8006c6ac>] cpu_idle+0x24/0x44
[<802c8a54>] start_kernel+0x348/0x360

FIX skbuff_head_cache: Restoring 0x8146ad5e-0x8146ad5e=0x6b

FIX skbuff_head_cache: Marking all objects used



Some hint to help me debug?
Can this cause the memory leak I'm looking for? (a huge amount of
SUnreclaim in /proc/meminfo)

Thank you

Francesco

[ath9k-devel] skbuff_head_cache: Poison overwritten

[Martin Schleier]

Francesco Tenerini <francesco.tenerini <at> forinicom.it> writes:

> BUG skbuff_head_cache: Poison overwritten
> 
> INFO: 0x8144cc7e-0x8144cc7e. First byte 0x7b instead of 0x6b
> INFO: Allocated in __alloc_skb+0x58/0x150 age=40399 cpu=0 pid=510
> INFO: Freed in llc_rcv+0x31c/0x36c age=437 cpu=0 pid=0

The bug is further down in the network stack, the
message will go away if llc (802.2) is disabled.

Report your problem to netdev!