From: Jens Axboe <jens.axboe@oracle.com>
To: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Cc: mmx@riz.pl, rientjes@google.com, cl@linux.com,
penberg@cs.helsinki.fi, linux-kernel@vger.kernel.org,
kernel-testers@vger.kernel.org, rjw@sisk.pl,
akpm@linux-foundation.org
Subject: Re: [Bug #13112] Oops in drain_array
Date: Tue, 28 Apr 2009 20:22:48 +0200 [thread overview]
Message-ID: <20090428182248.GL4593@kernel.dk> (raw)
In-Reply-To: <20090428234512P.fujita.tomonori@lab.ntt.co.jp>
On Tue, Apr 28 2009, FUJITA Tomonori wrote:
> On Tue, 28 Apr 2009 14:43:37 +0200 (CEST)
> Bart <mmx@riz.pl> wrote:
>
> > > On Mon, 27 Apr 2009 13:36:46 -0700 (PDT)
> > > David Rientjes <rientjes@google.com> wrote:
> > >
> > >> On Mon, 27 Apr 2009, Bart wrote:
> > >>
> > >>> After turning the suggested debuging options I've got tons of these when
> > >>> trying to stress the tape device like before:
> > >>>
> > >>> Apr 27 16:57:30 fs kernel: [ 96.446708] slab error in verify_redzone_free():
> > >>> cache `size-128': memory outside object was overwritten
> > >>> Apr 27 16:57:30 fs kernel: [ 96.446713] Pid: 0, comm: swapper Not tainted
> > >>> 2.6.29.1-64 #2
> > >>> Apr 27 16:57:30 fs kernel: [ 96.446715] Call Trace:
> > >>> Apr 27 16:57:30 fs kernel: [ 96.446717] <IRQ> [<ffffffff8029adc5>]
> > >>> __slab_error+0x1f/0x25
> > >>> Apr 27 16:57:30 fs kernel: [ 96.446728] [<ffffffff8029b24b>]
> > >>> cache_free_debugcheck+0x108/0x1d6
> > >>> Apr 27 16:57:30 fs kernel: [ 96.446731] [<ffffffff8029b473>]
> > >>> kfree+0x81/0xc2
> > >>> Apr 27 16:57:30 fs kernel: [ 96.446735] [<ffffffff802bd311>]
> > >>> bio_free_map_data+0xc/0x1e
> > >>
> > >> This appears to be kfree(bmd->iovecs) in bio_free_map_data(). It looks
> > >> like the memcpy size in bio_set_map_data() overrides the kmalloc size; in
> > >> other words, for a redzone error, bio->bi_vcnt > nr_pages in
> > >> bio_copy_user_iov().
> > >
> > > Can you try this?
> > >
> > > diff --git a/fs/bio.c b/fs/bio.c
> > > index 7bbc98f..6a09356 100644
> > > --- a/fs/bio.c
> > > +++ b/fs/bio.c
> > > @@ -817,6 +817,9 @@ struct bio *bio_copy_user_iov(struct request_queue *q,
> > > len += iov[i].iov_len;
> > > }
> > >
> > > + if (offset)
> > > + nr_pages += 1;
> > > +
> > > bmd = bio_alloc_map_data(nr_pages, iov_count, gfp_mask);
> > > if (!bmd)
> > > return ERR_PTR(-ENOMEM);
> > >
> >
> > There are no more errors in the dmesg after applying this patch to
> > 2.6.29.2.
> >
> > Without this patch I can reproduce this kind of errors on
> > 2.6.29.1, 2.6.29.2.
> >
> > I've not tested this patch with 2.6.29.1 and 2.6.30rc3-git3.
> > I will try to reproduce the error on 2.6.30rc3-git3 as soon as I compile
> > it.
>
> Thanks for testing! And very sorry about the bug.
>
> I'm sure that you hit the same bug with 2.6.30-rc3-git.
>
> Jens, can you please apply this against 2.6.30-rc (and we need this
> for 2.6.29.x too)?
>
> I know that bio_copy_user_iov() is hacky. I'll try to clean up the
> mapping API later.
I'll apply it for 2.6.30-rc and CC stable. bio_copy_user_iov() is indeed
not pretty, both the API and the implementation needs looking at...
--
Jens Axboe
next prev parent reply other threads:[~2009-04-28 18:23 UTC|newest]
Thread overview: 70+ messages / expand[flat|nested] mbox.gz Atom feed top
2009-04-26 9:42 2.6.30-rc3-git1: Reported regressions 2.6.28 -> 2.6.29 Rafael J. Wysocki
2009-04-26 9:42 ` [Bug #12490] ath5k related kernel panic in 2.6.29-rc1 Rafael J. Wysocki
2009-04-26 9:46 ` [Bug #12705] X200: Brightness broken since 2.6.29-rc4-58-g4c098bc Rafael J. Wysocki
2009-04-26 20:15 ` Nico Schottelius
2009-04-26 23:18 ` Rafael J. Wysocki
2009-04-30 8:00 ` Nico Schottelius
2009-04-26 9:46 ` [Bug #12681] s2ram: fails to wake up on Acer Extensa 4220 (SMP disabled) Rafael J. Wysocki
2009-04-26 9:46 ` [Bug #12499] Problem with using bluetooth adaper connected to usb port Rafael J. Wysocki
2009-04-26 9:46 ` [Bug #12947] r128: system hangs when X is started with DRI enabled Rafael J. Wysocki
2009-04-26 15:07 ` Angel
2009-04-26 17:43 ` Rafael J. Wysocki
2009-04-27 18:12 ` Jos van der Ende
2009-04-28 21:49 ` Rafael J. Wysocki
2009-04-26 9:46 ` [Bug #12909] boot/kernel init duration regression from 2.6.28 Rafael J. Wysocki
2009-04-26 9:46 ` [Bug #12899] Crash in i915.ko: i915_driver_irq_handler Rafael J. Wysocki
2009-04-26 9:46 ` [Bug #12861] Xorg fails to start "Failed to allocate space for kernel memory manager" Rafael J. Wysocki
2009-04-26 9:46 ` [Bug #12765] i915 VT switch with AIGLX causes X lock up Rafael J. Wysocki
2009-04-27 16:46 ` Jesse Barnes
2009-04-27 22:07 ` Sitsofe Wheeler
2009-04-26 9:46 ` [Bug #12836] 2.6.29-rc breaks STD using Intel 945 Rafael J. Wysocki
2009-04-26 9:46 ` [Bug #12971] "tg3 transmit timed out" when transmitting at high bitrate Rafael J. Wysocki
2009-04-26 9:46 ` [Bug #12980] lockup in X.org Rafael J. Wysocki
2009-04-26 9:46 ` [Bug #12961] Kernel panics in early boot: IO-APIC + timer doesn't work Rafael J. Wysocki
2009-04-26 9:46 ` [Bug #13001] PCI-DMA: Out of IOMMU space Rafael J. Wysocki
2009-04-28 8:28 ` FUJITA Tomonori
2009-04-28 9:18 ` Данила Жукоцкий
2009-04-28 9:43 ` FUJITA Tomonori
2009-05-04 5:27 ` Данила Жукоцкий
2009-05-05 1:58 ` Grant Grundler
2009-05-05 4:31 ` adam radford
2009-05-05 5:46 ` Данила Жукоцкий
2009-05-06 4:39 ` FUJITA Tomonori
2009-05-06 10:39 ` FUJITA Tomonori
2009-04-26 9:46 ` [Bug #13025] After upgrading to kernel 2.6.29, pulseaudio stopped with some strange error Rafael J. Wysocki
2009-04-26 9:46 ` [Bug #13003] [2.6.29 regression] ivtv driver causes strange oops'es, disrupts software suspend Rafael J. Wysocki
2009-04-27 6:46 ` Hans Verkuil
2009-04-28 21:53 ` Rafael J. Wysocki
2009-04-26 9:46 ` [Bug #13032] 2.6.29 regression: network interfaces drop after suspend/resume Rafael J. Wysocki
2009-04-26 9:46 ` [Bug #13040] DRM radeon Rafael J. Wysocki
2009-04-26 9:46 ` [Bug #13074] gspca_stv06xx doesn't work with Logitech QuickCam Express (046d:0840) Rafael J. Wysocki
2009-04-26 9:46 ` [Bug #13072] forcedeth seems to switch off eth on shutdown Rafael J. Wysocki
2009-04-26 20:52 ` Daniel Bierstedt
[not found] ` <1240778558.4995.4.camel@laptop.workgroup>
2009-04-26 23:20 ` Rafael J. Wysocki
2009-04-26 9:46 ` [Bug #13112] Oops in drain_array Rafael J. Wysocki
2009-04-26 20:19 ` David Rientjes
2009-04-27 8:52 ` Pekka Enberg
2009-04-27 14:04 ` Christoph Lameter
2009-04-27 16:58 ` Bart
2009-04-27 17:39 ` Christoph Lameter
2009-04-28 13:05 ` Bart
2009-04-27 20:36 ` David Rientjes
2009-04-28 6:47 ` Jens Axboe
2009-04-28 8:11 ` FUJITA Tomonori
2009-04-28 12:43 ` Bart
2009-04-28 14:44 ` FUJITA Tomonori
2009-04-28 18:22 ` Jens Axboe [this message]
2009-04-26 9:46 ` [Bug #13100] can't anymore even do a s2ram-s2disk-s2ram cycle on acer aspire 5720G Rafael J. Wysocki
2009-04-26 9:46 ` [Bug #13172] Spontaneous reboots since 2.6.29-rc* Rafael J. Wysocki
2009-04-26 9:46 ` [Bug #13144] resume from suspend fails using video card i915 Rafael J. Wysocki
2009-04-26 9:46 ` [Bug #13175] sata_nv incompatible with async scsi scan Rafael J. Wysocki
2009-04-26 9:46 ` [Bug #13184] Left audio channel broken after resume from suspend with Intel HDA Rafael J. Wysocki
2009-04-26 9:46 ` [Bug #13183] forcedeth: no link during initialization Rafael J. Wysocki
2009-04-26 9:46 ` [Bug #13178] Booting very slow Rafael J. Wysocki
2009-04-27 7:18 ` Martin Knoblauch
2009-04-26 9:46 ` [Bug #13186] cpufreq timer teardown problem Rafael J. Wysocki
2009-04-26 16:28 ` Mathieu Desnoyers
2009-04-26 17:45 ` Rafael J. Wysocki
2009-04-26 18:32 ` Mathieu Desnoyers
2009-04-26 12:47 ` 2.6.30-rc3-git1: Reported regressions 2.6.28 -> 2.6.29 Matthew Wilcox
-- strict thread matches above, loose matches on Subject: below --
2009-04-16 21:42 2.6.30-rc2-git2: Reported regressions from 2.6.29 Rafael J. Wysocki
2009-04-16 21:45 ` [Bug #13112] Oops in drain_array Rafael J. Wysocki
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20090428182248.GL4593@kernel.dk \
--to=jens.axboe@oracle.com \
--cc=akpm@linux-foundation.org \
--cc=cl@linux.com \
--cc=fujita.tomonori@lab.ntt.co.jp \
--cc=kernel-testers@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mmx@riz.pl \
--cc=penberg@cs.helsinki.fi \
--cc=rientjes@google.com \
--cc=rjw@sisk.pl \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).