From: Christoph Lameter <cl@linux.com>
To: Eric Dumazet <eric.dumazet@gmail.com>
Cc: Markus Trippelsdorf <markus@trippelsdorf.de>,
Christian Kujau <lists@nerdbynature.de>,
Benjamin Herrenschmidt <benh@kernel.crashing.org>,
"Alex,Shi" <alex.shi@intel.com>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
"linux-mm@kvack.org" <linux-mm@kvack.org>,
Pekka Enberg <penberg@kernel.org>, Matt Mackall <mpm@selenic.com>,
"netdev@vger.kernel.org" <netdev@vger.kernel.org>,
Tejun Heo <tj@kernel.org>
Subject: Re: WARNING: at mm/slub.c:3357, kernel BUG at mm/slub.c:3413
Date: Tue, 22 Nov 2011 10:36:44 -0600 (CST) [thread overview]
Message-ID: <alpine.DEB.2.00.1111221033350.28197@router.home> (raw)
In-Reply-To: <1321979579.18002.5.camel@edumazet-HP-Compaq-6005-Pro-SFF-PC>
[-- Attachment #1: Type: TEXT/PLAIN, Size: 2429 bytes --]
On Tue, 22 Nov 2011, Eric Dumazet wrote:
> Le mardi 22 novembre 2011 à 10:20 -0600, Christoph Lameter a écrit :
> > Argh. The Redzoning (and the general object pad initialization) is outside
> > of the slab_lock now. So I get wrong positives on those now. That
> > is already in 3.1 as far as I know. To solve that we would have to cover a
> > much wider area in the alloc and free with the slab lock.
> >
> > But I do not get the count mismatches that you saw. Maybe related to
> > preemption. Will try that next.
>
> Also I note the checks (redzoning and all features) that should be done
> in kfree() are only done on slow path ???
Yes debugging forces the slow paths.
> I am considering adding a "quarantine" capability : each cpu will
> maintain in its struct kmem_cache_cpu a FIFO list of "s->quarantine_max"
> freed objects.
>
> So it should be easier to track use after free bugs, setting
> quarantine_max to a big value.
It may be easier to simply disable interrupts early in __slab_free
if debugging is on. Doesnt look nice right now. Draft patch (not tested
yet):
---
mm/slub.c | 15 ++++++++++++---
1 file changed, 12 insertions(+), 3 deletions(-)
Index: linux-2.6/mm/slub.c
===================================================================
--- linux-2.6.orig/mm/slub.c 2011-11-22 09:04:47.000000000 -0600
+++ linux-2.6/mm/slub.c 2011-11-22 10:33:12.000000000 -0600
@@ -2391,8 +2391,13 @@ static void __slab_free(struct kmem_cach
stat(s, FREE_SLOWPATH);
- if (kmem_cache_debug(s) && !free_debug_processing(s, page, x, addr))
- return;
+ if (kmem_cache_debug(s)) {
+ local_irq_save(flags);
+ if (!free_debug_processing(s, page, x, addr)) {
+ local_irq_restore(flags);
+ return;
+ }
+ }
do {
prior = page->freelist;
@@ -2422,8 +2427,10 @@ static void __slab_free(struct kmem_cach
* Otherwise the list_lock will synchronize with
* other processors updating the list of slabs.
*/
- spin_lock_irqsave(&n->list_lock, flags);
+ if (!kmem_cache_debug(s))
+ local_irq_save(flags);
+ spin_lock(&n->list_lock);
}
}
inuse = new.inuse;
@@ -2448,6 +2455,8 @@ static void __slab_free(struct kmem_cach
*/
if (was_frozen)
stat(s, FREE_FROZEN);
+ if (kmem_cache_debug(s))
+ local_irq_restore(flags);
return;
}
next prev parent reply other threads:[~2011-11-22 16:36 UTC|newest]
Thread overview: 101+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-11-18 7:25 WARNING: at mm/slub.c:3357, kernel BUG at mm/slub.c:3413 Markus Trippelsdorf
2011-11-18 7:55 ` Markus Trippelsdorf
2011-11-18 8:43 ` Alex,Shi
2011-11-18 8:54 ` Markus Trippelsdorf
2011-11-18 8:57 ` Markus Trippelsdorf
2011-11-18 12:02 ` Markus Trippelsdorf
2011-11-21 0:44 ` Alex,Shi
2011-11-21 7:29 ` Markus Trippelsdorf
2011-11-21 8:05 ` Markus Trippelsdorf
2011-11-21 8:24 ` Markus Trippelsdorf
2011-11-21 8:56 ` Eric Dumazet
2011-11-21 9:16 ` Eric Dumazet
2011-11-21 13:15 ` Markus Trippelsdorf
2011-11-21 14:16 ` Eric Dumazet
2011-11-21 14:21 ` Markus Trippelsdorf
2011-11-21 15:36 ` Markus Trippelsdorf
2011-11-21 15:48 ` Eric Dumazet
2011-11-21 16:10 ` Markus Trippelsdorf
2011-11-21 16:34 ` Markus Trippelsdorf
2011-11-22 8:36 ` Markus Trippelsdorf
2011-12-19 3:21 ` Eric W. Biederman
2011-12-19 9:19 ` Markus Trippelsdorf
2011-12-19 9:06 ` Eric W. Biederman
2011-11-21 16:52 ` Eric Dumazet
2011-11-21 17:15 ` Eric Dumazet
2011-11-21 17:35 ` Markus Trippelsdorf
2011-11-21 18:39 ` Eric Dumazet
2011-11-21 18:52 ` Markus Trippelsdorf
2011-11-21 19:51 ` Markus Trippelsdorf
2011-11-21 20:27 ` Benjamin Herrenschmidt
2011-11-21 21:30 ` Pekka Enberg
2011-11-21 21:43 ` Christoph Lameter
[not found] ` <alpine.DEB.2.01.1111211617220.8000@trent.utfs.org>
2011-11-22 2:17 ` Benjamin Herrenschmidt
2011-11-22 3:18 ` Christoph Lameter
2011-11-22 7:48 ` Eric Dumazet
2011-11-22 7:51 ` Markus Trippelsdorf
2011-11-22 8:27 ` Eric Dumazet
2011-11-23 7:13 ` Markus Trippelsdorf
2011-11-23 7:20 ` Eric Dumazet
2011-11-22 21:58 ` Benjamin Herrenschmidt
[not found] ` <alpine.DEB.2.01.1111221511070.8000@trent.utfs.org>
2011-11-23 0:18 ` Benjamin Herrenschmidt
[not found] ` <alpine.DEB.2.01.1111221711410.8000@trent.utfs.org>
2011-11-23 1:43 ` Benjamin Herrenschmidt
[not found] ` <alpine.DEB.2.01.1111222145470.8000@trent.utfs.org>
2011-11-23 6:59 ` Pekka Enberg
2011-11-23 15:14 ` slub: use irqsafe_cpu_cmpxchg for put_cpu_partial Christoph Lameter
2011-11-23 16:04 ` Eric Dumazet
2011-11-23 23:15 ` David Rientjes
[not found] ` <alpine.DEB.2.01.1111231025180.8000@trent.utfs.org>
2011-11-24 6:45 ` Pekka Enberg
[not found] ` <alpine.DEB.2.01.1111220038060.8000@trent.utfs.org>
2011-11-22 22:16 ` WARNING: at mm/slub.c:3357, kernel BUG at mm/slub.c:3413 Benjamin Herrenschmidt
2011-11-22 22:31 ` Eric Dumazet
2011-11-22 22:32 ` Christoph Lameter
2011-11-22 8:45 ` Markus Trippelsdorf
2011-11-22 9:25 ` Eric Dumazet
2011-11-22 9:27 ` Eric Dumazet
2011-11-22 9:38 ` Eric Dumazet
2011-11-22 9:46 ` Eric Dumazet
2011-11-22 14:46 ` Christoph Lameter
2011-11-22 14:52 ` Eric Dumazet
2011-11-22 15:02 ` Christoph Lameter
2011-11-22 15:07 ` Christoph Lameter
2011-11-22 16:20 ` Christoph Lameter
2011-11-22 16:32 ` Eric Dumazet
2011-11-22 16:36 ` Christoph Lameter [this message]
2011-11-22 16:41 ` Christoph Lameter
2011-11-22 16:53 ` slub: Lockout validation scans during freeing of object Christoph Lameter
2011-11-22 17:21 ` Eric Dumazet
2011-11-22 17:40 ` Christoph Lameter
2011-11-22 18:55 ` Markus Trippelsdorf
2011-11-22 19:20 ` Christoph Lameter
2011-11-22 19:32 ` Markus Trippelsdorf
2011-11-22 19:46 ` Christoph Lameter
2011-11-22 17:59 ` Christoph Lameter
2011-11-22 11:21 ` WARNING: at mm/slub.c:3357, kernel BUG at mm/slub.c:3413 Markus Trippelsdorf
2011-11-22 14:50 ` Christoph Lameter
2011-11-22 14:44 ` Christoph Lameter
2011-11-21 15:51 ` Markus Trippelsdorf
2011-11-23 16:03 ` Markus Trippelsdorf
2011-11-23 16:06 ` Christoph Lameter
2011-11-24 8:50 ` Markus Trippelsdorf
2011-12-01 8:44 ` Markus Trippelsdorf
2011-12-01 8:53 ` Pekka Enberg
2011-12-02 19:43 ` Jerome Glisse
2011-12-02 20:06 ` Markus Trippelsdorf
2011-12-02 20:48 ` Markus Trippelsdorf
2011-12-07 14:32 ` Robert Richter
2011-12-07 14:39 ` Markus Trippelsdorf
2011-12-02 23:04 ` Jerome Glisse
2011-12-03 9:28 ` Markus Trippelsdorf
2011-12-03 12:20 ` Dave Airlie
2011-12-03 12:29 ` Markus Trippelsdorf
2011-12-03 19:31 ` Jerome Glisse
2011-12-03 19:32 ` Jerome Glisse
2011-12-04 1:02 ` Markus Trippelsdorf
2011-12-04 17:32 ` Jerome Glisse
2011-12-05 17:10 ` Jerome Glisse
2011-12-05 18:15 ` Markus Trippelsdorf
2011-12-05 18:43 ` Jerome Glisse
2011-12-05 19:11 ` Jerome Glisse
2011-12-05 19:27 ` Markus Trippelsdorf
2011-12-05 20:10 ` Pekka Enberg
2011-12-05 20:20 ` Jerome Glisse
2011-12-05 10:44 ` David Laight
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=alpine.DEB.2.00.1111221033350.28197@router.home \
--to=cl@linux.com \
--cc=alex.shi@intel.com \
--cc=benh@kernel.crashing.org \
--cc=eric.dumazet@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=lists@nerdbynature.de \
--cc=markus@trippelsdorf.de \
--cc=mpm@selenic.com \
--cc=netdev@vger.kernel.org \
--cc=penberg@kernel.org \
--cc=tj@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).