Re: Oops: 2.5.64 check_obj_poison for 'size-64'

[Andrew Morton]

Zwane Mwaikambo <[e-mail]> wrote:
>
> On Thu, 6 Mar 2003, Andrew Morton wrote:
> 
> > Zwane Mwaikambo <[e-mail]> wrote:
> > >
> > > This just popped up on my screen, seems to have been triggered by sar/cron 
> > > (i'll probably have to reboot the box soon)
> > > 
> > > slab error in check_poison_obj(): cache `size-64': object was modified after freeing
> > > Call Trace:
> > >  [<c0142226>] check_poison_obj+0x66/0x70
> > >  [<c0143b92>] kmalloc+0xd2/0x180
> > >  [<c0166078>] pipe_new+0x28/0xd0
> > >  [<c0166153>] get_pipe_inode+0x23/0xb0
> > >  [<c0166212>] do_pipe+0x32/0x1e0
> > >  [<c0111ed3>] sys_pipe+0x13/0x60
> > >  [<c010ad9b>] syscall_call+0x7/0xb
> > 
> > Don't know.  If you're using anticipatory scheduler in 2.5.63-mmfoo this
> > will happen. 64-mm1 is OK.
> 
> Nope simply 2.5.64-unwashed. I don't know how to twiddle the advanced 
> knobs

OK.  -mm has a more sophisticated use-after-free detector.  It might be
worth dropping that in there, see if we can get more info.

ftp://ftp.kernel.org/pub/linux/kernel/people/akpm/patches/2.5/2.5.64/2.5.64-mm1/broken-out/use-after-free-check.patch

> > show_interrupts() is walking the per-irq action chain without locking it.
> > Any concurrent add/remove activity will explode.
> > 
> > Do you want to hunt down all the show_interrupts() instances and pop a
> > spin_lock_irq(desc->lock) around them?
> 
> Sure thing.

OK, thanks.

All the arch/*/kernel/irq.c implementations are distressingly similar. 
Andrey Panin did a bunch of work a while back to start consolidating the
common code but it didn't quite get finished off.  Guess we just have to grit
our teeth for now.