On Wed, 23 May 2007 23:05:24 +0200
Michal Piotrowski <[EMAIL PROTECTED]> wrote:
> Christoph Lameter napisa__(a):
> > On Wed, 23 May 2007, Michal Piotrowski wrote:
> >
> >> Christoph, this looks like a bug in SLUB.
> >
> > Please boot with slub_debug to find the bad code that overwrites a slab
> > object after it was freed.
> >
> >
>
> [ 19.096577] Real Time Clock Driver v1.12ac
> [ 21.650315] *** SLUB kmalloc-8: Redzone [EMAIL PROTECTED] slab 0xc528c530
> [ 21.657365] offset=3360 flags=0x400000c3 inuse=61 freelist=0xc90f6d58
> [ 21.664349] Bytes b4 0xc90f6d10: 00 00 00 00 00 00 00 00 5a 5a 5a 5a 5a
> 5a 5a 5a ........ZZZZZZZZ
> [ 21.674305] Object 0xc90f6d20: 31 30 31 39 2e 30 30 35
> 1019.005
> [ 21.684259] Redzone 0xc90f6d28: 00 cc cc cc
> .______
> [ 21.694265] FreePointer 0xc90f6d2c -> 0xc90f6d58
> [ 21.699061] Last alloc: get_modalias+0x61/0xf5 jiffies_ago=53 cpu=1 pid=554
> [ 21.706362] Filler 0xc90f6d50: 5a 5a 5a 5a 5a 5a 5a 5a
> ZZZZZZZZ
argh, I never 100% understood the slab gobbledygook, and now we have slub
gobbledygook. I _hope_ what that's saying is that the 00 at 0xc90f6d28
wasn't supposed to be there.
Obvious bug:
--- a/drivers/firmware/dmi-id.c~a
+++ a/drivers/firmware/dmi-id.c
@@ -94,7 +94,7 @@ static ssize_t get_modalias(char *buffer
if (!c)
continue;
- t = kmalloc(strlen(c), GFP_KERNEL);
+ t = kmalloc(strlen(c) + 1, GFP_KERNEL);
if (!t)
break;
ascii_filter(t, c);
_
> Here is another one
Same deal.
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
