> [ 114.913404] Padding 000000006913c65d: 00 00 00 00 00 00 00 00 00 00 00 00 > 00 00 00 00 ................ > [ 114.915437] Padding 000000002d53f25c: 00 00 00 00 00 00 00 00 00 00 00 00 > 00 00 00 00 ................ > [ 114.917390] Padding 0000000078f7d621: 00 00 00 00 00 00 00 00 00 00 00 00 > 00 00 00 00 ................ > [ 114.919402] Padding 0000000063547658: 00 00 00 00 00 00 00 00 00 00 00 00 > 00 00 00 00 ................ > [ 114.921414] Padding 000000001a301f4e: 00 00 00 00 00 00 00 00 00 00 00 00 > 00 00 00 00 ................ > [ 114.923364] Padding 0000000046589d24: 00 00 00 00 00 00 00 00 00 00 00 00 > 00 00 00 00 ................ > [ 114.925340] Padding 0000000008fb13da: 00 00 00 00 00 00 00 00 00 00 00 00 > 00 00 00 00 ................ > [ 114.927291] Padding 00000000ae5cc298: 00 00 00 00 00 00 00 00 00 00 00 00 > 00 00 00 00 ................ > [ 114.929239] Padding 00000000d49cc239: 00 00 00 00 00 00 00 00 00 00 00 00 > 00 00 00 00 ................ > [ 114.931177] Padding 00000000d66ad6f5: 00 00 00 00 00 00 00 00 00 00 00 00 > 00 00 00 00 ................ > [ 114.933110] Padding 00000000069ad671: 00 00 00 00 00 00 00 00 00 00 00 00 > 00 00 00 00 ................ > [ 114.934986] Padding 00000000ffaf648c: 00 00 00 00 00 00 00 00 00 00 00 00 > 00 00 00 00 ................ > [ 114.936895] Padding 00000000c96d1b58: 00 00 00 00 00 00 00 00 00 00 00 00 > 00 00 00 00 ................ > [ 114.938848] Padding 00000000768e4920: 00 00 00 00 00 00 00 00 00 00 00 00 > 00 00 00 00 ................ > [ 114.940965] Padding 000000000d06b43c: 00 00 00 00 00 00 00 00 00 00 00 00 > 00 00 00 00 ................ > [ 114.942890] Padding 00000000af5ae9fa: 00 00 00 00 00 00 00 00 00 00 00 00 > 00 00 00 00 ................ > [ 114.944790] Padding 000000006b526f1e: 00 00 00 00 00 00 00 00 00 00 00 00 > 00 00 00 00 ................ > [ 114.946727] Padding 000000009c8dffe3: 00 00 00 00 00 00 00 00 00 00 00 00 > 00 00 00 00 ................
Another testing angle, It might be something is doing __GFP_ZERO and overwriting those slabs. This also matched the red root corruption, since RB_RED is bit 0. One thing to try is to enable page_owner=on in the command-line, and then obtain sorted_page_owner.txt before and after running the reproducer. $ cd tools/vm $ make page_owner_sort $ cat /sys/kernel/debug/page_owner > page_owner_full.txt $ grep -v ^PFN page_owner_full.txt > page_owner.txt $ ./page_owner_sort page_owner.txt sorted_page_owner.txt
