linux-kernel - Re: 2.6.23-rc6-mm1: BUG kmalloc-16: Object padding overwritten (sysfs?)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20070920103229.GB6781@localhost.sw.ru>
Date:	Thu, 20 Sep 2007 14:32:29 +0400
From:	Alexey Dobriyan <adobriyan@...ru>
To:	Christoph Lameter <clameter@....com>
Cc:	Andrew Morton <akpm@...ux-foundation.org>, gregkh@...e.de,
	linux-kernel@...r.kernel.org
Subject: Re: 2.6.23-rc6-mm1: BUG kmalloc-16: Object padding overwritten (sysfs?)

On Thu, Sep 20, 2007 at 11:53:53AM +0400, Alexey Dobriyan wrote:
> On Wed, Sep 19, 2007 at 02:36:04PM -0700, Christoph Lameter wrote:
> > So I would think that this is an actual memory corruption issue on your 
> > system and the /sys/slab stuff works fine. slabinfo -v will perform a more 
> > details scan to help you located the problem.
> 
> OK, I do clean boot, ssh to box, then sudo slabinfo -v.
> 
> 
> =============================================================================
> BUG kmalloc-16: Object padding overwritten
> -----------------------------------------------------------------------------

The winner is slub-avoid-touching-page-struct-when-freeing-to-per-cpu-slab.patch
Blind bisecting pointed to it and reverting the patch from full -mm makes
the problem go away

From: Christoph Lameter <clameter@....com>

Set c->node to -1 if we allocate from a debug slab instead for SlabDebug
which requires access the page struct cacheline.

Signed-off-by: Christoph Lameter <clameter@....com>
Signed-off-by: Andrew Morton <akpm@...ux-foundation.org>
---

 mm/slub.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff -puN mm/slub.c~slub-avoid-touching-page-struct-when-freeing-to-per-cpu-slab mm/slub.c
--- a/mm/slub.c~slub-avoid-touching-page-struct-when-freeing-to-per-cpu-slab
+++ a/mm/slub.c
@@ -1537,6 +1537,7 @@ debug:
 
 	c->page->inuse++;
 	c->page->freelist = object[c->offset];
+	c->node = -1;
 	slab_unlock(c->page);
 	return object;
 }
@@ -1560,8 +1561,7 @@ static void __always_inline *slab_alloc(
 
 	local_irq_save(flags);
 	c = get_cpu_slab(s, smp_processor_id());
-	if (unlikely(!c->page || !c->freelist ||
-					!node_match(c, node)))
+	if (unlikely(!c->freelist || !node_match(c, node)))
 
 		object = __slab_alloc(s, gfpflags, node, addr, c);
 
@@ -1670,7 +1670,7 @@ static void __always_inline slab_free(st
 	local_irq_save(flags);
 	debug_check_no_locks_freed(object, s->objsize);
 	c = get_cpu_slab(s, smp_processor_id());
-	if (likely(page == c->page && !SlabDebug(page))) {
+	if (likely(page == c->page && c->node >= 0)) {
 		object[c->offset] = c->freelist;
 		c->freelist = object;
 	} else
_

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/