[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <20090428171139N.fujita.tomonori@lab.ntt.co.jp>
Date: Tue, 28 Apr 2009 17:11:28 +0900
From: FUJITA Tomonori <fujita.tomonori@....ntt.co.jp>
To: rientjes@...gle.com
Cc: mmx@....pl, cl@...ux.com, penberg@...helsinki.fi,
linux-kernel@...r.kernel.org, kernel-testers@...r.kernel.org,
rjw@...k.pl, akpm@...ux-foundation.org,
fujita.tomonori@....ntt.co.jp, jens.axboe@...cle.com
Subject: Re: [Bug #13112] Oops in drain_array
On Mon, 27 Apr 2009 13:36:46 -0700 (PDT)
David Rientjes <rientjes@...gle.com> wrote:
> On Mon, 27 Apr 2009, Bart wrote:
>
> > After turning the suggested debuging options I've got tons of these when
> > trying to stress the tape device like before:
> >
> > Apr 27 16:57:30 fs kernel: [ 96.446708] slab error in verify_redzone_free():
> > cache `size-128': memory outside object was overwritten
> > Apr 27 16:57:30 fs kernel: [ 96.446713] Pid: 0, comm: swapper Not tainted
> > 2.6.29.1-64 #2
> > Apr 27 16:57:30 fs kernel: [ 96.446715] Call Trace:
> > Apr 27 16:57:30 fs kernel: [ 96.446717] <IRQ> [<ffffffff8029adc5>]
> > __slab_error+0x1f/0x25
> > Apr 27 16:57:30 fs kernel: [ 96.446728] [<ffffffff8029b24b>]
> > cache_free_debugcheck+0x108/0x1d6
> > Apr 27 16:57:30 fs kernel: [ 96.446731] [<ffffffff8029b473>]
> > kfree+0x81/0xc2
> > Apr 27 16:57:30 fs kernel: [ 96.446735] [<ffffffff802bd311>]
> > bio_free_map_data+0xc/0x1e
>
> This appears to be kfree(bmd->iovecs) in bio_free_map_data(). It looks
> like the memcpy size in bio_set_map_data() overrides the kmalloc size; in
> other words, for a redzone error, bio->bi_vcnt > nr_pages in
> bio_copy_user_iov().
Can you try this?
diff --git a/fs/bio.c b/fs/bio.c
index 7bbc98f..6a09356 100644
--- a/fs/bio.c
+++ b/fs/bio.c
@@ -817,6 +817,9 @@ struct bio *bio_copy_user_iov(struct request_queue *q,
len += iov[i].iov_len;
}
+ if (offset)
+ nr_pages += 1;
+
bmd = bio_alloc_map_data(nr_pages, iov_count, gfp_mask);
if (!bmd)
return ERR_PTR(-ENOMEM);
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists