linux-kernel - Re: list corruption in the last few days. (block ? crypto ?)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <alpine.DEB.2.00.1108051131440.28580@router.home>
Date:	Fri, 5 Aug 2011 11:32:09 -0500 (CDT)
From:	Christoph Lameter <cl@...ux.com>
To:	Pekka Enberg <penberg@...nel.org>
cc:	Markus Trippelsdorf <markus@...ppelsdorf.de>,
	Dave Jones <davej@...hat.com>,
	Linux Kernel <linux-kernel@...r.kernel.org>,
	Linus Torvalds <torvalds@...ux-foundation.org>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Jens Axboe <jaxboe@...ionio.com>
Subject: Re: list corruption in the last few days. (block ? crypto ?)

On Fri, 5 Aug 2011, Pekka Enberg wrote:

> On Fri, Aug 5, 2011 at 11:46 AM, Markus Trippelsdorf
> <markus@...ppelsdorf.de> wrote:
> > On 2011.08.04 at 21:00 -0400, Dave Jones wrote:
> >> Sometime in the last week, something was merged which causes my laptop
> >> to lock up occasionally.  I can trigger it most of the time just by
> >> doing a kernel build. When it gets to the final linking stage, it locks up hard.
> >>
> >> I finally managed to coax something out of usb console to get the traces below,
> >> which seem to implicate something in the block layer ?
> >>
> >> my root device is an lvm volume on an dmcrypt'd block dev, which might be relevant,
> >> as I don't see this happening on other machines with simpler setups.
> >>
> >> I'm going to try bisecting, but it might take me a few days, because it's
> >> such a pain in the ass to reproduce this reliably.
> >>
> >> [ 5913.233035] ------------[ cut here ]------------
> >> [ 5913.233097] WARNING: at lib/list_debug.c:53 __list_del_entry+0x8d/0x98()
> >> [ 5913.233101] Hardware name: Adamo 13
> >> [ 5913.233105] list_del corruption. prev->next should be ffffea000434fd20, but was ffffea0004199520
> >
> > See also: http://lkml.org/lkml/2011/8/3/37
>
> That's in networking so SLUB lockless patches are almost certainly the
> issue here. Is this with SLUB debugging enabled or not? Christoph, it
> like the partial lists are getting corrupted somehow.

This is occurring in __slab_free when we are freeing the last
object from a slab page that is on the partial list. It is not frozen so
it is not in use by a processor and thus deactivate_slab cannot be run
on it.

The logical race would be with acquire_slab() but both take the node lock
before doing anything with the lists.

Do you have CONFIG_DEBUG_VM on? If not please do so. This will check if
the frozen state is managed correctly.