Re: list corruption in the last few days. (block ? crypto ?)

[Pekka Enberg]

On Sat, 6 Aug 2011, Linus Torvalds wrote:
> Anybody has any ideas on this one? I'm back home, no more diving :(,
> ready to make -rc1, but I'd *prefer* to have a handle on this one.
>
> Of course, the fact that it apparently only happens with SLUB
> debugging on means that the impact is less, but on the other hand I
> really like all the people who enable debug features and help us test
> with those on. So..

Christoph, I've been reading the code and spotted two potential issues in 
__slab_free(). The first one seems like an off-by-one where our comparison 
in deactivate_slab() doesn't match __slab_free.

The other one is remove_full() call in __slab_free() that can get called 
even if cache debugging is not enabled.

Hmm?

			Pekka

diff --git a/mm/slub.c b/mm/slub.c
index eb5a8f9..cee8c20 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -2368,7 +2368,7 @@ static void __slab_free(struct kmem_cache *s, struct page *page,
 	if (was_frozen)
 		stat(s, FREE_FROZEN);
 	else {
-		if (unlikely(!inuse && n->nr_partial > s->min_partial))
+		if (unlikely(!inuse && n->nr_partial >= s->min_partial))
                         goto slab_empty;

 		/*
@@ -2376,7 +2376,8 @@ static void __slab_free(struct kmem_cache *s, struct page *page,
 		 * then add it.
 		 */
 		if (unlikely(!prior)) {
-			remove_full(s, page);
+			if (kmem_cache_debug(s))
+				remove_full(s, page);
 			add_partial(n, page, 0);
 			stat(s, FREE_ADD_PARTIAL);
 		}
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/