Re: 2.6.20.3: kernel BUG at mm/slab.c:597 try#2

From: Pekka Enberg
Date: Mon Mar 19 2007 - 04:00:34 EST


On 3/19/07, Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> wrote:
BUG_ON(!PageSlab(page));

that's seriously screwed up. Do you have CONFIG_DEBUG_SLAB enabled? If
not, please enable it and retest.

This is scary. Looking at disassembly of the OOPS:

Disassembly of section .text:

00000000 <.text>:
0: 5f pop %edi
1: c3 ret
2: 57 push %edi
3: 89 c1 mov %eax,%ecx
5: 89 d7 mov %edx,%edi
7: 8d 92 00 00 00 40 lea 0x40000000(%edx),%edx
d: 56 push %esi
e: c1 ea 0c shr $0xc,%edx
11: 53 push %ebx
12: c1 e2 05 shl $0x5,%edx
15: 03 15 40 5d 5a c0 add 0xc05a5d40,%edx

At this point, edx has the result of virt_to_page().

1b: 8b 02 mov (%edx),%eax
1d: f6 c4 40 test $0x40,%ah
20: 74 03 je 0x25

If it's a compound page, look up the real page from ->private.

22: 8b 52 0c mov 0xc(%edx),%edx

Now, reload page flags.

25: 8b 02 mov (%edx),%eax

And test...

27: a8 80 test $0x80,%al
29: 75 04 jne 0x2f
2b: 0f 0b ud2a
2d: eb fe jmp 0x2d
2f: 39 4a 18 cmp %ecx,0x18(%edx)

[snip, snip]

EIP is at kmem_cache_free+0x29/0x5a
eax: c1800000 ebx: f0ae12c0 ecx: c18f73c0 edx: c1800000
esi: c1919de0 edi: 00000000 ebp: 00001000 esp: f1fe7e14
ds: 007b es: 007b ss: 0068

But somehow eax and edx have the same value 0xc1800000 here. Hmm?

Pekka
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/