On Thu, 20 Sep 2007, Alexey Dobriyan wrote:

quoted text
> OK, I do clean boot, ssh to box, then sudo slabinfo -v.
>=20
>=20
> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D
quoted text
> BUG kmalloc-16: Object padding overwritten
> -------------------------------------------------------------------------=
----
quoted text
>=20
> INFO: 0xffff810100fd8998-0xffff810100fd8999. First byte 0xa7 instead of 0=
x5a
quoted text
> INFO: Allocated in sysfs_new_dirent+0x100/0x120 age=3D11055 cpu=3D0 pid=
=3D3474
quoted text
> INFO: Freed in kobject_uevent_env+0x123/0x430 age=3D11055 cpu=3D0 pid=3D3=
474
quoted text
> INFO: Slab 0xffff810004837740 used=3D28 fp=3D0xffff810100fd89a0 flags=3D0=
x8000000000000083
quoted text
> INFO: Object 0xffff810100fd8948 @offset=3D2376 fp=3D0xffff810100fd89a0

Hmmm.. A corrupted sysfs object at an offset of one word from the end of=20
the object that could never have been caught by SLAB since it does not=20
check more than 4 bytes. Does the value 0x5ea7 tell us anything? Maybe a=20
counter was incremented a couple of times from the initial value of 0x5a5a=
=20
that was put there by SLUB?

quoted text
> INFO: 0xffff810101b45310-0xffff810101b45311. First byte 0xd3 instead of 0=
x5a
quoted text
> INFO: Allocated in kobject_get_path+0x57/0xc0 age=3D18405 cpu=3D1 pid=3D2=
006
quoted text
> INFO: Freed in kobject_uevent_env+0x123/0x430 age=3D18405 cpu=3D1 pid=3D2=
006
quoted text
> INFO: Slab 0xffff81000485f718 used=3D8 fp=3D0xffff810101b45318 flags=3D0x=
8000000000000083
quoted text
> INFO: Object 0xffff810101b452c0 @offset=3D704 fp=3D0xffff810101b45370
>=20
> Bytes b4 0xffff810101b452b0:  db f9 fb ff 00 00 00 00 5a 5a 5a 5a 5a 5a 5=
a 5a =DB=F9=FB=FF....ZZZZZZZZ
quoted text
>   Object 0xffff810101b452c0:  6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6=
b a5 kkkkkkkkkkkkkkk=A5
quoted text
>  Redzone 0xffff810101b452d0:  bb bb bb bb bb bb bb bb                    =
     =BB=BB=BB=BB=BB=BB=BB=BB       =20
quoted text
>  Padding 0xffff810101b45310:  d3 5e 5a 5a 5a 5a 5a 5a                    =
     =D3^ZZZZZZ       =20

Ditto.... but here we have a freed object in the above case the object is=
=20
still in use. Done by different processes at different times.

Eric: Anything that comes to mind in sysfs?