rpms/kernel/devel linux-2.6-slab-corruptor-fix.patch, NONE, 1.1 kernel-2.6.spec, 1.2395, 1.2396

[fedora-cvs-commits at redhat.com]

Author: davej

Update of /cvs/dist/rpms/kernel/devel
In directory cvs.devel.redhat.com:/tmp/cvs-serv12289

Modified Files:
	kernel-2.6.spec 
Added Files:
	linux-2.6-slab-corruptor-fix.patch 
Log Message:
Ever wonder why the slab corruption issues only show up the week before the freeze?


linux-2.6-slab-corruptor-fix.patch:
 a/mm/slab.c |    9 --------
 b/mm/slab.c |   67 +++++++++++++++++++++++++++++++++++++-----------------------
 2 files changed, 42 insertions(+), 34 deletions(-)

--- NEW FILE linux-2.6-slab-corruptor-fix.patch ---
>From davej  Thu Jul 13 18:25:32 2006
Return-Path: <akpm at osdl.org>
X-Spam-Checker-Version: SpamAssassin 3.1.3 (2006-06-01) on 
	nwo.kernelslacker.org
X-Spam-Level: 
X-Spam-Status: No, score=0.0 required=5.0 tests=UNPARSEABLE_RELAY 
	autolearn=failed version=3.1.3
Received: from pobox.devel.redhat.com [10.11.255.8]
	by nwo.kernelslacker.org with IMAP (fetchmail-6.3.4)
	for <davej at localhost> (single-drop); Thu, 13 Jul 2006 18:25:32 -0400 (EDT)
Received: from pobox.devel.redhat.com ([unix socket])
	 by pobox.devel.redhat.com (Cyrus v2.2.12-Invoca-RPM-2.2.12-3.RHEL4.1) with LMTPA;
	 Thu, 13 Jul 2006 18:24:45 -0400
X-Sieve: CMU Sieve 2.2
Received: from int-mx1.corp.redhat.com (int-mx1.corp.redhat.com [172.16.52.254])
	by pobox.devel.redhat.com (8.13.1/8.13.1) with ESMTP id k6DMOiv8027699
	for <davej at pobox.devel.redhat.com>; Thu, 13 Jul 2006 18:24:45 -0400
Received: from mx3.redhat.com (mx3.redhat.com [172.16.48.32])
	by int-mx1.corp.redhat.com (8.12.11.20060308/8.12.11) with ESMTP id k6DMOifR011137
	for <davej at redhat.com>; Thu, 13 Jul 2006 18:24:44 -0400
Received: from smtp.osdl.org (smtp.osdl.org [65.172.181.4])
	by mx3.redhat.com (8.13.1/8.13.1) with ESMTP id k6DMOWXl005296
	for <davej at redhat.com>; Thu, 13 Jul 2006 18:24:38 -0400
Received: from shell0.pdx.osdl.net (fw.osdl.org [65.172.181.6])
	by smtp.osdl.org (8.12.8/8.12.8) with ESMTP id k6DMOQnW001908
	(version=TLSv1/SSLv3 cipher=EDH-RSA-DES-CBC3-SHA bits=168 verify=NO);
	Thu, 13 Jul 2006 15:24:26 -0700
Received: from box (shell0.pdx.osdl.net [10.9.0.31])
	by shell0.pdx.osdl.net (8.13.1/8.11.6) with SMTP id k6DMOQsd015752;
	Thu, 13 Jul 2006 15:24:26 -0700
Date: Thu, 13 Jul 2006 15:24:25 -0700
From: Andrew Morton <akpm at osdl.org>
To: Dave Jones <davej at redhat.com>
Cc: linux-kernel at vger.kernel.org, torvalds at osdl.org
Subject: Re: memory corruptor in .18rc1-git
Message-Id: <20060713152425.86412ea3.akpm at osdl.org>
In-Reply-To: <20060713221330.GB3371 at redhat.com>
References: <20060713221330.GB3371 at redhat.com>
X-Mailer: Sylpheed version 2.2.4 (GTK+ 2.8.17; i686-pc-linux-gnu)
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
X-MIMEDefang-Filter: osdl$Revision: 1.140 $
X-Scanned-By: MIMEDefang 2.36
X-RedHat-Spam-Score: 0.05 
Status: RO
X-Status: A
Content-Length: 1794
Lines: 48

On Thu, 13 Jul 2006 18:13:30 -0400
Dave Jones <davej at redhat.com> wrote:

> Three times in the last week, I've had a box running the -git-du-jour
> spontaneously reboot.  It just happened again, this time I had a serial
> console hooked up, but it rebooted before transferring much data.
> The one thing it did spew however was "List corruption. prev->ne",
> which came from the patch below which I had in my tree.
> (The latter half is likely irrelevant, and came from chasing a different bug)
> 
> Things in common at all three times it happened..
> reading email, and listening to oggs with rhythmbox.
> Another ALSA bug maybe ?
> 
> I've up'd the speed of the serial console, in the hope that more chars
> make it over the wire before reboot should this happen again.

Are you using SMP?  We have a known slab locking bug.

There have been a couple of slab.c patches committed today, but neither of
them appear to actually fix the bug.

The below should fix it, and testing this (disable lockdep) would be
useful.

It's going to take a bit of work to unpickle it all now.

diff -puN mm/slab.c~revert-slabc-lockdep-locking-change mm/slab.c
--- a/mm/slab.c~revert-slabc-lockdep-locking-change
+++ a/mm/slab.c
@@ -3100,16 +3100,7 @@ static void free_block(struct kmem_cache
 		if (slabp->inuse == 0) {
 			if (l3->free_objects > l3->free_limit) {
 				l3->free_objects -= cachep->num;
-				/*
-				 * It is safe to drop the lock. The slab is
-				 * no longer linked to the cache. cachep
-				 * cannot disappear - we are using it and
-				 * all destruction of caches must be
-				 * serialized properly by the user.
-				 */
-				spin_unlock(&l3->list_lock);
 				slab_destroy(cachep, slabp);
-				spin_lock(&l3->list_lock);
 			} else {
 				list_add(&slabp->list, &l3->slabs_free);
 			}
_