Quoting Linus Torvalds (2013-08-19 17:16:36) > On Mon, Aug 19, 2013 at 1:29 PM, Christoph Lameter <c...@gentwo.org> wrote: > > On Mon, 19 Aug 2013, Simon Kirby wrote: > > > >> [... ] The > >> alloc/free traces are always the same -- always alloc_pipe_info and > >> free_pipe_info. This is seen on 3.10 and (now) 3.11-rc4: > >> > >> Object ffff880090f19e78: 6b 6b 6b 6b 6c 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b > >> kkkklkkkkkkkkkkk > > > > This looks like an increment after free in the second 32 bit value of the > > structure. First 32 bit value's poison is unchanged. > > Ugh. If that is "struct pipe_inode_info" and I read it right, that's > the "wait_lock" spinlock that is part of the mutex. > > Doing a "spin_lock()" could indeed cause an increment operation. But > it still sounds like a very odd case. And even for some wild pointer > I'd then expect the spin_unlock to also happen, and to then increment > the next byte (or word) too. More importantly, for a mutex, I'd expect > the *other* fields to be corrupted too (the "waiter" field etc). That > is, unless we're still spinning waiting for the mutex, but with that > value we shouldn't, as far as I can see. >
Simon, is this box doing btrfs send/receive? If so, it's probably where this pipe is coming from. Linus' CONFIG_DEBUG_PAGE_ALLOC suggestions are going to be the fastest way to find it, I can give you a patch if it'll help. It would be nice if you could trigger this on plain 3.11-rcX instead of btrfs-next. -chris -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
