Bug 151111 - Slab corruption: start=e0840f38, len=2048
Summary: Slab corruption: start=e0840f38, len=2048
Status: RESOLVED DUPLICATE of bug 154601
Alias: None
Product: SUSE Linux 10.1
Classification: openSUSE
Component: Kernel (show other bugs)
Version: Beta 3.5internal
Hardware: Other Other
: P5 - None : Blocker (vote)
Target Milestone: ---
Assignee: E-mail List
QA Contact: E-mail List
URL:
Whiteboard:
Keywords:
Depends on:
Blocks: 140732
  Show dependency treegraph
 
Reported: 2006-02-15 10:15 UTC by Forgotten User ZhJd0F0L3x
Modified: 2006-04-11 09:07 UTC (History)
0 users

See Also:
Found By: Component Test
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments
more "unplug cp2101" => slab corruption messages (10.01 KB, text/plain)
2006-03-06 12:24 UTC, Forgotten User ZhJd0F0L3x
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Forgotten User ZhJd0F0L3x 2006-02-15 10:15:57 UTC
Today i found the following in my logs. I have no idea what it is, but it looks scary. Blocker on request from Michael Matz.

Feb 15 11:07:59 strolchi klogd: Slab corruption: start=e0840f38, len=2048
Feb 15 11:07:59 strolchi klogd: Redzone: 0x5a2cf071/0x5a2cf071.
Feb 15 11:07:59 strolchi klogd: Last user: [<c01f0e31>](release_mem+0xe6/0x1ce)
Feb 15 11:07:59 strolchi klogd: 0b0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b ff ff ff ff
Feb 15 11:07:59 strolchi klogd: 0c0: 00 00 00 00 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b
Feb 15 11:07:59 strolchi klogd: Prev obj: start=e084072c, len=2048
Feb 15 11:07:59 strolchi klogd: Redzone: 0x5a2cf071/0x5a2cf071.
Feb 15 11:07:59 strolchi klogd: Last user: [<c022f926>](kfree_skbmem+0x8/0x5f)
Feb 15 11:07:59 strolchi klogd: 000: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b
Feb 15 11:07:59 strolchi klogd: 010: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b
Feb 15 11:07:59 strolchi klogd: Next obj: start=e0841744, len=2048
Feb 15 11:07:59 strolchi klogd: Redzone: 0x170fc2a5/0x170fc2a5.
Feb 15 11:07:59 strolchi klogd: Last user: [<f91983eb>](tg3_alloc_rx_skb+0xb8/0x15b [tg3])
Feb 15 11:07:59 strolchi klogd: 000: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a
Feb 15 11:07:59 strolchi klogd: 010: 5a 5a 00 12 79 59 37 34 00 0a e4 53 2e be 08 00
Comment 1 Olaf Kirch 2006-02-16 16:07:48 UTC
Can you reproduce this?

What were you doing at the time of the corruption?
Comment 4 Olaf Kirch 2006-02-16 17:00:06 UTC
> I was connected via Bluetooth rfcomm => ppp to the internet

That makes sense. The corruption seems to happen when closing a tty
device (possibly the rfcomm device). So it could be related to rfcomm.

> IIRC no other network connection was active (WLAN was probably off), but
> NetworkManager might have been polling on the tg3 for link.

It seems the tg3 driver was receiving data in the not too distant past.

So feel this may be rfcomm related. Maybe you can test this a little
(connecting/disconnecting)?
Comment 5 Karsten Keil 2006-02-16 17:25:57 UTC
I saw some tty race fixed in rc3-git4 or git3.
Comment 6 Forgotten User ZhJd0F0L3x 2006-02-16 17:52:46 UTC
the bt-rfcomm-ppp connection was active and not interrupted at this time, dialin was at 10:46:19, RAS was set up 10:46:41, tg3 was probably unplugged at 08:55:55:
Feb 15 08:55:55 strolchi klogd: tg3: cable: Link is down.
Feb 15 08:55:55 strolchi NetworkManager: <information>  SWITCH: terminating current connection 'cable' because it's no longer va

What i did around the corruption time was trying to ssh / rsync into suse, but that did not work well since the network inside was kaputt.
Comment 7 Olaf Kirch 2006-02-16 18:13:20 UTC
Well, the slab chunks that were corrupted were previously used by tg3
and a tty driver (which was closed).

I will change this to NEEDINFO, please leave it in this state until
you have a reproduce with the most recent KOTD (which as Karsten
noted has some tty race fix in it).

Thanks!
Comment 8 Olaf Kirch 2006-03-06 12:04:34 UTC
Any news on this one? It's been a few weeks...
Comment 9 Forgotten User ZhJd0F0L3x 2006-03-06 12:21:51 UTC
i have not seen it again. But a new one, with a usb-serial converter. Just plug it in, "screen /dev/ttyUSB0", unplug. Boom.

Mar  6 13:19:33 susi kernel: usb 3-1: USB disconnect, address 3
Mar  6 13:19:33 susi kernel: cp2101 3-1:1.0: device disconnected
Mar  6 13:19:33 susi kernel: cp2101 ttyUSB0: cp2101_set_config - Unable to send request, request=0x0 size=2 result=-19
Mar  6 13:19:33 susi kernel: cp2101 ttyUSB0: cp2101 converter now disconnected from ttyUSB0
Mar  6 13:19:33 susi kernel: Slab corruption: start=c4eaa448, len=1024
Mar  6 13:19:33 susi kernel: Redzone: 0x5a2cf071/0x5a2cf071.
Mar  6 13:19:33 susi kernel: Last user: [<c020a43e>](device_release+0x14/0x41)
Mar  6 13:19:33 susi kernel: 010: 6b 6b 6b 6b 6b 6b 6b 6b 6c 6b 6b 6b 6b 6b 6b 6b
Mar  6 13:19:33 susi kernel: Prev obj: start=c4eaa03c, len=1024
Mar  6 13:19:33 susi kernel: Redzone: 0x170fc2a5/0x170fc2a5.
Mar  6 13:19:33 susi kernel: Last user: [<e117c66c>](usb_alloc_dev+0x1f/0x153 [usbcore])
Mar  6 13:19:33 susi kernel: 000: 01 00 00 00 30 00 00 00 00 00 00 00 00 00 00 00
Mar  6 13:19:33 susi kernel: 010: 00 00 00 00 07 00 00 00 02 00 00 00 00 00 00 00
Mar  6 13:19:33 susi kernel: Next obj: start=c4eaa854, len=1024
Mar  6 13:19:33 susi kernel: Redzone: 0x170fc2a5/0x170fc2a5.
Mar  6 13:19:33 susi kernel: Last user: [<c0166447>](expand_files+0x102/0x2e6)
Mar  6 13:19:33 susi kernel: 000: d4 b1 98 db d4 b1 98 db d4 b1 98 db 44 9f 9b d7
Mar  6 13:19:33 susi kernel: 010: 80 32 b3 db 00 00 00 00 00 00 00 00 00 00 00 00

i have more of those in the logs, will attach.
Comment 10 Forgotten User ZhJd0F0L3x 2006-03-06 12:24:19 UTC
Created attachment 71337 [details]
more "unplug cp2101" => slab corruption messages

i can also provide the hardware if necessary.
Comment 11 Olaf Kirch 2006-03-06 12:27:59 UTC
That is a different issue, most likely (your original report didn't mention
anything about USB). Please open a separate bug report for that.

Since you haven't seen the original problem again, I will resolve this
as WORKSFORME. Please reopen when it happens again.
Comment 12 Andreas Gruenbacher 2006-04-04 13:31:06 UTC
Seems to be the same as bug 154601; reopen.