[Question] Crash of kmem_cache_cpu->freelist access

[Gavin Guo <tuffkidtt@gmail.com>]

Hi all,

I'm currently debugging a bug and found out the problem is the general
protection fault of the following access:

static inline void *get_freepointer(struct kmem_cache *s, void *object)
{
        return *(void **)(object + s->offset);
}

I tried to disassembly and found that the object is from c->freelist
and it has an abnormal value which caused the fault. My first thought
is to try to add slub_debug in the kernel command line. But, the
kernel is a production kernel and may not have the chance to add
kernel parameters. The other way is to "echo 1 >
/sys/kernel/slab/<object name>/poison." But, I found the allocation is
bound to kmalloc-1024. So, it may not have a chance to enable the
sysfs poison debugging.

I tried to debug for a long time and can't find any clue. Is there
anyone has efficient debugging methods to deal with the c->freelist
crashing if the slub_debug doesn't have a chance to be added to kernel
parameters.

Really thanks for your time reading the mail.

Thanks,
Tuffkid

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>