Messages in this thread | | | Date | Sat, 22 Nov 2008 02:50:54 +0100 | From | "Vegard Nossum" <> | Subject | Re: kernel BUG at mm/slab.c:601 |
| |
On Sat, Nov 22, 2008 at 2:26 AM, Vegard Nossum <vegard.nossum@gmail.com> wrote: > [Resend with (I hope) working e-mail address for Mauro] > > On Sat, Nov 22, 2008 at 2:25 AM, Vegard Nossum <vegard.nossum@gmail.com> wrote: >> On Sat, Nov 22, 2008 at 2:10 AM, Vegard Nossum <vegard.nossum@gmail.com> wrote: >>>> [ 527.562373] ffffffff8043b157 0000000000200200 ffffffffa02810d4 >>>> ffff88001e13c600 >>> >>> LIST_POISON2 on the stack: >>> >>> include/linux/poison.h:#define LIST_POISON2 ((void *) 0x00200200) >> >> So looking at bttv source code, I wonder what the codes like these are >> trying to do: >> >> if (set->top->vb.queue.next) >> list_del(&set->top->vb.queue); >> >> Code is ancient, I'll ask Mauro.
A semantic patch that finds such invalid list constructs (it is invalid, isn't it?) would look like this:
@@ expression E; statement S; @@
( * if (E.next) S | * if (!E.next) S | * if (E.prev) S | * if (!E.prev) S )
I am guessing that the original code wanted to check whether the object was the last in a list? (The invalid assumption is that NULL ends the list. Or NULL means that the node is not on a list? But if so, why take it off the list? In either case, the NULL test looks wrong because of the poison pointers which prevent intent of the code -- to check if there is a valid next entry.)
But for this test we actually need to know the list head too. And I don't know where to find it.
Vegard
-- "The animistic metaphor of the bug that maliciously sneaked in while the programmer was not looking is intellectually dishonest as it disguises that the error is the programmer's own creation." -- E. W. Dijkstra, EWD1036
| |