Messages in this thread | | | Date | Fri, 18 Jul 2008 11:09:51 +0200 | From | Ingo Molnar <> | Subject | Re: [bug, netconsole, SLUB] BUG skbuff_head_cache: Poison overwritten |
| |
* Pekka Enberg <penberg@cs.helsinki.fi> wrote:
> On Fri, Jul 18, 2008 at 8:46 AM, Evgeniy Polyakov <johnpol@2ka.mipt.ru> wrote: > > Does SLUB have a debug check at freeing time? If so, how does it work > > and why didn't it caught use after free there? > > You can't detect use after free before the object is actually free'd > ;-)
yeah, we want to check use-after free at the next allocation point - i.e. as late as possible to gather all corruptions that happened meanwhile.
We could in theory have a SLUB debug mode where a SCHED_IDLE kernel thread would periodically check all free objects (of that CPU) in the background to ensure their integrity. That would catch corruptions sooner, with a possibly still meaningful context to print out. [right after the IRQ or process that corrupts them finishes running]
It could also be hooked into ftrace to print out the last few hundred kernel function calls executed prior any corruption. ftrace/slub-debug plugin perhaps?
Ingo
| |