Re: Badness in cache_free_debugcheck at mm/slab.c:2315

[Herbert Xu]

On Thu, Jan 12, 2006 at 04:53:15AM +0000, Dave Jones wrote:
>  > 
>  > Jan  7 17:22:45 white kernel: mismatch in kmem_cache_free: expected cache
>  > df7c9140, got df7c9200
>  > Jan  7 17:22:45 white kernel: df7c9200 is skbuff_head_cache.
>  > Jan  7 17:22:45 white kernel: df7c9140 is skbuff_fclone_cache.
>  > Jan  7 17:22:45 white kernel: Badness in cache_free_debugcheck at 
> mm/slab.c:2315
>  > (Not tainted)
>  > Jan  7 17:22:45 white kernel:  [<c0142731>] 
> cache_free_debugcheck+0x86/0x198   
>  >  [<c028d438>] __alloc_skb+0x10e/0x117
>  > Jan  7 17:22:45 white kernel:  [<c0142f85>] kmem_cache_free+0x1f/0x4f    
>  > [<c028d438>] __alloc_skb+0x10e/0x117

This is due to the fclone patch.  On the error path if we allocated an
fclone then we will free it in the wrong pool.

The following patch should fix the problem.

Signed-off-by: Herbert Xu <[EMAIL PROTECTED]>

Cheers,
-- 
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <[EMAIL PROTECTED]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

diff --git a/net/core/skbuff.c b/net/core/skbuff.c
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -135,13 +135,16 @@ void skb_under_panic(struct sk_buff *skb
 struct sk_buff *__alloc_skb(unsigned int size, gfp_t gfp_mask,
                            int fclone)
 {
+
+       kmem_cache_t *cache;
        struct skb_shared_info *shinfo;
        struct sk_buff *skb;
        u8 *data;
 
+       cache = fclone ? skbuff_fclone_cache : skbuff_head_cache;
+
        /* Get the HEAD */
-       skb = kmem_cache_alloc(fclone ? skbuff_fclone_cache : skbuff_head_cache,
-                               gfp_mask & ~__GFP_DMA);
+       skb = kmem_cache_alloc(cache, gfp_mask & ~__GFP_DMA);
        if (!skb)
                goto out;
 
@@ -180,7 +183,7 @@ struct sk_buff *__alloc_skb(unsigned int
 out:
        return skb;
 nodata:
-       kmem_cache_free(skbuff_head_cache, skb);
+       kmem_cache_free(cache, skb);
        skb = NULL;
        goto out;
 }