RHEL5: Panic with list corruption called from free_block in kmem cache memory reclaim code
Issue
- single instance of the following panic, signalling list corruption in the following call tree:
cache_reap->drain_array->free_block
list_add corruption. prev->next should be ffff81102eec1640, but was ffff810fd393b000
----------- [cut here ] --------- [please bite here ] ---------
Kernel BUG at lib/list_debug.c:31
invalid opcode: 0000 [1] SMP
last sysfs file: /devices/pci0000:00/0000:00:01.0/0000:03:00.0/0000:04:01.0/0000:07:00.0/0000:08:00.0/irq
CPU 14
Modules linked in: mptctl mptbase sg ipmi_si(U) ipmi_devintf(U) ipmi_msghandler(U) hpilo(U) nfs lockd fscache nfs_acl sunrpc ib_iser(U) iscsi_tcp(U) libiscsi(U) scsi_transport_iscsi(U) rdma_ucm(U) rds(U) ib_ucm(U) ib_sdp(U) rdma_cm(U) iw_cm(U) ib_addr(U) ib_ipoib(U) ipoib_helper(U) ib_cm(U) ib_sa(U) ipv6 xfrm_nalgo crypto_api ib_uverbs(U) ib_umad(U) mlx4_ib(U) ib_mthca(U) ib_mad(U) ib_core(U) dm_mirror dm_multipath dm_mod video sbs backlight i2c_ec i2c_core button battery asus_acpi acpi_memhotplug ac parport_pc lp parport e1000e(U) ide_cd mlx4_core(U) shpchp serio_raw cdrom bnx2(U) pcspkr ata_piix libata cciss(U) sd_mod scsi_mod ext3 jbd uhci_hcd ohci_hcd ehci_hcd
Pid: 64, comm: events/14 Tainted: G 2.6.18-92.el5 #1
RIP: 0010:[<ffffffff801468aa>] [<ffffffff801468aa>] __list_add+0x48/0x68
RSP: 0018:ffff81102fa6bd70 EFLAGS: 00010086
RAX: 0000000000000058 RBX: ffff81102eec1640 RCX: ffffffff802ec9a8
RDX: ffffffff802ec9a8 RSI: 0000000000000000 RDI: ffffffff802ec9a0
RBP: ffff81102ef5f000 R08: ffffffff802ec9a8 R09: 0000000000000046
R10: 0000000000000000 R11: 0000000000000280 R12: ffff810fd393b000
R13: ffff81102f7e0018 R14: ffff810fd393b6e0 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff81102fcb1540(0000) knlGS:0000000000000000
CS: 0010 DS: 0018 ES: 0018 CR0: 000000008005003b
CR2: 00002b8662a730a0 CR3: 000000101c587000 CR4: 00000000000006e0
Process events/14 (pid: 64, threadinfo ffff81102fa6a000, task ffff81102fa3a860)
Stack: ffff810fd393b000 ffff81102eec1640 ffff81102eedd080 ffffffff800d3bb2
0000000200000000 ffff81102f7e0018 0000000000000002 ffff81102f7e0000
0000000000000000 ffff81102eec1640 ffff81102eedd080 ffffffff800d3c5c
Call Trace:
[<ffffffff800d3bb2>] free_block+0x11c/0x13b
[<ffffffff800d3c5c>] drain_array+0x8b/0xc0
[<ffffffff800d46a9>] cache_reap+0x0/0x219
[<ffffffff800d474e>] cache_reap+0xa5/0x219
[<ffffffff8004cea9>] run_workqueue+0x94/0xe4
[<ffffffff800497be>] worker_thread+0x0/0x122
[<ffffffff800498ae>] worker_thread+0xf0/0x122
[<ffffffff8008ac03>] default_wake_function+0x0/0xe
[<ffffffff8003253d>] kthread+0xfe/0x132
[<ffffffff8005dfb1>] child_rip+0xa/0x11
[<ffffffff8003243f>] kthread+0x0/0x132
[<ffffffff8005dfa7>] child_rip+0x0/0x11
Code: 0f 0b 68 07 cb 29 80 c2 1f 00 4c 89 63 08 49 89 1c 24 4c 89
RIP [<ffffffff801468aa>] __list_add+0x48/0x68
RSP <ffff81102fa6bd70>
Environment
- Red Hat Enterprise Linux 5
- Seen on the following kernels:
- kernel-2.6.18-92.el5
- kernel-2.6.18-128.7.1.el5
- kernel-2.6.18-164.9.1.el5
- kernel-2.6.18-194.11.4.el5
- kernel-2.6.18-238.el5
- Seen on the following kernels:
- Proprietary modules seen in the vmcore
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase of over 48,000 articles and solutions.
Welcome! Check out the Getting Started with Red Hat page for quick tours and guides for common tasks.
