Subject: Re: [bug, netconsole, SLUB] BUG skbuff_head_cache: Poison overwritten

From: Christoph Lameter <[email-masked]>
Date: Fri, 18 Jul 2008 09:48:21 -0500

Pekka Enberg wrote:

> Yeah. See the free_debug_processing() function in mm/slub.c for
> details (the on_freelist() part). However, if you look at slab_free()
> you can see that in the SLUB fast-path we don't do any of these
> debugging checks. So you can end up with slab corruption without a
> nice error message.

The slub fastpath is not used when debugging is enabled.

Without debugging on double frees will typically corrupt the freepointer. So you get an invalid pointer reference in __slab_free.