Bug 441390 – Memory corruption due to VNIF increase

Bug 441390 - Memory corruption due to VNIF increase

Summary:	Memory corruption due to VNIF increase

Status:	CLOSED ERRATA

Aliases:	None

Product:	Red Hat Enterprise Linux 5
Classification:	Red Hat
Component:	kernel-xen (Show other bugs)
Sub Component:
Version:	5.2
Hardware:	All Linux

Priority	high Severity high
Target Milestone:	rc
Target Release:	---
Assigned To:	Tetsu Yamamoto
QA Contact:	Martin Jenner
Docs Contact:

URL:
Whiteboard:
Keywords:

Duplicates:	433755 (view as bug list)
Depends On:
Blocks:	442298
	Show dependency tree / graph

Reported:	2008-04-07 16:23 EDT by Bill Burns
Modified:	2008-05-21 11:13 EDT (History)
CC List:	3 users (show)

See Also:
Fixed In Version:	RHBA-2008-0314
Doc Type:	Bug Fix
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:	2008-05-21 11:13:59 EDT
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHBA-2008:0314	normal	SHIPPED_LIVE	Updated kernel packages for Red Hat Enterprise Linux 5.2	2008-05-20 14:43:34 EDT

Groups: None (edit)

Description Bill Burns 2008-04-07 16:23:56 EDT

The change to increase the VNIF's allowed per guest introduced an error that can
cause memory corruption. Detail follows:

A PV OS has two grant table data structures: the grant table itself and a free 
list.  The free list is composed of an array of pages, which grow dynamically as 
the guest OS requires more grants.  While the grant table contains 8-byte 
entries, the free list contains 4-byte entries.  So we have half as many pages 
in the free list than in the grant table.

There was a bug in the free list allocation code. The free list was indexed as 
if it was the same size as the grant table.  But it's only half as large.  So 
memory got corrupted, and I was seeing crashes in the slab allocator later on.

A patch has been posted upstream.

Comment 2 Mark McLoughlin 2008-04-08 08:17:39 EDT

Some details on this:

 - bug #297331 and bug #223908 were the original bugs requesting that guests
   be able to have more than 3 VNIFs

 - The upstream fix we backported was:

     http://xenbits.xensource.com/xen-unstable.hg?rev/70f05d642a2e
     http://lists.xensource.com/archives/html/xen-devel/2007-01/msg00166.html

 - This bug is about a potential memory corruption bug with the original patch.
   We have not yet reproduced this memory corruption, but the fix is upstream
   in linux-2.6.18-xen.hg and linus's tree:

     http://xenbits.xensource.com/linux-2.6.18-xen.hg?rev/4018c0da3360
    
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=bbc60c18ed17df75270da504bbd8f7bc4a52d43d

Comment 5 Don Zickus 2008-04-09 14:44:53 EDT

in kernel-2.6.18-89.el5
You can download this test kernel from http://people.redhat.com/dzickus/el5

Comment 7 Bill Burns 2008-04-16 07:59:57 EDT

*** Bug 433755 has been marked as a duplicate of this bug. ***

Comment 9 errata-xmlrpc 2008-05-21 11:13:59 EDT

An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHBA-2008-0314.html

Note You need to log in before you can comment on or make changes to this bug.