Re: [Xen-devel] Question regarding SLAB corruption

[Lukas Hejtmanek <xhejtman@xxxxxxxxxxx>]

On Mon, Jul 09, 2007 at 06:21:24PM +0100, Keir Fraser wrote:
> By my understanding, the infiniband driver is doing an order-6 allocation,
> then stuffing that multi-page region into a single element of a scatterlist.
> It is then calling dma_map_sg(), which [on Xen] calls swiotlb_map_sg(),
> which calls map_single() on that multi-page extent. Am I misunderstanding
> something?

Not exactly.

IB driver does alloc_pages (order-6). Then it calls pci_map_sg() which is
basically dma_map_sg(). This one invokes swiotlb_map_sg() which possibly calls
map_single() (right now I'm not sure, I must check it, but if yes, it creates
index 3328).

Then later, IB driver invokes dma_sync_single on the first page from that
order-6 allocation via dma_handle. And in __sync_single it crashes because
sync_single picks up index 3332 instead of 3328.

Btw, please, keep Roland in Cc.

-- 
Lukáš Hejtmánek

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel