Index: linux-2.6.21-rc2/mm/slub.c
===================================================================
--- linux-2.6.21-rc2.orig/mm/slub.c	2007-02-28 16:41:04.000000000 -0800
+++ linux-2.6.21-rc2/mm/slub.c	2007-02-28 16:45:06.000000000 -0800
@@ -303,17 +303,27 @@ static int check_valid_pointer(struct km
  * 		Bytes of the object to be managed.
  * 		If the freepointer may overlay the object then the free
  * 		pointer is the first word of the object.
+ * 		Poisoning uses 0x6b (POISON_FREE) and the last byte is
+ * 		0xa5 (POISON_END)
+ *
  * object + s->objsize
  * 		Padding to reach word boundary. This is also used for Redzoning.
  * 		Padding is extended to word size if Redzoning is enabled
  * 		and objsize == inuse.
+ * 		We fill with 0x71 (RED_INACTIVE) for inactive objects and with
+ * 		0xa5 (RED_INACTIVE) for objects in use.
+ *
  * object + s->inuse
  * 		A. Free pointer (if we cannot overwrite object on free)
  * 		B. Tracking data for SLAB_STORE_USER
  * 		C. Padding to reach required alignment boundary
+ * 			Padding is done using 0x5a (POISON_INUSE)
+ *
  * object + s->size
  *
  * If slabcaches are merged then the objsize and inuse boundaries are to be ignored.
+ * And therefore no slab options that rely on these boundaries may be used with
+ * merged slabcaches.
  */
 static int check_object(struct kmem_cache *s, struct page *page,
 					void *object, int active)