Re: [Xenomai] kernel NULL pointer dereference

[Gilles Chanteperdrix <gilles.chanteperdrix@xenomai.org>]

On 09/05/2012 09:22 PM, Gilles Chanteperdrix wrote:

> On 09/05/2012 02:25 PM, Gilles Chanteperdrix wrote:
> 
>> On 09/05/2012 02:10 PM, Henri Roosen wrote:
>>> I will find out why the application is doing a sys_exit. However I'm
>>> not sure how this is related to the thread affinity; when not setting
>>> the affinity, the problem is not reproducable.
>>
>> Thanks for the trace. When we find the bug we will say, of course, that
>> is the reason! Anyway, at first sight, the bug does not seem related to
>> multi-processor, I would say the difference with affinity is a
>> difference in how the cleanup happens in your application (namely the
>> case where a mutex holder is destroyed while another thread which is
>> waiting for the mutex is still alive).
> 
> 
> Indeed, the bug is reproducible on any UP board with the following 
> test case. With RPI enabled, the NULL user_task pointer is a problem in
> RPI handling functions, but with RPI disabled, I get the same backtrace
> as you.


The real test code, which really triggers the bug

#include <stdio.h>
#include <string.h>

#include <unistd.h>
#include <sys/mman.h>
#include <pthread.h>
#include <semaphore.h>

pthread_mutex_t mutex;
sem_t ready;

void locker(void)
{
	pthread_set_name_np(pthread_self(), "locker");
	pthread_mutex_lock(&mutex);
	sem_post(&ready);
}

void waiter(void)
{
	pthread_set_name_np(pthread_self(), "waiter");
	sem_wait(&ready);
	pthread_mutex_lock(&mutex);
}

void *thread(void *cookie)
{
	locker();
	sleep(1);
	return cookie;
}

int main(void)
{
	pthread_mutexattr_t mattr;
	struct sched_param sp;
	pthread_t tid;
	int rc;

	mlockall(MCL_CURRENT | MCL_FUTURE);

	pthread_mutexattr_init(&mattr);
	pthread_mutexattr_setprotocol(&mattr, PTHREAD_PRIO_INHERIT);

	rc = pthread_mutex_init(&mutex, &mattr);
	pthread_mutexattr_destroy(&mattr);
	if (rc) {
		fprintf(stderr, "pthread_mutex_init: %s\n", strerror(rc));
		return 1;
	}

	rc = sem_init(&ready, 0, 0);
	if (rc) {
		perror("sem_init");
		return 1;
	}

	rc = pthread_create(&tid, NULL, thread, NULL);
	if (rc) {
		fprintf(stderr, "pthread_create: %s\n", strerror(rc));
		return 1;
	}

	sp.sched_priority = 99;
	pthread_setschedparam(pthread_self(), SCHED_FIFO, &sp);

	waiter();

	return 0;
}


-- 
                                                                Gilles.