Reproducible kernel panic using gcc

Reproducible kernel panic using gcc

[Guy Martin]

[-- Attachment #1: Type: text/plain, Size: 1609 bytes --]

Hi PA hackers,


Using a simple test program, I'm able to panic the kernel using gdb.

I've attached the test program. The output from the console is the 
following :

Bad Address (null pointer deref?): Code=6 regs=000000007e354370 
(Addr=0000000000000000)
CPU: 0 PID: 1605 Comm: gdb-crash Not tainted 3.10.6 #1
task: 000000007e354038 ti: 000000007e33c000 task.ti: 000000007e33c000

      YZrvWESTHLNXBCVMcbcbcbcbOGFRQPDI
PSW: 00000000000001101111111000001111 Not tainted
r00-03  000000ff0006fe0f 0000000000000000 0000000000000000 
00000000faf02300
r04-07  00000000406d3b30 0000000000000000 00000000000c8e98 
00000000000c7a80
r08-11  00000000000c8e70 00000000000c8e70 000000000000006c 
0000000000000061
r12-15  00000000000c3100 0000000000000000 00000000000bf100 
00000000000c0900
r16-19  0000000000000000 00000000000c0900 000000000009f000 
0000000000000000
r20-23  0000000000010638 0000000000000000 0000000000010638 
00000000406d11b8
r24-27  00000000faf02034 00000000faf0202c 0000000000000000 
00000000000110e4
r28-31  00000000faf0230c 0000000000000001 0000000000000000 
0000000040143327
sr00-03  0000000000334000 0000000000334000 0000000000000000 
0000000000334000
sr04-07  0000000000334000 0000000000334000 0000000000334000 
0000000000334000

IASQ: 0000000000334000 0000000000334000 IAOQ: 0000000000000000 
0000000000000004
  IIR: 43ffff80    ISR: 0000000010240000  IOR: 000000f400b02308
  CPU:        0   CR30: 000000007e33c000 CR31: fe1eec3fc1ecdbed
  ORIG_R28: 0000000000000000
  IAOQ[0]:           (null)
  IAOQ[1]: 0x4
  RP(r2):           (null)
Backtrace:


There is no info from PIM.


Thanks,
   Guy

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #2: gdb-crash.c --]
[-- Type: text/x-csrc; name=gdb-crash.c, Size: 329 bytes --]

/*
To reproduce :
# gcc -O0 -pipe -ggdb3 gdb-crash.c -o gdb-crash
# gdb gdb-crash
(gdb) break gdb-crash.c:24
(gdb) run
(gdb) set tp = {0,0}
*crash*
*/

#include <stdio.h>

struct test {
	int a;
	int b;
};

int main() {

	struct test tv = { 1, 1 };

	struct test *tp = &tv;

	printf("Test is %u, %u\n", tv.a, tv.b);

	return 0;
}

Aw: Reproducible kernel panic using gcc

[Helge Deller]

> Using a simple test program, I'm able to panic the kernel using gdb.
> 
> I've attached the test program. The output from the console is the 
> following :
> 
> Bad Address (null pointer deref?): Code=6 regs=000000007e354370 
> (Addr=0000000000000000)

Works without crash for me on 3.12-rc6 ?
Linux ls3011 3.12.0-rc6-64bit+

Since you run 3.10.6, maybe updating the kernel might help.
Esp. this patch, which has been backported to kernel 3.10 (and is in 3.10.17):
http://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/commit/?h=linux-3.10.y&id=77587e89405f5d8225a0e750df254bcc2dcb73e1

Helge

Re: Aw: Reproducible kernel panic using gdb

[Guy Martin]

Hi Helge,

> 
> Works without crash for me on 3.12-rc6 ?
> Linux ls3011 3.12.0-rc6-64bit+
> 
> Since you run 3.10.6, maybe updating the kernel might help.
> Esp. this patch, which has been backported to kernel 3.10 (and is in 
> 3.10.17):
> http://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/commit/?h=linux-3.10.y&id=77587e89405f5d8225a0e750df254bcc2dcb73e1

Still the same problem with 3.12-rc6 here :

Output from the kernel :

terminator ~ # dmesg -n 8
terminator ~ # Backtrace:


Bad Address (null pointer deref?): Code=6 regs=000000007f41d3b0 
(Addr=0000000000000000)
CPU: 0 PID: 1536 Comm: gdb-crash Not tainted 3.12.0-rc6 #1
task: 000000007f41d038 ti: 000000413eb00000 task.ti: 000000413eb00000

      YZrvWESTHLNXBCVMcbcbcbcbOGFRQPDI
PSW: 00000000000001101111111000001111 Not tainted
r00-03  000000ff0006fe0f 0000000000000000 0000000000000000 
00000000faf02300
r04-07  0000000040a53b30 0000000000000000 00000000000c8e98 
00000000000c7a80
r08-11  00000000000c8e70 00000000000c8e70 000000000000006c 
0000000000000061
r12-15  00000000000c3100 0000000000000000 00000000000bf100 
00000000000c0900
r16-19  0000000000000000 00000000000c0900 000000000009f000 
0000000000000000
r20-23  0000000000010638 0000000000000000 0000000000010638 
0000000040a511b8
r24-27  00000000faf02034 00000000faf0202c 0000000000000000 
00000000000110e4
r28-31  00000000faf0230c 0000000000000001 0000000000000000 
0000000040403327
sr00-03  00000000002fc800 00000000002fc800 0000000000000000 
00000000002fc800
sr04-07  00000000002fc800 00000000002fc800 00000000002fc800 
00000000002fc800

IASQ: 00000000002fc800 00000000002fc800 IAOQ: 0000000000000000 
0000000000000004
  IIR: 43ffff80    ISR: 0000000010250000  IOR: 000003f7a5b02308
  CPU:        0   CR30: 000000413eb00000 CR31: fe1eec3fc1ecdbed
  ORIG_R28: 0000000000000000
  IAOQ[0]:           (null)
  IAOQ[1]: 0x4
  RP(r2):           (null)
Backtrace:

Kernel panic - not syncing: Bad Address (null pointer deref?)
Rebooting in 5 seconds..



Output from gdb :
(gdb) break gdb-crash.c:24
Breakpoint 1 at 0x10660: file gdb-crash.c, line 24.
(gdb) run
Starting program: /root/gdb-crash

Breakpoint 1, main () at gdb-crash.c:25
25              printf("Test is %u, %u\n", tv.a, tv.b);
(gdb) set tp = { 0,0}



Regards,
   Guy

Re: Aw: Reproducible kernel panic using gdb

[James Bottomley]

On Mon, 2013-10-28 at 10:00 +0100, Guy Martin wrote:
> Hi Helge,
> 
> > 
> > Works without crash for me on 3.12-rc6 ?
> > Linux ls3011 3.12.0-rc6-64bit+
> > 
> > Since you run 3.10.6, maybe updating the kernel might help.
> > Esp. this patch, which has been backported to kernel 3.10 (and is in 
> > 3.10.17):
> > http://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/commit/?h=linux-3.10.y&id=77587e89405f5d8225a0e750df254bcc2dcb73e1
> 
> Still the same problem with 3.12-rc6 here :

What system and CPU?

Thanks,

James

Re: Reproducible kernel panic using gdb

[Rolf Eike Beer]

James Bottomley: wrote
> On Mon, 2013-10-28 at 10:00 +0100, Guy Martin wrote:
>> Hi Helge,
>> 
>> >
>> > Works without crash for me on 3.12-rc6 ?
>> > Linux ls3011 3.12.0-rc6-64bit+
>> >
>> > Since you run 3.10.6, maybe updating the kernel might help.
>> > Esp. this patch, which has been backported to kernel 3.10 (and is in
>> > 3.10.17):
>> > http://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/commit/?h=linux-3.10.y&id=77587e89405f5d8225a0e750df254bcc2dcb73e1
>> 
>> Still the same problem with 3.12-rc6 here :
> 
> What system and CPU?

C8000

Eike (acting as IRC2Mail gateway)

Re: Reproducible kernel panic using gdb

[James Bottomley]

On Mon, 2013-10-28 at 16:08 +0100, Rolf Eike Beer wrote:
> James Bottomley: wrote
> > On Mon, 2013-10-28 at 10:00 +0100, Guy Martin wrote:
> >> Hi Helge,
> >> 
> >> >
> >> > Works without crash for me on 3.12-rc6 ?
> >> > Linux ls3011 3.12.0-rc6-64bit+
> >> >
> >> > Since you run 3.10.6, maybe updating the kernel might help.
> >> > Esp. this patch, which has been backported to kernel 3.10 (and is in
> >> > 3.10.17):
> >> > http://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/commit/?h=linux-3.10.y&id=77587e89405f5d8225a0e750df254bcc2dcb73e1
> >> 
> >> Still the same problem with 3.12-rc6 here :
> > 
> > What system and CPU?
> 
> C8000

I tried this on a rp3440  (pa8800) and I can't reproduce.  I think it
might be something about the way the kernel is compiled.  The (null)
values for rp2 and IOAQ[0] look suspicious.

James

Re: Reproducible kernel panic using gdb

[Helge Deller]

On 10/29/2013 06:06 AM, James Bottomley wrote:
> 
> On Mon, 2013-10-28 at 16:08 +0100, Rolf Eike Beer wrote:
>> James Bottomley: wrote
>>> On Mon, 2013-10-28 at 10:00 +0100, Guy Martin wrote:
>>>> Hi Helge,
>>>>
>>>>>
>>>>> Works without crash for me on 3.12-rc6 ?
>>>>> Linux ls3011 3.12.0-rc6-64bit+
>>>>>
>>>>> Since you run 3.10.6, maybe updating the kernel might help.
>>>>> Esp. this patch, which has been backported to kernel 3.10 (and is in
>>>>> 3.10.17):
>>>>> http://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/commit/?h=linux-3.10.y&id=77587e89405f5d8225a0e750df254bcc2dcb73e1
>>>>
>>>> Still the same problem with 3.12-rc6 here :
>>>
>>> What system and CPU?
>>
>> C8000
> 
> I tried this on a rp3440  (pa8800) and I can't reproduce.  I think it
> might be something about the way the kernel is compiled.  The (null)
> values for rp2 and IOAQ[0] look suspicious.

I tried it again, but this time on my c8000..
Again, it does not crash for me.
Kernel is 3.12.0-rc7-64bit.

I think James is right. Might be something with your compiler, but it would
be interesting what it is...

Helge

Re: Reproducible kernel panic using gdb

[Guy Martin]

On 2013-10-29 21:37, Helge Deller wrote:
> On 10/29/2013 06:06 AM, James Bottomley wrote:
>> 
>> On Mon, 2013-10-28 at 16:08 +0100, Rolf Eike Beer wrote:
>>> James Bottomley: wrote
>>>> On Mon, 2013-10-28 at 10:00 +0100, Guy Martin wrote:
>>>>> Hi Helge,
>>>>> 
>>>>>> 
>>>>>> Works without crash for me on 3.12-rc6 ?
>>>>>> Linux ls3011 3.12.0-rc6-64bit+
>>>>>> 
>>>>>> Since you run 3.10.6, maybe updating the kernel might help.
>>>>>> Esp. this patch, which has been backported to kernel 3.10 (and is 
>>>>>> in
>>>>>> 3.10.17):
>>>>>> http://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/commit/?h=linux-3.10.y&id=77587e89405f5d8225a0e750df254bcc2dcb73e1
>>>>> 
>>>>> Still the same problem with 3.12-rc6 here :
>>>> 
>>>> What system and CPU?
>>> 
>>> C8000
>> 
>> I tried this on a rp3440  (pa8800) and I can't reproduce.  I think it
>> might be something about the way the kernel is compiled.  The (null)
>> values for rp2 and IOAQ[0] look suspicious.
> 
> I tried it again, but this time on my c8000..
> Again, it does not crash for me.
> Kernel is 3.12.0-rc7-64bit.
> 
> I think James is right. Might be something with your compiler, but it 
> would
> be interesting what it is...


I've tried both
gcc-4.6.3 with ld 2.22
gcc-4.7.3 with ld 2.23.1

I've put a compiled kernel with modules here as well as the config :
http://www.tuxicoman.be/temp/linux-3.12-rc6-gdb-crash.tar.bz2

terminator linux-3.12-rc6 # hppa64-unknown-linux-gnu-gcc -v
Using built-in specs.
COLLECT_GCC=/usr/hppa2.0-unknown-linux-gnu/hppa64-unknown-linux-gnu/gcc-bin/4.7.3/hppa64-unknown-linux-gnu-gcc
COLLECT_LTO_WRAPPER=/usr/libexec/gcc/hppa64-unknown-linux-gnu/4.7.3/lto-wrapper
Target: hppa64-unknown-linux-gnu
Configured with: 
/var/tmp/portage/sys-devel/kgcc64-4.7.3/work/gcc-4.7.3/configure 
--prefix=/usr 
--bindir=/usr/hppa2.0-unknown-linux-gnu/hppa64-unknown-linux-gnu/gcc-bin/4.7.3 
--includedir=/usr/lib/gcc/hppa64-unknown-linux-gnu/4.7.3/include 
--datadir=/usr/share/gcc-data/hppa64-unknown-linux-gnu/4.7.3 
--mandir=/usr/share/gcc-data/hppa64-unknown-linux-gnu/4.7.3/man 
--infodir=/usr/share/gcc-data/hppa64-unknown-linux-gnu/4.7.3/info 
--with-gxx-include-dir=/usr/lib/gcc/hppa64-unknown-linux-gnu/4.7.3/include/g++-v4 
--host=hppa2.0-unknown-linux-gnu --target=hppa64-unknown-linux-gnu 
--build=hppa2.0-unknown-linux-gnu --disable-altivec 
--disable-fixed-point --without-cloog --without-ppl --disable-lto 
--enable-nls --without-included-gettext --with-system-zlib 
--enable-obsolete --disable-werror --enable-secureplt --disable-multilib 
--disable-libmudflap --disable-libssp --disable-libgomp 
--with-python-dir=/share/gcc-data/hppa64-unknown-linux-gnu/4.7.3/python 
--enable-poison-system-directories --enable-checking=release 
--disable-libgcj --disable-build-with-cxx 
--disable-build-poststage1-with-cxx --disable-libquadmath 
--enable-languages=c --disable-shared --disable-threads 
--without-headers --disable-bootstrap --enable-__cxa_atexit 
--enable-clocale=gnu --with-bugurl=http://bugs.gentoo.org/ 
--with-pkgversion='Gentoo 4.7.3 p1.3'
Thread model: single
gcc version 4.7.3 (Gentoo 4.7.3 p1.3)

Regards,
   Guy