From mboxrd@z Thu Jan 1 00:00:00 1970 From: Bruno =?UTF-8?B?UHLDqW1vbnQ=?= Subject: Re: [PATCH] Fix crash in viafb due to 4k stack overflow Date: Sun, 9 Nov 2008 21:38:11 +0100 Message-ID: <20081109213811.4b85adc6@neptune.home> References: <20081109202537.33ead0a2@neptune.home> <20081109113603.d45361ad.akpm@linux-foundation.org> <20081109122515.1deb9ec2@infradead.org> Mime-Version: 1.0 Content-Transfer-Encoding: QUOTED-PRINTABLE Return-path: In-Reply-To: <20081109122515.1deb9ec2@infradead.org> Sender: linux-kernel-owner@vger.kernel.org List-ID: Content-Type: text/plain; charset="iso-8859-1" To: Arjan van de Ven , Andrew Morton Cc: JosephChan@via.com.tw, linux-fbdev-devel@lists.sourceforge.net, linux-kernel@vger.kernel.org On Sun, 09 November 2008 Arjan van de Ven wrote: > On Sun, 9 Nov 2008 Andrew Morton wrote: > > On Sun, 9 Nov 2008 Bruno Pr=C3=A9mont wrote: > >=20 > > > The function viafb_cursor() uses 2 stack-variables of CURSOR_SIZE > > > bits; CURSOR_SIZE is defined as (8 * 1024). Using up twice 1k on > > > stack is too much for 4k-stack (though it works with 8k-stacks). > >=20 > > > =20 > > > if (viacursor.enable) > >=20 > > Is the ->fb_cursor handler allowed to perform GFP_KERNEL memory > > allocations? It's never called from atomic contexts? >=20 > if it's allowed to do GFP_KERNEL memory allocations the statement tha= t > it works with 8k stacks is a bit overstated... since irq's can come i= n > and take several KB of stack as well ;) I don't know if it can be called from atomic contexts or not :( In addition I get panics some time after start-up which I'm not sure what to associate them with (apparently unrelated) It could be some stack overflow by calling fbset (I will to more testin= g in order to find out) =46irst attempt: calling fbset via ssh: [ 1806.952151] BUG: unable to handle kernel NULL pointer dereference at= 00000123 [ 1806.952601] IP: [] icmpv6_send+0x387/0x580 [ 1806.952934] *pde =3D 00000000=20 [ 1806.953125] Oops: 0000 [#1]=20 [ 1806.953310] last sysfs file: /sys/devices/platform/w83627hf.656/temp= 2_input [ 1806.953717] Modules linked in: snd_hda_intel snd_pcm snd_timer snd s= oundcore snd_page_alloc sg [ 1806.954328]=20 [ 1806.954430] Pid: 1855, comm: sshd Not tainted (2.6.28-rc3-git6 #1) C= X700+W697HG [ 1806.954863] EIP: 0060:[] EFLAGS: 00010206 CPU: 0 [ 1806.955194] EIP is at icmpv6_send+0x387/0x580 [ 1806.955456] EAX: ffffffff EBX: f713c704 ECX: f6bc26a8 EDX: 0000006c [ 1806.955827] ESI: f713c500 EDI: 00000040 EBP: f6babca0 ESP: f6babbf8 [ 1806.956197] DS: 007b ES: 007b FS: 0000 GS: 0033 SS: 0068 [ 1806.956520] Process sshd (pid: 1855, ti=3Df6bab000 task=3Df70e7440 t= ask.ti=3Df6bab000) [ 1806.956952] Stack: [ 1806.957074] 00000000 00007515 ffffffcc f6babc51 f6babc51 c05f6045 f= 6babc8c 00000296 [ 1806.957614] f6babc3c 00000000 00000002 f6bc26a8 00000200 38b782ca f= 713c704 00000000 [ 1806.958321] 00000000 00000000 00000000 00000000 60090120 0000ab07 f= f1d0302 300005fe [ 1806.958882] Call Trace: [ 1806.959037] [] ? ip6_xmit+0x230/0x3f0 [ 1806.959339] [] ? inet6_csk_xmit+0x103/0x190 [ 1806.959669] [] ? tcp_v6_send_check+0x51/0x100 [ 1806.960011] [] ? tcp_transmit_skb+0x373/0x670 [ 1806.960016] [] ? tcp_push_one+0xa0/0xd0 [ 1806.960016] [] ? tcp_sendmsg+0x264/0xa30 [ 1806.960016] [] ? core_sys_select+0x207/0x2c0 [ 1806.960016] [] ? sock_aio_write+0xeb/0x110 [ 1806.960016] [] ? do_sync_write+0xcc/0x110 [ 1806.960016] [] ? pty_unthrottle+0x15/0x20 [ 1806.960016] [] ? autoremove_wake_function+0x0/0x50 [ 1806.960016] [] ? current_fs_time+0x16/0x20 [ 1806.960016] [] ? vfs_write+0x110/0x120 [ 1806.960016] [] ? sys_write+0x3d/0x70 [ 1806.960016] [] ? sysenter_do_call+0x12/0x25 [ 1806.960016] Code: 0f b6 4d 89 89 45 dc 88 4d e0 8b 52 50 29 c2 b8 d0= 04 00 00 81 fa d0 04 00 00 0f 47 d0 85 d2 0f 88 91 01 00 00 8b 4d 84 8= b 41 14 <8b> 98 24 01 00 00 85 db 74 06 ff 83 80 00 00 00 b8 40 00 00 0= 0=20 [ 1806.960016] EIP: [] icmpv6_send+0x387/0x580 SS:ESP 0068:f6= babbf8 [ 1807.067511] Kernel panic - not syncing: Fatal exception in interrupt Second attempt, delayed after calling fbset from console: [ 217.260426] BUG: unable to handle kernel NULL pointer dereference at= 000000c7 [ 217.260915] IP: [] rt_worker_func+0xb6/0x160 [ 217.261264] *pde =3D 00000000=20 [ 217.261458] Oops: 0000 [#1]=20 [ 217.261649] last sysfs file: /sys/devices/platform/w83627hf.656/temp= 2_input [ 217.262058] Modules linked in: snd_hda_intel snd_pcm snd_timer snd s= oundcore snd_page_alloc sg [ 217.262691]=20 [ 217.262795] Pid: 5, comm: events/0 Not tainted (2.6.28-rc3-git6 #1) = CX700+W697HG [ 217.263236] EIP: 0060:[] EFLAGS: 00010286 CPU: 0 [ 217.263570] EIP is at rt_worker_func+0xb6/0x160 [ 217.263846] EAX: 00000002 EBX: ffffffff ECX: c0606e20 EDX: fffffed4 [ 217.270015] ESI: f7172c5c EDI: 00007530 EBP: f7032f80 ESP: f7032f6c [ 217.270015] DS: 007b ES: 007b FS: 0000 GS: 0000 SS: 0068 [ 217.270015] Process events/0 (pid: 5, ti=3Df7032000 task=3Df702ad80 = task.ti=3Df7032000) [ 217.270015] Stack: [ 217.270015] 000001b5 00004b17 c053d7a0 f7008180 c0380a90 f7032fa4 c= 0130117 f702b440 [ 217.270015] f702ad80 c0510180 00000246 f7008188 f7008180 f7032fac f= 7032fcc c0130747 [ 217.270015] 00000000 f702ad80 c0133400 f7032fb8 f7032fb8 fffffffc f= 7008180 c01306b0 [ 217.270015] Call Trace: [ 217.270015] [] ? rt_worker_func+0x0/0x160 [ 217.270015] [] ? run_workqueue+0x67/0xe0 [ 217.270015] [] ? worker_thread+0x97/0xf0 [ 217.270015] [] ? autoremove_wake_function+0x0/0x50 [ 217.270015] [] ? worker_thread+0x0/0xf0 [ 217.270015] [] ? kthread+0x42/0x70 [ 217.270015] [] ? kthread+0x0/0x70 [ 217.270015] [] ? kernel_thread_helper+0x7/0x10 [ 217.270015] Code: f0 ff ff f6 40 08 08 0f 85 bb 00 00 00 8b 06 85 c0= 74 49 89 df e8 8b 5c da ff 8d 74 26 00 8d bc 27 00 00 00 00 8b 1e 85 d= b 74 2c <8b> 83 c8 00 00 00 3b 05 dc c9 61 c0 75 4c 8b 53 18 85 d2 74 2= c=20 [ 217.270015] EIP: [] rt_worker_func+0xb6/0x160 SS:ESP 0068:= f7032f6c [ 217.526097] Kernel panic - not syncing: Fatal exception in interrupt