From: Andrew Morton <akpm@osdl.org>
To: Bryce Harrington <bryce@osdl.org>
Cc: linux-kernel@vger.kernel.org, "Moore,
Eric Dean" <Eric.Moore@lsil.com>,
linux-scsi@vger.kernel.org
Subject: Re: [OOPS] -git8,9: NULL pointer dereference in mptspi_dv_renegotiate_work
Date: Thu, 28 Sep 2006 14:51:21 -0700 [thread overview]
Message-ID: <20060928145121.561f077d.akpm@osdl.org> (raw)
In-Reply-To: <20060928202548.GO12968@osdl.org>
(cc's added)
On Thu, 28 Sep 2006 13:25:48 -0700
Bryce Harrington <bryce@osdl.org> wrote:
> Apologies if this has already been reported;
It has not.
> I didn't spot it on the
> list. We've noticed an Oops on AMD64 when running linux-2.6.18-git8 and
> -git9, but not -git7:
>
> mptbase: Initiating ioc0 recovery
> Unable to handle kernel NULL pointer dereference at 0000000000000500 RIP:
> [<ffffffff80489aa2>] mptspi_dv_renegotiate_work+0xc/0x45
> PGD 0
> Oops: 0000 [1] PREEMPT SMP
> CPU 0
> Modules linked in:
> Pid: 8, comm: events/0 Not tainted 2.6.18-git8 #1
> RIP: 0010:[<ffffffff80489aa2>] [<ffffffff80489aa2>] mptspi_dv_renegotiate_work+0xc/0x45
> RSP: 0000:ffff81003ec65e40 EFLAGS: 00010282
> RAX: 0000000000000002 RBX: ffff81003e86f640 RCX: 000000000000001e
> RDX: 0000000000000001 RSI: 0000000000000213 RDI: 000000000003e86f
> RBP: 0000000000000500 R08: ffff81003ec64000 R09: ffff81003ed0cf40
> R10: ffff81003e86f640 R11: ffff81003ed0cf40 R12: ffff81003ed0cf40
> R13: 0000000000000213 R14: ffff81003e86f640 R15: ffffffff80489a96
> FS: 0000000000000000(0000) GS:ffffffff80779000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0018 ES: 0018 CR0: 000000008005003b
> CR2: 0000000000000500 CR3: 0000000000201000 CR4: 00000000000006e0
> Process events/0 (pid: 8, threadinfo ffff81003ec64000, task ffff81007f180740)
> Stack: ffff81003ec65ef8 ffff81003e86f640 ffff81003e86f648 ffffffff8023f1bd
> ffff81003ed0cf40 ffff81003ed0cf40 ffffffff8023f204 ffff8100016dfd70
> 00000000fffffffc ffffffff80593ffd 0000000000000000 ffffffff8023f300
> Call Trace:
> [<ffffffff8023f1bd>] run_workqueue+0x9a/0xe1
> [<ffffffff8023f204>] worker_thread+0x0/0x12e
> [<ffffffff8023f300>] worker_thread+0xfc/0x12e
> [<ffffffff80229f62>] default_wake_function+0x0/0xe
> [<ffffffff80229f62>] default_wake_function+0x0/0xe
> [<ffffffff80242433>] kthread+0xc8/0xf1
> [<ffffffff8020a3f8>] child_rip+0xa/0x12
> [<ffffffff8024236b>] kthread+0x0/0xf1
> [<ffffffff8020a3ee>] child_rip+0x0/0x12
>
>
> Code: 48 8b 45 00 31 f6 48 8b b8 50 01 00 00 e8 5c 4d fe ff 48 85
> RIP [<ffffffff80489aa2>] mptspi_dv_renegotiate_work+0xc/0x45
> RSP <ffff81003ec65e40>
> CR2: 0000000000000500
> <6>mptbase: Initiating ioc0 recovery
That's very clever. With gcc-4.0.2 and your .config I get
(gdb) x/20i mptspi_dv_renegotiate_work
0xffffffff8048475e <mptspi_dv_renegotiate_work>: push %rbp
0xffffffff8048475f <mptspi_dv_renegotiate_work+1>: push %rbx
0xffffffff80484760 <mptspi_dv_renegotiate_work+2>: push %rbp
0xffffffff80484761 <mptspi_dv_renegotiate_work+3>: mov 0x60(%rdi),%rbp
0xffffffff80484765 <mptspi_dv_renegotiate_work+7>: callq 0xffffffff8026df58 <kfree>
0xffffffff8048476a <mptspi_dv_renegotiate_work+12>: mov 0x0(%rbp),%rax
0xffffffff8048476e <mptspi_dv_renegotiate_work+16>: xor %esi,%esi
0xffffffff80484770 <mptspi_dv_renegotiate_work+18>: mov 0x150(%rax),%rdi
So on entry to this function, wqw->hd is 0x500.
Or kfree() somehow scrogged your %rbp register.
> Full console logs showing the above oops are here:
> -git7: ok http://crucible.osdl.org/runs/2223/sysinfo/amd01.console
> -git8: Oops http://crucible.osdl.org/runs/2233/sysinfo/amd01.console
> -git9: Oops http://crucible.osdl.org/runs/2241/sysinfo/amd01.console
>
> Reference information about the machine this is run on:
> http://crucible.osdl.org/runs/2223/sysinfo/amd01.1/
>
> Config files:
> -git7: http://crucible.osdl.org/runs/2223/sysinfo/amd01.config
> -git8: http://crucible.osdl.org/runs/2233/sysinfo/amd01.config
> ...
> Just checked against latest -git10, same oops:
>
> http://crucible.osdl.org/runs/2256/sysinfo/amd01.console
>
> However, it is not occurring on our ita64, x86, or x86_64 systems
> running the same kernels.
>
I'd be suspecting a miscompile, or something horrid in kfree().
Does it change anything if you move that kfree() down a bit?
--- a/drivers/message/fusion/mptspi.c~a
+++ a/drivers/message/fusion/mptspi.c
@@ -790,10 +790,9 @@ mptspi_dv_renegotiate_work(void *data)
struct _MPT_SCSI_HOST *hd = wqw->hd;
struct scsi_device *sdev;
- kfree(wqw);
-
shost_for_each_device(sdev, hd->ioc->sh)
mptspi_dv_device(hd, sdev);
+ kfree(wqw);
}
static void
_
next prev parent reply other threads:[~2006-09-28 21:51 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2006-09-28 20:25 [OOPS] -git8,9: NULL pointer dereference in mptspi_dv_renegotiate_work Bryce Harrington
2006-09-28 20:34 ` [Eng] [OOPS] -git8, 9: " Bryce Harrington
2006-09-28 21:51 ` Andrew Morton [this message]
2006-09-28 22:54 ` [OOPS] -git8,9: " Bryce Harrington
2006-09-29 0:26 ` Andrew Morton
2006-09-29 17:17 ` Bryce Harrington
-- strict thread matches above, loose matches on Subject: below --
2006-09-29 18:29 Moore, Eric
2006-09-29 21:41 ` Bryce Harrington
2006-09-30 0:10 Moore, Eric
2006-09-30 0:27 ` Bryce Harrington
[not found] ` <664A4EBB07F29743873A87CF62C26D702A994F@NAMAIL4.ad.lsil.com>
2006-09-30 21:55 ` Bryce Harrington
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20060928145121.561f077d.akpm@osdl.org \
--to=akpm@osdl.org \
--cc=Eric.Moore@lsil.com \
--cc=bryce@osdl.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-scsi@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox