* [OOPS] -git8,9: NULL pointer dereference in mptspi_dv_renegotiate_work
@ 2006-09-28 20:25 Bryce Harrington
2006-09-28 20:34 ` [Eng] [OOPS] -git8, 9: " Bryce Harrington
2006-09-28 21:51 ` [OOPS] -git8,9: " Andrew Morton
0 siblings, 2 replies; 6+ messages in thread
From: Bryce Harrington @ 2006-09-28 20:25 UTC (permalink / raw)
To: linux-kernel
Apologies if this has already been reported; I didn't spot it on the
list. We've noticed an Oops on AMD64 when running linux-2.6.18-git8 and
-git9, but not -git7:
mptbase: Initiating ioc0 recovery
Unable to handle kernel NULL pointer dereference at 0000000000000500 RIP:
[<ffffffff80489aa2>] mptspi_dv_renegotiate_work+0xc/0x45
PGD 0
Oops: 0000 [1] PREEMPT SMP
CPU 0
Modules linked in:
Pid: 8, comm: events/0 Not tainted 2.6.18-git8 #1
RIP: 0010:[<ffffffff80489aa2>] [<ffffffff80489aa2>] mptspi_dv_renegotiate_work+0xc/0x45
RSP: 0000:ffff81003ec65e40 EFLAGS: 00010282
RAX: 0000000000000002 RBX: ffff81003e86f640 RCX: 000000000000001e
RDX: 0000000000000001 RSI: 0000000000000213 RDI: 000000000003e86f
RBP: 0000000000000500 R08: ffff81003ec64000 R09: ffff81003ed0cf40
R10: ffff81003e86f640 R11: ffff81003ed0cf40 R12: ffff81003ed0cf40
R13: 0000000000000213 R14: ffff81003e86f640 R15: ffffffff80489a96
FS: 0000000000000000(0000) GS:ffffffff80779000(0000) knlGS:0000000000000000
CS: 0010 DS: 0018 ES: 0018 CR0: 000000008005003b
CR2: 0000000000000500 CR3: 0000000000201000 CR4: 00000000000006e0
Process events/0 (pid: 8, threadinfo ffff81003ec64000, task ffff81007f180740)
Stack: ffff81003ec65ef8 ffff81003e86f640 ffff81003e86f648 ffffffff8023f1bd
ffff81003ed0cf40 ffff81003ed0cf40 ffffffff8023f204 ffff8100016dfd70
00000000fffffffc ffffffff80593ffd 0000000000000000 ffffffff8023f300
Call Trace:
[<ffffffff8023f1bd>] run_workqueue+0x9a/0xe1
[<ffffffff8023f204>] worker_thread+0x0/0x12e
[<ffffffff8023f300>] worker_thread+0xfc/0x12e
[<ffffffff80229f62>] default_wake_function+0x0/0xe
[<ffffffff80229f62>] default_wake_function+0x0/0xe
[<ffffffff80242433>] kthread+0xc8/0xf1
[<ffffffff8020a3f8>] child_rip+0xa/0x12
[<ffffffff8024236b>] kthread+0x0/0xf1
[<ffffffff8020a3ee>] child_rip+0x0/0x12
Code: 48 8b 45 00 31 f6 48 8b b8 50 01 00 00 e8 5c 4d fe ff 48 85
RIP [<ffffffff80489aa2>] mptspi_dv_renegotiate_work+0xc/0x45
RSP <ffff81003ec65e40>
CR2: 0000000000000500
<6>mptbase: Initiating ioc0 recovery
Full console logs showing the above oops are here:
-git7: ok http://crucible.osdl.org/runs/2223/sysinfo/amd01.console
-git8: Oops http://crucible.osdl.org/runs/2233/sysinfo/amd01.console
-git9: Oops http://crucible.osdl.org/runs/2241/sysinfo/amd01.console
Reference information about the machine this is run on:
http://crucible.osdl.org/runs/2223/sysinfo/amd01.1/
Config files:
-git7: http://crucible.osdl.org/runs/2223/sysinfo/amd01.config
-git8: http://crucible.osdl.org/runs/2233/sysinfo/amd01.config
Bryce
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [Eng] [OOPS] -git8, 9: NULL pointer dereference in mptspi_dv_renegotiate_work 2006-09-28 20:25 [OOPS] -git8,9: NULL pointer dereference in mptspi_dv_renegotiate_work Bryce Harrington @ 2006-09-28 20:34 ` Bryce Harrington 2006-09-28 21:51 ` [OOPS] -git8,9: " Andrew Morton 1 sibling, 0 replies; 6+ messages in thread From: Bryce Harrington @ 2006-09-28 20:34 UTC (permalink / raw) To: linux-kernel Just checked against latest -git10, same oops: http://crucible.osdl.org/runs/2256/sysinfo/amd01.console However, it is not occurring on our ita64, x86, or x86_64 systems running the same kernels. Bryce On Thu, Sep 28, 2006 at 01:25:48PM -0700, Bryce Harrington wrote: > Apologies if this has already been reported; I didn't spot it on the > list. We've noticed an Oops on AMD64 when running linux-2.6.18-git8 and > -git9, but not -git7: > > mptbase: Initiating ioc0 recovery > Unable to handle kernel NULL pointer dereference at 0000000000000500 RIP: > [<ffffffff80489aa2>] mptspi_dv_renegotiate_work+0xc/0x45 > PGD 0 > Oops: 0000 [1] PREEMPT SMP > CPU 0 > Modules linked in: > Pid: 8, comm: events/0 Not tainted 2.6.18-git8 #1 > RIP: 0010:[<ffffffff80489aa2>] [<ffffffff80489aa2>] mptspi_dv_renegotiate_work+0xc/0x45 > RSP: 0000:ffff81003ec65e40 EFLAGS: 00010282 > RAX: 0000000000000002 RBX: ffff81003e86f640 RCX: 000000000000001e > RDX: 0000000000000001 RSI: 0000000000000213 RDI: 000000000003e86f > RBP: 0000000000000500 R08: ffff81003ec64000 R09: ffff81003ed0cf40 > R10: ffff81003e86f640 R11: ffff81003ed0cf40 R12: ffff81003ed0cf40 > R13: 0000000000000213 R14: ffff81003e86f640 R15: ffffffff80489a96 > FS: 0000000000000000(0000) GS:ffffffff80779000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0018 ES: 0018 CR0: 000000008005003b > CR2: 0000000000000500 CR3: 0000000000201000 CR4: 00000000000006e0 > Process events/0 (pid: 8, threadinfo ffff81003ec64000, task ffff81007f180740) > Stack: ffff81003ec65ef8 ffff81003e86f640 ffff81003e86f648 ffffffff8023f1bd > ffff81003ed0cf40 ffff81003ed0cf40 ffffffff8023f204 ffff8100016dfd70 > 00000000fffffffc ffffffff80593ffd 0000000000000000 ffffffff8023f300 > Call Trace: > [<ffffffff8023f1bd>] run_workqueue+0x9a/0xe1 > [<ffffffff8023f204>] worker_thread+0x0/0x12e > [<ffffffff8023f300>] worker_thread+0xfc/0x12e > [<ffffffff80229f62>] default_wake_function+0x0/0xe > [<ffffffff80229f62>] default_wake_function+0x0/0xe > [<ffffffff80242433>] kthread+0xc8/0xf1 > [<ffffffff8020a3f8>] child_rip+0xa/0x12 > [<ffffffff8024236b>] kthread+0x0/0xf1 > [<ffffffff8020a3ee>] child_rip+0x0/0x12 > > > Code: 48 8b 45 00 31 f6 48 8b b8 50 01 00 00 e8 5c 4d fe ff 48 85 > RIP [<ffffffff80489aa2>] mptspi_dv_renegotiate_work+0xc/0x45 > RSP <ffff81003ec65e40> > CR2: 0000000000000500 > <6>mptbase: Initiating ioc0 recovery > > Full console logs showing the above oops are here: > -git7: ok http://crucible.osdl.org/runs/2223/sysinfo/amd01.console > -git8: Oops http://crucible.osdl.org/runs/2233/sysinfo/amd01.console > -git9: Oops http://crucible.osdl.org/runs/2241/sysinfo/amd01.console > > Reference information about the machine this is run on: > http://crucible.osdl.org/runs/2223/sysinfo/amd01.1/ > > Config files: > -git7: http://crucible.osdl.org/runs/2223/sysinfo/amd01.config > -git8: http://crucible.osdl.org/runs/2233/sysinfo/amd01.config > > Bryce > _______________________________________________ > Eng mailing list > Eng@lists.osdl.org > https://lists.osdl.org/mailman/listinfo/eng ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [OOPS] -git8,9: NULL pointer dereference in mptspi_dv_renegotiate_work 2006-09-28 20:25 [OOPS] -git8,9: NULL pointer dereference in mptspi_dv_renegotiate_work Bryce Harrington 2006-09-28 20:34 ` [Eng] [OOPS] -git8, 9: " Bryce Harrington @ 2006-09-28 21:51 ` Andrew Morton 2006-09-28 22:54 ` Bryce Harrington 1 sibling, 1 reply; 6+ messages in thread From: Andrew Morton @ 2006-09-28 21:51 UTC (permalink / raw) To: Bryce Harrington; +Cc: linux-kernel, Moore, Eric Dean, linux-scsi (cc's added) On Thu, 28 Sep 2006 13:25:48 -0700 Bryce Harrington <bryce@osdl.org> wrote: > Apologies if this has already been reported; It has not. > I didn't spot it on the > list. We've noticed an Oops on AMD64 when running linux-2.6.18-git8 and > -git9, but not -git7: > > mptbase: Initiating ioc0 recovery > Unable to handle kernel NULL pointer dereference at 0000000000000500 RIP: > [<ffffffff80489aa2>] mptspi_dv_renegotiate_work+0xc/0x45 > PGD 0 > Oops: 0000 [1] PREEMPT SMP > CPU 0 > Modules linked in: > Pid: 8, comm: events/0 Not tainted 2.6.18-git8 #1 > RIP: 0010:[<ffffffff80489aa2>] [<ffffffff80489aa2>] mptspi_dv_renegotiate_work+0xc/0x45 > RSP: 0000:ffff81003ec65e40 EFLAGS: 00010282 > RAX: 0000000000000002 RBX: ffff81003e86f640 RCX: 000000000000001e > RDX: 0000000000000001 RSI: 0000000000000213 RDI: 000000000003e86f > RBP: 0000000000000500 R08: ffff81003ec64000 R09: ffff81003ed0cf40 > R10: ffff81003e86f640 R11: ffff81003ed0cf40 R12: ffff81003ed0cf40 > R13: 0000000000000213 R14: ffff81003e86f640 R15: ffffffff80489a96 > FS: 0000000000000000(0000) GS:ffffffff80779000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0018 ES: 0018 CR0: 000000008005003b > CR2: 0000000000000500 CR3: 0000000000201000 CR4: 00000000000006e0 > Process events/0 (pid: 8, threadinfo ffff81003ec64000, task ffff81007f180740) > Stack: ffff81003ec65ef8 ffff81003e86f640 ffff81003e86f648 ffffffff8023f1bd > ffff81003ed0cf40 ffff81003ed0cf40 ffffffff8023f204 ffff8100016dfd70 > 00000000fffffffc ffffffff80593ffd 0000000000000000 ffffffff8023f300 > Call Trace: > [<ffffffff8023f1bd>] run_workqueue+0x9a/0xe1 > [<ffffffff8023f204>] worker_thread+0x0/0x12e > [<ffffffff8023f300>] worker_thread+0xfc/0x12e > [<ffffffff80229f62>] default_wake_function+0x0/0xe > [<ffffffff80229f62>] default_wake_function+0x0/0xe > [<ffffffff80242433>] kthread+0xc8/0xf1 > [<ffffffff8020a3f8>] child_rip+0xa/0x12 > [<ffffffff8024236b>] kthread+0x0/0xf1 > [<ffffffff8020a3ee>] child_rip+0x0/0x12 > > > Code: 48 8b 45 00 31 f6 48 8b b8 50 01 00 00 e8 5c 4d fe ff 48 85 > RIP [<ffffffff80489aa2>] mptspi_dv_renegotiate_work+0xc/0x45 > RSP <ffff81003ec65e40> > CR2: 0000000000000500 > <6>mptbase: Initiating ioc0 recovery That's very clever. With gcc-4.0.2 and your .config I get (gdb) x/20i mptspi_dv_renegotiate_work 0xffffffff8048475e <mptspi_dv_renegotiate_work>: push %rbp 0xffffffff8048475f <mptspi_dv_renegotiate_work+1>: push %rbx 0xffffffff80484760 <mptspi_dv_renegotiate_work+2>: push %rbp 0xffffffff80484761 <mptspi_dv_renegotiate_work+3>: mov 0x60(%rdi),%rbp 0xffffffff80484765 <mptspi_dv_renegotiate_work+7>: callq 0xffffffff8026df58 <kfree> 0xffffffff8048476a <mptspi_dv_renegotiate_work+12>: mov 0x0(%rbp),%rax 0xffffffff8048476e <mptspi_dv_renegotiate_work+16>: xor %esi,%esi 0xffffffff80484770 <mptspi_dv_renegotiate_work+18>: mov 0x150(%rax),%rdi So on entry to this function, wqw->hd is 0x500. Or kfree() somehow scrogged your %rbp register. > Full console logs showing the above oops are here: > -git7: ok http://crucible.osdl.org/runs/2223/sysinfo/amd01.console > -git8: Oops http://crucible.osdl.org/runs/2233/sysinfo/amd01.console > -git9: Oops http://crucible.osdl.org/runs/2241/sysinfo/amd01.console > > Reference information about the machine this is run on: > http://crucible.osdl.org/runs/2223/sysinfo/amd01.1/ > > Config files: > -git7: http://crucible.osdl.org/runs/2223/sysinfo/amd01.config > -git8: http://crucible.osdl.org/runs/2233/sysinfo/amd01.config > ... > Just checked against latest -git10, same oops: > > http://crucible.osdl.org/runs/2256/sysinfo/amd01.console > > However, it is not occurring on our ita64, x86, or x86_64 systems > running the same kernels. > I'd be suspecting a miscompile, or something horrid in kfree(). Does it change anything if you move that kfree() down a bit? --- a/drivers/message/fusion/mptspi.c~a +++ a/drivers/message/fusion/mptspi.c @@ -790,10 +790,9 @@ mptspi_dv_renegotiate_work(void *data) struct _MPT_SCSI_HOST *hd = wqw->hd; struct scsi_device *sdev; - kfree(wqw); - shost_for_each_device(sdev, hd->ioc->sh) mptspi_dv_device(hd, sdev); + kfree(wqw); } static void _ ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [OOPS] -git8,9: NULL pointer dereference in mptspi_dv_renegotiate_work 2006-09-28 21:51 ` [OOPS] -git8,9: " Andrew Morton @ 2006-09-28 22:54 ` Bryce Harrington 2006-09-29 0:26 ` Andrew Morton 0 siblings, 1 reply; 6+ messages in thread From: Bryce Harrington @ 2006-09-28 22:54 UTC (permalink / raw) To: Andrew Morton; +Cc: linux-kernel, Moore, Eric Dean, linux-scsi On Thu, Sep 28, 2006 at 02:51:21PM -0700, Andrew Morton wrote: > On Thu, 28 Sep 2006 13:25:48 -0700 > Bryce Harrington <bryce@osdl.org> wrote: > > > Apologies if this has already been reported; > > It has not. > > > I didn't spot it on the > > list. We've noticed an Oops on AMD64 when running linux-2.6.18-git8 and > > -git9, but not -git7: > > > > mptbase: Initiating ioc0 recovery > > Unable to handle kernel NULL pointer dereference at 0000000000000500 RIP: > > [<ffffffff80489aa2>] mptspi_dv_renegotiate_work+0xc/0x45 > > PGD 0 > > Oops: 0000 [1] PREEMPT SMP > > That's very clever. > > I'd be suspecting a miscompile, or something horrid in kfree(). > > Does it change anything if you move that kfree() down a bit? > Got essentially the same oops, although the addresses have changed a little: mptbase: Initiating ioc0 recovery Unable to handle kernel NULL pointer dereference at 0000000000000500 RIP: [<ffffffff80489aa3>] mptspi_dv_renegotiate_work+0xd/0x4c PGD 0 Oops: 0000 [1] PREEMPT SMP CPU 0 Modules linked in: Pid: 8, comm: events/0 Not tainted 2.6.18-git10 #1 RIP: 0010:[<ffffffff80489aa3>] [<ffffffff80489aa3>] mptspi_dv_renegotiate_work+0xd/0x4c RSP: 0000:ffff81003ec65e40 EFLAGS: 00010246 RAX: ffff81003ec65ef8 RBX: ffff81003eff6640 RCX: ffff81003ec65ef8 RDX: ffff81003ed0cf58 RSI: 0000000000000000 RDI: ffff81003eff6640 RBP: 0000000000000500 R08: ffff81003ec64000 R09: 00000000ffffffff R10: 00000000ffffffff R11: ffff81003ed0cf40 R12: ffff81003eff6640 R13: 0000000000000213 R14: ffff81003eff6640 R15: ffffffff80489a96 FS: 0000000000000000(0000) GS:ffffffff8077a000(0000) knlGS:0000000000000000 CS: 0010 DS: 0018 ES: 0018 CR0: 000000008005003b CR2: 0000000000000500 CR3: 0000000000201000 CR4: 00000000000006e0 Process events/0 (pid: 8, threadinfo ffff81003ec64000, task ffff81007f180740) Stack: ffff81003eff6640 ffff81003eff6648 ffff81003ed0cf40 ffffffff8023f1bd ffff81003ed0cf40 ffff81003ed0cf40 ffffffff8023f204 ffff8100016dfd70 00000000fffffffc ffffffff8059457d 0000000000000000 ffffffff8023f30 Call Trace: [<ffffffff8023f1bd>] run_workqueue+0x9a/0xe1 [<ffffffff8023f204>] worker_thread+0x0/0x12e [<ffffffff8023f300>] worker_thread+0xfc/0x12e [<ffffffff80229f62>] default_wake_function+0x0/0xe [<ffffffff80229f62>] default_wake_function+0x0/0xe [<ffffffff80242433>] kthread+0xc8/0xf1 [<ffffffff8020a3f8>] child_rip+0xa/0x12 [<ffffffff8024236b>] kthread+0x0/0xf1 [<ffffffff8020a3ee>] child_rip+0x0/0x12 Code: 48 8b 45 00 48 8b b8 50 01 00 00 e8 5d 4d fe ff 48 85 c0 48 RIP [<ffffffff80489aa3>] mptspi_dv_renegotiate_work+0xd/0x4c RSP <ffff81003ec65e40> CR2: 0000000000000500 <6>mptbase: Initiating ioc0 recovery mptbase: Initiating ioc0 recovery mptbase: Initiating ioc0 recovery mptbase: Initiating ioc0 recovery mptbase: Initiating ioc0 recovery scsi0 : ioc0: LSI53C1030, FwRev=01030600h, Ports=1, MaxQ=255, IRQ=185 target0:0:0: dma_alloc_coherent for parameters failed mptscsih: ioc0: attempting task abort! (sc=ffff81003e840c80) scsi 0:0:0:0: command: cdb[0]=0x12: 12 00 00 00 24 00 mptbase: Initiating ioc0 recovery Bryce > With gcc-4.0.2 and your .config I get > > (gdb) x/20i mptspi_dv_renegotiate_work > 0xffffffff8048475e <mptspi_dv_renegotiate_work>: push %rbp > 0xffffffff8048475f <mptspi_dv_renegotiate_work+1>: push %rbx > 0xffffffff80484760 <mptspi_dv_renegotiate_work+2>: push %rbp > 0xffffffff80484761 <mptspi_dv_renegotiate_work+3>: mov 0x60(%rdi),%rbp > 0xffffffff80484765 <mptspi_dv_renegotiate_work+7>: callq 0xffffffff8026df58 <kfree> > 0xffffffff8048476a <mptspi_dv_renegotiate_work+12>: mov 0x0(%rbp),%rax > 0xffffffff8048476e <mptspi_dv_renegotiate_work+16>: xor %esi,%esi > 0xffffffff80484770 <mptspi_dv_renegotiate_work+18>: mov 0x150(%rax),%rdi > > So on entry to this function, wqw->hd is 0x500. > > Or kfree() somehow scrogged your %rbp register. > > > > Full console logs showing the above oops are here: > > -git7: ok http://crucible.osdl.org/runs/2223/sysinfo/amd01.console > > -git8: Oops http://crucible.osdl.org/runs/2233/sysinfo/amd01.console > > -git9: Oops http://crucible.osdl.org/runs/2241/sysinfo/amd01.console > > > > Reference information about the machine this is run on: > > http://crucible.osdl.org/runs/2223/sysinfo/amd01.1/ > > > > Config files: > > -git7: http://crucible.osdl.org/runs/2223/sysinfo/amd01.config > > -git8: http://crucible.osdl.org/runs/2233/sysinfo/amd01.config > > > ... > > > Just checked against latest -git10, same oops: > > > > http://crucible.osdl.org/runs/2256/sysinfo/amd01.console > > > > However, it is not occurring on our ita64, x86, or x86_64 systems > > running the same kernels. > > > > I'd be suspecting a miscompile, or something horrid in kfree(). > > Does it change anything if you move that kfree() down a bit? > > --- a/drivers/message/fusion/mptspi.c~a > +++ a/drivers/message/fusion/mptspi.c > @@ -790,10 +790,9 @@ mptspi_dv_renegotiate_work(void *data) > struct _MPT_SCSI_HOST *hd = wqw->hd; > struct scsi_device *sdev; > > - kfree(wqw); > - > shost_for_each_device(sdev, hd->ioc->sh) > mptspi_dv_device(hd, sdev); > + kfree(wqw); > } > > static void > _ ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [OOPS] -git8,9: NULL pointer dereference in mptspi_dv_renegotiate_work 2006-09-28 22:54 ` Bryce Harrington @ 2006-09-29 0:26 ` Andrew Morton 2006-09-29 17:17 ` Bryce Harrington 0 siblings, 1 reply; 6+ messages in thread From: Andrew Morton @ 2006-09-29 0:26 UTC (permalink / raw) To: Bryce Harrington; +Cc: linux-kernel, Moore, Eric Dean, linux-scsi On Thu, 28 Sep 2006 15:54:26 -0700 Bryce Harrington <bryce@osdl.org> wrote: > On Thu, Sep 28, 2006 at 02:51:21PM -0700, Andrew Morton wrote: > > On Thu, 28 Sep 2006 13:25:48 -0700 > > Bryce Harrington <bryce@osdl.org> wrote: > > > > > Apologies if this has already been reported; > > > > It has not. > > > > > I didn't spot it on the > > > list. We've noticed an Oops on AMD64 when running linux-2.6.18-git8 and > > > -git9, but not -git7: > > > > > > mptbase: Initiating ioc0 recovery > > > Unable to handle kernel NULL pointer dereference at 0000000000000500 RIP: > > > [<ffffffff80489aa2>] mptspi_dv_renegotiate_work+0xc/0x45 > > > PGD 0 > > > Oops: 0000 [1] PREEMPT SMP > > > > > That's very clever. > > > > I'd be suspecting a miscompile, or something horrid in kfree(). > > > > Does it change anything if you move that kfree() down a bit? > > > > Got essentially the same oops, although the addresses have changed a > little: > > mptbase: Initiating ioc0 recovery > Unable to handle kernel NULL pointer dereference at 0000000000000500 RIP: > [<ffffffff80489aa3>] mptspi_dv_renegotiate_work+0xd/0x4c > PGD 0 > Oops: 0000 [1] PREEMPT SMP > CPU 0 > Modules linked in: > Pid: 8, comm: events/0 Not tainted 2.6.18-git10 #1 > RIP: 0010:[<ffffffff80489aa3>] [<ffffffff80489aa3>] mptspi_dv_renegotiate_work+0xd/0x4c > RSP: 0000:ffff81003ec65e40 EFLAGS: 00010246 > RAX: ffff81003ec65ef8 RBX: ffff81003eff6640 RCX: ffff81003ec65ef8 > RDX: ffff81003ed0cf58 RSI: 0000000000000000 RDI: ffff81003eff6640 > RBP: 0000000000000500 R08: ffff81003ec64000 R09: 00000000ffffffff > R10: 00000000ffffffff R11: ffff81003ed0cf40 R12: ffff81003eff6640 > R13: 0000000000000213 R14: ffff81003eff6640 R15: ffffffff80489a96 > FS: 0000000000000000(0000) GS:ffffffff8077a000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0018 ES: 0018 CR0: 000000008005003b > CR2: 0000000000000500 CR3: 0000000000201000 CR4: 00000000000006e0 > Process events/0 (pid: 8, threadinfo ffff81003ec64000, task ffff81007f180740) > Stack: ffff81003eff6640 ffff81003eff6648 ffff81003ed0cf40 ffffffff8023f1bd > ffff81003ed0cf40 ffff81003ed0cf40 ffffffff8023f204 ffff8100016dfd70 > 00000000fffffffc ffffffff8059457d 0000000000000000 ffffffff8023f30 > Call Trace: > [<ffffffff8023f1bd>] run_workqueue+0x9a/0xe1 > [<ffffffff8023f204>] worker_thread+0x0/0x12e > [<ffffffff8023f300>] worker_thread+0xfc/0x12e > [<ffffffff80229f62>] default_wake_function+0x0/0xe > [<ffffffff80229f62>] default_wake_function+0x0/0xe > [<ffffffff80242433>] kthread+0xc8/0xf1 > [<ffffffff8020a3f8>] child_rip+0xa/0x12 > [<ffffffff8024236b>] kthread+0x0/0xf1 > [<ffffffff8020a3ee>] child_rip+0x0/0x12 > > > Code: 48 8b 45 00 48 8b b8 50 01 00 00 e8 5d 4d fe ff 48 85 c0 48 > RIP [<ffffffff80489aa3>] mptspi_dv_renegotiate_work+0xd/0x4c > RSP <ffff81003ec65e40> > CR2: 0000000000000500 > <6>mptbase: Initiating ioc0 recovery > mptbase: Initiating ioc0 recovery > mptbase: Initiating ioc0 recovery > mptbase: Initiating ioc0 recovery > mptbase: Initiating ioc0 recovery > scsi0 : ioc0: LSI53C1030, FwRev=01030600h, Ports=1, MaxQ=255, IRQ=185 > target0:0:0: dma_alloc_coherent for parameters failed > mptscsih: ioc0: attempting task abort! (sc=ffff81003e840c80) > scsi 0:0:0:0: > command: cdb[0]=0x12: 12 00 00 00 24 00 > mptbase: Initiating ioc0 recovery > Ah. Maybe we're simply being passed a junk pointer. This, please: --- a/drivers/message/fusion/mptspi.c~a +++ a/drivers/message/fusion/mptspi.c @@ -804,6 +804,9 @@ mptspi_dv_renegotiate(struct _MPT_SCSI_H if (!wqw) return; + printk("%p\n", hd); + if ((unsigned long)hd < 4000UL) + dump_stack(); INIT_WORK(&wqw->work, mptspi_dv_renegotiate_work, wqw); wqw->hd = hd; _ ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [OOPS] -git8,9: NULL pointer dereference in mptspi_dv_renegotiate_work 2006-09-29 0:26 ` Andrew Morton @ 2006-09-29 17:17 ` Bryce Harrington 0 siblings, 0 replies; 6+ messages in thread From: Bryce Harrington @ 2006-09-29 17:17 UTC (permalink / raw) To: Andrew Morton; +Cc: linux-kernel, Moore, Eric Dean, linux-scsi On Thu, Sep 28, 2006 at 05:26:52PM -0700, Andrew Morton wrote: > On Thu, 28 Sep 2006 15:54:26 -0700 > Bryce Harrington <bryce@osdl.org> wrote: > > > On Thu, Sep 28, 2006 at 02:51:21PM -0700, Andrew Morton wrote: > > > On Thu, 28 Sep 2006 13:25:48 -0700 > > > Bryce Harrington <bryce@osdl.org> wrote: > > > > > > > Apologies if this has already been reported; > > > > > > It has not. > > > > > > > I didn't spot it on the > > > > list. We've noticed an Oops on AMD64 when running linux-2.6.18-git8 and > > > > -git9, but not -git7: > > > > > > > > mptbase: Initiating ioc0 recovery > > > > Unable to handle kernel NULL pointer dereference at 0000000000000500 RIP: > > > > [<ffffffff80489aa2>] mptspi_dv_renegotiate_work+0xc/0x45 > > > > PGD 0 > > > > Oops: 0000 [1] PREEMPT SMP > > > > > > > > That's very clever. > > > > > > I'd be suspecting a miscompile, or something horrid in kfree(). > > > > > > Does it change anything if you move that kfree() down a bit? > > > > > > > Got essentially the same oops, although the addresses have changed a > > little: > > > > mptbase: Initiating ioc0 recovery > > Unable to handle kernel NULL pointer dereference at 0000000000000500 RIP: > > [<ffffffff80489aa3>] mptspi_dv_renegotiate_work+0xd/0x4c > > PGD 0 > > Oops: 0000 [1] PREEMPT SMP > > CPU 0 > > Modules linked in: > > Pid: 8, comm: events/0 Not tainted 2.6.18-git10 #1 > > RIP: 0010:[<ffffffff80489aa3>] [<ffffffff80489aa3>] mptspi_dv_renegotiate_work+0xd/0x4c > > RSP: 0000:ffff81003ec65e40 EFLAGS: 00010246 > > RAX: ffff81003ec65ef8 RBX: ffff81003eff6640 RCX: ffff81003ec65ef8 > > RDX: ffff81003ed0cf58 RSI: 0000000000000000 RDI: ffff81003eff6640 > > RBP: 0000000000000500 R08: ffff81003ec64000 R09: 00000000ffffffff > > R10: 00000000ffffffff R11: ffff81003ed0cf40 R12: ffff81003eff6640 > > R13: 0000000000000213 R14: ffff81003eff6640 R15: ffffffff80489a96 > > FS: 0000000000000000(0000) GS:ffffffff8077a000(0000) knlGS:0000000000000000 > > CS: 0010 DS: 0018 ES: 0018 CR0: 000000008005003b > > CR2: 0000000000000500 CR3: 0000000000201000 CR4: 00000000000006e0 > > Process events/0 (pid: 8, threadinfo ffff81003ec64000, task ffff81007f180740) > > Stack: ffff81003eff6640 ffff81003eff6648 ffff81003ed0cf40 ffffffff8023f1bd > > ffff81003ed0cf40 ffff81003ed0cf40 ffffffff8023f204 ffff8100016dfd70 > > 00000000fffffffc ffffffff8059457d 0000000000000000 ffffffff8023f30 > > Call Trace: > > [<ffffffff8023f1bd>] run_workqueue+0x9a/0xe1 > > [<ffffffff8023f204>] worker_thread+0x0/0x12e > > [<ffffffff8023f300>] worker_thread+0xfc/0x12e > > [<ffffffff80229f62>] default_wake_function+0x0/0xe > > [<ffffffff80229f62>] default_wake_function+0x0/0xe > > [<ffffffff80242433>] kthread+0xc8/0xf1 > > [<ffffffff8020a3f8>] child_rip+0xa/0x12 > > [<ffffffff8024236b>] kthread+0x0/0xf1 > > [<ffffffff8020a3ee>] child_rip+0x0/0x12 > > > > > > Code: 48 8b 45 00 48 8b b8 50 01 00 00 e8 5d 4d fe ff 48 85 c0 48 > > RIP [<ffffffff80489aa3>] mptspi_dv_renegotiate_work+0xd/0x4c > > RSP <ffff81003ec65e40> > > CR2: 0000000000000500 > > <6>mptbase: Initiating ioc0 recovery > > mptbase: Initiating ioc0 recovery > > mptbase: Initiating ioc0 recovery > > mptbase: Initiating ioc0 recovery > > mptbase: Initiating ioc0 recovery > > scsi0 : ioc0: LSI53C1030, FwRev=01030600h, Ports=1, MaxQ=255, IRQ=185 > > target0:0:0: dma_alloc_coherent for parameters failed > > mptscsih: ioc0: attempting task abort! (sc=ffff81003e840c80) > > scsi 0:0:0:0: > > command: cdb[0]=0x12: 12 00 00 00 24 00 > > mptbase: Initiating ioc0 recovery > > > > Ah. Maybe we're simply being passed a junk pointer. This, please: > > --- a/drivers/message/fusion/mptspi.c~a > +++ a/drivers/message/fusion/mptspi.c > @@ -804,6 +804,9 @@ mptspi_dv_renegotiate(struct _MPT_SCSI_H > if (!wqw) > return; > > + printk("%p\n", hd); > + if ((unsigned long)hd < 4000UL) > + dump_stack(); > INIT_WORK(&wqw->work, mptspi_dv_renegotiate_work, wqw); > wqw->hd = hd; > > _ Here's the stack dump: mptbase: Initiating ioc0 recovery 0000000000000500 Call Trace: <IRQ> [<ffffffff803e0d37>] vgacon_cursor+0x0/0x1a7 [<ffffffff80489b19>] mptspi_dv_renegotiate+0x3e/0x79 [<ffffffff80489b7b>] mptspi_ioc_reset+0x27/0x2e [<ffffffff804846ea>] mpt_do_ioc_recovery+0x115f/0x11dd [<ffffffff802387d7>] current_tick_length+0x5/0x26 [<ffffffff80238dd4>] do_timer+0x2f6/0x574 [<ffffffff8023851c>] lock_timer_base+0x1b/0x3c [<ffffffff8055ebff>] _spin_lock+0xe/0x5e [<ffffffff8022797a>] task_rq_lock+0x3d/0x6f [<ffffffff80227d03>] resched_task+0x4e/0x71 [<ffffffff8022847f>] try_to_wake_up+0x3d4/0x3e6 [<ffffffff80461794>] atapi_output_bytes+0x21/0x5c [<ffffffff802387d7>] current_tick_length+0x5/0x26 [<ffffffff8055ebff>] _spin_lock+0xe/0x5e [<ffffffff8022797a>] task_rq_lock+0x3d/0x6f [<ffffffff80227d03>] resched_task+0x4e/0x71 [<ffffffff8022847f>] try_to_wake_up+0x3d4/0x3e6 [<ffffffff8020cf66>] main_timer_handler+0x1e6/0x3a6 [<ffffffff80228f29>] find_busiest_group+0x21f/0x66f [<ffffffff80484f94>] mpt_HardResetHandler+0xb4/0x12c [<ffffffff8048500c>] mpt_timer_expired+0x0/0x24 [<ffffffff80485017>] mpt_timer_expired+0xb/0x24 [<ffffffff80238a07>] run_timer_softirq+0x156/0x1b2 [<ffffffff802357a1>] __do_softirq+0x46/0xb1 [<ffffffff8020a76c>] call_softirq+0x1c/0x28 [<ffffffff8020bb5f>] do_softirq+0x2c/0x7d [<ffffffff80207c37>] default_idle+0x0/0x47 [<ffffffff8023583f>] irq_exit+0x33/0x3e [<ffffffff8020a216>] apic_timer_interrupt+0x66/0x70 <EOI> [<ffffffff80207c60>] default_idle+0x29/0x47 [<ffffffff80207e3e>] cpu_idle+0x87/0xbe [<ffffffff80794704>] start_kernel+0x203/0x205 [<ffffffff80794179>] _sinittext+0x179/0x17d Unable to handle kernel NULL pointer dereference at 0000000000000500 RIP: [<ffffffff80489aa2>] mptspi_dv_renegotiate_work+0xc/0x45 PGD 0 Oops: 0000 [1] PREEMPT SMP CPU 0 Modules linked in: Pid: 8, comm: events/0 Not tainted 2.6.18-git10 #1 RIP: 0010:[<ffffffff80489aa2>] [<ffffffff80489aa2>] mptspi_dv_renegotiate_work+0xc/0x45 RSP: 0000:ffff81003ec65e40 EFLAGS: 00010282 RAX: 0000000000000004 RBX: ffff81003eff3640 RCX: 000000000000001e RDX: 0000000000000003 RSI: 0000000000000213 RDI: 000000000003eff3 RBP: 0000000000000500 R08: ffff81003ed0cf88 R09: ffff81003ed0cf40 R10: ffff81003eff3640 R11: ffff81003ed0cf40 R12: ffff81003ed0cf40 R13: 0000000000000213 R14: ffff81003eff3640 R15: ffffffff80489a96 FS: 0000000000knlGS:0000000000000000 CS: 0010 DS: 0018 ES: 0018 CR0: 000000008005003b CR2: 0000000000000500 CR3: 0000000000201000 CR4: 00000000000006e0 Process events/0 (pid: 8, threadinfo ffff81003ec64000, task ffff81007f180740) Stack: 0000000000000000 ffff81003eff3640 ffff81003eff3648 ffffffff8023f1bd ffff81003ed0cf40 ffff81003ed0cf40 ffffffff8023f204 ffff8100016dfd70 00000000fffffffc fd 0000000000000000 ffffffff8023f300 Call Trace: [<ffffffff8023f1bd>] run_workqueue+0x9a/0xe1 [<ffffffff8023f204>] worker_thread+0x0/0x12e [<ffffffff8023f300>] worker_thread+0xfc/0x12e [<ffffffff80229f62>] default_wake_function+0x0/0xe [<ffffffff80229f62>] default_wake_function+0x0/0xe [<ffffffff80242433>] kthread+0xc8/0xf1 [<ffffffff8020a3f8>] child_rip+0xa/0x12 [<ffffad+0x0/0xf1 [<ffffffff8020a3ee>] child_rip+0x0/0x12 Code: 48 8b 45 00 31 f6 48 8b b8 50 01 00 00 e8 5c 4d fe ff 48 85 RIP [<ffffffff80489aa2>] mptspi_dv_renegotiate_work+0xc/0x45 RSP <ffff81003ec65e40> CR2: 0000000000000500 <6>mptbase: Initiating ioc0 recovery 0000000000000500 Call Trace: <IRQ> [<ffffffff803e0d37>] vgacon_cursor+0x0/0x1a7 [<ffffffff80489b19>] mptspi_dv_renegotiate+0x3e/0x79 [<ffffffff80489b7b>] mptspi_ioc_reset+0x27/0x2e [<ffffffff804846ea>] mpt_do_ioc_recovery+0x115f/0x11dd [<ffffffff802387d7>] current_tick_length+0x5/0x26 [<ffffffff80238dd4>] do_timer+0x2f6/0x574 [<ffffffff8023851c>] lock_timer_base+0x1b/0x3c [<ffffffff8055ebff>] _spin_lock+0xe/0x5e [<ffffffff8022797a>] task_rq_lock+0x3d/0x6f [<ffffffff80227d03>] resched_task+0x4e/0x71 [<ffffffff8022847f>] try_to_wake_up+0x3d4/0x3e6 [<ffffffff80461794>] atapi_output_bytes+0x21/0x5c [<ffffffff802387d7>] current_tick_length+0x5/0x26 [<ffffffff80238dd4>] do_timer+0x2f6/0x574 [<ffffffff8055ebff>] _spin_lock+0xe/0x5e [<ffffffff8020cf66>] main_timer_hax3a6 [<ffffffff80228f29>] find_busiest_group+0x21f/0x66f [<ffffffff8055ebff>] _spin_lock+0xe/0x5e [<ffffffff80484f94>] mpt_HardResetHandler+0xb4/0x12c [<ffffffff8048500c>] mpt_timer_expired+0x0/0x24 [<ffffffff80485017>] mpt_timer_expired+0xb/0x24 [<ffffffff80238a07>] run_timer_softirq+0x156/0x1b2 [<ffffffff802357a1>] __do_softirq+0x46/0xb1 [<ffffffff8020a76c>] call_softir+0x1c/0x28 [<ffffffff8020bb5f>] do_softirq+0x2c/0x7d [<ffffffff80207c37>] default_idle+0x0/0x47 [<ffffffff8023583f>] irq_exit+0x33/0x3e [<ffffffff8020a216>] apic_timer_interrupt+0x66/0x70 <EOI> [<ffffffff80207c60>] default_idle+0x29/0x47 [<ffffffff80207e3e>] cpu_idle+0x87/0xbe [<ffffffff80794704>] start_kernel+0x203/0x205 [<ffffffff80794179>] _sinittext+0x179/0x17d Bryce ^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2006-09-29 17:17 UTC | newest] Thread overview: 6+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2006-09-28 20:25 [OOPS] -git8,9: NULL pointer dereference in mptspi_dv_renegotiate_work Bryce Harrington 2006-09-28 20:34 ` [Eng] [OOPS] -git8, 9: " Bryce Harrington 2006-09-28 21:51 ` [OOPS] -git8,9: " Andrew Morton 2006-09-28 22:54 ` Bryce Harrington 2006-09-29 0:26 ` Andrew Morton 2006-09-29 17:17 ` Bryce Harrington
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox