[new 2.6.21-rc6 crash] BUG: unable to handle kernel paging request at virtual address 6b6b6ceb

[Ingo Molnar <mingo@elte.hu>]

[-- Attachment #1: Type: text/plain, Size: 2762 bytes --]


i just got the crash below (with slab debug enabled) on -rc6-git4. I 
never saw this one before, and as you can see from the recompile count, 
i've rebuilt this tree a fair number of times - and the config didnt 
change much.

I promptly re-tried the same bzImage but the crash did not reoccur.

So we've got a memory corruptor of some sort in v2.6.21-to-be. I'm 100% 
sure that i never saw this under any v2.6.20 variant or on any prior 
kernel. The crash site corresponds to a module-refcount dec:

(gdb) list *0x00000000c013c1f4
0xc013c1f4 is in module_put (kernel/module.c:801).
796
797     void module_put(struct module *module)
798     {
799             if (module) {
800                     unsigned int cpu = get_cpu();
801                     local_dec(&module->ref[cpu].count);
802                     /* Maybe they're waiting for us to drop reference? */
803                     if (unlikely(!module_is_live(module)))
804                             wake_up_process(module->waiter);
805                     put_cpu();
(gdb)

NOTE: i'm still using a bzImage kernel, so there are no true modules in 
the kernel. (This also makes it pretty likely that this is not a build 
artifact either.)

(config and full bootlog attached.)

	Ingo

---------------------->
BUG: unable to handle kernel paging request at virtual address 6b6b6ceb
 printing eip:
c013c1f5
*pde = 0203000c
Oops: 0002 [#1]
SMP 
Modules linked in:
CPU:    0
EIP:    0060:[<c013c1f5>]    Not tainted VLI
EFLAGS: 00010256   (2.6.21-rc6 #273)
EIP is at module_put+0x19/0x2d
eax: 6b6b6ceb   ebx: f72fee2c   ecx: c03c9b36   edx: 6b6b6b6b
esi: f7428f54   edi: 6b6b6b6b   ebp: f737bf38   esp: f737bf38
ds: 007b   es: 007b   fs: 00d8  gs: 0033  ss: 0068
Process udev (pid: 1768, ti=f737a000 task=f7488000 task.ti=f737a000)
Stack: f737bf50 c019e832 f749092c 00000010 f72feda4 f746487c f737bf78 c0167c7f 
       00000000 00000000 f72f6ba4 c2928d48 f72feda4 f746487c f7be81d4 00000000 
       f737bf80 c0167d3b f737bf98 c01658b2 00000003 00000003 f7be81d4 f7be8254 
Call Trace:
 [<c0104c44>] show_trace_log_lvl+0x19/0x2e
 [<c0104cf4>] show_stack_log_lvl+0x9b/0xa3
 [<c0104fdd>] show_registers+0x1c8/0x29a
 [<c01052d0>] die+0x119/0x1f0
 [<c03cd075>] do_page_fault+0x4e3/0x5b8
 [<c03cb7a4>] error_code+0x7c/0x84
 [<c019e832>] sysfs_release+0x55/0x76
 [<c0167c7f>] __fput+0xb9/0x15e
 [<c0167d3b>] fput+0x17/0x19
 [<c01658b2>] filp_close+0x52/0x5a
 [<c01660a3>] sys_close+0x76/0xad
 [<c0103dc0>] syscall_call+0x7/0xb
 =======================
Code: 0a 00 89 f8 e8 90 f3 0a 00 5e 5f 89 d8 5b 5e 5f c9 c3 55 85 c0 89 c2 89 e5 74 22 64 a1 04 00 00 00 c1 e0 07 8d 84 10 80 01 00 00 <ff> 08 83 3a 02 75 0b 8b 82 88 11 00 00 e8 63 eb fd ff c9 c3 55 
EIP: [<c013c1f5>] module_put+0x19/0x2d SS:ESP 0068:f737bf38


[-- Attachment #2: .config.crash.bz2 --]
[-- Type: application/x-bzip2, Size: 14678 bytes --]

[-- Attachment #3: crash.log.bz2 --]
[-- Type: application/x-bzip2, Size: 11495 bytes --]