Re: 2.6.37-rc7: Regression: b43: crashes in hwrng_register()

["Mario 'BitKoenig' Holbe" <Mario.Holbe@TU-Ilmenau.DE>]

[-- Attachment #1.1: Type: text/plain, Size: 2828 bytes --]

On Thu, Dec 30, 2010 at 04:49:05PM -0600, Larry Finger wrote:
> Added the two listed maintainers for hardware randon-number generators and
> dropped the wireless and b43 lists.
> 
> Matt and Herbert:
> 
> There is a regression in 2.6.37-rcX relative to 2.6.36. The problem shows as the
> following kernel BUG:
> [   30.313362] BUG: unable to handle kernel paging request at 60870667
> [   30.313372] IP: [<f8f4e3df>] hwrng_register+0x5f/0x14d [rng_core]
> 
> Mario's box with this fault has two RNG devices - b43 and the one provided by
> via-rng. Experimentation has shown that if b43 is registered first, then there
> is no problem; however if via-rng is first, then the above BUG is triggered when
> b43 registers its hardware rng. This problem is a regression in that one of the
> changes in 2.6.37 has b43 registering its rng later in the startup sequence.
...
> Do you see any problems in the code in drivers/net/wireless/b43/main.c or
> drivers/char/hw_random/via-rng.c. As the latter seems to make b43 fail, I am
> suspecting via-rng, but I have no proof.

I believe I can confirm the bug does not directly belong to b43:
I created a second via-rng driver (just copied via-rng.c to via-rng2.c
and changed the via_rng.name) and modprobed it. I blacklisted b43 to
keep it out of the game.

Virtually the same crash dump as with b43 shows up when I modprobe
via-rng2 after via-rng is loaded already.

Attached is a dmesg excerpt from a 2.6.37-rc7 kernel built with Larrys
hwrng_debug patch applied (which basically calls dump_stack() in
hwrng_register()).

objdump of hw_random/core.o:

00000380 <hwrng_register>:
hwrng_register():
/tmp/1/linux-source-2.6.37-rc7/drivers/char/hw_random/core.c:299
 380:   56                      push   %esi
...
/tmp/1/linux-source-2.6.37-rc7/drivers/char/hw_random/core.c:315
 3d9:   8b 76 1c                mov    0x1c(%esi),%esi
 3dc:   83 ee 1c                sub    $0x1c,%esi
prefetch():
/tmp/1/linux-source-2.6.37-rc7/arch/x86/include/asm/processor.h:837
 3df:   8b 46 1c                mov    0x1c(%esi),%eax
 3e2:   8d 74 26 00             lea    0x0(%esi,%eiz,1),%esi
hwrng_register():
/tmp/1/linux-source-2.6.37-rc7/drivers/char/hw_random/core.c:315
 3e6:   81 fe f8 ff ff ff       cmp    $0xfffffff8,%esi

hw_random/core.c:
   313          /* Must not register two RNGs with the same name. */
   314          err = -EEXIST;
   315          list_for_each_entry(tmp, &rng_list, list) {
   316                  if (strcmp(tmp->name, rng->name) == 0)
   317                          goto out_unlock;
   318          }


Larry: Thanks for your help!


regards
   Mario
-- 
Goethe war nicht gerne Minister. Er beschaeftigte sich lieber geistig.
                                            -- Lukasburger Stilblueten

[-- Attachment #1.2: 2.6.37-rc7+via-rng2.dmesg --]
[-- Type: text/plain, Size: 4008 bytes --]

[   11.746521] VIA RNG detected
[   11.746526] Calling hwrng_register
[   11.746533] Pid: 770, comm: modprobe Not tainted 2.6.37-rc7-self #5
[   11.746536] Call Trace:
[   11.746546]  [<f90ed3ac>] ? hwrng_register+0x2c/0x14d [rng_core]
[   11.746554]  [<f90fa023>] ? mod_init+0x23/0x3b [via_rng]
[   11.746564]  [<c1003069>] ? do_one_initcall+0x68/0x10f
[   11.746574]  [<c105f0d3>] ? sys_init_module+0xca5/0xe36
[   11.746602]  [<c1008b1f>] ? sysenter_do_call+0x12/0x28
...
[  106.660466] VIA RNG detected
[  106.660471] Calling hwrng_register
[  106.660478] Pid: 2673, comm: modprobe Not tainted 2.6.37-rc7-self #5
[  106.660482] Call Trace:
[  106.660500]  [<f90ed3ac>] ? hwrng_register+0x2c/0x14d [rng_core]
[  106.660510]  [<f830e023>] ? mod_init+0x23/0x3b [via_rng2]
[  106.660520]  [<c1003069>] ? do_one_initcall+0x68/0x10f
[  106.660532]  [<c105f0d3>] ? sys_init_module+0xca5/0xe36
[  106.660600]  [<c1008b1f>] ? sysenter_do_call+0x12/0x28
[  106.660630] BUG: unable to handle kernel paging request at 7268d4f3
[  106.660640] IP: [<f90ed3df>] hwrng_register+0x5f/0x14d [rng_core]
[  106.660658] *pdpt = 0000000033c0a001 *pde = 0000000000000000 
[  106.660670] Oops: 0000 [#1] SMP 
[  106.660678] last sysfs file: /sys/module/rng_core/initstate
[  106.660687] Modules linked in: via_rng2(+) uinput via drm rfcomm sco bnep l2cap crc16 parport_pc ppdev lp parport sbs sbshc power_meter pci_slot hed fan container acpi_cpufreq mperf cpufreq_conservative cpufreq_userspace cpufreq_stats cpufreq_powersave dm_crypt fuse loop eeprom via_cputemp i2c_dev nvram padlock_aes aes_i586 aes_generic padlock_sha sha256_generic sha1_generic via_rng rng_core msr cpuid snd_hda_codec_realtek snd_hda_intel snd_hda_codec snd_hwdep snd_pcm_oss snd_mixer_oss joydev snd_pcm snd_seq_midi snd_rawmidi snd_seq_midi_event snd_seq snd_timer snd_seq_device snd uvcvideo videodev v4l1_compat btusb ideapad_laptop soundcore video tpm_tis bluetooth psmouse i2c_viapro pcspkr tpm battery ac tpm_bios i2c_core evdev serio_raw power_supply snd_page_alloc output processor rfkill shpchp wmi pci_hotplug button ext3 jbd mbcache raid10 raid456 async_raid6_recov async_pq raid6_pq async_xor xor async_memcpy async_tx raid1 raid0 multipath linear md_mod dm_mirror dm_region_hash dm_log dm_mod btrfs zlib_deflate crc32c libcrc32c sd_mod crc_t10dif ata_generic pata_via libata ssb uhci_hcd via_sdmmc ehci_hcd usbcore scsi_mod tg3 pcmcia mmc_core pcmcia_core libphy thermal thermal_sys nls_base [last unloaded: scsi_wait_scan]
[  106.660952] 
[  106.660963] Pid: 2673, comm: modprobe Not tainted 2.6.37-rc7-self #5 MoutCook/20021,2959
[  106.660975] EIP: 0060:[<f90ed3df>] EFLAGS: 00010216 CPU: 0
[  106.660987] EIP is at hwrng_register+0x5f/0x14d [rng_core]
[  106.660996] EAX: ffffffff EBX: f829e26c ECX: f90ed589 EDX: f829e267
[  106.661006] ESI: 7268d4d7 EDI: f3c7eac0 EBP: f830e000 ESP: f72b9f14
[  106.661015]  DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
[  106.661025] Process modprobe (pid: 2673, ti=f72b8000 task=f3ce30c0 task.ti=f72b8000)
[  106.661033] Stack:
[  106.661037]  ffffffed 00000000 f830e023 f829e226 f829e290 c1003069 00000000 f829e290
[  106.661055]  00000000 f3c7eac0 00000001 c105f0d3 00000017 f829e2d8 0000000a f829ac04
[  106.661072]  f3c7eac0 00000025 f829e3e0 f829a000 000010d4 f829a86c f829a788 f829ae7c
[  106.661090] Call Trace:
[  106.661102]  [<f830e023>] ? mod_init+0x23/0x3b [via_rng2]
[  106.661114]  [<c1003069>] ? do_one_initcall+0x68/0x10f
[  106.661126]  [<c105f0d3>] ? sys_init_module+0xca5/0xe36
[  106.661188]  [<c1008b1f>] ? sysenter_do_call+0x12/0x28
[  106.661195] Code: 1b c8 8b 35 1c d6 0e f9 59 83 ee 1c eb 1d 8b 13 8b 06 e8 84 16 06 c8 85 c0 75 0a be ef ff ff ff e9 d3 00 00 00 8b 76 1c 83 ee 1c <8b> 46 1c 0f 18 00 90 81 fe 00 d6 0e f9 75 d4 83 3d 2c d8 0e f9 
[  106.661280] EIP: [<f90ed3df>] hwrng_register+0x5f/0x14d [rng_core] SS:ESP 0068:f72b9f14
[  106.661300] CR2: 000000007268d4f3
[  106.661309] ---[ end trace 4fa39662da4e519f ]---

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 482 bytes --]