From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753979AbdJIIM7 (ORCPT ); Mon, 9 Oct 2017 04:12:59 -0400 Received: from mga01.intel.com ([192.55.52.88]:38603 "EHLO mga01.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753728AbdJIIM5 (ORCPT ); Mon, 9 Oct 2017 04:12:57 -0400 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.42,499,1500966000"; d="scan'208";a="908095973" Date: Mon, 9 Oct 2017 16:10:50 +0800 From: Ye Xiaolong To: Linus Torvalds Cc: NeilBrown , Tejun Heo , Jens Axboe , Christoph Hellwig , Ming Lei , LKML , LKP Subject: Re: [lkp-robot] [blk] 47e0fb461f: BUG:unable_to_handle_kernel Message-ID: <20171009081050.GA31518@yexl-desktop> References: <20170921024603.GB8188@yexl-desktop> <87a81or0u2.fsf@notabene.neil.brown.name> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.21 (2010-09-15) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 09/30, Linus Torvalds wrote: >On Thu, Sep 21, 2017 at 12:02 AM, NeilBrown wrote: >> >> I think it is crashing in >> static inline bool ata_is_host_link(const struct ata_link *link) >> { >> return link == &link->ap->link || link == link->ap->slave_link; >> } > >Yes. The code is > > 1a: 8b 3a mov (%edx),%edi > 1c: 8d 8f 40 16 00 00 lea 0x1640(%edi),%ecx > 22: 39 ca cmp %ecx,%edx > 24: 74 49 je 0x6f > 26: b9 01 00 00 00 mov $0x1,%ecx > 2b:* 39 97 80 24 00 00 cmp %edx,0x2480(%edi) <-- trapping instruction > 31: 74 3c je 0x6f > >and that first "je" is the test for "link == &link->ap->link" (which >only takes the address relative to "link->ap" - thus the "lea"), and >that cmp that oopses is indeed loading that actual slave_link value. > >So I agree. "link->ap" is NULL for some odd reason. > >Hmm. Absolutely nothing has changed in libata-core.c recently, >certainly not that async_port_probe() thing. > >So I suspect either it's just a timing difference, or it's some >unrelated memory corruption. > >Xiaolong, I see that you have SLUB_DEBUG and SLUB_DEBUG_ON enabled, >but wonder if you can recreate this with DEBUG_PAGEALLOC and/or >DEBUG_OBJECTS enabled too? > Sorry for the late, just come back from vacation. I retested with with DEBUG_PAGEALLOC and DEBUG_OBJECTS enabled for both commit 47e0fb461f and commit 011067b056, and both showed the ata_dev_next crash issue, so commit 47e0fb461f should be irrelevant, sorry for the noise. Thanks, Xiaolong >Tejun, any ideas? The original report is at > > https://lkml.org/lkml/2017/9/20/939 > >in case you don't see it in your inbox from lkml. > > Linus