public inbox for linux-kernel@vger.kernel.org
 help / color / mirror / Atom feed
* shm updates broke UML
@ 2011-08-01 13:41 Richard Weinberger
  2011-08-01 13:49 ` Vasiliy Kulikov
  0 siblings, 1 reply; 12+ messages in thread
From: Richard Weinberger @ 2011-08-01 13:41 UTC (permalink / raw)
  To: segoon
  Cc: serge.hallyn, torvalds, akpm, linux-kernel, user-mode-linux-devel,
	toralf.foerster

Vasiliy,

5774ed01 (shm: handle separate PID namespaces case)
b34a6b1d (ipc: introduce shm_rmid_forced sysctl)
4c677e2e (shm: optimize locking and ipc_namespace getting)

broke UML on i386.
It crashes while starting up by SIGSEGV.
exit_shm() seems to be the evil doer.

Reverting all three patches make UML work again.

Commit 5774ed01 removed the !ns->shm_rmid_forced check, maybe this is wrong?
The attached patch cures the problem, but I'm sure it's wrong. 8)

---cut---
#13 0x08067efb in hard_handler (sig=11) at arch/um/os-Linux/sys-i386/signal.c:12
#14 <signal handler called>
#15 __list_add (sem=0x824cc98, subclass=0) at include/linux/list.h:44
#16 list_add_tail (sem=0x824cc98, subclass=0) at include/linux/list.h:76
#17 __down_write_nested (sem=0x824cc98, subclass=0) at lib/rwsem-spinlock.c:232
#18 0x081c7ba1 in __down_write (sem=0x824cc98) at lib/rwsem-spinlock.c:252
#19 0x081c74a3 in down_write (sem=0x824cc98) at kernel/rwsem.c:51
#20 0x08139913 in exit_shm (task=0x9c73b60) at ipc/shm.c:308
#21 0x08075649 in do_exit (code=0) at kernel/exit.c:983
#22 0x08081dd2 in ____call_usermodehelper (data=0x9c6bce0) at kernel/kmod.c:187
#23 0x08065c18 in run_kernel_thread (fn=0x8081ce4 <____call_usermodehelper>, arg=0x9c6bce0, 
jmp_ptr=0x9c73d94)
    at arch/um/os-Linux/process.c:268
#24 0x080588cb in new_thread_handler () at arch/um/kernel/process.c:153
#25 0x00000000 in ?? ()
---cut---

Not-Signed-off-by: Richard Weinberger <richard@nod.at>
---
diff --git a/ipc/shm.c b/ipc/shm.c
index 9fb044f3b..2196a0d 100644
--- a/ipc/shm.c
+++ b/ipc/shm.c
@@ -304,6 +304,9 @@ void exit_shm(struct task_struct *task)
 {
 	struct ipc_namespace *ns = task->nsproxy->ipc_ns;
 
+	if(!ns->shm_rmid_forced)
+		return;
+
 	/* Destroy all already created segments, but not mapped yet */
 	down_write(&shm_ids(ns).rw_mutex);
 	if (&shm_ids(ns).in_use)

^ permalink raw reply related	[flat|nested] 12+ messages in thread

* Re: shm updates broke UML
  2011-08-01 13:41 shm updates broke UML Richard Weinberger
@ 2011-08-01 13:49 ` Vasiliy Kulikov
  2011-08-01 14:04   ` Richard Weinberger
  2011-08-01 16:01   ` Marc Zyngier
  0 siblings, 2 replies; 12+ messages in thread
From: Vasiliy Kulikov @ 2011-08-01 13:49 UTC (permalink / raw)
  To: Richard Weinberger
  Cc: serge.hallyn, torvalds, akpm, linux-kernel, user-mode-linux-devel,
	toralf.foerster

Hi Richard,

On Mon, Aug 01, 2011 at 15:41 +0200, Richard Weinberger wrote:
> 5774ed01 (shm: handle separate PID namespaces case)
> b34a6b1d (ipc: introduce shm_rmid_forced sysctl)
> 4c677e2e (shm: optimize locking and ipc_namespace getting)
> 
> broke UML on i386.
> It crashes while starting up by SIGSEGV.
> exit_shm() seems to be the evil doer.

I was reported 20 mins ago that it's reproducable on MIPS too.

> Reverting all three patches make UML work again.

Can you confirm that 5774ed01 breaks the boot? (it is for MIPS)


> Commit 5774ed01 removed the !ns->shm_rmid_forced check, maybe this is wrong?

No, it's not the reason.

> ---cut---
> #13 0x08067efb in hard_handler (sig=11) at arch/um/os-Linux/sys-i386/signal.c:12
> #14 <signal handler called>
> #15 __list_add (sem=0x824cc98, subclass=0) at include/linux/list.h:44
> #16 list_add_tail (sem=0x824cc98, subclass=0) at include/linux/list.h:76
> #17 __down_write_nested (sem=0x824cc98, subclass=0) at lib/rwsem-spinlock.c:232
> #18 0x081c7ba1 in __down_write (sem=0x824cc98) at lib/rwsem-spinlock.c:252
> #19 0x081c74a3 in down_write (sem=0x824cc98) at kernel/rwsem.c:51
> #20 0x08139913 in exit_shm (task=0x9c73b60) at ipc/shm.c:308
> #21 0x08075649 in do_exit (code=0) at kernel/exit.c:983
> #22 0x08081dd2 in ____call_usermodehelper (data=0x9c6bce0) at kernel/kmod.c:187
> #23 0x08065c18 in run_kernel_thread (fn=0x8081ce4 <____call_usermodehelper>, arg=0x9c6bce0, 
> jmp_ptr=0x9c73d94)
>     at arch/um/os-Linux/process.c:268
> #24 0x080588cb in new_thread_handler () at arch/um/kernel/process.c:153
> #25 0x00000000 in ?? ()
> ---cut---

Can you post the whole oops message?  I'd want to see what pointer is
NULL.

Thanks,

-- 
Vasiliy Kulikov
http://www.openwall.com - bringing security into open computing environments

^ permalink raw reply	[flat|nested] 12+ messages in thread

* Re: shm updates broke UML
  2011-08-01 13:49 ` Vasiliy Kulikov
@ 2011-08-01 14:04   ` Richard Weinberger
  2011-08-01 16:01   ` Marc Zyngier
  1 sibling, 0 replies; 12+ messages in thread
From: Richard Weinberger @ 2011-08-01 14:04 UTC (permalink / raw)
  To: Vasiliy Kulikov
  Cc: serge.hallyn, torvalds, akpm, linux-kernel, user-mode-linux-devel,
	toralf.foerster

Hi Vasiliy,

On Montag 01 August 2011 15:49:11 Vasiliy Kulikov wrote:
> Hi Richard,
> 
> On Mon, Aug 01, 2011 at 15:41 +0200, Richard Weinberger wrote:
> > 5774ed01 (shm: handle separate PID namespaces case)
> > b34a6b1d (ipc: introduce shm_rmid_forced sysctl)
> > 4c677e2e (shm: optimize locking and ipc_namespace getting)
> > 
> > broke UML on i386.
> > It crashes while starting up by SIGSEGV.
> > exit_shm() seems to be the evil doer.
> 
> I was reported 20 mins ago that it's reproducable on MIPS too.
> 
> > Reverting all three patches make UML work again.
> 
> Can you confirm that 5774ed01 breaks the boot? (it is for MIPS)

Yes. But I also had to revert 4c677e2e because 5774ed01 depends on it...

> Can you post the whole oops message?  I'd want to see what pointer is
> NULL.

UML is not that friendly in reporting NULL pointers :)
EAX and ECX are NULL.

---cut---

$ ./linux earlyprintk
Locating the bottom of the address space ... 0x10000
Locating the top of the address space ... 0xffffd000
Core dump limits :
        soft - 0
        hard - NONE
Checking that ptrace can change system call numbers...OK
Checking syscall emulation patch for ptrace...OK
Checking advanced syscall emulation patch for ptrace...OK
Checking for tmpfs mount on /dev/shm...OK
Checking PROT_EXEC mmap in /tmp/...OK
Checking for the skas3 patch in the host:
  - /proc/mm...not found: No such file or directory
  - PTRACE_FAULTINFO...not found
  - PTRACE_LDT...not found
UML running in SKAS0 mode
bootconsole [earlycon0] enabled
PID hash table entries: 128 (order: -3, 512 bytes)
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
Memory: 29896k available
NR_IRQS:15
Calibrating delay loop... 3173.58 BogoMIPS (lpj=15867904)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
Checking for host processor cmov support...Yes
Checking that host ptys support output SIGIO...Yes
Checking that host ptys support SIGIO on close...No, enabling workaround

EIP: 0023:[<081c7b8a>] CPU: 0 Not tainted ESP: 002b:09c74f00 EFLAGS: 00010206
    Not tainted
EAX: 00000000 EBX: 0824cc9c ECX: 00000000 EDX: 09c74f00
ESI: 09c73b60 EDI: 00000001 EBP: 09c74f20 DS: 002b ES: 002b
0823fb70:  [<0806b6e8>] show_regs+0xc5/0xcd
0823fb9c:  [<0805a52a>] segv+0x5b/0x234
0823fc40:  [<0805a74c>] segv_handler+0x49/0x53
0823fc68:  [<08066776>] sig_handler_common+0x61/0x70
0823fce0:  [<08066851>] sig_handler+0x31/0x40
0823fcec:  [<0806653e>] handle_signal+0x50/0x7d
0823fd0c:  [<08067efb>] hard_handler+0xf/0x14
0823fd1c:  [<ffffe400>] 0xffffe400

Kernel panic - not syncing: Segfault with no mm
0823fb4c:  [<081c63da>] dump_stack+0x1c/0x20
0823fb64:  [<081c642b>] panic+0x4d/0x13e
0823fb98:  [<0805a5d9>] segv+0x10a/0x234
0823fc40:  [<0805a74c>] segv_handler+0x49/0x53
0823fc68:  [<08066776>] sig_handler_common+0x61/0x70
0823fce0:  [<08066851>] sig_handler+0x31/0x40
0823fcec:  [<0806653e>] handle_signal+0x50/0x7d
0823fd0c:  [<08067efb>] hard_handler+0xf/0x14
0823fd1c:  [<ffffe400>] 0xffffe400


EIP: 0023:[<ffffe430>] CPU: 0 Not tainted ESP: 002b:ffaae1c8 EFLAGS: 00000296
    Not tainted
EAX: 00000000 EBX: 000017b4 ECX: 00000013 EDX: 000017b4
ESI: 000017a6 EDI: 0000003d EBP: ffaae1f4 DS: 002b ES: 002b
0823fafc:  [<0806b6e8>] show_regs+0xc5/0xcd
0823fb28:  [<0805a97b>] panic_exit+0x25/0x3b
0823fb3c:  [<0808a9c4>] notifier_call_chain+0x25/0x4a
0823fb64:  [<0808aa17>] atomic_notifier_call_chain+0x15/0x17
0823fb74:  [<081c6446>] panic+0x68/0x13e
0823fb98:  [<0805a5d9>] segv+0x10a/0x234
0823fc40:  [<0805a74c>] segv_handler+0x49/0x53
0823fc68:  [<08066776>] sig_handler_common+0x61/0x70
0823fce0:  [<08066851>] sig_handler+0x31/0x40
0823fcec:  [<0806653e>] handle_signal+0x50/0x7d
0823fd0c:  [<08067efb>] hard_handler+0xf/0x14
0823fd1c:  [<ffffe400>] 0xffffe400

---cut---

Thanks,
//richard

^ permalink raw reply	[flat|nested] 12+ messages in thread

* Re: shm updates broke UML
  2011-08-01 13:49 ` Vasiliy Kulikov
  2011-08-01 14:04   ` Richard Weinberger
@ 2011-08-01 16:01   ` Marc Zyngier
  2011-08-01 17:10     ` Vasiliy Kulikov
  1 sibling, 1 reply; 12+ messages in thread
From: Marc Zyngier @ 2011-08-01 16:01 UTC (permalink / raw)
  To: Vasiliy Kulikov
  Cc: Richard Weinberger, serge.hallyn, torvalds, akpm, linux-kernel,
	user-mode-linux-devel, toralf.foerster


On Mon, 1 Aug 2011 17:49:11 +0400, Vasiliy Kulikov <segoon@openwall.com>
wrote:
> Hi Richard,
> 
> On Mon, Aug 01, 2011 at 15:41 +0200, Richard Weinberger wrote:
>> 5774ed01 (shm: handle separate PID namespaces case)
>> b34a6b1d (ipc: introduce shm_rmid_forced sysctl)
>> 4c677e2e (shm: optimize locking and ipc_namespace getting)
>> 
>> broke UML on i386.
>> It crashes while starting up by SIGSEGV.
>> exit_shm() seems to be the evil doer.
> 
> I was reported 20 mins ago that it's reproducable on MIPS too.
> 
>> Reverting all three patches make UML work again.
> 
> Can you confirm that 5774ed01 breaks the boot? (it is for MIPS)

It also breaks ARM (at least 11MPCore and Cortex A9).
The same workaround gets the kernel booting again.

For the record:
[...]
CPU: Testing write buffer coherency: ok
Calibrating local timer... 104.99MHz.
CPU1: Booted secondary processor
CPU1: Unknown IPI message 0x1
CPU2: Booted secondary processor
CPU2: Unknown IPI message 0x1
CPU3: Booted secondary processor
CPU3: Unknown IPI message 0x1
Brought up 4 CPUs
SMP: Total of 4 processors activated (333.92 BogoMIPS).
Unable to handle kernel NULL pointer dereference at virtual address
00000000
NET: Registered protocol family 16
pgd = c0004000
[00000000] *pgd=00000000
Internal error: Oops: 805 [#1] SMP
Modules linked in:
CPU: 2    Not tainted  (3.0.0-next-20110801+ #801)
PC is at __down_write_nested+0x88/0xe0
LR is at __down_write_nested+0x18/0xe0
pc : [<c0320090>]    lr : [<c0320020>]    psr: 60000093
sp : df883f68  ip : 00000000  fp : 00000000
r10: 00000000  r9 : 00000000  r8 : c04474dc
r7 : c04474d8  r6 : 00000000  r5 : 00000002  r4 : df884000
r3 : df884008  r2 : 00000000  r1 : 60000013  r0 : c04474e0
Flags: nZCv  IRQs off  FIQs on  Mode SVC_32  ISA ARM  Segment user
Control: 00c5787f  Table: 7000400a  DAC: 00000015
Process kworker/u:0 (pid: 18, stack limit = 0xdf882270)
Stack: (0xdf883f68 to 0xdf884000)
3f60:                   c04474e0 df8b0004 df884000 00000002 c04474d8
c0447474
3f80: 00000000 00000000 df8b0000 c015da08 df884000 00000000 00000000
c002e550
3fa0: 00000000 00000000 df882000 00000001 00000000 00000000 00000000
00000000
3fc0: 00000000 df8238c0 df8a7000 fffffffe 00000013 00000000 00000000
00000000
3fe0: 00000000 c003eaac df8238c0 c003e970 c000f630 c000f630 00000000
00000000
[<c0320090>] (__down_write_nested+0x88/0xe0) from [<c015da08>]
(exit_shm+0x28/0x48)
[<c015da08>] (exit_shm+0x28/0x48) from [<c002e550>] (do_exit+0x59c/0x750)
[<c002e550>] (do_exit+0x59c/0x750) from [<c003eaac>]
(____call_usermodehelper+0x13c/0x154)
[<c003eaac>] (____call_usermodehelper+0x13c/0x154) from [<c000f630>]
(kernel_thread_exit+0x0/0x8)
Code: 1afffffa e597c00c e58d0000 e587d00c (e58cd000) 
---[ end trace 1b75b31a2719ed1c ]---

        M.
-- 
Who you jivin' with that Cosmik Debris?

^ permalink raw reply	[flat|nested] 12+ messages in thread

* Re: shm updates broke UML
  2011-08-01 16:01   ` Marc Zyngier
@ 2011-08-01 17:10     ` Vasiliy Kulikov
  2011-08-01 17:19       ` Marc Zyngier
  2011-08-01 17:20       ` Richard Weinberger
  0 siblings, 2 replies; 12+ messages in thread
From: Vasiliy Kulikov @ 2011-08-01 17:10 UTC (permalink / raw)
  To: Marc Zyngier
  Cc: Richard Weinberger, serge.hallyn, torvalds, akpm, linux-kernel,
	user-mode-linux-devel, toralf.foerster

On Mon, Aug 01, 2011 at 18:01 +0200, Marc Zyngier wrote:
> It also breaks ARM (at least 11MPCore and Cortex A9).
> The same workaround gets the kernel booting again.

Can you please apply this patch and show the output? 
I suppose all numbers will be nonNULL and the last is NULL.

diff --git a/ipc/shm.c b/ipc/shm.c
index bf46636..8e48ad8 100644
--- a/ipc/shm.c
+++ b/ipc/shm.c
@@ -304,6 +304,12 @@ void exit_shm(struct task_struct *task)
 {
 	struct ipc_namespace *ns = task->nsproxy->ipc_ns;
 
+	pr_err("ns = %p, ids = %p",
+		ns, ns ? &shm_ids(ns) : (void*)(-2));
+	pr_err("wait_list = %p\n", ns ? &shm_ids(ns) ?
+		 &shm_ids(ns).rw_mutex.wait_list : (void*)(-1) : (void*)(-2));
+	pr_err("next = %p\n", shm_ids(ns).rw_mutex.wait_list.next);
+
 	/* Destroy all already created segments, but not mapped yet */
 	down_write(&shm_ids(ns).rw_mutex);
 	if (&shm_ids(ns).in_use)
--

^ permalink raw reply related	[flat|nested] 12+ messages in thread

* Re: shm updates broke UML
  2011-08-01 17:10     ` Vasiliy Kulikov
@ 2011-08-01 17:19       ` Marc Zyngier
  2011-08-01 17:24         ` Vasiliy Kulikov
  2011-08-01 17:20       ` Richard Weinberger
  1 sibling, 1 reply; 12+ messages in thread
From: Marc Zyngier @ 2011-08-01 17:19 UTC (permalink / raw)
  To: Vasiliy Kulikov
  Cc: Richard Weinberger, serge.hallyn, torvalds, akpm, linux-kernel,
	user-mode-linux-devel, toralf.foerster


On Mon, 1 Aug 2011 21:10:42 +0400, Vasiliy Kulikov <segoon@openwall.com>
wrote:
> On Mon, Aug 01, 2011 at 18:01 +0200, Marc Zyngier wrote:
>> It also breaks ARM (at least 11MPCore and Cortex A9).
>> The same workaround gets the kernel booting again.
> 
> Can you please apply this patch and show the output? 
> I suppose all numbers will be nonNULL and the last is NULL.

Here you go (sorry about the line wrapping, damned webmail...):

Calibrating local timer... 104.99MHz.
CPU1: Booted secondary processor
CPU1: Unknown IPI message 0x1
CPU2: Booted secondary processor
CPU2: Unknown IPI message 0x1
CPU3: Booted secondary processor
CPU3: Unknown IPI message 0x1
Brought up 4 CPUs
SMP: Total of 4 processors activated (333.41 BogoMIPS).
ns = c0447474, ids = c04474d0
ns = c0447474, ids = c04474d0
wait_list = c04474e0
next =   (null)
Unable to handle kernel NULL pointer dereference at virtual address
00000000
pgd = c0004000
[00000000] *pgd=00000000
Internal error: Oops: 805 [#1] SMP
Modules linked in:
CPU: 3    Not tainted  (3.0.0-next-20110801+ #808)
PC is at __down_write_nested+0x88/0xe0
LR is at __down_write_nested+0x18/0xe0
pc : [<c0320090>]    lr : [<c0320020>]    psr: 60000093
sp : df8d1f68  ip : 00000000  fp : 00000000
r10: 00000000  r9 : 00000000  r8 : c04474dc
r7 : c04474d8  r6 : 00000000  r5 : 00000002  r4 : df884380
r3 : df884388  r2 : 00000000  r1 : 60000013  r0 : c04474e0
Flags: nZCv  IRQs off  FIQs on  Mode SVC_32  ISA ARM  Segment user
Control: 00c5787f  Table: 7000400a  DAC: 00000015
Process kworker/u:0 (pid: 19, stack limit = 0xdf8d0270)
Stack: (0xdf8d1f68 to 0xdf8d2000)
1f60:                   c04474e0 c031dae0 df884380 00000002 c0447474
c04474d8
1f80: 00000000 00000000 df8b0200 c015d9e4 df884380 00000000 00000000
c002e550
1fa0: 00000000 00000000 df8d0000 00000001 00000000 00000000 00000000
00000000
1fc0: 00000000 df823a00 df8d2000 fffffffe 00000013 00000000 00000000
00000000
1fe0: 00000000 c003eaac df823a00 c003e970 c000f630 c000f630 55555555
55555555
[<c0320090>] (__down_write_nested+0x88/0xe0) from [<c015d9e4>]
(exit_shm+0x48/0x8c)
[<c015d9e4>] (exit_shm+0x48/0x8c) from [<c002e550>] (do_exit+0x59c/0x750)
[<c002e550>] (do_exit+0x59c/0x750) from [<c003eaac>]
(____call_usermodehelper+0x13c/0x154)
[<c003eaac>] (____call_usermodehelper+0x13c/0x154) from [<c000f630>]
(kernel_thread_exit+0x0/0x8)
Code: 1afffffa e597c00c e58d0000 e587d00c (e58cd000) 
---[ end trace 1b75b31a2719ed1c ]---
Fixing recursive fault but reboot is needed!
NET: Registered protocol family 16
ns = c0447474, ids = c04474d0
wait_list = c04474e0
next =   (null)
ns = c0447474, ids = c04474d0
wait_list = c04474e0
next =   (null)
ns = c0447474, ids = c04474d0
wait_list = c04474e0
next =   (null)
wait_list = c04474e0
next =   (null)

-- 
Fast, cheap, reliable. Pick two.

^ permalink raw reply	[flat|nested] 12+ messages in thread

* Re: shm updates broke UML
  2011-08-01 17:10     ` Vasiliy Kulikov
  2011-08-01 17:19       ` Marc Zyngier
@ 2011-08-01 17:20       ` Richard Weinberger
  1 sibling, 0 replies; 12+ messages in thread
From: Richard Weinberger @ 2011-08-01 17:20 UTC (permalink / raw)
  To: Vasiliy Kulikov
  Cc: Marc Zyngier, serge.hallyn, torvalds, akpm, linux-kernel,
	user-mode-linux-devel, toralf.foerster

On Montag 01 August 2011 19:10:42 Vasiliy Kulikov wrote:
> On Mon, Aug 01, 2011 at 18:01 +0200, Marc Zyngier wrote:
> > It also breaks ARM (at least 11MPCore and Cortex A9).
> > The same workaround gets the kernel booting again.
> 
> Can you please apply this patch and show the output?
> I suppose all numbers will be nonNULL and the last is NULL.

true. :-)

ns = 0824cc44, ids = 0824cc90
wait_list = 0824cc9c
next =   (null)

Thanks,
//richard

^ permalink raw reply	[flat|nested] 12+ messages in thread

* Re: shm updates broke UML
  2011-08-01 17:19       ` Marc Zyngier
@ 2011-08-01 17:24         ` Vasiliy Kulikov
  2011-08-01 17:32           ` Vasiliy Kulikov
  2011-08-04 11:04           ` Toralf Förster
  0 siblings, 2 replies; 12+ messages in thread
From: Vasiliy Kulikov @ 2011-08-01 17:24 UTC (permalink / raw)
  To: Marc Zyngier
  Cc: Richard Weinberger, serge.hallyn, torvalds, akpm, linux-kernel,
	user-mode-linux-devel, toralf.foerster

On Mon, Aug 01, 2011 at 19:19 +0200, Marc Zyngier wrote:
> Here you go (sorry about the line wrapping, damned webmail...):

Thank you!  Now I see that the problem is rw_mutex is not initialized:

	down_write(&shm_ids(ns).rw_mutex);

void __sched __down_write_nested(struct rw_semaphore *sem, int subclass)
{
    ...
	if (sem->activity == 0 && list_empty(&sem->wait_list)) {
                                         ^^^^^^^^^^^^^^^ is NULL

Wtf - ipc namespace should be fully initialized for the moment of
threads run...

> Calibrating local timer... 104.99MHz.
> CPU1: Booted secondary processor
> CPU1: Unknown IPI message 0x1
> CPU2: Booted secondary processor
> CPU2: Unknown IPI message 0x1
> CPU3: Booted secondary processor
> CPU3: Unknown IPI message 0x1
> Brought up 4 CPUs
> SMP: Total of 4 processors activated (333.41 BogoMIPS).
> ns = c0447474, ids = c04474d0
> ns = c0447474, ids = c04474d0
> wait_list = c04474e0
> next =   (null)
           ^^^^^^

-- 
Vasiliy Kulikov
http://www.openwall.com - bringing security into open computing environments

^ permalink raw reply	[flat|nested] 12+ messages in thread

* Re: shm updates broke UML
  2011-08-01 17:24         ` Vasiliy Kulikov
@ 2011-08-01 17:32           ` Vasiliy Kulikov
  2011-08-01 17:43             ` Marc Zyngier
  2011-08-04 11:04           ` Toralf Förster
  1 sibling, 1 reply; 12+ messages in thread
From: Vasiliy Kulikov @ 2011-08-01 17:32 UTC (permalink / raw)
  To: Marc Zyngier
  Cc: Richard Weinberger, serge.hallyn, torvalds, akpm, linux-kernel,
	user-mode-linux-devel, toralf.foerster

Marc,

On Mon, Aug 01, 2011 at 21:24 +0400, Vasiliy Kulikov wrote:
> On Mon, Aug 01, 2011 at 19:19 +0200, Marc Zyngier wrote:
> > Here you go (sorry about the line wrapping, damned webmail...):
> 
> Thank you!  Now I see that the problem is rw_mutex is not initialized:
> 
> 	down_write(&shm_ids(ns).rw_mutex);
> 
> void __sched __down_write_nested(struct rw_semaphore *sem, int subclass)
> {
>     ...
> 	if (sem->activity == 0 && list_empty(&sem->wait_list)) {
>                                          ^^^^^^^^^^^^^^^ is NULL
> 
> Wtf - ipc namespace should be fully initialized for the moment of
> threads run...

Does ARM try to run _any_ threads before do_initcalls()?  IPC
initialization is initcall, so any thread before do_initcalls() is a
dependency bug.

static void __init do_basic_setup(void)
{
	cpuset_init_smp();
	usermodehelper_init();
	init_tmpfs();
	driver_init();
	init_irq_proc();
	do_ctors();
	do_initcalls(); <<<<
}

Thanks,

-- 
Vasiliy Kulikov
http://www.openwall.com - bringing security into open computing environments

^ permalink raw reply	[flat|nested] 12+ messages in thread

* Re: shm updates broke UML
  2011-08-01 17:32           ` Vasiliy Kulikov
@ 2011-08-01 17:43             ` Marc Zyngier
  0 siblings, 0 replies; 12+ messages in thread
From: Marc Zyngier @ 2011-08-01 17:43 UTC (permalink / raw)
  To: Vasiliy Kulikov
  Cc: Richard Weinberger, serge.hallyn@canonical.com,
	torvalds@linux-foundation.org, akpm@linux-foundation.org,
	linux-kernel@vger.kernel.org,
	user-mode-linux-devel@lists.sourceforge.net,
	toralf.foerster@gmx.de

On 01/08/11 18:32, Vasiliy Kulikov wrote:
> Marc,
> 
> On Mon, Aug 01, 2011 at 21:24 +0400, Vasiliy Kulikov wrote:
>> On Mon, Aug 01, 2011 at 19:19 +0200, Marc Zyngier wrote:
>>> Here you go (sorry about the line wrapping, damned webmail...):
>>
>> Thank you!  Now I see that the problem is rw_mutex is not initialized:
>>
>> 	down_write(&shm_ids(ns).rw_mutex);
>>
>> void __sched __down_write_nested(struct rw_semaphore *sem, int subclass)
>> {
>>     ...
>> 	if (sem->activity == 0 && list_empty(&sem->wait_list)) {
>>                                          ^^^^^^^^^^^^^^^ is NULL
>>
>> Wtf - ipc namespace should be fully initialized for the moment of
>> threads run...
> 
> Does ARM try to run _any_ threads before do_initcalls()?  IPC
> initialization is initcall, so any thread before do_initcalls() is a
> dependency bug.

I don't think it does anything different from other architectures.
The crash I'm observing seem to be from kworker, which is created from
an early_initcall (kernel/workqueue.c).

This looks very much like a generic problem to me.

	M.
-- 
Jazz is not dead. It just smells funny...


^ permalink raw reply	[flat|nested] 12+ messages in thread

* Re: shm updates broke UML
  2011-08-01 17:24         ` Vasiliy Kulikov
  2011-08-01 17:32           ` Vasiliy Kulikov
@ 2011-08-04 11:04           ` Toralf Förster
  2011-08-04 11:16             ` Vasiliy Kulikov
  1 sibling, 1 reply; 12+ messages in thread
From: Toralf Förster @ 2011-08-04 11:04 UTC (permalink / raw)
  To: Vasiliy Kulikov
  Cc: Marc Zyngier, Richard Weinberger, serge.hallyn, torvalds, akpm,
	linux-kernel, user-mode-linux-devel

issue solved for the UML, tested linux-v3.0-7347-g288d5ab whcih works fine.

BTW is there a special commit id dealing with this bug or was it solved as a 
side effect of another commit ?

Vasiliy Kulikov wrote at 19:24:52
> On Mon, Aug 01, 2011 at 19:19 +0200, Marc Zyngier wrote:
> > Here you go (sorry about the line wrapping, damned webmail...):
> Thank you!  Now I see that the problem is rw_mutex is not initialized:
> 
> 	down_write(&shm_ids(ns).rw_mutex);
> 
> void __sched __down_write_nested(struct rw_semaphore *sem, int subclass)
> {
>     ...
> 	if (sem->activity == 0 && list_empty(&sem->wait_list)) {
>                                          ^^^^^^^^^^^^^^^ is NULL
> 
> Wtf - ipc namespace should be fully initialized for the moment of
> threads run...
> 
> > Calibrating local timer... 104.99MHz.
> > CPU1: Booted secondary processor
> > CPU1: Unknown IPI message 0x1
> > CPU2: Booted secondary processor
> > CPU2: Unknown IPI message 0x1
> > CPU3: Booted secondary processor
> > CPU3: Unknown IPI message 0x1
> > Brought up 4 CPUs
> > SMP: Total of 4 processors activated (333.41 BogoMIPS).
> > ns = c0447474, ids = c04474d0
> > ns = c0447474, ids = c04474d0
> > wait_list = c04474e0
> > next =   (null)
> 
>            ^^^^^^


-- 
MfG/Sincerely
Toralf Förster
pgp finger print: 7B1A 07F4 EC82 0F90 D4C2 8936 872A E508 7DB6 9DA3

^ permalink raw reply	[flat|nested] 12+ messages in thread

* Re: shm updates broke UML
  2011-08-04 11:04           ` Toralf Förster
@ 2011-08-04 11:16             ` Vasiliy Kulikov
  0 siblings, 0 replies; 12+ messages in thread
From: Vasiliy Kulikov @ 2011-08-04 11:16 UTC (permalink / raw)
  To: Toralf Förster
  Cc: Marc Zyngier, Richard Weinberger, serge.hallyn, torvalds, akpm,
	linux-kernel, user-mode-linux-devel

On Thu, Aug 04, 2011 at 13:04 +0200, Toralf Förster wrote:
> issue solved for the UML, tested linux-v3.0-7347-g288d5ab whcih works fine.
> 
> BTW is there a special commit id dealing with this bug or was it solved as a 
> side effect of another commit ?

The oops is fixed by 298507d4d2cff2248e84afcf646b697301294442 (shm:
optimize exit_shm()), but the dependency problem (tasks spawned by the
kernel are started with uninitialized namespaces) is not solved yet,
AFAICS.

Thanks,

-- 
Vasiliy Kulikov
http://www.openwall.com - bringing security into open computing environments

^ permalink raw reply	[flat|nested] 12+ messages in thread

end of thread, other threads:[~2011-08-04 11:16 UTC | newest]

Thread overview: 12+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2011-08-01 13:41 shm updates broke UML Richard Weinberger
2011-08-01 13:49 ` Vasiliy Kulikov
2011-08-01 14:04   ` Richard Weinberger
2011-08-01 16:01   ` Marc Zyngier
2011-08-01 17:10     ` Vasiliy Kulikov
2011-08-01 17:19       ` Marc Zyngier
2011-08-01 17:24         ` Vasiliy Kulikov
2011-08-01 17:32           ` Vasiliy Kulikov
2011-08-01 17:43             ` Marc Zyngier
2011-08-04 11:04           ` Toralf Förster
2011-08-04 11:16             ` Vasiliy Kulikov
2011-08-01 17:20       ` Richard Weinberger

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox