Re: 2.6.17-mm2

Andrew Morton
2006-06-25T11:40:21Z

On Sun, 25 Jun 2006 13:19:25 +0200
"Michal Piotrowski" <michal.k.k.piotrowski@gmail.com> wrote:

> On 24/06/06, Andrew Morton <akpm@osdl.org> wrote:
> >
> > ftp://ftp.kernel.org/pub/linux/kernel/people/akpm/patches/2.6/2.6.17/2.6.17-mm2/
> >
>
> I found this in /var/log/messages.1
>
> Jun 24 22:29:52 ltg01-fedora kernel: BUG: unable to handle kernel
> paging request at virtual address 6b6b6b7b
> Jun 24 22:29:52 ltg01-fedora kernel: printing eip:
> Jun 24 22:29:52 ltg01-fedora kernel: c01174f2
> Jun 24 22:29:52 ltg01-fedora kernel: *pde = 00000000
> Jun 24 22:29:52 ltg01-fedora kernel: Oops: 0000 [#1]
> Jun 24 22:29:52 ltg01-fedora kernel: 4K_STACKS PREEMPT SMP
> Jun 24 22:29:52 ltg01-fedora kernel: last sysfs file:
> /devices/platform/i2c-9191/9191-0290/temp2_input
> Jun 24 22:29:52 ltg01-fedora kernel: Modules linked in: ipv6 w83627hf
> hwmon_vid hwmon i2c_isa af_packet ip_conntrack_netbios
> _ns ipt_REJECT xt_state ip_conntrack nfnetlink xt_tcpudp
> iptable_filter ip_tables x_tables p4_clockmod speedstep_lib binfmt_
> misc thermal processor fan container parport_pc parport nvram
> snd_intel8x0 snd_ac97_codec snd_ac97_bus snd_seq_dummy snd_seq
> _oss snd_seq_midi_event evdev snd_seq snd_seq_device snd_pcm_oss
> snd_mixer_oss snd_pcm snd_timer snd soundcore ide_cd snd_pa
> ge_alloc intel_agp i2c_i801 sk98lin skge agpgart cdrom rtc unix
> Jun 24 22:29:52 ltg01-fedora kernel: CPU: 0
> Jun 24 22:29:52 ltg01-fedora kernel: EIP: 0060:[<c01174f2>] Not
> tainted VLI
> Jun 24 22:29:52 ltg01-fedora kernel: EFLAGS: 00010096 (2.6.17-mm2 #51)
> Jun 24 22:29:52 ltg01-fedora kernel: EIP is at task_rq_lock+0x1d/0x57

OK, thanks. I expect the below will fix that (I've since dropped the
offending patches)

Begin forwarded message:

Date: Sun, 25 Jun 2006 01:31:12 +0200
From: Ingo Molnar <mingo@elte.hu>
To: Andrew Morton <akpm@osdl.org>
Subject: Re: more -mm2 troubles ...

* Ingo Molnar <mingo@elte.hu> wrote:

> hm, look at the sched_exit() => task_rq_lock() use-after-free crash
> below.
>
> I bet it was p->real_parent that got freed. (because at the point we
> call sched_exit() we already unlink ourselves from the parent so it is
> free to exit)
>
> We moved sched_exit() within exit.c to an unsafe place in mm2 - what
> patch was that?

patch below seems to fix it for me. mm2 is now stable.

Ingo

--------------
Subject: move sched_exit() back to under the tasklist_lock umbrella
From: Ingo Molnar <mingo@elte.hu>

seems like sched_exit() cannot be moved to a later stage just yet.
Needs more investigation.

Signed-off-by: Ingo Molnar <mingo@elte.hu>
---
kernel/exit.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)

Index: linux/kernel/exit.c
===================================================================
--- linux.orig/kernel/exit.c
+++ linux/kernel/exit.c
@@ -827,6 +827,7 @@ static void exit_notify(struct task_stru
state = EXIT_DEAD;
tsk->exit_state = state;

+ sched_exit(tsk);
write_unlock_irq(&tasklist_lock);

list_for_each_safe(_p, _n, &ptrace_dead) {
@@ -952,8 +953,6 @@ fastcall NORET_TYPE void do_exit(long co
if (tsk->splice_pipe)
__free_pipe_info(tsk->splice_pipe);

- sched_exit(tsk);
-
/* PF_DEAD causes final put_task_struct after we schedule. */
preempt_disable();
BUG_ON(tsk->flags & PF_DEAD);