From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751433AbcBZJXX (ORCPT ); Fri, 26 Feb 2016 04:23:23 -0500 Received: from mail-wm0-f51.google.com ([74.125.82.51]:35125 "EHLO mail-wm0-f51.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750867AbcBZJXT (ORCPT ); Fri, 26 Feb 2016 04:23:19 -0500 Subject: Re: BUG: unable to handle kernel paging request from pty_write [was: Linux 4.4.2] To: Linus Torvalds References: <20160217203730.GA14820@kroah.com> <56CED373.9060603@suse.cz> <56CF4A83.3040408@hurleysoftware.com> <56CF64C9.8050705@hurleysoftware.com> <56CF72EA.9040009@suse.cz> <56D01331.5030401@suse.cz> Cc: Peter Hurley , Greg KH , Linux Kernel Mailing List , Andrew Morton , stable , lwn@lwn.net, Steven Rostedt From: Jiri Slaby X-Enigmail-Draft-Status: N1110 Message-ID: <56D01984.5010607@suse.cz> Date: Fri, 26 Feb 2016 10:23:16 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.6.0 MIME-Version: 1.0 In-Reply-To: <56D01331.5030401@suse.cz> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 02/26/2016, 09:56 AM, Jiri Slaby wrote: >> I really don't see how it would happen here - that code doesn't look >> particularly odd. Funnily enough, this is what I got today, when booting 4.4.2 in qemu VM on my host. RIP crashing (ffffffff810f28d5) is action->dev_id dereference in handle_irq_event_percpu. Look: 0xffffffff810f28d5 <+101>: mov 0x8(%rbx),%rsi 0xffffffff810f28d9 <+105>: mov %r12d,%edi 0xffffffff810f28dc <+108>: callq *(%rbx) which is trace_irq_handler_entry(irq, action); res = action->handler(irq, action->dev_id); trace_irq_handler_exit(irq, action, res); Now, I feel a bit worried: crash involving percpu and trace together? I have seen this pattern inlined in try_to_wake_up already (see ffffffff810a54af in core.s [1]). try_to_wake_up -> ttwu_queue -> ttwu_queue_remote -> trace_sched_wake_idle_without_ipi -> ttwu_stat ** CRASH somewhere here So is this the same bug or not? [1] http://labs.suse.cz/jslaby/bug-968218/ BUG: unable to handle kernel NULL pointer dereference at 0000000000000008 IP: [] handle_irq_event_percpu+0x65/0x340 PGD 0 Oops: 0000 [#1] PREEMPT SMP Modules linked in: ... CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.4.2-13.g19ca782-default #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS by qemu-project.org 04/01/2014 task: ffffffff81e12540 ti: ffffffff81e00000 task.ti: ffffffff81e00000 RIP: 0010:[] [] handle_irq_event_percpu+0x65/0x340 RSP: 0018:ffff880093e03d88 EFLAGS: 00010002 RAX: 0000000000000001 RBX: 0000000000000000 RCX: 000000000000000f RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000046 RBP: ffff880093e03dc8 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000004 R13: ffff880087c3b058 R14: 0000000000000000 R15: ffffffff81e03df8 FS: 0000000000000000(0000) GS:ffff880093e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b CR2: 0000000000000008 CR3: 000000008a790000 CR4: 00000000000006f0 Stack: ffff880087c3b000 0000000087c3b0d8 ffff880087c3b058 ffff880087c3b000 ffff880087c3b0d8 ffff880087c3b058 0000000000000034 ffffffff81e03df8 ffff880093e03df0 ffffffff810f2bec ffff880087c3b000 ffff880087c3b0d8 Call Trace: [] handle_irq_event+0x3c/0x60 [] handle_edge_irq+0x80/0x150 [] handle_irq+0x1d/0x30 [] do_IRQ+0x61/0x120 [] common_interrupt+0x8c/0x8c Full inexact backtrace again: [] handle_irq_event+0x3c/0x60 [] handle_edge_irq+0x80/0x150 [] handle_irq+0x1d/0x30 [] do_IRQ+0x61/0x120 [] common_interrupt+0x8c/0x8c [] ? __do_softirq+0xa7/0x470 [] ? __do_softirq+0xa0/0x470 [] irq_exit+0xb3/0xc0 [] smp_apic_timer_interrupt+0x42/0x50 [] apic_timer_interrupt+0x8c/0xa0 [] ? native_safe_halt+0x6/0x10 [] ? trace_hardirqs_on+0xd/0x10 [] default_idle+0x23/0x170 [] arch_cpu_idle+0xf/0x20 [] default_idle_call+0x2a/0x40 [] cpu_startup_entry+0x387/0x400 [] rest_init+0x136/0x140 [] start_kernel+0x499/0x4a6 [] ? early_idt_handler_array+0x120/0x120 [] x86_64_start_reservations+0x2a/0x2c [] x86_64_start_kernel+0x13b/0x14a Code: 7e 48 8b 05 5e 58 e2 00 e8 79 8e 00 00 85 c0 74 0d 80 3d 54 3a e2 00 00 0f 84 db 01 00 00 65 ff 0d 01 96 f1 7e 0f 84 89 01 00 00 <48> 8b 73 08 44 89 e7 ff 13 41 89 c5 0f 1f 44 00 00 65 ff 05 e3 RIP [] handle_irq_event_percpu+0x65/0x340 RSP CR2: 0000000000000008 thanks, -- js suse labs