On Tuesday 22 December 2009 23:09:41 Michael Buesch wrote: > On Tuesday 22 December 2009 16:38:35 Jeff Epler wrote: > > This is just a shot in the dark, but it seems to match several things > > I'm seeing in the tracebacks -- SMP, x86-64, preempt, and irqs: > > http://article.gmane.org/gmane.linux.kernel.adeos.general/1481 > > http://article.gmane.org/gmane.linux.kernel.adeos.general/1487 > > http://article.gmane.org/gmane.linux.kernel.adeos.general/1491 > > > > I have to confess that I don't follow the technical details so apologies > > if it's a red herring. > > What kernel do these patches apply to? The first two are easy to port > to 2.6.29, but the third is hard, because there's no irq_count percpu var. >
Here's another oops (now with patch 1 and 2 applied) This one's interesting. Notice the NULL ptr deref af 0x7 and the program counter at 0x147. I think this might point to a use-after-free bug. So a resource is possibly free'd (and zero'd) while it was still registered to the kernel. The backtrace is pretty vague and most likely wrong in places, but it always seems to point at the timer interrupt. Which _might_ point us to a freed-but-not-unregistered timer. I'm just poking in the dark, so I might be completely wrong. Too bad 2.6.29 doesn't seem to have as good memory debugging as tip kernel has... [ 117.417774] BUG: unable to handle kernel NULL pointer dereference at 0000000000000007 [ 117.417792] IP: [<0000000000000147>] 0x147 [ 117.417802] PGD 6fce5067 PUD 6fccb067 PMD 0 [ 117.417812] Oops: 0000 [#1] PREEMPT SMP [ 117.417823] last sysfs file: /sys/devices/pci0000:00/0000:00:0b.0/0000:02:00.0/resource [ 117.417827] CPU 0 [ 117.417832] Modules linked in: charge_pump stepgen hal_parport probe_parport motmod trivkins hal_lib rtapi rtai_math rtai_sem rtai_shm rtai_fifos rtai_sched rtai_hal k8temp evdev [last unloaded: rtai_hal] [ 117.417881] Pid: 4444, comm: axis Not tainted 2.6.29.6-rtai #9 GeForce7050M-M [ 117.417885] RIP: 0000:[<0000000000000147>] [<0000000000000147>] 0x147 [ 117.417890] RSP: ffffffff80c918b8:0000000000000000 EFLAGS: 00000147 [ 117.417893] RAX: ffffffffffffffff RBX: ffffffff80c84700 RCX: 0000000000001470 [ 117.417897] RDX: ffffffff80c88120 RSI: 0000000000000000 RDI: ffffffff80c84700 [ 117.417900] RBP: ffff88006fc09f58 R08: 0000000000000140 R09: ffffffffffffffff [ 117.417903] R10: ffffffff80cee2c0 R11: 0000000000000140 R12: 0000000000000147 [ 117.417907] R13: 0000000000000000 R14: 0000000000000147 R15: 0000000000000000 [ 117.417911] FS: 00007ffdcd0c06e0(0000) GS:ffffffff80c9a040(0000) knlGS:0000000000000000 [ 117.417915] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 117.417918] CR2: 0000000000000007 CR3: 000000007243c000 CR4: 00000000000006a0 [ 117.417922] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 117.417925] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 117.417929] Process axis (pid: 4444, threadinfo ffff880071d90000, task ffff8800725876c0) [ 117.417932] Stack: [ 117.417935] ffffffff80c91c58 ffff8800725876c0 ffffffff80c91ec8 0000000000000000 [ 117.417945] 000000000000002b ffffffff80c91ec8 ffffffff80c91ce8 ffffffff8020f0e5 [ 117.417965] 0000000000000000 0000000000000000 0000004080c91cb8 ffffffff8025f8d1 [ 117.417986] Call Trace: [ 117.417990] <IRQ> <0> [<ffffffff8020f0e5>] ? show_registers+0x135/0x330 [ 117.418002] [<ffffffff8025f8d1>] ? atomic_notifier_call_chain+0x11/0x20 [ 117.418010] [<ffffffff802102ee>] ? __die+0xbe/0x110 [ 117.418018] [<ffffffff802294d6>] ? do_page_fault+0x416/0x980 [ 117.418025] [<ffffffff80235d6f>] ? pick_next_task_fair+0x5f/0x130 [ 117.418031] [<ffffffff80912255>] ? schedule+0x275/0x8c0 [ 117.418040] [<ffffffff8026568f>] ? clockevents_program_event+0x4f/0x90 [ 117.418047] [<ffffffff80266a0e>] ? tick_dev_program_event+0x3e/0xc0 [ 117.418054] [<ffffffff80266af5>] ? tick_program_event+0x25/0x30 [ 117.418061] [<ffffffff8025e6d4>] ? hrtimer_interrupt+0x114/0x1b0 [ 117.418069] [<ffffffff8021d500>] ? smp_apic_timer_interrupt+0x0/0xb0 [ 117.418078] [<ffffffff802211de>] ? __ipipe_preempt_schedule_irq+0x3e/0xc0 [ 117.418084] [<ffffffff80221035>] ? __ipipe_handle_exception+0xe5/0x250 [ 117.418092] [<ffffffff80914fa6>] ? page_fault+0x26/0x70 [ 117.418098] [<ffffffffa02d1a0f>] ? rtai_hirq_dispatcher+0x1af/0x620 [rtai_hal] [ 117.418111] [<ffffffff8020c555>] ? common_interrupt+0x15/0x2e [ 117.418117] <EOI> <0>Code: Bad RIP value. [ 117.418126] RIP [<0000000000000147>] 0x147 [ 117.418131] RSP <0000000000000000> [ 117.418134] CR2: 0000000000000007 [ 117.418138] ---[ end trace df0cb7b0a2cd4273 ]--- -- Greetings, Michael. ------------------------------------------------------------------------------ This SF.Net email is sponsored by the Verizon Developer Community Take advantage of Verizon's best-in-class app development support A streamlined, 14 day to market process makes app distribution fast and easy Join now and get one step closer to millions of Verizon customers http://p.sf.net/sfu/verizon-dev2dev _______________________________________________ Emc-developers mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/emc-developers
