* Alexander Shishkin <[email protected]> wrote:
> Peter Zijlstra <[email protected]> writes:
>
> > Alex, any clue?
>
> Let me look into it. Definitely haven't seen anything like that in my
> tests.
That's natural: Vince is running randomize fuzzing tests, so you should look
out
for boundary conditions and 'nonsensical' values that won't normally trigger in
functional testing.
In fact Vince is using 'directed fuzzing': i.e. the fuzzer is aware of the
general
perf ABI structure and will try to generate partially valid, partially
randomized
requests, to be able to test 'leaf' functionality of the perf ABI as well,
which
would otherwise need astronomical odds to occur in a pure fuzzing test.
These crashes started popping up when Vince added 'AUX area awareness' to the
fuzzer.
> >> [36299.068111] [<ffffffff810c2acf>] do_raw_spin_lock+0x13f/0x180
> >> [36299.074897] [<ffffffff816de6e9>] _raw_spin_lock+0x39/0x40
> >> [36299.081276] [<ffffffff8117a039>] ? free_pcppages_bulk+0x39/0x620
> >> [36299.088340] [<ffffffff8117a039>] free_pcppages_bulk+0x39/0x620
> >> [36299.095182] [<ffffffff81177e14>] ? free_pages_prepare+0x3a4/0x550
> >> [36299.102291] [<ffffffff811c9936>] ? kfree_debugcheck+0x16/0x40
> >> [36299.108987] [<ffffffff8117a938>] free_hot_cold_page+0x178/0x1a0
> >> [36299.115850] [<ffffffff8117aa47>] __free_pages+0x37/0x50
> >> [36299.121991] [<ffffffff8116ae0a>] rb_free_aux+0xba/0xf0
>
> This one goes to free aux pages from nmi context, looks like aux buffer was
> unmapped while the event was running, so here it dropped the last reference.
Yeah, that in itself is an absolute no-no - so I guess refcounting went wrong
somewhere? (assuming it exists properly).
Thanks,
Ingo
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
