lkml.org 
[lkml]   [1999]   [Feb]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: Linux-2.2.2-pre2..
From
Date
Linus Torvalds <torvalds@transmeta.com> writes:

> There's a new pre-2 on ftp.kernel.org in testing: this one contains
> various small documentation updates and updates to xconfig, but the
> important parts (and the smallest part of the actual patch) are:

>8 snip 8<

> None of the fixes are critical to most people, but all of them _can_ be
> critical to people who have seen vulnerabilities in the area. As such, if
> you're happy with 2.2.1 there is no pressing reason to test this patch
> out, but I hope to have the pre-patches so that the final 2.2.2 can be
> left around for a while (CD-ROM manufacturers etc would certainly prefer
> to not see lots of releases).

The enclosed program will kill any multi-processor SMP machine...
Dorry for reposting this again, but I've been tracking down this
for too long without getting any attention so far...

The crashme thingie spawns <N> processes (<N> defined on the command
line) which just open and close BSD-style tty/pty pairs endlessly.

Tested is on:
Linux ceramic 2.2.1 #8 SMP Wed Feb 3 19:49:07 PST 1999 i686 unknown
and
Linux ceramic 2.2.2-pre2 #2 SMP Fri Feb 5 22:22:00 PST 1999 i686 unknown

both times with 2 CPUs, without UNIX98_PTYS support.
Doesn't show up on uniprocessor machines (compiled without SMP).

You'll get (change device numbers and counts randomly):
1) A lot of "Warning: dev (03:07) tty->count(0) != #fd's(2) in
do_tty_hangup"
2) A few Warning: null TTY for (03:01) in tty_fasync
3) And finally a couple of this oopses (or worse) (you might have to
wait a few minutes for these)

I've noticed the warnings to come up much faster under 2.2.2-pre2.
Additionnaly, having some disk activity (eg find / >& /dev/null) will
cause the oops to show up faster.

Ttys are above my limited knowledge of the kernel :-(

==================== Begin Oops ====================
Unable to handle kernel NULL pointer dereference at virtual address 00000000
current->tss.cr3 = 05be1000, %cr3 = 05be1000
*pde = 00000000
Oops: 0002
CPU: 1
EIP: 0010:[<c019d926>]
EFLAGS: 00010282
eax: c7fc1020 ebx: 00000001 ecx: 00000009 edx: 00000001
esi: c7fc1020 edi: 00000000 ebp: 00000000 esp: c7dfbe4c
ds: 0018 es: 0018 ss: 0018
Process find (pid: 196, process nr: 21, stackpage=c7dfb000)
Stack: c7e8fd40 c7dfbe84 c7fc1000 00000000 c011172e c7fc1000 00000000 c7dfa000
c7e8fd40 c7dfa000 c7e8fd40 00000000 00000001 c0242020 00000000 c0127601
00000002 c3df18e0 00000000 00000000 c7dfa000 c7e8fd6c c013d406 c7e8fd40
Call Trace: [<c011172e>] [<c0127601>] [<c013d406>] [<c013af19>] [<c011c3e3>] [<c011c607>] [<c012f810>]
[<c012f688>] [<c013ae50>] [<c0108c00>]
Code: f3 a5 a1 c4 c3 27 c0 8b 74 24 10 39 86 c8 00 00 00 74 5b 8b

>>EIP: c019d926 <do_tty_hangup+14a/2d0>
Trace: c011172e <schedule+d2/360>
Trace: c0127601 <__wait_on_buffer+c9/12c>
Trace: c013d406 <ext2_bread+e2/114>
Trace: c013af19 <ext2_readdir+c9/584>
Trace: c011c3e3 <do_anonymous_page+97/a8>
Trace: c011c607 <handle_mm_fault+103/1e8>
Trace: c012f810 <sys_getdents+104/170>
Trace: c012f688 <filldir+0/84>
Code: c019d926 <do_tty_hangup+14a/2d0> 00000000 <_EIP>:
Code: c019d926 <do_tty_hangup+14a/2d0> 0: f3 a5 repz movsl %ds:(%esi),%es:(%edi)
Code: c019d928 <do_tty_hangup+14c/2d0> 2: a1 c4 c3 27 c0 movl 0xc027c3c4,%eax
Code: c019d92d <do_tty_hangup+151/2d0> 7: 8b 74 24 10 movl 0x10(%esp,1),%esi
Code: c019d931 <do_tty_hangup+155/2d0> b: 39 86 c8 00 00 cmpl %eax,0xc8(%esi)
Code: c019d936 <do_tty_hangup+15a/2d0> 10: 00
Code: c019d937 <do_tty_hangup+15b/2d0> 11: 74 5b je 6e <_EIP+0x6e> c019d994 <do_tty_hangup+1b8/2d0>
Code: c019d939 <do_tty_hangup+15d/2d0> 13: 8b 00 movl (%eax),%eax
==================== End Oops ====================

Corresponding lines on do_tty_hangup (oopses on line 440):
435 /*
436 * Shutdown the current line discipline, and reset it to
437 * N_TTY.
438 */
439 if (tty->driver.flags & TTY_DRIVER_RESET_TERMIOS)
440 *tty->termios = tty->driver.init_termios;
441 if (tty->ldisc.num != ldiscs[N_TTY].num) {
442 if (tty->ldisc.close)
443 (tty->ldisc.close)(tty);
444 tty->ldisc = ldiscs[N_TTY];

Phil.

[unhandled content-type:application/octet-stream]
\
 
 \ /
  Last update: 2005-03-22 13:50    [W:0.082 / U:0.052 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site