Messages in this thread | | | Subject | Re: Linux-2.2.2-pre2.. | From | Philippe Troin <> | Date | 05 Feb 1999 23:58:18 -0800 |
| |
Linus Torvalds <torvalds@transmeta.com> writes:
> There's a new pre-2 on ftp.kernel.org in testing: this one contains > various small documentation updates and updates to xconfig, but the > important parts (and the smallest part of the actual patch) are:
>8 snip 8<
> None of the fixes are critical to most people, but all of them _can_ be > critical to people who have seen vulnerabilities in the area. As such, if > you're happy with 2.2.1 there is no pressing reason to test this patch > out, but I hope to have the pre-patches so that the final 2.2.2 can be > left around for a while (CD-ROM manufacturers etc would certainly prefer > to not see lots of releases).
The enclosed program will kill any multi-processor SMP machine... Dorry for reposting this again, but I've been tracking down this for too long without getting any attention so far...
The crashme thingie spawns <N> processes (<N> defined on the command line) which just open and close BSD-style tty/pty pairs endlessly.
Tested is on: Linux ceramic 2.2.1 #8 SMP Wed Feb 3 19:49:07 PST 1999 i686 unknown and Linux ceramic 2.2.2-pre2 #2 SMP Fri Feb 5 22:22:00 PST 1999 i686 unknown
both times with 2 CPUs, without UNIX98_PTYS support. Doesn't show up on uniprocessor machines (compiled without SMP).
You'll get (change device numbers and counts randomly): 1) A lot of "Warning: dev (03:07) tty->count(0) != #fd's(2) in do_tty_hangup" 2) A few Warning: null TTY for (03:01) in tty_fasync 3) And finally a couple of this oopses (or worse) (you might have to wait a few minutes for these)
I've noticed the warnings to come up much faster under 2.2.2-pre2. Additionnaly, having some disk activity (eg find / >& /dev/null) will cause the oops to show up faster.
Ttys are above my limited knowledge of the kernel :-(
==================== Begin Oops ==================== Unable to handle kernel NULL pointer dereference at virtual address 00000000 current->tss.cr3 = 05be1000, %cr3 = 05be1000 *pde = 00000000 Oops: 0002 CPU: 1 EIP: 0010:[<c019d926>] EFLAGS: 00010282 eax: c7fc1020 ebx: 00000001 ecx: 00000009 edx: 00000001 esi: c7fc1020 edi: 00000000 ebp: 00000000 esp: c7dfbe4c ds: 0018 es: 0018 ss: 0018 Process find (pid: 196, process nr: 21, stackpage=c7dfb000) Stack: c7e8fd40 c7dfbe84 c7fc1000 00000000 c011172e c7fc1000 00000000 c7dfa000 c7e8fd40 c7dfa000 c7e8fd40 00000000 00000001 c0242020 00000000 c0127601 00000002 c3df18e0 00000000 00000000 c7dfa000 c7e8fd6c c013d406 c7e8fd40 Call Trace: [<c011172e>] [<c0127601>] [<c013d406>] [<c013af19>] [<c011c3e3>] [<c011c607>] [<c012f810>] [<c012f688>] [<c013ae50>] [<c0108c00>] Code: f3 a5 a1 c4 c3 27 c0 8b 74 24 10 39 86 c8 00 00 00 74 5b 8b
>>EIP: c019d926 <do_tty_hangup+14a/2d0> Trace: c011172e <schedule+d2/360> Trace: c0127601 <__wait_on_buffer+c9/12c> Trace: c013d406 <ext2_bread+e2/114> Trace: c013af19 <ext2_readdir+c9/584> Trace: c011c3e3 <do_anonymous_page+97/a8> Trace: c011c607 <handle_mm_fault+103/1e8> Trace: c012f810 <sys_getdents+104/170> Trace: c012f688 <filldir+0/84> Code: c019d926 <do_tty_hangup+14a/2d0> 00000000 <_EIP>: Code: c019d926 <do_tty_hangup+14a/2d0> 0: f3 a5 repz movsl %ds:(%esi),%es:(%edi) Code: c019d928 <do_tty_hangup+14c/2d0> 2: a1 c4 c3 27 c0 movl 0xc027c3c4,%eax Code: c019d92d <do_tty_hangup+151/2d0> 7: 8b 74 24 10 movl 0x10(%esp,1),%esi Code: c019d931 <do_tty_hangup+155/2d0> b: 39 86 c8 00 00 cmpl %eax,0xc8(%esi) Code: c019d936 <do_tty_hangup+15a/2d0> 10: 00 Code: c019d937 <do_tty_hangup+15b/2d0> 11: 74 5b je 6e <_EIP+0x6e> c019d994 <do_tty_hangup+1b8/2d0> Code: c019d939 <do_tty_hangup+15d/2d0> 13: 8b 00 movl (%eax),%eax ==================== End Oops ====================
Corresponding lines on do_tty_hangup (oopses on line 440): 435 /* 436 * Shutdown the current line discipline, and reset it to 437 * N_TTY. 438 */ 439 if (tty->driver.flags & TTY_DRIVER_RESET_TERMIOS) 440 *tty->termios = tty->driver.init_termios; 441 if (tty->ldisc.num != ldiscs[N_TTY].num) { 442 if (tty->ldisc.close) 443 (tty->ldisc.close)(tty); 444 tty->ldisc = ldiscs[N_TTY];
Phil.
[unhandled content-type:application/octet-stream] | |