Messages in this thread Patch in this message | | | Date | Mon, 28 Apr 2008 14:57:37 +0800 | From | Dave Young <> | Subject | Re: NULL dereference OOPS on SysRq-w |
| |
On Sun, Apr 27, 2008 at 02:36:42AM -0400, Dan Noe wrote: > I've experienced the following on a build done today from Linus's linux-2.6 > tree. After a fresh boot I do "echo "w" > /proc/sysrq_trigger" and I get > the OOPS, every time. I looked at the sched_debug code but I admit I was > lost. Not sure why sched.c includes sched_debug.c. > > Cheers, > Dan > > Via netconsole: > > SysRq : Show Blocked State > task PC stack pid father > Sched Debug Version: v0.07, 2.6.25 #12 > now at 275558.648467 msecs
[snip]
> : 2038 .shares : 2048BUG: unable to handle kernel > NULL pointer dereference at 0000000000000018IP: [<ffffffff802b9ab6>] > seq_printf+0x2e/0xa7 > PGD 7dd05067 PUD 7e0fb067 PMD 0 Oops: 0000 [1] PREEMPT SMP > DEBUG_PAGEALLOCCPU 0 > Modules linked in: netconsole nfsd lockd nfs_acl auth_rpcgss sunrpc > exportfs ac battery ipv6 dm_snapshot dm_mirror dm_log dm_mod eeprom > coretemp loop parport_pc parport snd_hda_intel rtc iTCO_wdt > iTCO_vendor_support i2c_i801 i2c_core snd_pc > m snd_timer snd soundcore snd_page_alloc button intel_agp evdev ext3 jbd > mbcache sd_mod ata_generic ata_piix pata_acpi libata scsi_mod dock ehci_hcd > uhci_hcd ide_pci_generic piix ide_core r8169 usbcore thermal processor fan > Pid: 3078, comm: zsh Not tainted 2.6.25 #12 > RIP: 0010:[<ffffffff802b9ab6>] [<ffffffff802b9ab6>] seq_printf+0x2e/0xa7 > RSP: 0018:ffff81007e387c68 EFLAGS: 00010092 > RAX: ffffffff804eec79 RBX: 0000000000000000 RCX: ffffee71806668f8 > RDX: ffff810001091f80 RSI: ffffffff804eec79 RDI: 0000000000000000 > RBP: ffff81007e387d48 R08: 0000000000000002 R09: ffffffff8024fb76 > R10: 00000000d59bb5d6 R11: ffff81007e387968 R12: 0000000000000000 > R13: 0000000000000000 R14: ffff810001091740 R15: 0000000000000007 > FS: 00007f7dce0896e0(0000) GS:ffffffff8057a000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b > CR2: 0000000000000018 CR3: 000000007e3ed000 CR4: 00000000000006e0 > DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 > DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 > Process zsh (pid: 3078, threadinfo ffff81007e386000, task ffff81007e090000) > Stack: 0000000000000002 ffffffff8024fb76 ffff81007e090090 ffff81007e090000 > ffffffff8022dc31 0000000000000046 ffff810001091f80 ffffee71806668f8 > 0000000000000002 ffffffff8024fb76 0000000000000096 0000000000000000 > Call Trace: > [<ffffffff8024fb76>] ? up+0xf/0x39 > [<ffffffff8022dc31>] ? print_cfs_rq+0x130/0x465 > [<ffffffff8024fb76>] ? up+0xf/0x39 > [<ffffffff8041dfa5>] ? _spin_unlock_irqrestore+0x66/0x74 > [<ffffffff8022df57>] ? print_cfs_rq+0x456/0x465 > [<ffffffff8022e920>] sched_debug_show+0x9ba/0xd28 > [<ffffffff8022f978>] ? cpu_clock+0xf0/0xff > [<ffffffff802745fe>] ? get_timestamp+0x9/0xf > [<ffffffff80274628>] ? touch_softlockup_watchdog+0x24/0x2d > [<ffffffff802319ec>] show_state_filter+0x8b/0xaa > [<ffffffff80375848>] sysrq_handle_showstate_blocked+0xe/0x10 > [<ffffffff803757a3>] __handle_sysrq+0x9e/0x135 > [<ffffffff802e2544>] ? write_sysrq_trigger+0x0/0x3a > [<ffffffff802e2574>] write_sysrq_trigger+0x30/0x3a > [<ffffffff802dc6b2>] proc_reg_write+0x8a/0xa7 > [<ffffffff802a0118>] vfs_write+0xa7/0xe1 > [<ffffffff802a020c>] sys_write+0x47/0x6d > [<ffffffff8020c3ab>] system_call_after_swapgs+0x7b/0x80 > Code: f0 48 89 e5 53 48 89 fb 48 81 ec d8 00 00 00 48 89 95 50 ff ff ff 48 > 89 8d 58 ff ff ff 4c 89 85 60 ff ff ff 4c 89 8d 68 ff ff ff <48> 8b 7f 18 > 48 3b 7b 08 73 5a 48 8b 73 08 48 8d 55 10 48 8d 8d > RIP [<ffffffff802b9ab6>] seq_printf+0x2e/0xa7 > RSP <ffff81007e387c68> > CR2: 0000000000000018 > ---[ end trace ffd04a8c8a72749a ]---
[snip]
I have a fix for the NULL pointer reference BUG, tested on my pc. ---
"m" will be NULL if seq_printf & seq_puts is called from sched_debug_show Use SEQ_* macros to fix it
Signed-off-by: Dave Young <hidave.darkstar@gmail.com>
--- include/linux/sched.h | 22 ++++++++++++++++++++++ kernel/sched_debug.c | 12 ------------ kernel/sched_fair.c | 6 +++--- 3 files changed, 25 insertions(+), 15 deletions(-)
diff -upr linux/include/linux/sched.h linux.new/include/linux/sched.h --- linux/include/linux/sched.h 2008-04-28 14:27:25.000000000 +0800 +++ linux.new/include/linux/sched.h 2008-04-28 14:37:45.000000000 +0800 @@ -2145,6 +2145,28 @@ static inline void migration_init(void) #define TASK_SIZE_OF(tsk) TASK_SIZE #endif +#ifdef CONFIG_SCHED_DEBUG +/* + * This allows printing both to /proc/sched_debug and + * to the console + */ +#define SEQ_printf(m, x...) \ + do { \ + if (m) \ + seq_printf(m, x); \ + else \ + printk(x); \ + } while (0) + +#define SEQ_puts(m, x...) \ + do { \ + if (m) \ + seq_puts(m, x); \ + else \ + printk(x); \ + } while (0) +#endif + #endif /* __KERNEL__ */ #endif diff -upr linux/kernel/sched_debug.c linux.new/kernel/sched_debug.c --- linux/kernel/sched_debug.c 2008-04-28 14:24:02.000000000 +0800 +++ linux.new/kernel/sched_debug.c 2008-04-28 14:37:32.000000000 +0800 @@ -17,18 +17,6 @@ #include <linux/utsname.h> /* - * This allows printing both to /proc/sched_debug and - * to the console - */ -#define SEQ_printf(m, x...) \ - do { \ - if (m) \ - seq_printf(m, x); \ - else \ - printk(x); \ - } while (0) - -/* * Ease the printing of nsec fields: */ static long long nsec_high(unsigned long long nsec) diff -upr linux/kernel/sched_fair.c linux.new/kernel/sched_fair.c --- linux/kernel/sched_fair.c 2008-04-28 14:16:17.000000000 +0800 +++ linux.new/kernel/sched_fair.c 2008-04-28 14:37:24.000000000 +0800 @@ -1623,9 +1623,9 @@ print_cfs_rq_tasks(struct seq_file *m, s int i; for (i = depth; i; i--) - seq_puts(m, " "); + SEQ_puts(m, " "); - seq_printf(m, "%lu %s %lu\n", + SEQ_printf(m, "%lu %s %lu\n", se->load.weight, entity_is_task(se) ? "T" : "G", calc_delta_weight(SCHED_LOAD_SCALE, se) @@ -1643,7 +1643,7 @@ static void print_cfs_stats(struct seq_f for_each_leaf_cfs_rq(cpu_rq(cpu), cfs_rq) print_cfs_rq(m, cpu, cfs_rq); - seq_printf(m, "\nWeight tree:\n"); + SEQ_printf(m, "\nWeight tree:\n"); print_cfs_rq_tasks(m, &cpu_rq(cpu)->cfs, 1); rcu_read_unlock(); }
| |