lkml.org 
[lkml]   [2014]   [Oct]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH] futex: fix a race condition between REQUEUE_PI and task death
From
Date
(CCs more eyeballs)

On Thu, 2014-10-23 at 15:28 -0400, Brian Silverman wrote:
> Here's the test code:

Which took a 2 socket 28 core box (NOPREEMPT) out in short order. With
patchlet applied, looks like it'll stay up (37 minutes and counting),
I'll squeak if it explodes.

Tested-by: Mike Galbraith <umgwanakikbuti@gmail.com>

[ 387.396020] BUG: unable to handle kernel NULL pointer dereference at 0000000000000b34
[ 387.414177] IP: [<ffffffff810d411e>] free_pi_state+0x4e/0xb0
[ 387.427638] PGD 8394fe067 PUD 847c37067 PMD 0
[ 387.438457] Oops: 0002 [#1] SMP
[ 387.446534] Modules linked in: nfs(E) lockd(E) grace(E) sunrpc(E) fscache(E) iscsi_ibft(E) iscsi_boot_sysfs(E) af_packet(E) ext4(E) crc16(E) mbcache(E) jbd2(E) joydev(E) hid_generic(E) intel_rapl(E) usbhid(E) x86_pkg_temp_thermal(E) iTCO_wdt(E) intel_powerclamp(E) iTCO_vendor_support(E) coretemp(E) kvm_intel(E) kvm(E) crct10dif_pclmul(E) crc32_pclmul(E) ghash_clmulni_intel(E) aesni_intel(E) aes_x86_64(E) lrw(E) ixgbe(E) gf128mul(E) glue_helper(E) ptp(E) ablk_helper(E) pps_core(E) cryptd(E) sb_edac(E) pcspkr(E) mdio(E) edac_core(E) ipmi_si(E) dca(E) ipmi_msghandler(E) lpc_ich(E) mfd_core(E) wmi(E) acpi_power_meter(E) xhci_pci(E) mei_me(E) i2c_i801(E) acpi_pad(E) processor(E) mei(E) xhci_hcd(E) shpchp(E) button(E) dm_mod(E) btrfs(E) xor(E) raid6_pq(E) sr_mod(E) cdrom(E) sd_mod(E) mgag200(E) syscopyarea(E)
[ 387.610406] sysfillrect(E) sysimgblt(E) i2c_algo_bit(E) drm_kms_helper(E) ehci_pci(E) ttm(E) ahci(E) ehci_hcd(E) crc32c_intel(E) libahci(E) drm(E) usbcore(E) libata(E) usb_common(E) sg(E) scsi_mod(E) autofs4(E)
[ 387.651513] CPU: 27 PID: 136696 Comm: futex-exit-race Tainted: G E 3.18.0-default #51
[ 387.672339] Hardware name: Intel Corporation S2600WTT/S2600WTT, BIOS GRNDSDP1.86B.0030.R03.1405061547 05/06/2014
[ 387.696066] task: ffff880833002250 ti: ffff880830d04000 task.ti: ffff880830d04000
[ 387.713855] RIP: 0010:[<ffffffff810d411e>] [<ffffffff810d411e>] free_pi_state+0x4e/0xb0
[ 387.733015] RSP: 0018:ffff880830d07d78 EFLAGS: 00010046
[ 387.746030] RAX: 0000000000000000 RBX: ffff8804592ea340 RCX: 0000000000000bb6
[ 387.763089] RDX: ffff8804592ea340 RSI: ffff880866c3fb48 RDI: ffff88083b40cb84
[ 387.780167] RBP: ffff880830d07d88 R08: ffffc900136b8a70 R09: ffff88046afe8150
[ 387.797255] R10: 0000000000000000 R11: 00000000000101b0 R12: ffff880830d07e08
[ 387.814360] R13: 0000000000000000 R14: ffffc900136b8a70 R15: 0000000000000001
[ 387.831476] FS: 00007fb2637c5700(0000) GS:ffff88087f1a0000(0000) knlGS:0000000000000000
[ 387.850710] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 387.864766] CR2: 0000000000000b34 CR3: 00000008374e7000 CR4: 00000000001407e0
[ 387.881901] Stack:
[ 387.887707] ffff880830d07d88 00000000ffffffff ffff880830d07e58 ffffffff810d52c4
[ 387.905497] 0000001b00000001 ffff880830d07e20 0002018230d07dc8 0000000000000001
[ 387.923290] ffffc900136b8a84 ffff880830d07f08 00007fb2637d838c 0000000100000001
[ 387.941071] Call Trace:
[ 387.947864] [<ffffffff810d52c4>] futex_requeue+0x2b4/0x8e0
[ 387.961578] [<ffffffff810d5e89>] do_futex+0xa9/0x580
[ 387.974128] [<ffffffff81585502>] ? do_nanosleep+0x82/0x110
[ 387.987814] [<ffffffff810c414c>] ? hrtimer_nanosleep+0xac/0x160
[ 388.002458] [<ffffffff810d63d1>] SyS_futex+0x71/0x150
[ 388.015181] [<ffffffff815868a9>] system_call_fastpath+0x12/0x17
[ 388.029826] Code: 30 48 85 ff 74 41 48 81 c7 34 0b 00 00 e8 7b 1f 4b 00 48 8b 43 08 48 8b 13 48 89 42 08 48 89 10 48 89 1b 48 89 5b 08 48 8b 43 30 <66> 83 80 34 0b 00 00 01 fb 66 0f 1f 44 00 00 48 8b 73 30 48 8d
[ 388.075136] RIP [<ffffffff810d411e>] free_pi_state+0x4e/0xb0
[ 388.089266] RSP <ffff880830d07d78>
[ 388.098386] CR2: 0000000000000b34




\
 
 \ /
  Last update: 2014-10-24 08:01    [W:0.213 / U:0.336 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site