| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Fri, 4 Apr 2014 11:15:31 +0800
From: Fengguang Wu <fengguang.wu@...el.com>
To: Viresh Kumar <viresh.kumar@...aro.org>
Cc: linux-kernel@...r.kernel.org, Jet Chen <jet.chen@...el.com>
Subject: [hrtimer] BUG: unable to handle kernel NULL pointer dereference at
00000010
Greetings,
I got the below dmesg and the first bad commit is
commit 336ca196738842764df39fbd4d3f9129179b3e7d
Author: Viresh Kumar <viresh.kumar@...aro.org>
AuthorDate: Mon Mar 31 12:33:21 2014 +0530
Commit: Viresh Kumar <viresh.kumar@...aro.org>
CommitDate: Wed Apr 2 11:15:17 2014 +0530
hrtimer: Use for_each_active_base() to iterate over active clock bases
There are various places where we are currently running a loop of
HRTIMER_MAX_CLOCK_BASES iterations. We just run 'continue;' if there are no
timers added to a clock base. Instead we can use the new for_each_active_base()
routine to iterate over only the bases which are currently active.
This also updates hrtimer_interrupt() which was earlier modified to use
ffs(active_bases) directly.
Signed-off-by: Viresh Kumar <viresh.kumar@...aro.org>
+----------------------------------------------------------+------------+------------+------------+
| | f2c2345d95 | 336ca19673 | b0e33c34e2 |
+----------------------------------------------------------+------------+------------+------------+
| boot_successes | 171 | 1 | 5 |
| boot_failures | 37 | 28 | 18 |
| BUG:kernel_test_hang | 15 | | |
| BUG:kernel_early_hang_without_any_printk_output | 8 | 0 | 1 |
| BUG:kernel_boot_hang | 12 | | |
| BUG:kernel_boot_crashed | 2 | | |
| Oops:DEBUG_PAGEALLOC | 0 | 28 | 17 |
| EIP_is_at_hrtimer_force_reprogram | 0 | 28 | 17 |
| Kernel_panic-not_syncing:Attempted_to_kill_the_idle_task | 0 | 28 | 17 |
| backtrace:cpu_startup_entry | 0 | 28 | 17 |
| BUG:unable_to_handle_kernel_NULL_pointer_dereference | 0 | 27 | 16 |
+----------------------------------------------------------+------------+------------+------------+
done.
hwclock: can't open '/dev/misc/rtc': No such file or directory
Running postinst /etc/rpm-postinsts/100...
[ 2.258025] BUG: unable to handle kernel NULL pointer dereference at 00000010
[ 2.258641] IP: [<bd84b778>] hrtimer_force_reprogram+0x3d/0xb1
[ 2.259151] *pde = 00000000
[ 2.259412] Oops: 0000 [#1] DEBUG_PAGEALLOC
[ 2.259786] CPU: 0 PID: 0 Comm: swapper Not tainted 3.14.0-rc1-00080-g336ca19 #9
[ 2.260388] task: bdde5534 ti: bddda000 task.ti: bddda000
[ 2.260830] EIP: 0060:[<bd84b778>] EFLAGS: 00210002 CPU: 0
[ 2.261278] EIP is at hrtimer_force_reprogram+0x3d/0xb1
[ 2.261284] EAX: bddfaf54 EBX: 00000030 ECX: 00000000 EDX: 7fffffff
[ 2.261284] ESI: ffffffff EDI: bddfafd8 EBP: bdddbf48 ESP: bdddbf30
[ 2.261284] DS: 007b ES: 007b FS: 0000 GS: 00e0 SS: 0068
[ 2.261284] CR0: 8005003b CR2: 00000010 CR3: 10f4e000 CR4: 00000690
[ 2.261284] Stack:
[ 2.261284] 00000000 00000001 00000001 00000000 bdf3f17c bddfafa8 bdddbf64 bd84b845
[ 2.261284] 00000000 bdf3f17c bdf3f17c 00000001 00200046 bdddbf78 bd84c153 bdf3f17c
[ 2.261284] 00000000 00000000 bdddbf84 bd84c19e 86969207 bdddbfa0 bd8771f0 86969207
[ 2.261284] Call Trace:
[ 2.261284] [<bd84b845>] __remove_hrtimer+0x59/0x7b
[ 2.261284] [<bd84c153>] hrtimer_try_to_cancel+0x7b/0xb4
[ 2.261284] [<bd84c19e>] hrtimer_cancel+0x12/0x1d
[ 2.261284] [<bd8771f0>] tick_nohz_idle_exit+0x129/0x1f1
[ 2.261284] [<bd867b07>] cpu_startup_entry+0x1fa/0x290
[ 2.261284] [<bdbf1a96>] rest_init+0xa2/0xa7
[ 2.261284] [<bdfe79f6>] start_kernel+0x3be/0x3c5
[ 2.261284] [<bdfe72c3>] i386_start_kernel+0x79/0x7d
[ 2.261284] Code: 55 ec ba ff ff ff 7f 89 75 f0 83 ce ff 83 cb ff 0f bc 7d f0 0f 44 fb 8d 4f 01 6b d9 30 85 c9 89 7d e8 8d 7c 18 54 74 38 8b 4f e0 <8b> 59 10 8b 49 0c 2b 4f f8 1b 5f fc 85 db 79 04 31 c9 31 db 39
[ 2.261284] EIP: [<bd84b778>] hrtimer_force_reprogram+0x3d/0xb1 SS:ESP 0068:bdddbf30
[ 2.261284] CR2: 0000000000000010
[ 2.261284] ---[ end trace e155771ac78a2857 ]---
[ 2.261284] Kernel panic - not syncing: Attempted to kill the idle task!
git bisect start b0e33c34e23c7f8ede2f19d992628802308c3afc 455c6fdbd219161bd09b1165f11699d6d73de11c --
git bisect good c055491e20b2cde6b0b95af708ba1e95be080b81 # 23:20 23+ 1 Merge 'drm-intel/drm-intel-nightly' into devel-roam-i386-201404021703
git bisect good 2fa442064d8c64d1114e55a8ea07ab681d690580 # 23:33 23+ 0 Merge 'drm-exynos/exynos-drm-next' into devel-roam-i386-201404021703
git bisect bad 9dc0b63c0484a57ff4d11619f8986caac86643a8 # 23:47 1- 4 Merge 'vireshk/timer-cleanup-for-tglx' into devel-roam-i386-201404021703
git bisect good b97f0291a2504291aef850077f98cab68a5a2f33 # 00:13 23+ 2 tick: Remove code duplication in tick_handle_periodic()
git bisect good fe04ef37d949ea92dbc37164eff116fe3c4a0930 # 00:39 23+ 0 hrtimer: make enqueue_hrtimer() return void
git bisect bad deab1b2857728ee9d98078d2547fd7ab030ff508 # 00:48 0- 6 hrtimer: call hrtimer_get_softirq_time() only if cpu_base->active_bases is set
git bisect good dcdce37edcaacc6f3b4cc3f1b9a9c2a459b0ed9b # 01:56 23+ 5 hrtimer: use base->hres_active directly instead of hrtimer_hres_active()
git bisect good ca9949bac1a7e54bf7f832e0ffffdaafac8ea5c5 # 02:07 23+ 2 hrtimer: replace sizeof(struct hrtimer) with sizeof(*timer)
git bisect bad 336ca196738842764df39fbd4d3f9129179b3e7d # 02:07 0- 28 hrtimer: Use for_each_active_base() to iterate over active clock bases
git bisect good f2c2345d95fd44633a1356bad259198673192e21 # 03:15 23+ 12 hrtimer: create for_each_active_base()
# first bad commit: [336ca196738842764df39fbd4d3f9129179b3e7d] hrtimer: Use for_each_active_base() to iterate over active clock bases
git bisect good f2c2345d95fd44633a1356bad259198673192e21 # 04:35 69+ 37 hrtimer: create for_each_active_base()
git bisect bad b0e33c34e23c7f8ede2f19d992628802308c3afc # 04:35 0- 18 0day head guard for 'devel-roam-i386-201404021703'
git bisect good 59ecc26004e77e100c700b1d0da7502b0fdadb46 # 04:46 69+ 6 Merge git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6
git bisect good 4b22efdd5595f0acb48f02bf664a451ee98f9a2e # 05:06 69+ 2 Add linux-next specific files for 20140403
This script may reproduce the error.
-----------------------------------------------------------------------------
#!/bin/bash
kernel=$1
initrd=yocto-minimal-i386.cgz
wget --no-clobber https://github.com/fengguang/reproduce-kernel-bug/blob/master/initrd/$initrd
kvm=(
qemu-system-x86_64 -cpu kvm64 -enable-kvm
-kernel $kernel
-initrd $initrd
-smp 2
-m 256M
-net nic,vlan=0,macaddr=00:00:00:00:00:00,model=virtio
-net user,vlan=0
-net nic,vlan=1,model=e1000
-net user,vlan=1
-boot order=nc
-no-reboot
-watchdog i6300esb
-serial stdio
-display none
-monitor null
)
append=(
debug
sched_debug
apic=debug
ignore_loglevel
sysrq_always_enabled
panic=10
prompt_ramdisk=0
earlyprintk=ttyS0,115200
console=ttyS0,115200
console=tty0
vga=normal
root=/dev/ram0
rw
)
"${kvm[@]}" --append "${append[*]}"
-----------------------------------------------------------------------------
Thanks,
Fengguang
View attachment "dmesg-yocto-lkp-ib04-9:20140404015729:i386-randconfig-r1-0402:3.14.0-rc1-00080-g336ca19:9" of type "text/plain" (29493 bytes)
Download attachment "i386-randconfig-r1-0402-b0e33c34e23c7f8ede2f19d992628802308c3afc-BUG:-unable-to-handle-kernel-NULL-pointer-dereference-at-119227.log" of type "application/octet-stream" (35278 bytes)
View attachment "config-3.14.0-rc1-00080-g336ca19" of type "text/plain" (63611 bytes)
Powered by blists - more mailing lists