| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20070102140419.GK2122@elf.ucw.cz>
Date: Tue, 2 Jan 2007 15:04:19 +0100
From: Pavel Machek <pavel@....cz>
To: kernel list <linux-kernel@...r.kernel.org>,
Andrew Morton <akpm@...l.org>, gregkh@....ucw.cz,
marcel@...tmann.org, maxk@...lcomm.com, bluez-devel@...ts.sf.net
Subject: regression: bluetooth oopses because of multiple kobject_add()
Hi!
On 2.6.20-rc2, I got:
This used to work before... certainly with 2.6.19.
Running this multiple times seems to trigger it:
#!/bin/bash
#
# Run tui on desktop machine, using t68i instead of a modem.
#
hciconfig hci0 name billionton
hciconfig hci0 up
hcid
rfcomm unbind 1
# t68
rfcomm bind 1 00:80:37:??:??:??
stty -echo < /dev/rfcomm1
cd ~pavel/misc/tui/microwindows-0.91/src
( while true; do ~pavel/sf/tui/input_sx1 | bin/phone; done ) &
./launcher.sh
Pavel
....
l2cap_recv_acldata: Unexpected continuation frame (len 0)
l2cap_recv_acldata: Unexpected continuation frame (len 0)
l2cap_recv_acldata: Unexpected continuation frame (len 0)
l2cap_recv_acldata: Unexpected continuation frame (len 0)
l2cap_recv_acldata: Unexpected continuation frame (len 0)
l2cap_recv_acldata: Unexpected continuation frame (len 0)
l2cap_recv_acldata: Unexpected continuation frame (len 0)
l2cap_recv_acldata: Unexpected continuation frame (len 0)
l2cap_recv_acldata: Unexpected continuation frame (len 0)
kobject_add failed for rfcomm1 with -EEXIST, don't try to register things with the same name in the same directory.
[<c025121c>] kobject_add+0x1ac/0x1e0
[<c0328d40>] device_add+0xb0/0x500
[<c025156b>] kobject_init+0x2b/0x40
[<c0328510>] device_create_release+0x0/0x10
[<c0329229>] device_create+0x89/0xc0
[<c02d854b>] tty_register_device+0x5b/0xf0
[<c0612038>] _read_lock_bh+0x8/0x20
[<c05e4072>] hci_get_route+0x112/0x120
[<c05f04ed>] rfcomm_dev_ioctl+0x4cd/0x690
[<c05ee6b9>] rfcomm_sock_ioctl+0x29/0x50
[<c054409f>] sock_ioctl+0xaf/0x1d0
[<c0543ff0>] sock_ioctl+0x0/0x1d0
[<c017a23b>] do_ioctl+0x2b/0xa0
[<c017a30c>] vfs_ioctl+0x5c/0x2e0
[<c017a5cd>] sys_ioctl+0x3d/0x70
[<c010304c>] syscall_call+0x7/0xb
[<c0610033>] schedule+0x2c3/0x8f0
=======================
BUG: unable to handle kernel NULL pointer dereference at virtual address 0000003c
printing eip:
c05ef978
*pde = 00000000
BUG: soft lockup detected on CPU#0!
[<c014d469>] softlockup_tick+0xa9/0xd0
[<c0131383>] update_process_times+0x33/0x80
[<c011ab7b>] smp_apic_timer_interrupt+0x6b/0x80
[<c0103aa4>] apic_timer_interrupt+0x28/0x30
[<c0255606>] delay_tsc+0x16/0x20
[<c0255646>] __delay+0x6/0x10
[<c011fbbb>] do_page_fault+0x35b/0x600
[<c011f860>] do_page_fault+0x0/0x600
[<c061237c>] error_code+0x7c/0x84
[<c02d007b>] read_fan+0x59/0x6f
[<c05ef978>] rfcomm_tty_chars_in_buffer+0x8/0x20
[<c02dcd64>] normal_poll+0xd4/0x140
[<c02dcc90>] normal_poll+0x0/0x140
[<c02d9f4b>] tty_poll+0x6b/0x90
[<c017b5c9>] do_select+0x219/0x4b0
[<c017ac00>] __pollwait+0x0/0x110
[<c0123c90>] default_wake_function+0x0/0x10
[<c0123c90>] default_wake_function+0x0/0x10
[<c0123c90>] default_wake_function+0x0/0x10
[<c018f0a0>] __find_get_block_slow+0xc0/0x140
[<c0169c39>] poison_obj+0x29/0x60
[<c016962e>] dbg_redzone1+0xe/0x20
[<c016a51e>] cache_alloc_debugcheck_after+0x3e/0x150
[<c016a364>] check_poison_obj+0x24/0x1a0
[<c019129f>] __find_get_block+0xcf/0x1c0
[<c0169c39>] poison_obj+0x29/0x60
[<c0169c39>] poison_obj+0x29/0x60
[<c016a220>] cache_free_debugcheck+0xb0/0x1d0
[<c01c0592>] journal_stop+0x162/0x1f0
[<c01c0592>] journal_stop+0x162/0x1f0
[<c01ba0e4>] __ext3_journal_stop+0x24/0x50
[<c01b29f1>] ext3_ordered_commit_write+0xa1/0xd0
[<c01b16a0>] ext3_journal_dirty_data+0x0/0x50
[<c015162b>] generic_file_buffered_write+0x39b/0x680
[<c01ba0e4>] __ext3_journal_stop+0x24/0x50
[<c018a824>] __mark_inode_dirty+0x34/0x1c0
[<c0152a43>] __generic_file_aio_write_nolock+0x283/0x590
[<c017ba26>] core_sys_select+0x1c6/0x2e0
[<c06112cf>] __mutex_lock_slowpath+0xef/0x230
[<c0152db2>] generic_file_aio_write+0x62/0xd0
[<c01b0570>] ext3_file_write+0x30/0xc0
[<c016ea77>] do_sync_write+0xc7/0x130
[<c015e392>] __handle_mm_fault+0x642/0x890
[<c013c680>] autoremove_wake_function+0x0/0x50
[<c02d82d5>] tty_ldisc_deref+0x15/0x70
[<c017bea1>] sys_select+0x51/0x1c0
[<c010304c>] syscall_call+0x7/0xb
=======================
Oops: 0000 [#1]
SMP
Modules linked in:
CPU: 0
EIP: 0060:[<c05ef978>] Not tainted VLI
EFLAGS: 00010246 (2.6.20-rc2 #384)
EIP is at rfcomm_tty_chars_in_buffer+0x8/0x20
eax: 00000000 ebx: db0e5704 ecx: 00000000 edx: f79858ac
esi: 00000000 edi: f7599528 ebp: 00000000 esp: da73bb54
ds: 007b es: 007b ss: 0068
Process phone (pid: 3930, ti=da73a000 task=dc212a70 task.ti=da73a000)
Stack: c02dcd64 00610a52 f7599528 db0e5704 c02dcc90 c02d9f4b 00000000 db0e5710
00000010 f7599528 00000004 0000001c c017b5c9 00000000 da73bf9c da73bf54
00000000 da73be60 da73be64 da73be68 da73be58 da73be5c da73be60 00000011
Call Trace:
[<c02dcd64>] normal_poll+0xd4/0x140
[<c02dcc90>] normal_poll+0x0/0x140
[<c02d9f4b>] tty_poll+0x6b/0x90
[<c017b5c9>] do_select+0x219/0x4b0
[<c017ac00>] __pollwait+0x0/0x110
[<c0123c90>] default_wake_function+0x0/0x10
[<c0123c90>] default_wake_function+0x0/0x10
[<c0123c90>] default_wake_function+0x0/0x10
[<c018f0a0>] __find_get_block_slow+0xc0/0x140
[<c0169c39>] poison_obj+0x29/0x60
[<c016962e>] dbg_redzone1+0xe/0x20
[<c016a51e>] cache_alloc_debugcheck_after+0x3e/0x150
[<c016a364>] check_poison_obj+0x24/0x1a0
[<c019129f>] __find_get_block+0xcf/0x1c0
[<c0169c39>] poison_obj+0x29/0x60
[<c0169c39>] poison_obj+0x29/0x60
[<c016a220>] cache_free_debugcheck+0xb0/0x1d0
[<c01c0592>] journal_stop+0x162/0x1f0
[<c01c0592>] journal_stop+0x162/0x1f0
[<c01ba0e4>] __ext3_journal_stop+0x24/0x50
[<c01b29f1>] ext3_ordered_commit_write+0xa1/0xd0
[<c01b16a0>] ext3_journal_dirty_data+0x0/0x50
[<c015162b>] generic_file_buffered_write+0x39b/0x680
[<c01ba0e4>] __ext3_journal_stop+0x24/0x50
[<c018a824>] __mark_inode_dirty+0x34/0x1c0
[<c0152a43>] __generic_file_aio_write_nolock+0x283/0x590
[<c017ba26>] core_sys_select+0x1c6/0x2e0
[<c06112cf>] __mutex_lock_slowpath+0xef/0x230
[<c0152db2>] generic_file_aio_write+0x62/0xd0
[<c01b0570>] ext3_file_write+0x30/0xc0
[<c016ea77>] do_sync_write+0xc7/0x130
[<c015e392>] __handle_mm_fault+0x642/0x890
[<c013c680>] autoremove_wake_function+0x0/0x50
[<c02d82d5>] tty_ldisc_deref+0x15/0x70
[<c017bea1>] sys_select+0x51/0x1c0
[<c010304c>] syscall_call+0x7/0xb
=======================
Code: 8d 76 00 8b 80 60 01 00 00 8b 50 3c f0 0f ba 72 3c 00 19 c0 85 c0 75 01 c3 89 d0 e9 f3 cb ff ff 8d 76 00 8b 80 60 01 00 00 31 c9 <8b> 50 3c 8d 42 0c 39 42 0c 74 03 8b 4a 50 89 c8 c3 8d b4 26 00
EIP: [<c05ef978>] rfcomm_tty_chars_in_buffer+0x8/0x20 SS:ESP 0068:da73bb54
--
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html
Download attachment "delme.bz2" of type "application/octet-stream" (14055 bytes)
Powered by blists - more mailing lists