linux-kernel - Re: [Regression] 2.6.24-git9: RT sched mishandles artswrapper (bisected)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 7 Feb 2008 20:53:20 +0100
From:	"Rafael J. Wysocki" <rjw@...k.pl>
To:	Ingo Molnar <mingo@...e.hu>,
	Peter Zijlstra <a.p.zijlstra@...llo.nl>
Cc:	Dmitry Adamushko <dmitry.adamushko@...il.com>,
	Andrew Morton <akpm@...ux-foundation.org>,
	LKML <linux-kernel@...r.kernel.org>,
	Steven Rostedt <rostedt@...dmis.org>
Subject: Re: [Regression] 2.6.24-git9: RT sched mishandles artswrapper (bisected)

On Thursday, 7 of February 2008, Ingo Molnar wrote:
> 
> * Rafael J. Wysocki <rjw@...k.pl> wrote:
> 
> > > http://programming.kicks-ass.net/kernel-patches/sched-rt-group/
> > > 
> > > on top of sched-devel.
> > 
> > Indeed, with these patches applied the issue is not reproducible any 
> > more.
> 
> great! I've queued Peter's fixes and enhancements up in sched-devel. 
> (not pushed out yet)

However, these patches break my second testbed (dual -core AMD desktop),
with the attached config.

It crashes on boot with the following trace:

Using local APIC timer interrupts.
Detected 12.500 MHz APIC timer.
lockdep: fixing up alternatives.
Booting processor 1/2 APIC 0x1
Initializing CPU#1
Calibrating delay using timer specific routine.. 4400.18 BogoMIPS (lpj=8800361)
CPU: L1 I Cache: 64K (64 bytes/line), D cache 64K (64 bytes/line)
CPU: L2 Cache: 512K (64 bytes/line)
AMD Athlon(tm) 64 X2 Dual Core Processor 4200+ stepping 01
Brought up 2 CPUs
divide error: 0000 [1] SMP
CPU 0
Modules linked in:
Pid: 2, comm: kthreadd Not tainted 2.6.24 #41
RIP: 0010:[<ffffffff8022a024>]  [<ffffffff8022a024>] place_entity+0xa4/0xc0
RSP: 0000:ffff81007f885d20  EFLAGS: 00010046
RAX: 0000000321067800 RBX: ffff81007f8d22b8 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000c8419e RDI: 0000000000000c31
RBP: ffff81007f885d30 R08: 0000000000000000 R09: 0000000000000001
R10: cf3cf3cf3cf3cf3d R11: 0000000000000000 R12: fffffffffff00000
R13: 0000000000000000 R14: 0000000000000000 R15: ffff810002c32300
FS:  0000000000000000(0000) GS:ffffffff8067f000(0000) knlGS:0000000000000000
CS:  0010 DS: 0018 ES: 0018 CR0: 000000008005003b
CR2: 0000000000000000 CR3: 0000000000201000 CR4: 00000000000006e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process kthreadd (pid: 2, threadinfo ffff81007f884000, task ffff81007f882080)
Stack:  ffff81007f8d2280 ffff810002c2e880 ffff81007f885d70 ffffffff802340b3
 ffff81007f885d70 ffff81007f8d2280 ffff810002c32300 0000000000000009
 0000000000000000 0000000000000000 ffff81007f885da0 ffffffff80234afc
Call Trace:
 [<ffffffff802340b3>] task_new_fair+0x83/0xf0
 [<ffffffff80234afc>] wake_up_new_task+0xac/0xc0
 [<ffffffff802372ee>] do_fork+0x1fe/0x320
 [<ffffffff8025d641>] ? __lock_acquire+0x251/0x1100
 [<ffffffff8020c531>] kernel_thread+0x81/0xde
 [<ffffffff8024eb00>] ? kthread+0x0/0x80
 [<ffffffff8020c58e>] ? child_rip+0x0/0x12
 [<ffffffff8024ecd4>] ? kthreadd+0x154/0x190
 [<ffffffff8020c598>] child_rip+0xa/0x12
 [<ffffffff8020bcaf>] ? restore_args+0x0/0x31
 [<ffffffff8024eb80>] ? kthreadd+0x0/0x190
 [<ffffffff8020c58e>] ? child_rip+0x0/0x12


Code: 0f 1f 80 00 00 00 00 48 8b 81 30 01 00 00 48 39 cb 48 8b 10 74 2c 48 89 f0 89 d2 48 8b 89 28 01 00 00 48 c1 e0 0a 49 89 d0 31 d2 <49> f7 f0 48 8
RIP  [<ffffffff8022a024>] place_entity+0xa4/0xc0
 RSP <ffff81007f885d20>
---[ end trace ca143223eefdc828 ]---
kthreadd used greatest stack depth: 5424 bytes left

where

(gdb) l *place_entity+0xa4
0xffffffff8022a024 is in place_entity (/home/rafael/src/linux-2.6/kernel/sched_fair.c:390).
385                     weight = cfs_rq->load.weight;
386                     if (se == new)
387                             weight += new->load.weight;
388
389                     vslice *= NICE_0_LOAD;
390                     do_div(vslice, weight);
391             }
392
393             return vslice;
394     }
(gdb)

so it looks like "weight" is 0.  Peter?

Thanks,
Rafael

View attachment "failing-config" of type "text/plain" (51108 bytes)