linux-kernel - Re: recent -git: BUG in free_thread

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <b647ffbd0807231501va30f6d4kee49d1daa30227fc@mail.gmail.com>
Date:	Thu, 24 Jul 2008 00:01:46 +0200
From:	"Dmitry Adamushko" <dmitry.adamushko@...il.com>
To:	"Vegard Nossum" <vegard.nossum@...il.com>
Cc:	"Suresh Siddha" <suresh.b.siddha@...el.com>,
	LKML <linux-kernel@...r.kernel.org>,
	"the arch/x86 maintainers" <x86@...nel.org>,
	"Paul E. McKenney" <paulmck@...ux.vnet.ibm.com>,
	"Ingo Molnar" <mingo@...e.hu>,
	"Peter Zijlstra" <a.p.zijlstra@...llo.nl>
Subject: Re: recent -git: BUG in free_thread_xstate

2008/7/23 Vegard Nossum <vegard.nossum@...il.com>:
> On Wed, Jul 23, 2008 at 11:35 PM, Dmitry Adamushko
> <dmitry.adamushko@...il.com> wrote:
>> 2008/7/23 Dmitry Adamushko <dmitry.adamushko@...il.com>:
>>> 2008/7/23 Vegard Nossum <vegard.nossum@...il.com>:
>>>> ------------[ cut here ]------------
>>>> WARNING: at kernel/sched_fair.c:815 hrtick_start_fair+0x158/0x170()
>>>
>>> that's interesting. As a first step and if it's easily reproducible,
>>> would you try something like below?
>>
>> If not, maybe object files are still in-tact? Just to see where
>> exactly in schedule() it crashed so maybe we may get an idea on what
>> was a result of next = pick_next_task(rq, prev);
>
> Yes, indeed. You mean this part?
>
> BUG: unable to handle kernel paging request at c0804358
> IP: [<c057e38d>] schedule+0x1ed/0x850
> *pde = 3780e163 *pte = 00804162
> Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC
> Pid: 5575, comm: migration/1 Tainted: G        W (2.6.26 #1)
> EIP: 0060:[<c057e38d>] EFLAGS: 00010086 CPU: 1
> EIP is at schedule+0x1ed/0x850
> EAX: c0803f00 EBX: 00000001 ECX: f4d10000 EDX: 00450008
> ESI: f4c91fe0 EDI: c0803f00 EBP: f4c85fa0 ESP: f4c85f3c
>
> $ addr2line -e vmlinux -i c057e38d
> kernel/sched_stats.h:164
> kernel/sched_stats.h:236
> kernel/sched_stats.h:242
> kernel/sched.c:4191
>
> (Keep in mind that the line numbers are for v2.6.26.)
>
> Looks to be this line (kernel/sched.c):
>
>                sched_info_switch(prev, next);
>
> or for kernel/sched_stats.h:164:
>
>        unsigned long long now = task_rq(t)->clock, delta = 0;
>
> ..I'm not sure how much information this is?

combining with other information from this thread (which I have
happily ignored before jumping in :-/), it's quite a lot.

't' ('next' from schedule()) is ok in this case. The problem might be
with its thread_info structure. In this case, task_rq(t) resorts to
task_cpu(t) which, in turn, comes to task_thread_info(t)->cpu.

So I guess, 'cpu' value is slightly, well, out of reality. Check the
address of "runqueues" in your kernel image...
I guess, it should be quite close to the "fault" address... then we
can even calculate 'cpu' :-)

task's thread_info is on the stack so if it gets corrupted we may get
something like this.


>
> Most likely the task_struct just got corrupted, like for the xstate
> crashes... Should I still try the patch? :-)

No. It has the same symptoms as above, namely task_cpu() is likely
wrong. So it fits in this "perhaps task's thread_info gets corrupted"
theory.


>
> Vegard
>

-- 
Best regards,
Dmitry Adamushko
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/