linux-kernel - Re: in 2.6.23-rc3-git7 in do_cciss

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <20080821091514.8f56e2d5.randy.dunlap@oracle.com>
Date:	Thu, 21 Aug 2008 09:15:14 -0700
From:	Randy Dunlap <randy.dunlap@...cle.com>
To:	"Miller, Mike (OS Dev)" <Mike.Miller@...com>
Cc:	lkml <linux-kernel@...r.kernel.org>,
	scsi <linux-scsi@...r.kernel.org>,
	akpm <akpm@...ux-foundation.org>
Subject: Re: in 2.6.23-rc3-git7 in do_cciss_intr

On Thu, 21 Aug 2008 15:48:35 +0000 Miller, Mike (OS Dev) wrote:

> 
> 
> > -----Original Message-----
> > From: Randy Dunlap [mailto:randy.dunlap@...cle.com]
> > Sent: Thursday, August 21, 2008 10:44 AM
> > To: Miller, Mike (OS Dev)
> > Cc: lkml; scsi; akpm
> > Subject: Re: in 2.6.23-rc3-git7 in do_cciss_intr
> >
> > On Thu, 21 Aug 2008 14:26:06 +0000 Miller, Mike (OS Dev) wrote:
> >
> > >
> > >
> > > > -----Original Message-----
> > > > From: rdunlap [mailto:randy.dunlap@...cle.com]
> > > > Sent: Thursday, August 21, 2008 12:53 AM
> > > > To: lkml; scsi; Miller, Mike (OS Dev)
> > > > Subject: BUG: in 2.6.23-rc3-git7 in do_cciss_intr
> > > >
> > > > on x86_64, 4 proc, 8 GB RAM:
> > > >
> > > > calling  cciss_init+0x0/0x2e [cciss] HP CISS Driver (v 3.6.20)
> > > > ACPI: PCI Interrupt Link [LNKA] enabled at IRQ 54 cciss
> > > > 0000:42:08.0: PCI INT A -> Link[LNKA] -> GSI 54 (level, high)
> > > > -> IRQ 54
> > > > cciss0: <0x3238> at PCI 0000:42:08.0 IRQ 503 using DAC
> > > > BUG: unable to handle kernel NULL pointer dereference at
> > > > 0000000000000248
> > > > IP: [<ffffffffa001bb68>] do_cciss_intr+0x627/0xa6c [cciss] PGD
> > > > 17e422067 PUD 17e423067 PMD 0
> > > > Oops: 0002 [1] SMP
> > > > CPU 2
> > > > Modules linked in: cciss(+) ehci_hcd ohci_hcd uhci_hcd
> > > > Pid: 0, comm: swapper Not tainted 2.6.27-rc3-git7 #1
> > > > RIP: 0010:[<ffffffffa001bb68>]  [<ffffffffa001bb68>]
> > > > do_cciss_intr+0x627/0xa6c [cciss]
> > > > RSP: 0018:ffff88027f66fee8  EFLAGS: 00010007
> > > > RAX: 0000000000000000 RBX: ffff88007f840270 RCX: 000000000000000c
> > > > RDX: 0000000000000000 RSI: ffff88027e5c0000 RDI: ffff88027e5c0000
> > > > RBP: ffff88027f66ff18 R08: 0000000000000000 R09: ffff88017fa95e88
> > > > R10: 0000000000000000 R11: ffff88027f66ff48 R12: ffff88027e5c0000
> > > > R13: 0000000000000000 R14: 00000000000001f7 R15: 0000000000000086
> > > > FS:  0000000000680850(0000) GS:ffff88017fc02c80(0000)
> > > > knlGS:0000000000000000
> > > > CS:  0010 DS: 0018 ES: 0018 CR0: 000000008005003b
> > > > CR2: 0000000000000248 CR3: 000000017e425000 CR4: 00000000000006e0
> > > > DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> > > > DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7:
> > > > 0000000000000400 Process swapper (pid: 0, threadinfo
> > > > ffff88017fa94000, task ffff88027f63d340)
> > > > Stack:  ffff88027f66fee0 ffff88017e9b4800 0000000000000000
> > > > 0000000000000000
> > > >  00000000000001f7 0000000000000000 ffff88027f66ff48
> > ffffffff8026757e
> > > > ffffffff80719000 00000000000001f7 ffff88017e9b4800
> > ffffffff80719050
> > > > Call Trace:
> > > >  <IRQ>  [<ffffffff8026757e>] handle_IRQ_event+0x27/0x57
> > > > [<ffffffff80268d08>] handle_edge_irq+0xed/0x12e
> > [<ffffffff8020eaab>]
> > > > do_IRQ+0xf6/0x167  [<ffffffff8020c471>]
> > ret_from_intr+0x0/0xa  <EOI>
> > > > [<ffffffff802122b1>] ?
> > > > default_idle+0x2b/0x40  [<ffffffff802124bf>] ?
> > > > c1e_idle+0xd4/0xdb  [<ffffffff8055677d>] ?
> > > > atomic_notifier_call_chain+0xf/0x11
> > > >  [<ffffffff8020ac6c>] ? cpu_idle+0x71/0x8f [<ffffffff8054e752>] ?
> > > > start_secondary+0x157/0x15c
> > > >
> > > >
> > > > Code: 8b 83 48 02 00 00 48 39 d8 74 37 49 39 9c 24 c0 00
> > 01 00 75 08
> > > > 49 89 84 24 c0 00 01 00 48 8b 83 40 02 00 00 48 8b
> > > > 93 48 02 00 00 <48> 89 90 48 02 00 00 48 8b 93 48 02 00 00 48
> > > > 89 82 40 02 00 00 RIP  [<ffffffffa001bb68>]
> > > > do_cciss_intr+0x627/0xa6c [cciss]  RSP <ffff88027f66fee8>
> > > > CR2: 0000000000000248
> > > > ---[ end trace 902dc79a9e72d3ed ]---
> > > >
> > >
> > > Randy,
> > > Sorry I haven't replied sooner. I saw your earlier mail,
> > just been busy breaking stuff internally. Did this happen
> > during driver init or runtime?
> >
> > Hi Mike,
> >
> > It's very much during driver init.
> >
> > Full boot log and .config are attached.
> >
> > Andrew:  I'll rerun the test ASAP.  Machine is busy atm.
> 
> Randy,
> We know of a race condition in cciss_init_one. It's fixed in 2.6.26 I believe. Here's the patch:
> 
> http://groups.google.com/group/linux.kernel/browse_thread/thread/7b39f2b77622ab03/4f5f45c008655ca1?hl=en&lnk=gst&q=cciss#4f5f45c008655ca1


Mike,
Sorry, but my fingers have typoed the $subject.  My bad.
Kernel is 2.6.27-rc3-git7 (from above):

> > > > Modules linked in: cciss(+) ehci_hcd ohci_hcd uhci_hcd
> > > > Pid: 0, comm: swapper Not tainted 2.6.27-rc3-git7 #1
> > > > RIP: 0010:[<ffffffffa001bb68>]  [<ffffffffa001bb68>]
> > > > do_cciss_intr+0x627/0xa6c [cciss]


---
~Randy
Linux Plumbers Conference, 17-19 September 2008, Portland, Oregon USA
http://linuxplumbersconf.org/
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/