linux-kernel - Re: [RFC 0/4] Using HPET in MSI mode and setting up per CPU HPET timers

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20080906130353.GA30340@elte.hu>
Date:	Sat, 6 Sep 2008 15:03:53 +0200
From:	Ingo Molnar <mingo@...e.hu>
To:	venkatesh.pallipadi@...el.com
Cc:	tglx@...utronix.de, hpa@...or.com, linux-kernel@...r.kernel.org,
	shaohua.li@...el.com, Yinghai Lu <yhlu.kernel@...il.com>
Subject: Re: [RFC 0/4] Using HPET in MSI mode and setting up per CPU HPET
	timers


* Ingo Molnar <mingo@...e.hu> wrote:

> There's a few routine checks this new has to pass: we've got to see 
> how widely this works and whether there are any bugs/quirks to take 
> care of, so i created a separate feature topic for it: 
> tip/timers/hpet-percpu.

it crashes two testsystems, the fault on a NULL pointer in hpet init, 
with:

initcall print_all_ICs+0x0/0x520 returned 0 after 26 msecs
calling  hpet_late_init+0x0/0x1c0
BUG: unable to handle kernel NULL pointer dereference at 000000000000008c
IP: [<ffffffff80d228be>] hpet_late_init+0xfe/0x1c0
PGD 0 
Oops: 0000 [1] SMP 
CPU 0 
Modules linked in:
Pid: 1, comm: swapper Not tainted 2.6.27-rc5 #29725
RIP: 0010:[<ffffffff80d228be>]  [<ffffffff80d228be>] hpet_late_init+0xfe/0x1c0
RSP: 0018:ffff88003fa07dd0  EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000000
RDX: ffffc20000000160 RSI: 0000000000000000 RDI: 0000000000000003
RBP: ffff88003fa07e90 R08: 0000000000000000 R09: ffff88003fa07dd0
R10: 0000000000000001 R11: 0000000000000000 R12: ffff88003fa07dd0
R13: 0000000000000002 R14: ffffc20000000000 R15: 000000006f57e511
FS:  0000000000000000(0000) GS:ffffffff80cf6a80(0000) knlGS:0000000000000000
CS:  0010 DS: 0018 ES: 0018 CR0: 000000008005003b
CR2: 000000000000008c CR3: 0000000000201000 CR4: 00000000000006e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process swapper (pid: 1, threadinfo ffff88003fa06000, task ffff88003fa08000)
Stack:  00000000fed00000 ffffc20000000000 0000000100000003 0000000800000002
 0000000000000000 0000000000000000 0000000000000000 0000000000000000
 0000000000000000 0000000000000000 0000000000000000 0000000000000000
Call Trace:
 [<ffffffff80d227c0>] ? hpet_late_init+0x0/0x1c0
 [<ffffffff80209045>] do_one_initcall+0x45/0x190
 [<ffffffff80296f39>] ? register_irq_proc+0x19/0xe0
 [<ffffffff80d0d140>] ? early_idt_handler+0x0/0x73
 [<ffffffff80d0dabc>] kernel_init+0x14c/0x1b0
 [<ffffffff80942ac1>] ? trace_hardirqs_on_thunk+0x3a/0x3f
 [<ffffffff8020dbd9>] child_rip+0xa/0x11
 [<ffffffff8020ceee>] ? restore_args+0x0/0x30
 [<ffffffff80d0d970>] ? kernel_init+0x0/0x1b0
 [<ffffffff8020dbcf>] ? child_rip+0x0/0x11
Code: 20 48 83 c1 01 48 39 f1 75 e3 44 89 e8 4c 8b 05 29 29 22 00 31 f6 48 8d 78 01 66 66 90 89 f0 48 8d 04 80 48 c1 e0 05 4a 8d 0c 00 <f6> 81 8c 00 00 00 08 74 26 8b 81 80 00 00 00 8b 91 88 00 00 00 
RIP  [<ffffffff80d228be>] hpet_late_init+0xfe/0x1c0
 RSP <ffff88003fa07dd0>
CR2: 000000000000008c
Kernel panic - not syncing: Fatal exception
Rebooting in 1 seconds..Press any key to enter the menu

I've attached the full crashlog and the .config as well.

i bisected it down to:

 45efe60daf77bf628c0dcfdbd2abc3fb531b5114 is first bad commit
 commit 45efe60daf77bf628c0dcfdbd2abc3fb531b5114
 Author: venkatesh.pallipadi@...el.com <venkatesh.pallipadi@...el.com>
 Date:   Fri Sep 5 18:02:18 2008 -0700

     x86: HPET_MSI Initialise per-cpu HPET timers
 
 # bad:  [c25af515] Merge branch 'timers/hpet-percpu'
 # good: [1d09e6e1] Merge branch 'out-of-tree'
 # good: [d81e5e19] Merge branch 'x86/unify-cpu-detect'
 # good: [462e8a8f] x86: HPET_MSI Refactor code in preparation for HPE
 # good: [69e09e1d] x86: HPET_MSI Basic HPET_MSI setup code, cleanups
 # bad:  [45efe60d] x86: HPET_MSI Initialise per-cpu HPET timers

at first look hpet_virt_address must be NULL or so? Probably something 
trivial.

[ Another 32-bit testsystem crashed too but it's not as debuggable as 
  this 64-bit system - i presume it's the same problem. ]

	Ingo

View attachment "crash.log" of type "text/plain" (35816 bytes)

View attachment "config" of type "text/plain" (61190 bytes)