| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20090203172836.GA6964@elte.hu>
Date: Tue, 3 Feb 2009 18:28:36 +0100
From: Ingo Molnar <mingo@...e.hu>
To: Greg KH <gregkh@...e.de>,
Mauro Carvalho Chehab <mchehab@...radead.org>
Cc: linux-kernel@...r.kernel.org, Hans Verkuil <hverkuil@...all.nl>,
Janne Grunau <janne-dvb@...nau.be>,
Luca Olivetti <luca@...toso.org>
Subject: [crash] af9005_usb_module_init(): BUG: unable to handle kernel
paging request at ff100000
FYI, -tip qa keeps triggering this bootup crash occasionally, ever since
June 2008 when a DVB merge brought in this new driver:
[ 59.980634] calling dib0700_module_init+0x0/0x41 @ 1
[ 59.985814] dib0700: loaded with support for 8 different device-types
[ 59.992390] bus: 'usb': add driver dvb_usb_dib0700
[ 59.998014] usbcore: registered new interface driver dvb_usb_dib0700
[ 60.004542] initcall dib0700_module_init+0x0/0x41 returned 0 after 18284 usecs
[ 60.011959] calling af9005_usb_module_init+0x0/0x95 @ 1
[ 60.017419] bus: 'usb': add driver dvb_usb_af9005
[ 60.023624] usbcore: registered new interface driver dvb_usb_af9005
[ 60.030048] BUG: unable to handle kernel paging request at ff100000
[ 60.034004] IP: [<c14ecafe>] af9005_usb_module_init+0x84/0x95
[ 60.034004] *pdpt = 000000000169a001 *pde = 0000000000000000
[ 60.034004] Oops: 0000 [#1] SMP DEBUG_PAGEALLOC
[ 60.034004] last sysfs file:
[ 60.034004]
[ 60.034004] Pid: 1, comm: swapper Not tainted (2.6.29-rc3-tip #2) P4DC6
[ 60.034004] EIP: 0060:[<c14ecafe>] EFLAGS: 00010286 CPU: 2
[ 60.034004] EIP is at af9005_usb_module_init+0x84/0x95
[ 60.034004] EAX: ff100000 EBX: 00000000 ECX: 00000000 EDX: 00000000
[ 60.034004] ESI: 0000000d EDI: c14eca7a EBP: f64fcda0 ESP: f64fcd9c
[ 60.034004] DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068
[ 60.034004] Process swapper (pid: 1, ti=f64fc000 task=f6518000 task.ti=f64fc000)
[ 60.034004] Stack:
[ 60.034004] f950ea97 f64fcfc8 c0101088 00000000 c016ff33 f6518000 00000000 00000002
[ 60.034004] f651854c 00000002 00000005 c18f2ea0 003d0005 f6518000 f64fce44 c0172a24
[ 60.034004] ffffffff 00000000 00000005 00000000 00000001 00000000 00000001 00000000
[ 60.034004] Call Trace:
[ 60.034004] [<c0101088>] ? do_one_initcall+0x6a/0x16e
[ 60.034004] [<c016ff33>] ? register_lock_class+0x17/0x226
[ 60.034004] [<c0172a24>] ? __lock_acquire+0xabf/0xad8
[ 60.034004] [<c0172a24>] ? __lock_acquire+0xabf/0xad8
[ 60.034004] [<c01ae8b6>] ? page_address+0x1a/0x99
[ 60.034004] [<c01c5df1>] ? check_bytes_and_report+0x26/0x94
[ 60.034004] [<c01c7921>] ? kmem_cache_free+0xcf/0xd7
[ 60.034004] [<c016fe60>] ? lock_release_holdtime+0x43/0x48
[ 60.034004] [<c054bb8a>] ? _raw_spin_unlock+0xa7/0xcb
[ 60.034004] [<c0d089a5>] ? _spin_unlock+0x22/0x25
[ 60.034004] [<c020b1e0>] ? proc_register+0x14b/0x15c
[ 60.034004] [<c020b2f5>] ? create_proc_entry+0x72/0x86
[ 60.034004] [<c0189f8a>] ? init_irq_proc+0x58/0x65
[ 60.034004] [<c14b2826>] ? kernel_init+0x114/0x168
[ 60.034004] [<c14b2712>] ? kernel_init+0x0/0x168
[ 60.034004] [<c011b457>] ? kernel_thread_helper+0x7/0x10
[ 60.034004] Code: 09 b8 00 00 10 ff 85 c0 75 17 68 60 31 21 c1 e8 29 49 c6 fe c7 05 00 b6 3b c1 00 00 00 00 58 eb 14 c7 05 f8 b5 3b c1 00 00 10 ff <a1> 00 00 10 ff a3 fc b5 3b c1 89 d8 8b 5d fc c9 c3 55 89 e5 53
[ 60.034004] EIP: [<c14ecafe>] af9005_usb_module_init+0x84/0x95 SS:ESP 0068:f64fcd9c
[ 60.034004] ---[ end trace 3926c3016b33ad96 ]---
it first triggered last June.
Config attached - disassembly below. Reliable testbox otherwise (and other
x86 hw triggered such crashes too in the past).
( Note, it's a relocatable kernel so the symbols are offset by 0xf00000.)
Ingo
c23eca7a <af9005_usb_module_init>:
c23eca7a: 55 push %ebp
c23eca7b: 89 e5 mov %esp,%ebp
c23eca7d: 53 push %ebx
c23eca7e: b9 2b 31 11 c2 mov $0xc211312b,%ecx
c23eca83: 31 d2 xor %edx,%edx
c23eca85: b8 b8 b4 2b c2 mov $0xc22bb4b8,%eax
c23eca8a: e8 d6 e8 4e ff call c18db365 <usb_register_driver>
c23eca8f: 89 c3 mov %eax,%ebx
c23eca91: 85 c0 test %eax,%eax
c23eca93: 74 0f je c23ecaa4 <af9005_usb_module_init+0x2a>
c23eca95: 50 push %eax
c23eca96: 68 3a 31 11 c2 push $0xc211313a
c23eca9b: e8 70 49 c6 fe call c1051410 <printk>
c23ecaa0: 58 pop %eax
c23ecaa1: 5a pop %edx
c23ecaa2: eb 64 jmp c23ecb08 <af9005_usb_module_init+0x8e>
c23ecaa4: c7 05 8c 71 cd c2 00 movl $0x0,0xc2cd718c
c23ecaab: 00 00 00
c23ecaae: c7 05 90 71 cd c2 00 movl $0x0,0xc2cd7190
c23ecab5: 00 00 00
c23ecab8: c7 05 94 71 cd c2 00 movl $0x0,0xc2cd7194
c23ecabf: 00 00 00
c23ecac2: b8 00 00 00 00 mov $0x0,%eax
c23ecac7: 85 c0 test %eax,%eax
c23ecac9: 74 12 je c23ecadd <af9005_usb_module_init+0x63>
c23ecacb: b8 00 00 00 00 mov $0x0,%eax
c23ecad0: 85 c0 test %eax,%eax
c23ecad2: 74 09 je c23ecadd <af9005_usb_module_init+0x63>
c23ecad4: b8 00 00 00 00 mov $0x0,%eax
c23ecad9: 85 c0 test %eax,%eax
c23ecadb: 75 17 jne c23ecaf4 <af9005_usb_module_init+0x7a>
c23ecadd: 68 60 31 11 c2 push $0xc2113160
c23ecae2: e8 29 49 c6 fe call c1051410 <printk>
c23ecae7: c7 05 00 b6 2b c2 00 movl $0x0,0xc22bb600
c23ecaee: 00 00 00
c23ecaf1: 58 pop %eax
c23ecaf2: eb 14 jmp c23ecb08 <af9005_usb_module_init+0x8e>
c23ecaf4: c7 05 f8 b5 2b c2 00 movl $0x0,0xc22bb5f8
c23ecafb: 00 00 00
c23ecafe: a1 00 00 00 00 mov 0x0,%eax <= crash
c23ecb03: a3 fc b5 2b c2 mov %eax,0xc22bb5fc
c23ecb08: 89 d8 mov %ebx,%eax
c23ecb0a: 8b 5d fc mov -0x4(%ebp),%ebx
c23ecb0d: c9 leave
c23ecb0e: c3 ret
View attachment "config" of type "text/plain" (74649 bytes)
Powered by blists - more mailing lists