linux-kernel - Re: 2.6.30-rc2 hangs in get_measured

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <1239778197.2567.849.camel@ymzhang>
Date:	Wed, 15 Apr 2009 14:49:57 +0800
From:	"Zhang, Yanmin" <yanmin_zhang@...ux.intel.com>
To:	Rusty Russell <rusty@...tcorp.com.au>
Cc:	LKML <linux-kernel@...r.kernel.org>,
	Venkatesh Pallipadi <venkatesh.pallipadi@...el.com>
Subject: Re: 2.6.30-rc2 hangs in get_measured_perf on tigerton

On Wed, 2009-04-15 at 14:01 +0800, Zhang, Yanmin wrote:
> My machine hanged with kernel 2.6.30-rc2 when script read
> /sys/devices/system/cpu/cpu0/cpufreq/scaling_governor.
> 
> opps happens in get_measured_perf:
> 
>         cur.aperf.whole = readin.aperf.whole -
>                                 per_cpu(drv_data, cpu)->saved_aperf;
> 
> Because per_cpu(drv_data, cpu)=NULL.
> 
> So function get_measured_perf should check if (per_cpu(drv_data, cpu)==NULL)
> and return 0 if it's NULL.
> 
> Other functions have such checking.
How about below patch? I tested it on my tigerton machine.

---

--- linux-2.6.30-rc2/arch/x86/kernel/cpu/cpufreq/acpi-cpufreq.c	2009-04-15 02:24:38.000000000 -0400
+++ linux-2.6.30-rc2_cpufreqbug/arch/x86/kernel/cpu/cpufreq/acpi-cpufreq.c	2009-04-15 02:31:37.000000000 -0400
@@ -277,6 +277,9 @@ static unsigned int get_measured_perf(st
 	unsigned int perf_percent;
 	unsigned int retval;
 
+	if (unlikely(per_cpu(drv_data, cpu) == NULL))
+		return 0;
+
 	if (smp_call_function_single(cpu, read_measured_perf_ctrs, &readin, 1))
 		return 0;
 

> 
> yanmin
> 
> 
> 
> --------------sys log------------------
> 
> BUG: unable to handle kernel NULL pointer dereference at 0000000000000020
> IP: [<ffffffff8021af75>] get_measured_perf+0x4a/0xf9
> PGD a7dd88067 PUD a7ccf5067 PMD 0 
> Oops: 0000 [#1] SMP 
> last sysfs file: /sys/devices/system/cpu/cpu0/cpufreq/scaling_governor
> CPU 0 
> Modules linked in: video output
> Pid: 2091, comm: kondemand/0 Not tainted 2.6.30-rc2 #1 MP Server
> RIP: 0010:[<ffffffff8021af75>]  [<ffffffff8021af75>] get_measured_perf+0x4a/0xf9
> RSP: 0018:ffff880a7d56de20  EFLAGS: 00010246
> RAX: 0000000000000000 RBX: 00000046241a42b6 RCX: ffff88004d219000
> RDX: 000000000000b660 RSI: 0000000000000020 RDI: 0000000000000001
> RBP: ffff880a7f052000 R08: 00000046241a42b6 R09: ffffffff807639f0
> R10: 00000000ffffffea R11: ffffffff802207f4 R12: ffff880a7f052000
> R13: ffff88004d20e460 R14: 0000000000ddd5a6 R15: 0000000000000001
> FS:  0000000000000000(0000) GS:ffff88004d200000(0000) knlGS:0000000000000000
> CS:  0010 DS: 0018 ES: 0018 CR0: 000000008005003b
> CR2: 0000000000000020 CR3: 0000000a7f1bf000 CR4: 00000000000006e0
> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
> Process kondemand/0 (pid: 2091, threadinfo ffff880a7d56c000, task ffff880a7d4d18c0)
> Stack:
>  ffff880a7f052078 ffffffff803efd54 00000046241a42b6 000000462ffa9e95
>  0000000000000001 0000000000000001 00000000ffffffea ffffffff8064f41a
>  0000000000000012 0000000000000012 ffff880a7f052000 ffffffff80650547
> Call Trace:
>  [<ffffffff803efd54>] ? kobject_get+0x12/0x17
>  [<ffffffff8064f41a>] ? __cpufreq_driver_getavg+0x42/0x57
>  [<ffffffff80650547>] ? do_dbs_timer+0x147/0x272
>  [<ffffffff80650400>] ? do_dbs_timer+0x0/0x272
>  [<ffffffff802474ca>] ? worker_thread+0x15b/0x1f5
>  [<ffffffff8024a02c>] ? autoremove_wake_function+0x0/0x2e
>  [<ffffffff8024736f>] ? worker_thread+0x0/0x1f5
>  [<ffffffff80249f0d>] ? kthread+0x54/0x83
>  [<ffffffff8020c87a>] ? child_rip+0xa/0x20
>  [<ffffffff80249eb9>] ? kthread+0x0/0x83
>  [<ffffffff8020c870>] ? child_rip+0x0/0x20
> Code: 99 a6 03 00 31 c9 85 c0 0f 85 c3 00 00 00 89 df 4c 8b 44 24 10 48 c7 c2 60 b6 00 00 48 8b 0c fd e0 30 a5 80 4c 89 c3 48 8b 04 0a <48> 2b 58 20 48 8b 44 24 18 48 89 1c 24 48 8b 34 0a 48 2b 46 28 
> RIP  [<ffffffff8021af75>] get_measured_perf+0x4a/0xf9
>  RSP <ffff880a7d56de20>
> CR2: 0000000000000020
> ---[ end trace 2b8fac9a49e19ad4 ]---
> 
> 
> --
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majordomo@...r.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at  http://www.tux.org/lkml/

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/