From: Dave Hansen <haveblue@us.ibm.com>
To: Ingo Molnar <mingo@redhat.com>
Cc: Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
Andrew Morton <akpm@digeo.com>
Subject: Structure clobbering causes timer oopses
Date: Sat, 12 Oct 2002 17:59:49 -0700 [thread overview]
Message-ID: <3DA8C585.1030600@us.ibm.com> (raw)
It put some extrace checks in timer_t, including a tripwire at the
beginning and end, just in case the timer was just trampled by
something. It was.
I added begin, and end:
> struct timer_list {
>+ unsigned int begin;
> struct list_head entry;
> unsigned long expires;
>
> void (*function)(unsigned long);
> unsigned long data;
>
> struct tvec_t_base_s *base;
>+ unsigned int end;
> };
> static inline void init_timer(struct timer_list * timer)
> {
>+ timer->begin = TIMER_BEG_MAGIC;
>+ timer->end = TIMER_END_MAGIC;
> timer->base = NULL;
> }
then this beast:
(yeah, yeah, it ain't pretty, but it worked)
> #define CHECK_TIMER(timer) do {\
> if (((timer)->begin!=TIMER_BEG_MAGIC) || \
> ((timer)->end!=TIMER_END_MAGIC)) {\
> printk("timer magic check failed %s:%s():%d\n",
> __stringify(KBUILD_BASENAME),__FUNCTION__,__LINE__);\
> printk("begin: 0x%x end:0x%x\n", (timer)->begin,
> (timer)->end);\
> dump_stack();\
> }} while (0)
Just before a crash, I got:
timer magic check failed timer:__run_timers():351
begin: 0xc035fbc8 end:0xc035fbe8
Call Trace:
[<c0120d53>] run_timer_tasklet+0xf7/0x188
[<c011d945>] tasklet_hi_action+0x85/0xe0
[<c011d64a>] do_softirq+0x5a/0xac
[<c01117ed>] smp_apic_timer_interrupt+0x111/0x118
[<c0105334>] poll_idle+0x0/0x48
[<c0107a7a>] apic_timer_interrupt+0x1a/0x20
[<c0105334>] poll_idle+0x0/0x48
[<c010535d>] poll_idle+0x29/0x48
[<c01053b3>] cpu_idle+0x37/0x48
[<c011898d>] printk+0x125/0x140
Then, the full crash:
general protection fault: fbe0
CPU: 4
EIP: 0060:[<c035fbe9>] Not tainted
EFLAGS: 00010287
EIP is at tvec_bases+0x169/0x20400
eax: d18deac0 ebx: c035dbcc ecx: c035fbe0 edx: c0363f70
esi: c035fbd8 edi: c0363b00 ebp: 00000001 esp: f77c7f1c
ds: 0068 es: 0068 ss: 0068
Process swapper (pid: 0, threadinfo=f77c6000 task=f77c5060)
Stack: c0120d9b c035fbe0 cb1101c8 00000000 f77c6000 c011d945 00000000
00000001 c035f960 fffffffe 00000080 c03443e4 c03443e4 c011d64a
c035f960 00000010 00000004 00000000 00000000 00000046 c01117ed
f77c6000 c0105334 00000000
Call Trace:
[<c0120d9b>] run_timer_tasklet+0x13f/0x188
[<c011d945>] tasklet_hi_action+0x85/0xe0
[<c011d64a>] do_softirq+0x5a/0xac
[<c01117ed>] smp_apic_timer_interrupt+0x111/0x118
[<c0105334>] poll_idle+0x0/0x483
[<c0107a7a>] apic_timer_interrupt+0x1a/0x20
[<c0105334>] poll_idle+0x0/0x48
[<c010535d>] poll_idle+0x29/0x48
[<c01053b3>] cpu_idle+0x37/0x48
[<c011898d>] printk+0x125/0x140
APIC error on CPU4: 08(08)
APIC error on CPU4: 08(08)
APIC error on CPU4: 08(08)
APIC error on CPU4: 08(08)
...
Notice that the junk that got put in begin, end, and function, are
fairly close values, like something was trying to fill out an array.
Can anyone think of clever ways to figure out what is doing the
trampling?
BTW, I found lots of users who aren't using init_timer(). Should I
publicly humiliate them?
--
Dave Hansen
haveblue@us.ibm.com
next reply other threads:[~2002-10-13 0:54 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2002-10-13 0:59 Dave Hansen [this message]
2002-10-13 1:07 ` Structure clobbering causes timer oopses Andrew Morton
2002-10-13 2:09 ` Dave Hansen
2002-10-13 19:50 ` Dipankar Sarma
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=3DA8C585.1030600@us.ibm.com \
--to=haveblue@us.ibm.com \
--cc=akpm@digeo.com \
--cc=linux-kernel@vger.kernel.org \
--cc=mingo@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).