From: Linus Torvalds <torvalds@linux-foundation.org>
To: Thomas Gleixner <tglx@linutronix.de>,
Bjorn Helgaas <bhelgaas@google.com>,
Yinghai Lu <yinghai@kernel.org>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: "Knut Petersen" <Knut_Petersen@t-online.de>,
"Ingo Molnar" <mingo@kernel.org>,
"Paul McKenney" <paulmck@linux.vnet.ibm.com>,
"Frédéric Weisbecker" <fweisbec@gmail.com>,
linux-kernel <linux-kernel@vger.kernel.org>,
"linux-pci@vger.kernel.org" <linux-pci@vger.kernel.org>
Subject: Re: [BUG 3.12.rc4] Oops: unable to handle kernel paging request during shutdown
Date: Sun, 27 Oct 2013 21:13:29 +0000 [thread overview]
Message-ID: <CA+55aFz9ewd7VhCKDxJUzY4PGH7E3N-xMr=pDGQxf1PyNd1W1w@mail.gmail.com> (raw)
In-Reply-To: <CA+55aFxuVpDo3LvmG9j-Hu7sENLTcsB6_CY2TA4mE-k+CuTeGg@mail.gmail.com>
.. and one more case of freeing a delayed work object (likely a kobject again):
This time it looks like it's in the PCI layer, freeing the msi irq information.
It looks like that code simply does
kobject_del(&entry->kobj);
kobject_put(&entry->kobj);
list_del(&entry->list);
kfree(entry);
and the problem is that the "entry->kobj" may have *other* references
to it, thanks to people accessing it through /sys, so despite doing a
kojbect_del/kobject_put(), it's not at all ok to then do a "kfree()"
on it. The embedded kobj might still be in use.
Afaik, that code should do the kfree() on the kobject in the _release_
method, not synchronously like that.
We already have a msi_kobj_release(), I'm wondering why that doesn't
do the kfree().
Bjorn? Yinghai? Greg, comments about that msi kobj usage?
Linus
---
[ 2373.142964] mei_me 0000:00:16.0: stop
[ 2373.143023] kobject: 'pn544' (ffff88011808f810): kobject_release,
parent (null) (delayed)
[ 2373.143076] kobject: '59' (ffff8800d268f648): kobject_release,
parent (null) (delayed)
[ 2373.143080] ------------[ cut here ]------------
[ 2373.143087] WARNING: CPU: 3 PID: 2922 at lib/debugobjects.c:260
debug_print_object+0x83/0xa0()
[ 2373.143094] ODEBUG: free active (active state 0) object type:
timer_list hint: delayed_work_timer_fn+0x0/0x20
[ 2373.143096] Modules linked in: fuse ipt_MASQUERADE ip6t_REJECT
xt_conntrack bnep bluetooth ip6table_nat nf_conntrack_ipv6
nf_defrag_ipv6 nf_nat_ipv6 ip6table_mangle ip6ta$
[ 2373.143159] CPU: 3 PID: 2922 Comm: rmmod Tainted: G W
3.12.0-rc6-00331-ga2ff82065b5b #2
[ 2373.143162] Hardware name: Sony Corporation SVP11213CXB/VAIO,
BIOS R0270V7 05/17/2013
[ 2373.143164] 0000000000000009 ffff8800b74b5c20 ffffffff8160d4a2
ffff8800b74b5c68
[ 2373.143170] ffff8800b74b5c58 ffffffff810514e8 ffff8800b74a4f00
ffffffff81c365e0
[ 2373.143174] ffffffff819f9133 ffffffff81f4c1b0 0000000000000001
ffff8800b74b5cb8
[ 2373.143179] Call Trace:
[ 2373.143189] [<ffffffff8160d4a2>] dump_stack+0x45/0x56
[ 2373.143195] [<ffffffff810514e8>] warn_slowpath_common+0x78/0xa0
[ 2373.143200] [<ffffffff81051557>] warn_slowpath_fmt+0x47/0x50
[ 2373.143204] [<ffffffff812f8883>] debug_print_object+0x83/0xa0
[ 2373.143209] [<ffffffff8106aa90>] ? execute_in_process_context+0x90/0x90
[ 2373.143214] [<ffffffff812f99fb>] debug_check_no_obj_freed+0x20b/0x250
[ 2373.143219] [<ffffffff8132d213>] ? free_msi_irqs+0x103/0x150
[ 2373.143224] [<ffffffff8115db59>] kfree+0x89/0x160
[ 2373.143227] [<ffffffff8132d213>] free_msi_irqs+0x103/0x150
[ 2373.143232] [<ffffffff8132dc8d>] pci_disable_msi+0x3d/0x60
[ 2373.143241] [<ffffffffa01d2211>] mei_me_remove+0x61/0xb0 [mei_me]
[ 2373.143248] [<ffffffff81317796>] pci_device_remove+0x36/0xb0
[ 2373.143254] [<ffffffff813c6bea>] __device_release_driver+0x7a/0xe0
[ 2373.143260] [<ffffffff813c7568>] driver_detach+0xc8/0xd0
[ 2373.143266] [<ffffffff813c6816>] bus_remove_driver+0x96/0x120
[ 2373.143273] [<ffffffff813c7b77>] driver_unregister+0x27/0x50
[ 2373.143278] [<ffffffff813167ec>] pci_unregister_driver+0x1c/0x90
[ 2373.143286] [<ffffffffa01d3098>] mei_me_driver_exit+0x10/0xf78 [mei_me]
[ 2373.143291] [<ffffffff810b857d>] SyS_delete_module+0x15d/0x2c0
[ 2373.143299] [<ffffffff81002929>] ? do_notify_resume+0x59/0x90
[ 2373.143305] [<ffffffff8161b9a2>] system_call_fastpath+0x16/0x1b
[ 2373.143308] ---[ end trace 25f53c192da70827 ]---
[ 2373.143313] kobject: 'msi_irqs' (ffff880037327a18):
kobject_release, parent ffff880119bb40a8 (delayed)
[ 2373.143458] kobject: 'misc' (ffff8800d6487500): kobject_release,
parent ffff880119bb40a8 (delayed)
[ 2373.143463] kobject: 'mei' (ffff8800d35f3410): kobject_release,
parent (null) (delayed)
[ 2373.143607] kobject: 'mei_me' (ffff88003717ce00):
kobject_release, parent ffff8801194b2818 (delayed)
[ 2373.143670] kobject: 'drivers' (ffff8800d6487600):
kobject_release, parent ffffffffa01d5330 (delayed)
[ 2373.143678] kobject: 'holders' (ffff8800d6714700):
kobject_release, parent ffffffffa01d5330 (delayed)
[ 2373.143682] kobject: 'notes' (ffff8800d6714600): kobject_release,
parent ffffffffa01d5330 (delayed)
next prev parent reply other threads:[~2013-10-27 21:13 UTC|newest]
Thread overview: 45+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <525BD08C.2080101@t-online.de>
2013-10-14 17:53 ` [BUG 3.12.rc4] Oops: unable to handle kernel paging request during shutdown Linus Torvalds
2013-10-14 21:28 ` Paul E. McKenney
2013-10-14 21:51 ` Frederic Weisbecker
2013-10-14 22:31 ` Knut Petersen
2013-10-14 22:43 ` Frederic Weisbecker
2013-10-15 6:40 ` Ingo Molnar
2013-10-15 7:53 ` Knut Petersen
2013-10-17 14:25 ` Frederic Weisbecker
2013-10-18 6:30 ` Ingo Molnar
2013-10-14 21:52 ` Knut Petersen
2013-10-14 23:16 ` Paul E. McKenney
2013-10-15 0:59 ` Paul E. McKenney
2013-10-15 8:06 ` Knut Petersen
2013-10-25 8:38 ` Linus Torvalds
2013-10-25 9:02 ` Linus Torvalds
2013-10-25 9:08 ` Paul E. McKenney
2013-10-25 9:17 ` Greg Kroah-Hartman
2013-10-25 9:13 ` Greg Kroah-Hartman
2013-10-25 9:28 ` Rafael J. Wysocki
2013-10-25 9:51 ` Rafael J. Wysocki
2013-10-25 9:54 ` Viresh Kumar
2013-10-25 10:10 ` Rafael J. Wysocki
2013-10-25 10:00 ` Viresh Kumar
2013-10-25 10:07 ` Linus Torvalds
2013-10-25 11:10 ` Rafael J. Wysocki
2013-10-25 13:49 ` Viresh Kumar
2013-10-25 14:21 ` Rafael J. Wysocki
2013-10-28 15:02 ` Knut Petersen
2013-10-25 10:23 ` Thomas Gleixner
2013-10-25 10:48 ` Linus Torvalds
2013-10-26 11:43 ` Ingo Molnar
2013-10-28 14:50 ` Knut Petersen
2013-10-28 15:01 ` Ingo Molnar
2013-10-28 15:16 ` Ingo Molnar
2013-10-28 15:45 ` Knut Petersen
2013-10-27 20:20 ` Linus Torvalds
2013-10-27 20:39 ` Linus Torvalds
2013-10-27 21:13 ` Linus Torvalds [this message]
2013-10-27 21:24 ` Greg Kroah-Hartman
2013-10-28 17:23 ` Bjorn Helgaas
2013-10-28 17:30 ` Veaceslav Falico
2013-10-28 17:35 ` Bjorn Helgaas
2013-10-28 17:39 ` Veaceslav Falico
2013-10-28 18:52 ` Greg Kroah-Hartman
2013-10-30 18:04 ` Pablo Neira Ayuso
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CA+55aFz9ewd7VhCKDxJUzY4PGH7E3N-xMr=pDGQxf1PyNd1W1w@mail.gmail.com' \
--to=torvalds@linux-foundation.org \
--cc=Knut_Petersen@t-online.de \
--cc=bhelgaas@google.com \
--cc=fweisbec@gmail.com \
--cc=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-pci@vger.kernel.org \
--cc=mingo@kernel.org \
--cc=paulmck@linux.vnet.ibm.com \
--cc=tglx@linutronix.de \
--cc=yinghai@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).