kupdated oops in 2.4.8-pre5

kupdated oops in 2.4.8-pre5

[Peter Osterlund]

I got the following oops with kernel 2.4.8-pre5. bh becomes NULL in
sync_old_buffers() but the code tries to dereference it anyway.

Unable to handle kernel NULL pointer dereference at virtual address 0000001c
c0132ed7
*pde = 00000000
Oops: 0000
CPU:    0
EIP:    0010:[<c0132ed7>]
Using defaults from ksymoops -t elf32-i386 -a i386
EFLAGS: 00010286
eax: 00016975   ebx: c5fec550   ecx: 00000000   edx: 00000000
esi: ffffffff   edi: fff9ffff   ebp: c5fec000   esp: c5fedfc4
ds: 0018   es: 0018   ss: 0018
Process kupdated (pid: 7, stackpage=c5fed000)
Stack: c5fec550 c5fec550 ffffffff c5fec000 c013317c 0008e000 c5fec000 00010f00
       c11e1fb0 c0105000 0008e000 c01054f6 c0231cf0 c0133090 c0223fd8
Call Trace: [<c013317c>] [<c0105000>] [<c01054f6>] [<c0133090>]
Code: 3b 42 1c 0f 89 e0 ff ff ff 81 3d a0 b3 21 c0 a0 b3 21 c0 74

>>EIP; c0132ed7 <sync_old_buffers+27/50>   <=====
Trace; c013317c <kupdate+ec/f0>
Trace; c0105000 <_stext+0/0>
Trace; c01054f6 <kernel_thread+26/30>
Trace; c0133090 <kupdate+0/f0>
Code;  c0132ed7 <sync_old_buffers+27/50>
00000000 <_EIP>:
Code;  c0132ed7 <sync_old_buffers+27/50>   <=====
   0:   3b 42 1c                  cmp    0x1c(%edx),%eax   <=====
Code;  c0132eda <sync_old_buffers+2a/50>
   3:   0f 89 e0 ff ff ff         jns    ffffffe9 <_EIP+0xffffffe9> c0132ec0 <sync_old_buffers+10/50>
Code;  c0132ee0 <sync_old_buffers+30/50>
   9:   81 3d a0 b3 21 c0 a0      cmpl   $0xc021b3a0,0xc021b3a0
Code;  c0132ee7 <sync_old_buffers+37/50>
  10:   b3 21 c0
Code;  c0132eea <sync_old_buffers+3a/50>
  13:   74 00                     je     15 <_EIP+0x15> c0132eec <sync_old_buffers+3c/50>

-- 
Peter Österlund             peter.osterlund@mailbox.swipnet.se
Sköndalsvägen 35            http://home1.swipnet.se/~w-15919
S-128 66 Sköndal            +46 8 942647
Sweden

Re: kupdated oops in 2.4.8-pre5

[Linus Torvalds]

On Tue, 7 Aug 2001, Peter Osterlund wrote:
>
> I got the following oops with kernel 2.4.8-pre5. bh becomes NULL in
> sync_old_buffers() but the code tries to dereference it anyway.

Yes, stupid lost test. Already fixed in -pre6.

		Linus "fast than you can download one kernel" Torvalds

Re: kupdated oops in 2.4.8-pre5

[Paul Jakma]

On Tue, 7 Aug 2001, Linus Torvalds wrote:

> Yes, stupid lost test. Already fixed in -pre6.

Hi Linus,

I'm seeing what appears to be the same problem in pre7, can trigger
it reliably:

Aug  9 08:36:15 dunlop kernel: Unable to handle kernel NULL pointer dereference at virtual address 0000001c
Aug  9 08:36:15 dunlop kernel: c0133dd7
Aug  9 08:36:15 dunlop kernel: *pde = 00000000
Aug  9 08:36:15 dunlop kernel: Oops: 0000
Aug  9 08:36:15 dunlop kernel: CPU:    0
Aug  9 08:36:15 dunlop kernel: EIP:    0010:[sync_old_buffers+39/80]
Aug  9 08:36:15 dunlop kernel: EFLAGS: 00210286
Aug  9 08:36:15 dunlop kernel: eax: 0001691d   ebx: c127c550   ecx: 00000000   edx: 00000000
Aug  9 08:36:15 dunlop kernel: esi: ffffffff   edi: fff9ffff   ebp: c127c000   esp: c127dfc4
Aug  9 08:36:15 dunlop kernel: ds: 0018   es: 0018   ss: 0018
Aug  9 08:36:15 dunlop kernel: Process kupdated (pid: 7, stackpage=c127d000)
Aug  9 08:36:15 dunlop kernel: Stack: ffffff10 c127c550 ffffffff c127c000 c0134078 0008e000 c127c000 00010f00
Aug  9 08:36:15 dunlop kernel:        c7fc5fb0 c0105000 0008e000 c01054f6 c026ce44 c0133f90 c0259fc4
Aug  9 08:36:15 dunlop kernel: Call Trace: [kupdate+232/240] [stext+0/48] [kernel_thread+38/48] [kupdate+0/240]
Aug  9 08:36:15 dunlop kernel: Code: 3b 42 1c 79 e4 81 3d e0 0f 25 c0 e0 0f 25 c0 74 0b 68 e0 0f

Code;  00000000 Before first symbol
00000000 <_EIP>:
Code;  00000000 Before first symbol
   0:   3b 42 1c                  cmp    0x1c(%edx),%eax
Code;  00000003 Before first symbol
   3:   79 e4                     jns    ffffffe9 <_EIP+0xffffffe9>
ffffffe9 <END_OF_CODE+3777d6f5/???
Code;  00000005 Before first symbol
   5:   81 3d e0 0f 25 c0 e0      cmpl   $0xc0250fe0,0xc0250fe0
Code;  0000000c Before first symbol
   c:   0f 25 c0
Code;  0000000f Before first symbol
   f:   74 0b                     je     1c <_EIP+0x1c> 0000001c
Before first symbol
Code;  00000011 Before first symbol
  11:   68 e0 0f 00 00            push   $0xfe0

regards,

Paul Jakma.

Re: kupdated oops in 2.4.8-pre5

[Jens Axboe]

On Thu, Aug 09 2001, Paul Jakma wrote:
> On Tue, 7 Aug 2001, Linus Torvalds wrote:
> 
> > Yes, stupid lost test. Already fixed in -pre6.
> 
> Hi Linus,
> 
> I'm seeing what appears to be the same problem in pre7, can trigger
> it reliably:

Double check your source, afaics it can't happen in pre7.

-- 
Jens Axboe

Re: kupdated oops in 2.4.8-pre5

[Paul Jakma]

On Thu, 9 Aug 2001, Jens Axboe wrote:

> Double check your source, afaics it can't happen in pre7.

ah... sorry... you are right. the Oops would appear to be from -pre5.
I've had so many lockups this morning i lost track which kernel i was
running at what time.

however, there is a good chance that the fix has not worked, as the
trigger for the oops in pre5 is still consistently causing my box to
lockup with pre7 (but without oops).

The trigger is playing an mpeg movie with gtv, when i kill it.
sometimes it happens after the first play of a movie, sometimes the
2nd, 3rd. the box locks solid (with oops in pre5, without in
pre7). sysrq doesn't work. host doesn't respond to pings.

xine does not trigger the lockups. i've no idea what gtv does
differently to xine.

box is Compaq deskpro exd, i815 chipset, PIII 800, G200 graphics,
XFree 4.1.0, glibc 2.2.3.

anything you'd like to try?

--paulj

Re: kupdated oops in 2.4.8-pre5

[Paul Jakma]

On Thu, 9 Aug 2001, Paul Jakma wrote:

> lockup with pre7 (but without oops).

clarification: if there is an oops, it isn't making it to the disk.

as my test case is in X, i can't see whether there is an oops on
console. i've tried to trigger it by running gtv, switching to console
and killing gtv - but not had any luck.

--paulj