[OOPS] 2.2.10-ac8 bug found

Robbert Muller (mjrider@Cam031312.student.utwente.nl)
Thu, 5 Aug 1999 10:50:30 +0200 (CEST)


[1.] One line summary of the problem:
oops with kernel 2.2.10-ac8 ( by slab magic )

[2.] Full description of the problem/report:
i think that when the unused modules where removed by cronjob the ppa
module did some nasty thinks, ( this because thats the only thing which
uses scsi here ). the slab magic by alan cox made it say oops.

[3.] Keywords (i.e., modules, networking, kernel):
kernel / modules i'm not sure
[4.] Kernel version (from /proc/version):
Linux version 2.2.10-ac8 (root@mjrider.student.utwente.nl) (gcc version egcs-2.91.66 19990314/Linux (egcs-1.1.2 release)) #2 Sun Jul 4 16:13:00 CEST 1999

[5.] Output of Oops.. message (if applicable) with symbolic information
resolved (see Documentation/oops-tracing.txt)
Options used: -V (default)
-o /lib/modules/2.2.10-ac8/ (default)
-k /proc/ksyms (default)
-l /proc/modules (default)
-m /usr/src/linux/System.map (default)
-c 1 (default)

You did not tell me where to find symbol information. I will assume
that the log matches the kernel and modules that are running right now
and I'll use the default options above for symbol resolution.
If the current kernel and/or modules do not match the log, you can get
more accurate output by telling me the kernel version and where to find
map, modules, ksyms etc. ksymoops -h explains the options.

Warning in compare_ksyms_lsmod, module 3c59x is in lsmod but not in ksyms, probably no symbols exported
Warning in compare_ksyms_lsmod, module ip_masq_ftp is in lsmod but not in ksyms, probably no symbols exported
Warning in compare_ksyms_lsmod, module ip_masq_irc is in lsmod but not in ksyms, probably no symbols exported
Warning in compare_ksyms_lsmod, module ip_masq_quake is in lsmod but not in ksyms, probably no symbols exported
Warning in compare_ksyms_lsmod, module ip_masq_raudio is in lsmod but not in ksyms, probably no symbols exported
Warning in compare_ksyms_lsmod, module sd_mod is in lsmod but not in ksyms, probably no symbols exported
Unable to handle kernel NULL pointer dereference at virtual address 00000000
current->tss.cr3 = 05c22000, %cr3 = 05c22000
*pde = 00000000
Oops: 0002
CPU: 0
EIP: 0010:[<c011eb1f>]
EFLAGS: 00010292
eax: 0000001b ebx: 5a5a5a5a ecx: 0000001f edx: 0000001c
esi: c18c3aa0 edi: 5a5a5a5a ebp: c685de80 esp: c5c1ff2c
ds: 0018 es: 0018 ss: 0018
Process rmmod (pid: 5167, process nr: 114, stackpage=c5c1f000)
Stack: 5a5a5a5a c18c3aa0 c18c3b40 c685de80 a5c32f2b 00001548 00000246 c684df3a
5a5a5a5a 5a5a5a5a c684f2be 5a5a5a5a 00000118 c685a000 c685a000 00000001
00000000 c684f3a2 c685de80 c685ce12 00000004 c685de80 c685a000 c685a000
Call Trace: [<c685de80>] [<c684df3a>] [<c684f2be>] [<c685a000>] [<c685a000>] [<c684f3a2>] [<c685de80>]
[<c685ce12>] [<c685de80>] [<c685a000>] [<c685a000>] [<c0114568>] [<c685a000>] [<c684c000>] [<c0113c3c>]
[<c685a000>] [<c01079bc>]
Code: c7 05 00 00 00 00 00 00 00 00 83 c4 08 5b 5e 5f 5d 83 c4 0c

>>EIP: c011eb1f <kfree+28f/2a4>
Trace: c685de80 <scsi_mlqueue_remove_lock+5858/6a24>
Trace: c684df3a <scsi_init_free+32/38>
Trace: c684f2be <scsi_unregister_device+5e/b4>
Trace: c685a000 <scsi_mlqueue_remove_lock+19d8/6a24>
Trace: c685a000 <scsi_mlqueue_remove_lock+19d8/6a24>
Trace: c684f3a2 <scsi_unregister_module+32/38>
Trace: c685de80 <scsi_mlqueue_remove_lock+5858/6a24>
Trace: c685ce12 <scsi_mlqueue_remove_lock+47ea/6a24>
Trace: c685a000 <scsi_mlqueue_remove_lock+19d8/6a24>
Code: c011eb1f <kfree+28f/2a4> 00000000 <_EIP>: <===
Code: c011eb1f <kfree+28f/2a4> 0: c7 05 00 00 00 00 00 movl $0x0,0x0 <===
Code: c011eb26 <kfree+296/2a4> 7: 00 00 00
Code: c011eb29 <kfree+299/2a4> a: 83 c4 08 addl $0x8,%esp
Code: c011eb2c <kfree+29c/2a4> d: 5b popl %ebx
Code: c011eb2d <kfree+29d/2a4> e: 5e popl %esi
Code: c011eb2e <kfree+29e/2a4> f: 5f popl %edi
Code: c011eb2f <kfree+29f/2a4> 10: 5d popl %ebp
Code: c011eb30 <kfree+2a0/2a4> 11: 83 c4 0c addl $0xc,%esp

7 warnings issued. Results may not be reliable.

[6.] A small shell script or example program which triggers the
problem (if possible)
i think this should do the trick ( can't test it now i'm not at the
console right now )

#!/bin/sh
modprobe ppa
rmmod ppa

[7.] Environment
Redhat linux 6.0 al updates installed
by own build kernel 2.2.10 +ac8 patch
[7.1.] Software (add the output of the ver_linux script here)
-- Versions installed: (if some fields are empty or looks
-- unusual then possibly you have very old versions)
Linux mjrider.student.utwente.nl 2.2.10-ac8 #2 Sun Jul 4 16:13:00 CEST 1999 i586 unknown
Kernel modules 2.1.121
Gnu C egcs-2.91.66
Binutils 2.9.1.0.23
Linux C Library 2.1.1
Dynamic linker ldd (GNU libc) 2.1.1
Procps 2.0.2
Mount 2.9o
Net-tools 1.52
Kbd [option...]
Sh-utils 1.16
Modules Loaded ppa sd_mod scsi_mod ip_masq_quake ip_masq_raudio ip_masq_irc ip_masq_ftp 3c509 3c59x

[7.2.] Processor information (from /proc/cpuinfo):
processor : 0
vendor_id : AuthenticAMD
cpu family : 5
model : 8
model name : AMD-K6(tm) 3D processor
stepping : 0
cpu MHz : 299.385540
fdiv_bug : no
hlt_bug : no
sep_bug : no
f00f_bug : no
coma_bug : no
fpu : yes
fpu_exception : yes
cpuid level : 1
wp : yes
flags : fpu vme de pse tsc msr mce cx8 sep mmx 3dnow
bogomips : 598.02

[7.3.] Module information (from /proc/modules):
ppa 9040 0
sd_mod 16316 0 (deleted)
scsi_mod 50736 2 (autoclean) [ppa sd_mod]
ip_masq_quake 1092 0 (unused)
ip_masq_raudio 2736 0 (unused)
ip_masq_irc 1360 0 (unused)
ip_masq_ftp 2352 0
3c509 5812 1 (autoclean)
3c59x 18920 1 (autoclean)

[7.4.] SCSI information (from /proc/scsi/scsi)
Attached devices:
Host: scsi0 Channel: 00 Id: 06 Lun: 00
Vendor: IOMEGA Model: ZIP 100 Rev: D.13
Type: Direct-Access ANSI SCSI revision: 02
[7.5.] Other information that might be relevant to the problem
(please look in /proc and include all information that you
think to be relevant):

[extra] [desg]
Linux version 2.2.10-ac8 (root@mjrider.student.utwente.nl) (gcc version egcs-2.91.66 19990314/Linux (egcs-1.1.2 release)) #2 Sun Jul 4 16:13:00 CEST 1999
Detected 299385540 Hz processor.
Console: colour VGA+ 80x25
Calibrating delay loop... 598.02 BogoMIPS
Memory: 95372k/98304k available (1040k kernel code, 412k reserved, 1444k data, 36k init)
VFS: Diskquotas version dquot_6.4.0 initialized
CPU: AMD AMD-K6(tm) 3D processor stepping 00
Checking 386/387 coupling... OK, FPU using exception 16 error reporting.
Checking 'hlt' instruction... OK.
POSIX conformance testing by UNIFIX
PCI: PCI BIOS revision 2.10 entry at 0xf0430
PCI: Using configuration type 1
PCI: Probing PCI hardware
Linux NET4.0 for Linux 2.2
Based upon Swansea University Computer Society NET3.039
NET4: Unix domain sockets 1.0 for Linux NET4.0.
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP
IPv4 over IPv4 tunneling driver
early initialization of device tunl0 is deferred
GRE over IPv4 tunneling driver
early initialization of device gre0 is deferred
Initializing RT netlink socket
Starting kswapd v 1.5
parport0: PC-style at 0x378 [SPP,PS2,EPP]
Serial driver version 4.27 with no serial options enabled
ttyS00 at 0x03f8 (irq = 4) is a 16550A
ttyS01 at 0x02f8 (irq = 3) is a 16550A
pty: 2048 Unix98 ptys configured
Sound initialization started
<Sound Blaster 16 (4.13)> at 0x220 irq 5 dma 1,5
<Sound Blaster 16> at 0x330 irq 5 dma 0
<Yamaha OPL3> at 0x388
Sound initialization complete
loop: registered device at major 7
PIIX3: IDE controller on PCI bus 00 dev 39
PIIX3: not 100% native mode: will probe irqs later
ide0: BM-DMA at 0xe800-0xe807, BIOS settings: hda:DMA, hdb:DMA
ide1: BM-DMA at 0xe808-0xe80f, BIOS settings: hdc:DMA, hdd:pio
hda: QUANTUM FIREBALL ST2.1A, ATA DISK drive
hdb: OPTICS 12X IDE CD-ROM, ATAPI CDROM drive
hdc: IBM-DTTA-351010, ATA DISK drive
ide0 at 0x1f0-0x1f7,0x3f6 on irq 14
ide1 at 0x170-0x177,0x376 on irq 15
hda: QUANTUM FIREBALL ST2.1A, 2014MB w/81kB Cache, CHS=1023/64/63, (U)DMA
hdc: IBM-DTTA-351010, 9671MB w/466kB Cache, CHS=19650/16/63, (U)DMA
Uniform CDROM driver Revision: 2.55
PPP: version 2.3.7 (demand dialling)
TCP compression code copyright 1989 Regents of the University of California
PPP line discipline registered.
Partition check:
hda: hda1 hda2 hda4 < hda5 hda6 hda7 hda8 >
hdc: hdc1 hdc2 hdc4 < hdc5 hdc6 hdc7 >
VFS: Mounted root (ext2 filesystem) readonly.
Freeing unused kernel memory: 36k freed
Adding Swap: 102780k swap-space (priority -1)
Adding Swap: 102780k swap-space (priority -2)
3c59x.c:v0.99H 11/17/98 Donald Becker http://cesdis.gsfc.nasa.gov/linux/drivers/vortex.html
eth0: 3Com 3c905B Cyclone 100baseTx at 0xe000, 00:10:5a:64:e9:78, IRQ 12
8K byte-wide RAM 5:3 Rx:Tx split, autoselect/Autonegotiate interface.
MII transceiver found at address 24, status 786d.
MII transceiver found at address 0, status 786d.
Enabling bus-master transmits and whole-frame receives.
eth1: 3c509 at 0x280 tag 1, 10baseT port, address 00 60 8c 95 e5 55, IRQ 10.
3c509.c:1.16 (2.2) 2/3/98 becker@cesdis.gsfc.nasa.gov.
ppa: Version 2.03 (for Linux 2.2.x)
ppa: Found device at ID 6, Attempting to use EPP 32 bit
ppa: Communication established with ID 6 using EPP 32 bit
scsi0 : Iomega VPI0 (ppa) interface
scsi : 1 host.
Vendor: IOMEGA Model: ZIP 100 Rev: D.13
Type: Direct-Access ANSI SCSI revision: 02
Detected scsi removable disk sda at scsi0, channel 0, id 6, lun 0
SCSI device sda: hdwr sector= 512 bytes. Sectors= 196608 [96 MB] [0.1 GB]
sda: Write Protect is off
sda: sda4
kfree: Bad obj 5a5a5a5a
Unable to handle kernel NULL pointer dereference at virtual address 00000000
current->tss.cr3 = 05c22000, %cr3 = 05c22000
*pde = 00000000
Oops: 0002
CPU: 0
EIP: 0010:[<c011eb1f>]
EFLAGS: 00010292
eax: 0000001b ebx: 5a5a5a5a ecx: 0000001f edx: 0000001c
esi: c18c3aa0 edi: 5a5a5a5a ebp: c685de80 esp: c5c1ff2c
ds: 0018 es: 0018 ss: 0018
Process rmmod (pid: 5167, process nr: 114, stackpage=c5c1f000)
Stack: 5a5a5a5a c18c3aa0 c18c3b40 c685de80 a5c32f2b 00001548 00000246 c684df3a
5a5a5a5a 5a5a5a5a c684f2be 5a5a5a5a 00000118 c685a000 c685a000 00000001
00000000 c684f3a2 c685de80 c685ce12 00000004 c685de80 c685a000 c685a000
Call Trace: [<c685de80>] [<c684df3a>] [<c684f2be>] [<c685a000>] [<c685a000>] [<c684f3a2>] [<c685de80>]
[<c685ce12>] [<c685de80>] [<c685a000>] [<c685a000>] [<c0114568>] [<c685a000>] [<c684c000>] [<c0113c3c>]
[<c685a000>] [<c01079bc>]
Code: c7 05 00 00 00 00 00 00 00 00 83 c4 08 5b 5e 5f 5d 83 c4 0c

i'll hope this helps tracking down this bug

grtz

-- 

Robbert Muller

mjrider@writeme dot com | Never let a luser on your console. uin: 9659330 | Because that means they're in your room.

- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/