2.3.18ac10 oops in d_lookup

Jarno Paananen (jpaana@s2.org)
30 Sep 1999 12:28:31 +0300


Hi,

I get this oops once in a while, usually during heavy disk
activity (this one was while compiling X).

It seems my computer freezes after all kinds of oopses (even
*(int*)0 = 0 kinds) which it survived earlier, so I had to write
this on paper and retype, so there might be some errors even I
double checked it.

The kernel is 2.3.18ac10 as said, compiled with gcc 2.7.2.3.

Options used: -V -o /lib/modules/2.3.18ac10/ -k /proc/ksyms -l /proc/modules -m /usr/src/linux/System.map

Unable to handle kernel NULL pointer dereference at virtual address 00000000
c013b24d
oops: 0000
CPU: 1
eip: 0010:[<c013b24d>]
EFLAGS: 00010282
eax: 00001890 ebx: ffffffe8 ecx: c042bf12 edx: c042b315
esi: 000064fe edi: 0000000b ebp: 00000000 esp: c45c9dc4
ds: 0018 es: 0018 ss: 0018
Process gcc.real (pid: 4441, stackpage=c45c9000)
Stack: 0000000b c0724ac0 c022468c c3301005 000064fe 00000003 c01352b6 c0724ac0
c45c9e10 c45c9e10 c01355c9 c0724ac0 c45c9e10 0000000b c3301000 c45c8000
00000000 0805d328 00000005 c3301005 00000003 000064fe c0135784 c3301000
Call trace: [<c01352b6>] [<c01355c9>] [<c0135784>] [<c014638c>] [<c0133e68>]
[<c0146c09>] [<c011305a>] [<c01350d8>] [<c010936c>] [<c010aa04>]
Code: 8b 6d 00 8b 74 24 18 39 73 48 75 eb 8b 74 24 24 39 73 0c 75

>>EIP: c013b24d <d_lookup+65/d8>
Trace: c01352b6 <put_write_access+6a/280>
Trace: c01355c9 <lookup_dentry+fd/1ac>
Trace: c0135784 <open_namei+6c/364>
Trace: c014638c <resetup_one_dev+2ef4/7d40>
Trace: c0133e68 <do_execve+40/1258>
Trace: c0146c09 <resetup_one_dev+3771/7d40>
Trace: c011305a <recalc_sigpending+216/238>
Trace: c01350d8 <getname+58/90>
Trace: c010936c <dump_thread+288/2dc>
Trace: c010aa04 <__up_wakeup+1174/21f4>

4 warnings and 2 errors issued. Results may not be reliable.

The disassembled code is:

83d: 8b 6d 00 mov 0x0(%ebp),%ebp
840: 8b 74 24 18 mov 0x18(%esp,1),%esi
844: 39 73 48 cmp %esi,0x48(%ebx)
847: 75 eb jne 834 <d_lookup+0x5c>
849: 8b 74 24 24 mov 0x24(%esp,1),%esi
84d: 39 73 0c cmp %esi,0xc(%ebx)

which corresponds to this C-code:

tmp = tmp->next;

so tmp is initialized NULL by this code:

unsigned int hash = name->hash;
struct list_head *head = d_hash(parent,hash);
struct list_head *tmp = head->next;

where parent and name are parameters.

So it seems that there should be a check for NULL in head->next
or something? What should we do in that case? Or is this just a
symptom of a bug in higher level?

// Jarno

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/