2.6.10-rc2-bk7 - kernel BUG at fs/sysfs/file.c:87!

From: Christopher S. Aker
Date: Wed Nov 24 2004 - 14:26:31 EST


Doing "cat /sys/block/sda/queue/iosched/show_status" produces the following BUG:

------------[ cut here ]------------
kernel BUG at fs/sysfs/file.c:87!
invalid operand: 0000 [#1]
SMP
Modules linked in:
CPU: 0
EIP: 0060:[<c018455b>] Not tainted VLI
EFLAGS: 00010206 (2.6.10-rc2-bk7-1-bigmem)
EIP is at fill_read_buffer+0x93/0x9d
eax: 000019bb ebx: f4004fc0 ecx: f7eb8800 edx: c03c49a3
esi: f7eb6188 edi: c04173b0 ebp: c0417348 esp: c0883f34
ds: 007b es: 007b ss: 0068
Process cat (pid: 14936, threadinfo=c0882000 task=f1b1ea20)
Stack: f7eb6188 c0417348 ddff0000 00000000 f4004fc0 c06a0380 c0883fac 00001000
c0184657 f6a19654 f4004fc0 00000000 00001000 00000000 c0150ffc c06a0380
0804d888 00001000 c0883fac e0026148 e0026140 c06a0380 fffffff7 0804d888
Call Trace:
[<c0184657>] sysfs_read_file+0x31/0x6d
[<c0150ffc>] vfs_read+0xb0/0x119
[<c01512ba>] sys_read+0x51/0x80
[<c01023e9>] sysenter_past_esp+0x52/0x71
Code: 10 00 00 7f 26 85 c0 78 1c 89 03 8b 54 24 0c 89 d0 8b 5c 24 10 8b 74 24 14 8b
7c 24 18 8b 6c 24 1c 83 c4 20 c3 89 44 24 0c eb e0 <0f> 0b 57 00 17 3a 3b c0 eb d0 83
ec 24 89 5c 24 14 89 74 24 18

ksymoops output:

>>EIP; c018455b <fill_read_buffer+93/9d> <=====

>>ebx; f4004fc0 <pg0+33af2fc0/3faec400>
>>ecx; f7eb8800 <pg0+379a6800/3faec400>
>>edx; c03c49a3 <__func__.4+1a7a0/41bc1>
>>esi; f7eb6188 <pg0+379a4188/3faec400>
>>edi; c04173b0 <cfq_sysfs_ops+0/8>
>>ebp; c0417348 <cfq_misc_entry+0/14>
>>esp; c0883f34 <pg0+371f34/3faec400>

Trace; c0184657 <sysfs_read_file+31/6d>
Trace; c0150ffc <vfs_read+b0/119>
Trace; c01512ba <sys_read+51/80>
Trace; c01023e9 <sysenter_past_esp+52/71>

This architecture has variable length instructions, decoding before eip
is unreliable, take these instructions with a pinch of salt.

Code; c0184530 <fill_read_buffer+68/9d>
00000000 <_EIP>:
Code; c0184530 <fill_read_buffer+68/9d>
0: 10 00 adc %al,(%eax)
Code; c0184532 <fill_read_buffer+6a/9d>
2: 00 7f 26 add %bh,0x26(%edi)
Code; c0184535 <fill_read_buffer+6d/9d>
5: 85 c0 test %eax,%eax
Code; c0184537 <fill_read_buffer+6f/9d>
7: 78 1c js 25 <_EIP+0x25>
Code; c0184539 <fill_read_buffer+71/9d>
9: 89 03 mov %eax,(%ebx)
Code; c018453b <fill_read_buffer+73/9d>
b: 8b 54 24 0c mov 0xc(%esp,1),%edx
Code; c018453f <fill_read_buffer+77/9d>
f: 89 d0 mov %edx,%eax
Code; c0184541 <fill_read_buffer+79/9d>
11: 8b 5c 24 10 mov 0x10(%esp,1),%ebx
Code; c0184545 <fill_read_buffer+7d/9d>
15: 8b 74 24 14 mov 0x14(%esp,1),%esi
Code; c0184549 <fill_read_buffer+81/9d>
19: 8b 7c 24 18 mov 0x18(%esp,1),%edi
Code; c018454d <fill_read_buffer+85/9d>
1d: 8b 6c 24 1c mov 0x1c(%esp,1),%ebp
Code; c0184551 <fill_read_buffer+89/9d>
21: 83 c4 20 add $0x20,%esp
Code; c0184554 <fill_read_buffer+8c/9d>
24: c3 ret
Code; c0184555 <fill_read_buffer+8d/9d>
25: 89 44 24 0c mov %eax,0xc(%esp,1)
Code; c0184559 <fill_read_buffer+91/9d>
29: eb e0 jmp b <_EIP+0xb>

This decode from eip onwards should be reliable

Code; c018455b <fill_read_buffer+93/9d>
00000000 <_EIP>:
Code; c018455b <fill_read_buffer+93/9d> <=====
0: 0f 0b ud2a <=====
Code; c018455d <fill_read_buffer+95/9d>
2: 57 push %edi
Code; c018455e <fill_read_buffer+96/9d>
3: 00 17 add %dl,(%edi)
Code; c0184560 <fill_read_buffer+98/9d>
5: 3a 3b cmp (%ebx),%bh
Code; c0184562 <fill_read_buffer+9a/9d>
7: c0 eb d0 shr $0xd0,%bl
Code; c0184565 <flush_read_buffer+0/c1>
a: 83 ec 24 sub $0x24,%esp
Code; c0184568 <flush_read_buffer+3/c1>
d: 89 5c 24 14 mov %ebx,0x14(%esp,1)
Code; c018456c <flush_read_buffer+7/c1>
11: 89 74 24 18 mov %esi,0x18(%esp,1)

-Chris

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/