Re: v2.6.31-rc6: BUG: unable to handle kernel NULL pointer dereference at 0000000000000008

[Xiaotian Feng]

I got following on 2.6.31-rc5 and rc6 .....

------------[ cut here ]------------
kernel BUG at kernel/workqueue.c:287!
invalid opcode: 0000 [#1] SMP
last sysfs file: /sys/devices/pci0000:00/0000:00:19.0/irq
CPU 2
Modules linked in: fuse sco bridge stp llc bnep l2cap bluetooth sunrpc
ip6t_REJECT nf_conntrack_ipv6 ip6table_filter ip6_tables ipv6
dm_multipath uinput radeon snd_hda_codec_analog ttm drm snd_hda_intel
i2c_algo_bit i2c_i801 snd_hda_codec snd_hwdep snd_pcm wmi dcdbas
i2c_core ppdev parport_pc parport snd_timer e1000e snd soundcore
snd_page_alloc iTCO_wdt iTCO_vendor_support pcspkr serio_raw
ata_generic pata_acpi [last unloaded: speedstep_lib]
Pid: 17, comm: events/2 Not tainted 2.6.31-rc5 #51 OptiPlex 760
RIP: 0010:[<ffffffff81060941>]Â [<ffffffff81060941>] worker_thread+0x1bc/0x31d
RSP: 0000:ffff88022ec61de0Â EFLAGS: 00010286
RAX: ffff88021200d238 RBX: ffff88003598ec00 RCX: 000000000000009f
RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff88022edf22f0
RBP: ffff88022ec61eb0 R08: 0000000000000000 R09: ffff88003598ec00
R10: 0000000000000000 R11: 0000000000000000 R12: ffff88021200d230
R13: ffff88003598ec40 R14: 0000000000000000 R15: ffff88003598ec50
FS:Â 0000000000000000(0000) GS:ffff8800357b8000(0000) knlGS:0000000000000000
CS:Â 0010 DS: 0018 ES: 0018 CR0: 000000008005003b
CR2: 0000000001af7aa8 CR3: 00000001fd0d3000 CR4: 00000000000406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process events/2 (pid: 17, threadinfo ffff88022ec60000, task ffff88022edf22f0)
Stack:
Âffffffff81060945 ffffffff81415f34 ffff88022ec61e00 ffff88022ec61e20
<0> ffff88022ec61e20 ffffffff810739bb ffff88021200d238 ffff88022edf22f0
<0> 0000000000000000 0000000000000000 0000000000000000 0000000000000000
Call Trace:
Â[<ffffffff81060945>] ? worker_thread+0x1c0/0x31d
Â[<ffffffff81415f34>] ? thread_return+0x3e/0xaf
Â[<ffffffff810739bb>] ? lock_release_holdtime+0x2c/0x11d
Â[<ffffffff8106549e>] ? autoremove_wake_function+0x0/0x39
Â[<ffffffff81060785>] ? worker_thread+0x0/0x31d
Â[<ffffffff8106513c>] kthread+0x8a/0x92
Â[<ffffffff81012d4a>] child_rip+0xa/0x20
Â[<ffffffff810126d0>] ? restore_args+0x0/0x30
Â[<ffffffff810650b2>] ? kthread+0x0/0x92
Â[<ffffffff81012d40>] ? child_rip+0x0/0x20
Code: 08 48 89 31 48 89 52 08 48 89 12 48 89 85 60 ff ff ff e8 66 74
3b 00 48 8b 85 60 ff ff ff 48 8b 50 f8 48 83 e2 fc 48 39 d3 74 04 <0f>
0b eb fe f0 80 60 f8 fe 48 8b bb a8 00 00 00 45 31 c9 31 c9
RIPÂ [<ffffffff81060941>] worker_thread+0x1bc/0x31d
ÂRSP <ffff88022ec61de0>
---[ end trace 4d8a59030f36f167 ]---



On Thu, Aug 20, 2009 at 3:33 PM, Eric W. Biederman
<ebiederm@xxxxxxxxxxxx> wrote:
>
> Xiaotian Feng <xtfeng@xxxxxxxxx> writes:
>
> > On Thu, Aug 20, 2009 at 2:07 PM, Eric W. Biederman <ebiederm@xxxxxxxxxxxx>
> > wrote:
> >
> >
> > Â Â ebiederm@xxxxxxxxxxxx (Eric W. Biederman) writes:
> >
> > Â Â > I'm not certain who I should route this too, but I just had 2.6.31-rc6
> > Â Â > fall over on me. ÂI don't know how reproducible this will be but
> > Â Â > I have a full crash dump if someone is interested in looking into this.
> >
> > Â Â Looks like I was wrong. ÂThis is appears trivial to reproduce,
> > Â Â I have just reproduced it two more times in a row. ÂI think
> > Â Â the problem is pty related.
> >
> > Â Â I was looking into a change in behavior on 2.6.31-rc6 where
> > Â Â data was being lost, and it appears one variant of my test program
> > Â Â kills the kernel.
> >
> > Â Â The following program run as an unprivileged user causes a kernel
> > Â Â panic in about a minute:
> >
> > Â Â aka
> >
> > Â Â while :; do ./KernelTtyTest ; done
> >
> >
> > oops.... It panics my x86_64 machine.....
>
> I guess I forgot to mention that detail. ÂThanks for confirming this
> bug isn't just me.
>
> Eric
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/