oops 4 sale

Herbert Rosmanith (herp@wildsau.idv.uni-linz.ac.at)
Mon, 19 Aug 1996 14:30:53 +0200 (MET DST)


trying to reproduce the ISDN bug (*)(see below), I came across another
bug. I don't know what triggered it. maybe ISDN did, maybe not ...

general protection: 0000
CPU: 0
EIP: 0010:[<00110b82>]
EFLAGS: 00010286
eax: 01749934 ebx: 0160d000 ecx: 00000480 edx: ffffffff
esi: 00000000 edi: 01749934 ebp: 01c8ff40 esp: 01c8ff34
ds: 0018 es: 0018 fs: 002b gs: 002b ss: 0018
Process in.telnetd (pid: 175, process nr: 26, stackpage=01c8f000)
Stack: 0174a000 00000000 01bab900 01749000 00183859 01749934 0174a000 0017b17f
0174a000 01bab900 01bab900 01ba7b70 00000001 01661810 01917ed8 01917e98
00000000 01917d18 0017b59a 01bab900 00122bd2 01ba7b70 01bab900 00000001
Call Trace: [<00183859>] [<0017b17f>] [<0017b59a>] [<00122bd2>] [<00116246>] [<0011633e>] [<0010a6d2>]
Code: 8b 02 83 f8 01 75 61 9c 5e fa c7 02 00 00 00 00 83 7a 4c 00

Using `System.map' to map addresses to symbols.

>>EIP: 110b82 <wake_up_interruptible+22/f0>
Trace: 183859 <pty_close+69/b0>
Trace: 17b17f <release_dev+29f/4e0>
Trace: 17b59a <tty_release+a/10>
Trace: 122bd2 <close_fp+62/90>
Trace: 116246 <do_exit+116/200>
Trace: 11633e <sys_exit+e/10>
Trace: 10a6d2 <system_call+52/80>

Code: 110b82 <wake_up_interruptible+22/f0> movl (%edx),%eax
Code: 110b84 <wake_up_interruptible+24/f0> cmpl $0x1,%eax
Code: 110b87 <wake_up_interruptible+27/f0> jne 110bea <wake_up_interruptible+8a/f0>
Code: 110b89 <wake_up_interruptible+29/f0> pushf
Code: 110b8a <wake_up_interruptible+2a/f0> popl %esi
Code: 110b8b <wake_up_interruptible+2b/f0> cli
Code: 110b8c <wake_up_interruptible+2c/f0> movl $0x0,(%edx)
Code: 110b92 <wake_up_interruptible+32/f0> cmpl $0x0,0x4c(%edx)

(*) ad ISDN:

I can make the machine crash with that bug. sometimes it even happens
when I just power on the PBX. unfortunately, the panic() routine triggers
another panic() itself. I inserted cli() in various places in panic()
(before printk(), after printk()), adding a for(;;); after the printk.
still I see multiple occurences of panici (but not as many as without
the for(;;);). So I guess that
a) printk turns on interrupts again and b) it's the printk statement
in panic() which causes another panic. too sad I don't have a camera
here, the screen looks real funny after that ... :)

/herp
:wq