Request for net guru help: waitqueue oops

From: Hans Grobler (grobh@sun.ac.za)
Date: Tue Oct 03 2000 - 07:14:11 EST


Hi all,

A driver I'm working on seems to be doing/triggering something related
to waitqueues. This causes a perfectly reproducable oops (small mercies!).
Since the oops is not happening in my driver, I'm having a hard time
figuring out whats going wrong. I suspect a networking guru will take
one look and know what I'm doing wrong. Any suggestions please?

Initially, I was getting the first oops below. After browsing the waitqueue
code, I found and enabled the WAITQUEUE_DEBUG define. Now I'm getting the
second oops. The values 8729, 8731 in eax ebx ecx (first oops) and in the
magic & creator field (second oops) look very weird... something
incrementing...

In my driver I have all pointers protected by magic numbers. These are
validated before every use (will do a BUG() on invalid pointer).

TIA
-- Hans.

---[ OOPS1 ]--------------------------------------------------------------

ksymoops 2.3.4 on i686 2.4.0-test9. Options used
     -v /usr/src/linux/vmlinux (specified)
     -k ./ksyms (specified)
     -l ./modules (specified)
     -o /lib/modules/2.4.0-test9 (specified)
     -m /usr/src/linux/System.map (specified)

Unable to handle kernel paging request at virtual address 00008731
c0113a70
*pde = 00000000
Oops: 0000
CPU: 0
EIP: 0010:[<c0113a70>]
Using defaults from ksymoops -t elf32-i386 -a i386
EFLAGS: 00010003
eax: 00008729 ebx: 00008731 ecx: 00008731 edx: 00000021
esi: 00000000 edi: 0000000d ebp: c0231f40 esp: c0231f1c
ds: 0018 es: 0018 ss: 0018
Process swapper (pid: 0, stackpage=c0231000)
Stack: c3fc59a0 c3fa8800 0000000d 00000110 00008731 c17aec6c 00000246 00000001
       00000021 c0231fa4 c01a5155 c3fc59a0 c01a4a53 c3fc59a0 00000000 c01a55d0
       c3fa8800 0000000d c010a00d c01a7129 c3fa8800 00000001 c0269c08 0000000d
Call Trace: [<c01a5155>] [<c01a4a53>] [<c01a55d0>] [<c010a00d>] [<c01a7129>] [<c01192ee>] [<c010a1a8>]
       [<c0107160>] [<c0107160>] [<c0108df0>] [<c0107160>] [<c0107160>] [<c0100018>] [<c0107183>] [<c01071e4>]
       [<c0105000>] [<c0100192>]
Code: 8b 1b 89 5d ec 8b 48 04 8b 11 89 d0 24 df 85 45 fc 0f 84 79

>>EIP; c0113a70 <__wake_up+50/144> <=====
Trace; c01a5155 <sock_def_write_space+2d/74>
Trace; c01a4a53 <sock_wfree+17/30>
Trace; c01a55d0 <__kfree_skb+7c/11c>
Trace; c010a00d <handle_IRQ_event+31/5c>
Trace; c01a7129 <net_tx_action+45/a0>
Trace; c01192ee <do_softirq+4e/74>
Trace; c010a1a8 <do_IRQ+9c/ac>
Trace; c0107160 <default_idle+0/28>
Trace; c0107160 <default_idle+0/28>
Trace; c0108df0 <ret_from_intr+0/20>
Trace; c0107160 <default_idle+0/28>
Trace; c0107160 <default_idle+0/28>
Trace; c0100018 <startup_32+18/13a>
Trace; c0107183 <default_idle+23/28>
Trace; c01071e4 <cpu_idle+3c/50>
Trace; c0105000 <empty_bad_page+0/1000>
Trace; c0100192 <L6+0/2>
Code; c0113a70 <__wake_up+50/144>
00000000 <_EIP>:
Code; c0113a70 <__wake_up+50/144> <=====
   0: 8b 1b mov (%ebx),%ebx <=====
Code; c0113a72 <__wake_up+52/144>
   2: 89 5d ec mov %ebx,0xffffffec(%ebp)
Code; c0113a75 <__wake_up+55/144>
   5: 8b 48 04 mov 0x4(%eax),%ecx
Code; c0113a78 <__wake_up+58/144>
   8: 8b 11 mov (%ecx),%edx
Code; c0113a7a <__wake_up+5a/144>
   a: 89 d0 mov %edx,%eax
Code; c0113a7c <__wake_up+5c/144>
   c: 24 df and $0xdf,%al
Code; c0113a7e <__wake_up+5e/144>
   e: 85 45 fc test %eax,0xfffffffc(%ebp)
Code; c0113a81 <__wake_up+61/144>
  11: 0f 84 79 00 00 00 je 90 <_EIP+0x90> c0113b00 <__wake_up+e0/144>

Aiee, killing interrupt handler
Kernel panic: Attempted to kill the idle task!

---[ OOPS2 ]--------------------------------------------------------------

ksymoops 2.3.4 on i686 2.4.0-test9. Options used
     -v /usr/src/linux/vmlinux (specified)
     -k ./ksyms (specified)
     -l ./modules (specified)
     -o /lib/modules/2.4.0-test9 (specified)
     -m /usr/src/linux/System.map (specified)

bad magic 8722 (should be c2dfbbd4, creator 8723), wq bug, forcing oops.
kernel BUG at /usr/src/linux/include/linux/wait.h:155!
invalid operand: 0000
CPU: 0
EIP: 0010:[<c01b3715>]
Using defaults from ksymoops -t elf32-i386 -a i386
EFLAGS: 00010296
eax: 00000037 ebx: c2dfbbc8 ecx: c0240b48 edx: 00000000
esi: c3bbe060 edi: 0000000d ebp: c0253fa4 esp: c0253f34
ds: 0018 es: 0018 ss: 0018
Process swapper (pid: 0, stackpage=c0253000)
Stack: c02291e4 c02291c0 0000009b c3bbe060 c3f87260 c01b2ea7 c3bbe060 00000000
       c01b3bc0 c3f87260 0000000d 00000000 c01b582a c3f87260 00000001 c028bc08
       0000000d c0253fa4 c011b1ae c028bc08 000000a0 c02839a0 00000005 c010a4a5
Call Trace: [<c02291e4>] [<c02291c0>] [<c01b2ea7>] [<c01b3bc0>] [<c01b582a>] [<c011b1ae>] [<c010a4a5>]
       [<c0107160>] [<c0107160>] [<c010902c>] [<c0107160>] [<c0107160>] [<c0100018>] [<c0107183>] [<c01071e4>]
       [<c0105000>] [<c0100192>]
Code: 0f 0b 83 c4 0c 8d b6 00 00 00 00 8d 43 04 39 43 04 74 0d 8b

>>EIP; c01b3715 <sock_def_write_space+5d/c4> <=====
Trace; c02291e4 <RCSid+6ee4/9360>
Trace; c02291c0 <RCSid+6ec0/9360>
Trace; c01b2ea7 <sock_wfree+17/30>
Trace; c01b3bc0 <__kfree_skb+7c/11c>
Trace; c01b582a <net_tx_action+46/e8>
Trace; c011b1ae <do_softirq+4e/74>
Trace; c010a4a5 <do_IRQ+c5/d4>
Trace; c0107160 <default_idle+0/28>
Trace; c0107160 <default_idle+0/28>
Trace; c010902c <ret_from_intr+0/20>
Trace; c0107160 <default_idle+0/28>
Trace; c0107160 <default_idle+0/28>
Trace; c0100018 <startup_32+18/13a>
Trace; c0107183 <default_idle+23/28>
Trace; c01071e4 <cpu_idle+3c/50>
Trace; c0105000 <empty_bad_page+0/1000>
Trace; c0100192 <L6+0/2>
Code; c01b3715 <sock_def_write_space+5d/c4>
00000000 <_EIP>:
Code; c01b3715 <sock_def_write_space+5d/c4> <=====
   0: 0f 0b ud2a <=====
Code; c01b3717 <sock_def_write_space+5f/c4>
   2: 83 c4 0c add $0xc,%esp
Code; c01b371a <sock_def_write_space+62/c4>
   5: 8d b6 00 00 00 00 lea 0x0(%esi),%esi
Code; c01b3720 <sock_def_write_space+68/c4>
   b: 8d 43 04 lea 0x4(%ebx),%eax
Code; c01b3723 <sock_def_write_space+6b/c4>
   e: 39 43 04 cmp %eax,0x4(%ebx)
Code; c01b3726 <sock_def_write_space+6e/c4>
  11: 74 0d je 20 <_EIP+0x20> c01b3735 <sock_def_write_space+7d/c4>
Code; c01b3728 <sock_def_write_space+70/c4>
  13: 8b 00 mov (%eax),%eax

Aiee, killing interrupt handler
Kernel panic: Attempted to kill the idle task!

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
Please read the FAQ at http://www.tux.org/lkml/



This archive was generated by hypermail 2b29 : Sat Oct 07 2000 - 21:00:11 EST