[OOPS] 2.6.12-rc3 ptrace bug?

["Udo A. Steinberg" <us15@os.inf.tu-dresden.de>]

[-- Attachment #1.1: Type: text/plain, Size: 1170 bytes --]


The attached (radically shortened) program to measure pipe performance oopses
the Linux-2.6.12-rc3 kernel when traced using "strace -f". The problem no longer
occurs in -rc4 or -rc5. It would be good to know whether the bug causing the
problem is known and has been fixed or simply went away due to other changes.
I have been unable to find a Changelog detailing the patches that went
into -rc4.

The bug is reproducible on all -rc3 kernels I've tried.

Unable to handle kernel NULL pointer dereference at virtual address 00000000
 printing eip:
00000000
*pde = 00000000
Oops: 0000 [#1]
PREEMPT 
Modules linked in:
CPU:    0
EIP:    0060:[<00000000>]    Not tainted VLI
EFLAGS: 00010286   (2.6.12-rc3) 
EIP is at 0x0
eax: db052000   ebx: 01200011   ecx: 00000000   edx: 00000000
esi: df605060   edi: 00000000   ebp: db052000   esp: db052fc4
ds: 007b   es: 007b   ss: 0068
Process pipe (pid: 778, threadinfo=db052000 task=df605060)
Stack: 01202011 00000000 00000000 00000000 b7ea0708 bf9da748 00000000 0000007b 
       c010007b 00000078 b7f290a5 00000073 00000282 bf9da6e0 0000007b 
Call Trace:
Code:  Bad EIP value.

Best regards,
-Udo.

[-- Attachment #1.2: pipe.c --]
[-- Type: application/octet-stream, Size: 1041 bytes --]


#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

unsigned iterations = 1000;
int ping[2], pong[2];
pid_t pid;

void do_ping (void)
{
    char buffer;
    unsigned i;
    
    for (i = 0; i < iterations; i++) {
        if (write (ping[1], "E", 1) != 1)
            break;
        if (read (pong[0], &buffer, 1) != 1)
            break;
    }

    close (ping[1]);
    close (pong[0]);

    waitpid (pid, &i, 0);
}

void do_echo (void)
{
    char buffer;

    for (;;) {
        if (read (ping[0], &buffer, 1) != 1)
            break;
        if (write (pong[1], "R", 1) != 1)
            break;
    }
}

int main (int argc, char **argv)
{
    if (pipe (ping) == -1 || pipe (pong) == -1)
        return -1;
    
    switch (pid = fork()) {

        case -1:
            return -1;

        case 0:
            close (ping[1]);
            close (pong[0]);
            do_echo();
            return 0;

        default:
            close (ping[0]);
            close (pong[1]);
            do_ping();        
    }

    return 0;
}

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]