Re: [stable] apparent regression (crash) - 2.6.38.6

Re: [stable] apparent regression (crash) - 2.6.38.6

[Paul Slootman]

> 2.6.39 was released without it ;/

I noticed that 2.6.39 crashes on my system if I have a CDROM in the
drive (PATA) during booting.  Perhaps related?
Screen photo: http://corky.wurtel.net/~paul/panic-boot-2.6.39.jpg

2.6.39 also crashes after half a day :-(
Photo of the panic at
http://corky.wurtel.net/~paul/panic-2.6.39.jpg

Paul

Re: [stable] apparent regression (crash) - 2.6.38.6

[Atsushi Nemoto]

On Fri, 03 Jun 2011 11:01:37 +0400, Michael Tokarev <mjt@tls.msk.ru> wrote:
> Something like this?  (run-tested but I haven't seen the problem
> in this place)
> 
> commit 2e8532e0a9ee1d25b279ac78ee8ce31701e2aa15
> Author: Michael Tokarev <mjt@tls.msk.ru>
> Date:   Fri Jun 3 10:50:49 2011 +0400
> 
>     block: add proper state guards to elv_queue_empty()

Yes, that's exactly what I mean.

>     Like in 0a58e077eb600d1efd7e54ad9926a75a39d7f8ae (backported to
>     stable 2.6.38 as 0a58e077eb600d1efd7e54ad9926a75a39d7f8ae) which
>     fixes this for __elv_next_request(), as reported by Atsushi Nemoto,
>     elv_queue_empty() also needs to check for dead queue condition
>     before touchin elevator.
> 
>     elv_queue_empty() has been removed upstream so this is only applicable
>     for versions prior to 2.6.39, including 2.6.32-longterm.

Yes, Wolfgang Walter reported same crash on 2.6.32.40 so
2.6.32-longterm would need this fix.

I suppose all stable branches which have backport of 86cbfb56 ("put
stricter guards on queue dead checks") need this fix.

---
Atsushi Nemoto

Re: [stable] apparent regression (crash) - 2.6.38.6

[Jiri Slaby]

On 06/03/2011 09:09 AM, lists+linux-kernel@corpit.ru wrote:
> 03.06.2011 11:01, Michael Tokarev wrote:
>> commit 2e8532e0a9ee1d25b279ac78ee8ce31701e2aa15
>> Author: Michael Tokarev <mjt@tls.msk.ru>
>> Date:   Fri Jun 3 10:50:49 2011 +0400
>>
>>     block: add proper state guards to elv_queue_empty()
>>
>>     Like in 0a58e077eb600d1efd7e54ad9926a75a39d7f8ae (backported to
>>     stable 2.6.38 as 0a58e077eb600d1efd7e54ad9926a75a39d7f8ae) which
>>     fixes this for __elv_next_request(), as reported by Atsushi Nemoto,
>>     elv_queue_empty() also needs to check for dead queue condition
>>     before touchin elevator.
>>
>>     elv_queue_empty() has been removed upstream so this is only applicable
>>     for versions prior to 2.6.39, including 2.6.32-longterm.
> 
> Um, i'm not sure about this one -- 2.6.32 does not have
> other pieces of this puzzle (and 2.6.38.8 was the last
> in the 2.6.38.y series).

And what about .33 and .34 which are longterm too? Does this apply to them?

thanks,
-- 
js
suse labs

Re: [stable] apparent regression (crash) - 2.6.38.6

[lists+linux-kernel]

03.06.2011 11:01, Michael Tokarev wrote:
> commit 2e8532e0a9ee1d25b279ac78ee8ce31701e2aa15
> Author: Michael Tokarev <mjt@tls.msk.ru>
> Date:   Fri Jun 3 10:50:49 2011 +0400
> 
>     block: add proper state guards to elv_queue_empty()
> 
>     Like in 0a58e077eb600d1efd7e54ad9926a75a39d7f8ae (backported to
>     stable 2.6.38 as 0a58e077eb600d1efd7e54ad9926a75a39d7f8ae) which
>     fixes this for __elv_next_request(), as reported by Atsushi Nemoto,
>     elv_queue_empty() also needs to check for dead queue condition
>     before touchin elevator.
> 
>     elv_queue_empty() has been removed upstream so this is only applicable
>     for versions prior to 2.6.39, including 2.6.32-longterm.

Um, i'm not sure about this one -- 2.6.32 does not have
other pieces of this puzzle (and 2.6.38.8 was the last
in the 2.6.38.y series).

/mjt

>     Signed-Off-By: Michael Tokarev <mjt@tls.msk.ru>
> 
> diff --git a/block/elevator.c b/block/elevator.c
> index 236e93c..30cec25 100644
> --- a/block/elevator.c
> +++ b/block/elevator.c
> @@ -727,7 +727,8 @@ int elv_queue_empty(struct request_queue *q)
>  	if (!list_empty(&q->queue_head))
>  		return 0;
> 
> -	if (e->ops->elevator_queue_empty_fn)
> +	if (!test_bit(QUEUE_FLAG_DEAD, &q->queue_flags) &&
> +	    e->ops->elevator_queue_empty_fn)
>  		return e->ops->elevator_queue_empty_fn(q);
> 
>  	return 1;

Re: [stable] apparent regression (crash) - 2.6.38.6

[Michael Tokarev]

01.06.2011 16:34, Atsushi Nemoto wrote:
> On Thu, 19 May 2011 07:39:27 +0400, James Bottomley <James.Bottomley@HansenPartnership.com> wrote:
>>>>>>> [  106.994628] BUG: unable to handle kernel NULL pointer dereference at 0000000000000048
>>>>>>> [  106.994755] IP: [<ffffffff811bec1b>] elv_queue_empty+0x1b/0x30
>>>>>
>>>>> Hmm, it's another missing elevator guard, like this patch:
>>>>>
>>>>> http://marc.info/?l=linux-scsi&m=130348673628282
>>>>>
>>>>> I think the bug here is that q->elevator is null, so dereferencing
>>>>> elevator->ops gives the bug.
>>>>
>>>> Is this patch going to Linus anytime soon?
>>>
>>> Ping?
>>
>> I pinged Jens about it yesterday; he said it should be on its way to
>> Linus.
> 
> The patch in above URL ("block: add proper state guards to
> __elv_next_request") is in mainline and stable-queues now, but how
> about a similar fix for elv_queue_empty()?
> 
> The elv_queue_empty() is removed in mainline, but it seems
> stable-2.6.38.x and prior stable-branches still need the fix for
> elv_queue_empty().

Something like this?  (run-tested but I haven't seen the problem
in this place)

commit 2e8532e0a9ee1d25b279ac78ee8ce31701e2aa15
Author: Michael Tokarev <mjt@tls.msk.ru>
Date:   Fri Jun 3 10:50:49 2011 +0400

    block: add proper state guards to elv_queue_empty()

    Like in 0a58e077eb600d1efd7e54ad9926a75a39d7f8ae (backported to
    stable 2.6.38 as 0a58e077eb600d1efd7e54ad9926a75a39d7f8ae) which
    fixes this for __elv_next_request(), as reported by Atsushi Nemoto,
    elv_queue_empty() also needs to check for dead queue condition
    before touchin elevator.

    elv_queue_empty() has been removed upstream so this is only applicable
    for versions prior to 2.6.39, including 2.6.32-longterm.

    Signed-Off-By: Michael Tokarev <mjt@tls.msk.ru>

diff --git a/block/elevator.c b/block/elevator.c
index 236e93c..30cec25 100644
--- a/block/elevator.c
+++ b/block/elevator.c
@@ -727,7 +727,8 @@ int elv_queue_empty(struct request_queue *q)
 	if (!list_empty(&q->queue_head))
 		return 0;

-	if (e->ops->elevator_queue_empty_fn)
+	if (!test_bit(QUEUE_FLAG_DEAD, &q->queue_flags) &&
+	    e->ops->elevator_queue_empty_fn)
 		return e->ops->elevator_queue_empty_fn(q);

 	return 1;

Re: [stable] apparent regression (crash) - 2.6.38.6

[Atsushi Nemoto]

On Thu, 19 May 2011 07:39:27 +0400, James Bottomley <James.Bottomley@HansenPartnership.com> wrote:
> On Wed, 2011-05-18 at 17:25 -0700, Greg KH wrote:
> > On Wed, May 11, 2011 at 12:34:51PM -0700, Greg KH wrote:
> > > On Wed, May 11, 2011 at 02:19:17PM -0500, James Bottomley wrote:
> > > > > > [  106.994628] BUG: unable to handle kernel NULL pointer dereference at 0000000000000048
> > > > > > [  106.994755] IP: [<ffffffff811bec1b>] elv_queue_empty+0x1b/0x30
> > > > 
> > > > Hmm, it's another missing elevator guard, like this patch:
> > > > 
> > > > http://marc.info/?l=linux-scsi&m=130348673628282
> > > > 
> > > > I think the bug here is that q->elevator is null, so dereferencing
> > > > elevator->ops gives the bug.
> > > 
> > > Is this patch going to Linus anytime soon?
> > 
> > Ping?
> 
> I pinged Jens about it yesterday; he said it should be on its way to
> Linus.

The patch in above URL ("block: add proper state guards to
__elv_next_request") is in mainline and stable-queues now, but how
about a similar fix for elv_queue_empty()?

The elv_queue_empty() is removed in mainline, but it seems
stable-2.6.38.x and prior stable-branches still need the fix for
elv_queue_empty().

---
Atsushi Nemoto

Re: [stable] apparent regression (crash) - 2.6.38.6

[Arkadiusz Miskiewicz]

On Thursday 19 of May 2011, James Bottomley wrote:
> On Wed, 2011-05-18 at 17:25 -0700, Greg KH wrote:
> > On Wed, May 11, 2011 at 12:34:51PM -0700, Greg KH wrote:
> > > On Wed, May 11, 2011 at 02:19:17PM -0500, James Bottomley wrote:
> > > > On Wed, 2011-05-11 at 08:30 +0200, Jiri Slaby wrote:

> > > > Hmm, it's another missing elevator guard, like this patch:
> > > > 
> > > > http://marc.info/?l=linux-scsi&m=130348673628282
> > > > 
> > > > I think the bug here is that q->elevator is null, so dereferencing
> > > > elevator->ops gives the bug.
> > > 
> > > Is this patch going to Linus anytime soon?
> > 
> > Ping?
> 
> I pinged Jens about it yesterday; he said it should be on its way to
> Linus.

2.6.39 was released without it ;/

> James


-- 
Arkadiusz Miśkiewicz        PLD/Linux Team
arekm / maven.pl            http://ftp.pld-linux.org/

Re: [stable] apparent regression (crash) - 2.6.38.6

[James Bottomley]

On Wed, 2011-05-18 at 17:25 -0700, Greg KH wrote:
> On Wed, May 11, 2011 at 12:34:51PM -0700, Greg KH wrote:
> > On Wed, May 11, 2011 at 02:19:17PM -0500, James Bottomley wrote:
> > > On Wed, 2011-05-11 at 08:30 +0200, Jiri Slaby wrote:
> > > > On 05/10/2011 09:55 PM, Michael Tokarev wrote:
> > > > > Hello.
> > > > > 
> > > > > I just tried 2.6.38.6 (which has been released today), and
> > > > > discovered that it crashes during bootup on my machine.
> > > > > 2.6.38.5 with exactly the same config works.
> > > > 
> > > > Is it reproducible?
> > > > 
> > > > > Unfortunately I don't have time _right now_ to debug the
> > > > > issue, but will try tomorrow.
> > > > > 
> > > > > For now, here's a part of dmesg with an oops, captured
> > > > > using netconsole.  If someone have a clue, please speak
> > > > > up ;)
> > > > > 
> > > > > What I also noticed is that for some reason, udev now loads
> > > > > option driver (option: v0.7.2:USB Driver for GSM modems),
> > > > > even if I don't have any modems connected to the system.
> > > > > This is obviously not related to the issue at hand.
> > > > ...
> > > > > [  106.761932] input: Logitech USB-PS/2 Optical Mouse as /devices/pci0000:00/0000:00:12.1/usb2/2-2/2-2:1.0/input/input6
> > > > > [  106.762170] generic-usb 0003:046D:C044.0004: input,hidraw0: USB HID v1.10 Mouse [Logitech USB-PS/2 Optical Mouse] on usb-0000:00:12.1-2/input0
> > > > > [  106.994177] scsi 10:0:0:0: Direct-Access     Kingston DT HyperX        HMAP PQ: 0 ANSI: 0 CCS
> > > > > [  106.994458] sd 10:0:0:0: Attached scsi generic sg3 type 0
> > > > > [  106.994628] BUG: unable to handle kernel NULL pointer dereference at 0000000000000048
> > > > > [  106.994755] IP: [<ffffffff811bec1b>] elv_queue_empty+0x1b/0x30
> > > 
> > > Hmm, it's another missing elevator guard, like this patch:
> > > 
> > > http://marc.info/?l=linux-scsi&m=130348673628282
> > > 
> > > I think the bug here is that q->elevator is null, so dereferencing
> > > elevator->ops gives the bug.
> > 
> > Is this patch going to Linus anytime soon?
> 
> Ping?

I pinged Jens about it yesterday; he said it should be on its way to
Linus.

James

Re: [stable] apparent regression (crash) - 2.6.38.6

[Greg KH]

On Thu, May 12, 2011 at 12:22:25AM +0400, Michael Tokarev wrote:
> 11.05.2011 23:31, Michael Tokarev wrote:
> 
> >> http://marc.info/?l=linux-scsi&m=130348673628282
> 
> > I wonder why there's so many reports about this issue.
> 
> I mean, why there's so FEW reports about this issue.
> Should it happen rare?

I see lots of reports of this right now for openSUSE users with this
kernel release, so you aren't alone.

thanks,

greg k-h

Re: [stable] apparent regression (crash) - 2.6.38.6

[Greg KH]

On Wed, May 11, 2011 at 12:34:51PM -0700, Greg KH wrote:
> On Wed, May 11, 2011 at 02:19:17PM -0500, James Bottomley wrote:
> > On Wed, 2011-05-11 at 08:30 +0200, Jiri Slaby wrote:
> > > On 05/10/2011 09:55 PM, Michael Tokarev wrote:
> > > > Hello.
> > > > 
> > > > I just tried 2.6.38.6 (which has been released today), and
> > > > discovered that it crashes during bootup on my machine.
> > > > 2.6.38.5 with exactly the same config works.
> > > 
> > > Is it reproducible?
> > > 
> > > > Unfortunately I don't have time _right now_ to debug the
> > > > issue, but will try tomorrow.
> > > > 
> > > > For now, here's a part of dmesg with an oops, captured
> > > > using netconsole.  If someone have a clue, please speak
> > > > up ;)
> > > > 
> > > > What I also noticed is that for some reason, udev now loads
> > > > option driver (option: v0.7.2:USB Driver for GSM modems),
> > > > even if I don't have any modems connected to the system.
> > > > This is obviously not related to the issue at hand.
> > > ...
> > > > [  106.761932] input: Logitech USB-PS/2 Optical Mouse as /devices/pci0000:00/0000:00:12.1/usb2/2-2/2-2:1.0/input/input6
> > > > [  106.762170] generic-usb 0003:046D:C044.0004: input,hidraw0: USB HID v1.10 Mouse [Logitech USB-PS/2 Optical Mouse] on usb-0000:00:12.1-2/input0
> > > > [  106.994177] scsi 10:0:0:0: Direct-Access     Kingston DT HyperX        HMAP PQ: 0 ANSI: 0 CCS
> > > > [  106.994458] sd 10:0:0:0: Attached scsi generic sg3 type 0
> > > > [  106.994628] BUG: unable to handle kernel NULL pointer dereference at 0000000000000048
> > > > [  106.994755] IP: [<ffffffff811bec1b>] elv_queue_empty+0x1b/0x30
> > 
> > Hmm, it's another missing elevator guard, like this patch:
> > 
> > http://marc.info/?l=linux-scsi&m=130348673628282
> > 
> > I think the bug here is that q->elevator is null, so dereferencing
> > elevator->ops gives the bug.
> 
> Is this patch going to Linus anytime soon?

Ping?

Re: [stable] apparent regression (crash) - 2.6.38.6

[Greg KH]

On Wed, May 11, 2011 at 02:19:17PM -0500, James Bottomley wrote:
> On Wed, 2011-05-11 at 08:30 +0200, Jiri Slaby wrote:
> > On 05/10/2011 09:55 PM, Michael Tokarev wrote:
> > > Hello.
> > > 
> > > I just tried 2.6.38.6 (which has been released today), and
> > > discovered that it crashes during bootup on my machine.
> > > 2.6.38.5 with exactly the same config works.
> > 
> > Is it reproducible?
> > 
> > > Unfortunately I don't have time _right now_ to debug the
> > > issue, but will try tomorrow.
> > > 
> > > For now, here's a part of dmesg with an oops, captured
> > > using netconsole.  If someone have a clue, please speak
> > > up ;)
> > > 
> > > What I also noticed is that for some reason, udev now loads
> > > option driver (option: v0.7.2:USB Driver for GSM modems),
> > > even if I don't have any modems connected to the system.
> > > This is obviously not related to the issue at hand.
> > ...
> > > [  106.761932] input: Logitech USB-PS/2 Optical Mouse as /devices/pci0000:00/0000:00:12.1/usb2/2-2/2-2:1.0/input/input6
> > > [  106.762170] generic-usb 0003:046D:C044.0004: input,hidraw0: USB HID v1.10 Mouse [Logitech USB-PS/2 Optical Mouse] on usb-0000:00:12.1-2/input0
> > > [  106.994177] scsi 10:0:0:0: Direct-Access     Kingston DT HyperX        HMAP PQ: 0 ANSI: 0 CCS
> > > [  106.994458] sd 10:0:0:0: Attached scsi generic sg3 type 0
> > > [  106.994628] BUG: unable to handle kernel NULL pointer dereference at 0000000000000048
> > > [  106.994755] IP: [<ffffffff811bec1b>] elv_queue_empty+0x1b/0x30
> 
> Hmm, it's another missing elevator guard, like this patch:
> 
> http://marc.info/?l=linux-scsi&m=130348673628282
> 
> I think the bug here is that q->elevator is null, so dereferencing
> elevator->ops gives the bug.

Is this patch going to Linus anytime soon?

thanks,

greg k-h