From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933669AbdCUSSK (ORCPT ); Tue, 21 Mar 2017 14:18:10 -0400 Received: from scorn.kernelslacker.org ([45.56.101.199]:58702 "EHLO scorn.kernelslacker.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756347AbdCUSRr (ORCPT ); Tue, 21 Mar 2017 14:17:47 -0400 Date: Tue, 21 Mar 2017 14:17:10 -0400 From: Dave Jones To: Linux Kernel Cc: Steven Rostedt , tglx@linutronix.de Subject: run_timer_softirq gpf. tracing? Message-ID: <20170321181710.5hoxel4ss4z55xew@codemonkey.org.uk> Mail-Followup-To: Dave Jones , Linux Kernel , Steven Rostedt , tglx@linutronix.de MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: NeoMutt/20170306 (1.8.0) X-Spam-Note: SpamAssassin invocation failed Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org I just hit this while fuzzing.. general protection fault: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC CPU: 2 PID: 0 Comm: swapper/2 Not tainted 4.11.0-rc2-think+ #1 task: ffff88017f0ed440 task.stack: ffffc90000094000 RIP: 0010:run_timer_softirq+0x15f/0x700 RSP: 0018:ffff880507c03ec8 EFLAGS: 00010086 RAX: dead000000000200 RBX: ffff880507dd0d00 RCX: 0000000000000002 RDX: ffff880507c03ed0 RSI: 00000000ffffffff RDI: ffffffff8204b3a0 RBP: ffff880507c03f48 R08: ffff880507dd12d0 R09: ffff880507c03ed8 R10: ffff880507dd0db0 R11: 0000000000000000 R12: ffffffff8215cc38 R13: ffff880507c03ed0 R14: ffffffff82005188 R15: ffff8804b55491a8 FS: 0000000000000000(0000) GS:ffff880507c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000004 CR3: 0000000005011000 CR4: 00000000001406e0 Call Trace: ? clockevents_program_event+0x47/0x120 __do_softirq+0xbf/0x5b1 irq_exit+0xb5/0xc0 smp_apic_timer_interrupt+0x3d/0x50 apic_timer_interrupt+0x97/0xa0 RIP: 0010:cpuidle_enter_state+0x12e/0x400 RSP: 0018:ffffc90000097e40 EFLAGS: 00000202 [CONT START] ORIG_RAX: ffffffffffffff10 RAX: ffff88017f0ed440 RBX: ffffe8ffffa03cc8 RCX: 0000000000000001 RDX: 20c49ba5e353f7cf RSI: 0000000000000001 RDI: ffff88017f0ed440 RBP: ffffc90000097e80 R08: 00000000ffffffff R09: 0000000000000008 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000005 R13: ffffffff820b9338 R14: 0000000000000005 R15: ffffffff820b9320 cpuidle_enter+0x17/0x20 call_cpuidle+0x23/0x40 do_idle+0xfb/0x200 cpu_startup_entry+0x71/0x80 start_secondary+0x16a/0x210 start_cpu+0x14/0x14 Code: 8b 05 ce 1b ef 7e 83 f8 03 0f 87 4e 01 00 00 89 c0 49 0f a3 04 24 0f 82 0a 01 00 00 49 8b 07 49 8b 57 08 48 85 c0 48 89 02 74 04 <48> 89 50 08 41 f6 47 2a 20 49 c7 47 08 00 00 00 00 48 89 df 48 RAX looks like list poison, and CR2 = 4, which is likely the ->next of a list, with a NULL pointer. Here's the disassembly of timer.o https://codemonkey.org.uk/junk/timer.o.txt Sure enough, run_timer_softirq+0x15f (1ccf) is.. entry->next = LIST_POISON2; 1cc8: 48 b8 00 02 00 00 00 movabs $0xdead000000000200,%rax 1ccf: 00 ad de This looks to be something to do with the tracing definition of timer_cancel. I don't fully grok how the tracing macros work, is there something obvious here before I dig deeper ? Right before that list op, we do this.. if (timer->flags & TIMER_IRQSAFE) { Which looks like a line from expire_timers. I'm not following how we get there from that tracing definition. No tracing was active when this happened. Dave