From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S263483AbUCTReW (ORCPT ); Sat, 20 Mar 2004 12:34:22 -0500 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S263484AbUCTReW (ORCPT ); Sat, 20 Mar 2004 12:34:22 -0500 Received: from obsidian.spiritone.com ([216.99.193.137]:30854 "EHLO obsidian.spiritone.com") by vger.kernel.org with ESMTP id S263483AbUCTRd7 (ORCPT ); Sat, 20 Mar 2004 12:33:59 -0500 Date: Sat, 20 Mar 2004 09:33:38 -0800 From: "Martin J. Bligh" To: Andrea Arcangeli cc: Hugh Dickins , Andrew Morton , linux-kernel@vger.kernel.org Subject: Re: [PATCH] anobjrmap 1/6 objrmap Message-ID: <2698500000.1079804017@[10.10.2.4]> In-Reply-To: <20040320165500.GW9009@dualathlon.random> References: <2663710000.1079716282@[10.10.2.4]> <20040320123009.GC9009@dualathlon.random> <2696050000.1079798196@[10.10.2.4]> <20040320161905.GT9009@dualathlon.random> <2696880000.1079800826@[10.10.2.4]> <20040320165500.GW9009@dualathlon.random> X-Mailer: Mulberry/2.2.1 (Linux/x86) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Content-Disposition: inline Sender: linux-kernel-owner@vger.kernel.org X-Mailing-List: linux-kernel@vger.kernel.org >> Unable to handle kernel NULL pointer dereference at virtual address 00000003 >> printing eip: >> c013f504 >> *pde = 2e820001 >> *pte = 00000000 >> Oops: 0000 [#1] >> SMP >> CPU: 15 >> EIP: 0060:[] Not tainted >> EFLAGS: 00010292 (2.6.5-rc1-aa2) >> EIP is at do_no_page+0xc4/0x45c >> eax: 00000000 ebx: 00000000 ecx: 00000000 edx: 00000000 >> esi: ee5eea60 edi: ee5a3ec8 ebp: ee9c52a0 esp: ee5a3e94 >> ds: 007b es: 007b ss: 0068 >> Process sshd (pid: 19069, threadinfo=ee5a2000 task=ee69a870) >> Stack: 00000000 eeb43340 00000001 ee9c52a0 c3ba2820 00000000 40268000 ee5a3ec8 >> ee9c52a0 ee69a870 ee5eea60 00000000 ef6a6134 00000001 c013fa0f ee9c52a0 >> ee5eea60 40268000 00000001 eeb43340 eeea8008 ee9c52a0 ee69a870 ee5eea60 >> Call Trace: >> [] handle_mm_fault+0xc7/0x190 >> [] do_page_fault+0x13b/0x540 >> [] do_page_fault+0x0/0x540 >> [] do_mmap_pgoff+0x4b7/0x5fc >> [] sys_mmap2+0x67/0x98 >> [] error_code+0x2d/0x38 >> >> Code: 0f b6 41 03 8b 14 85 80 a9 35 c0 89 c8 2b 82 84 0b 00 00 69 > > this looks strange: > > Code; c013f504 > 00000000 <_EIP>: > Code; c013f504 <===== > 0: 0f b6 41 03 movzbl 0x3(%ecx),%eax <===== > Code; c013f508 > 4: 8b 14 85 80 a9 35 c0 mov 0xc035a980(,%eax,4),%edx > Code; c013f50f > b: 89 c8 mov %ecx,%eax > Code; c013f511 > d: 2b 82 84 0b 00 00 sub 0xb84(%edx),%eax > Code; c013f517 > 13: 69 00 00 00 00 00 imul $0x0,(%eax),%eax > > %ecx is zero, not sure what can actually look at a 3 byte offset in > do_no_page (infact it looks like it was miscompiled), can you send me > your vmlinux privately (or just the the whole assembler for do_no_page)? I dumped stuff here: ftp://ftp.kernel.org/pub/linux/kernel/people/mbligh/andrea but it may take a few minutes to replicate. I'm using gcc 2.95.4, if you're doing funny gcc 3.x only stuff, that might explain it ;-) I'll try a 3.3 build in a bit to confirm. Dump of assembler code for function do_no_page: 0xc013f440 : sub $0x28,%esp 0xc013f443 : push %ebp 0xc013f444 : push %edi 0xc013f445 : push %esi 0xc013f446 : push %ebx 0xc013f447 : mov 0x4c(%esp,1),%edi 0xc013f44b : mov 0x40(%esp,1),%edx 0xc013f44f : movl $0x0,0x30(%esp,1) 0xc013f457 : movl $0x0,0x2c(%esp,1) 0xc013f45f : movl $0x1,0x34(%esp,1) 0xc013f467 : mov 0x3c(%edx),%eax 0xc013f46a : test %eax,%eax 0xc013f46c : je 0xc013f474 0xc013f46e : cmpl $0x0,0x8(%eax) 0xc013f472 : jne 0xc013f4a0 0xc013f474 : mov 0x44(%esp,1),%ecx 0xc013f478 : push %ecx 0xc013f479 : mov 0x4c(%esp,1),%esi 0xc013f47d : push %esi 0xc013f47e : mov 0x58(%esp,1),%eax 0xc013f482 : push %eax 0xc013f483 : push %edi 0xc013f484 : mov 0x50(%esp,1),%edx 0xc013f488 : push %edx 0xc013f489 : mov 0x50(%esp,1),%ecx 0xc013f48d : push %ecx 0xc013f48e : call 0xc013f1d4 0xc013f493 : add $0x18,%esp 0xc013f496 : jmp 0xc013f892 0xc013f49b : nop 0xc013f49c : lea 0x0(%esi,1),%esi 0xc013f4a0 : mov 0x3c(%esp,1),%esi 0xc013f4a4 : movb $0x1,0x30(%esi) 0xc013f4a8 : mov 0x40(%esp,1),%edi 0xc013f4ac : mov 0x44(%edi),%eax 0xc013f4af : test %eax,%eax 0xc013f4b1 : je 0xc013f4c4 0xc013f4b3 : mov 0x90(%eax),%eax 0xc013f4b9 : mov %eax,0x30(%esp,1) 0xc013f4bd : mov 0x60(%eax),%eax 0xc013f4c0 : mov %eax,0x2c(%esp,1) 0xc013f4c4 : lock addl $0x0,0x0(%esp,1) 0xc013f4ca : mov 0x44(%esp,1),%ecx 0xc013f4ce : lea 0x34(%esp,1),%edx 0xc013f4d2 : mov %edx,0x1c(%esp,1) 0xc013f4d6 : mov %ecx,0x18(%esp,1) 0xc013f4da : andl $0xfffff000,0x18(%esp,1) 0xc013f4e2 : mov 0x40(%esp,1),%esi 0xc013f4e6 : mov 0x1c(%esp,1),%edi 0xc013f4ea : mov 0x3c(%esi),%eax 0xc013f4ed : push %edi 0xc013f4ee : mov 0x1c(%esp,1),%edx 0xc013f4f2 : push %edx 0xc013f4f3 : push %esi 0xc013f4f4 : mov 0x8(%eax),%eax 0xc013f4f7 : call *%eax 0xc013f4f9 : mov %eax,0x20(%esp,1) 0xc013f4fd : add $0xc,%esp 0xc013f500 : mov 0x14(%esp,1),%ecx 0xc013f504 : movzbl 0x3(%ecx),%eax 0xc013f508 : mov 0xc035a980(,%eax,4),%edx 0xc013f50f : mov %ecx,%eax 0xc013f511 : sub 0xb84(%edx),%eax 0xc013f517 : imul $0xcccccccd,%eax,%eax 0xc013f51d : sar $0x3,%eax 0xc013f520 : add 0xb88(%edx),%eax 0xc013f526 : cmp 0xc035e360,%eax 0xc013f52c : jb 0xc013f536 0xc013f52e : ud2a 0xc013f530 : test %al,0xc0268680 0xc013f536 : mov 0x14(%esp,1),%esi 0xc013f53a : mov (%esi),%eax 0xc013f53c : test $0x200000,%eax 0xc013f541 : je 0xc013f550 0xc013f543 : ud2a 0xc013f545 : xchg %eax,0xc0268680 0xc013f54b : nop 0xc013f54c : lea 0x0(%esi,1),%esi 0xc013f550 : mov 0x14(%esp,1),%edi 0xc013f554 : mov (%edi),%eax 0xc013f556 : test $0x100000,%eax 0xc013f55b : je 0xc013f565 0xc013f55d : ud2a 0xc013f55f : mov %eax,0xc0268680 0xc013f565 : mov 0x40(%esp,1),%edx 0xc013f569 : mov 0x14(%edx),%eax 0xc013f56c : mov %eax,0x28(%esp,1) 0xc013f570 : andl $0x80000,0x28(%esp,1) 0xc013f578 : mov %eax,%edx 0xc013f57a : jne 0xc013f598 0xc013f57c : mov 0x14(%esp,1),%ecx 0xc013f580 : cmpl $0x0,0x1c(%ecx) 0xc013f584 : je 0xc013f590 0xc013f586 : mov (%ecx),%eax 0xc013f588 : test $0x8,%ah 0xc013f58b : je 0xc013f598 0xc013f58d : lea 0x0(%esi),%esi 0xc013f590 : ud2a 0xc013f592 : xchg %eax,%ebx 0xc013f593 : add $0xc0268680,%eax 0xc013f598 : cmpl $0x0,0x14(%esp,1) 0xc013f59d : jne 0xc013f5a6 0xc013f59f : xor %eax,%eax 0xc013f5a1 : jmp 0xc013f892 0xc013f5a6 : cmpl $0xffffffff,0x14(%esp,1) 0xc013f5ab : jne 0xc013f5b6 0xc013f5ad : mov 0x14(%esp,1),%eax 0xc013f5b1 : jmp 0xc013f892 0xc013f5b6 : xor %ebp,%ebp 0xc013f5b8 : cmpl $0x0,0x48(%esp,1) 0xc013f5bd : je 0xc013f698 0xc013f5c3 : test $0x8,%dl 0xc013f5c6 : jne 0xc013f698 0xc013f5cc : mov 0x40(%esp,1),%eax 0xc013f5d0 : call 0xc0143a84 0xc013f5d5 : test %eax,%eax 0xc013f5d7 : jne 0xc013f856 0xc013f5dd : mov $0xffffe000,%eax 0xc013f5e2 : and %esp,%eax 0xc013f5e4 : mov 0x10(%eax),%eax 0xc013f5e7 : shl $0x2,%eax 0xc013f5ea : mov 0xc02b2cc0(%eax),%eax 0xc013f5f0 : shl $0x2,%eax 0xc013f5f3 : mov 0xc0347760(%eax),%ecx 0xc013f5f9 : add $0x2588,%ecx 0xc013f5ff : xor %edx,%edx 0xc013f601 : mov $0xd2,%eax 0xc013f606 : call 0xc0134eb0 <__alloc_pages> 0xc013f60b : mov %eax,%ebp 0xc013f60d : test %ebp,%ebp 0xc013f60f : je 0xc013f856 0xc013f615 : push $0x3 0xc013f617 : mov 0x18(%esp,1),%esi 0xc013f61b : push %esi 0xc013f61c : call 0xc0116028 0xc013f621 : mov %eax,%ebx 0xc013f623 : push $0x4 0xc013f625 : push %ebp 0xc013f626 : call 0xc0116028 0xc013f62b : mov %eax,0x20(%esp,1) 0xc013f62f : add $0x10,%esp 0xc013f632 : mov 0x10(%esp,1),%edi 0xc013f636 : mov $0x400,%ecx 0xc013f63b : mov %ebx,%esi 0xc013f63d : repz movsl %ds:(%esi),%es:(%edi) 0xc013f63f : push $0x3 0xc013f641 : push %ebx 0xc013f642 : call 0xc01160b4 0xc013f647 : push $0x4 0xc013f649 : mov 0x1c(%esp,1),%eax 0xc013f64d : push %eax 0xc013f64e : call 0xc01160b4 0xc013f653 : add $0x10,%esp 0xc013f656 : mov 0x14(%esp,1),%edx 0xc013f65a : mov (%edx),%eax 0xc013f65c : test $0x8,%ah 0xc013f65f : jne 0xc013f688 0xc013f661 : mov 0x4(%edx),%eax 0xc013f664 : test %eax,%eax 0xc013f666 : jne 0xc013f670 0xc013f668 : ud2a 0xc013f66a : inc %ecx 0xc013f66b : add %esp,0x8bc02686 0xc013f671 : dec %esp 0xc013f672 : and $0x14,%al 0xc013f674 : lock decl 0x4(%ecx) 0xc013f678 : sete %al 0xc013f67b : test %al,%al 0xc013f67d : je 0xc013f688 0xc013f67f : mov 0x14(%esp,1),%eax 0xc013f683 : call 0xc01399a0 <__page_cache_release> 0xc013f688 : mov %ebp,%eax 0xc013f68a : call 0xc0139914 0xc013f68f : mov %ebp,0x14(%esp,1) 0xc013f693 : mov $0x1,%ebp 0xc013f698 : mov 0x3c(%esp,1),%esi 0xc013f69c : lock decb 0x30(%esi) 0xc013f6a0 : js 0xc013fd44 <.text.lock.memory+215> 0xc013f6a6 : cmpl $0x0,0x30(%esp,1) 0xc013f6ab : je 0xc013f704 0xc013f6ad : mov 0x30(%esp,1),%edi 0xc013f6b1 : mov 0x60(%edi),%eax 0xc013f6b4 : cmp %eax,0x2c(%esp,1) 0xc013f6b8 : je 0xc013f704 0xc013f6ba : mov 0x60(%edi),%eax 0xc013f6bd : mov %eax,0x2c(%esp,1) 0xc013f6c1 : movb $0x1,0x30(%esi) 0xc013f6c5 : mov 0x14(%esp,1),%edx 0xc013f6c9 : mov (%edx),%eax 0xc013f6cb : test $0x8,%ah 0xc013f6ce : jne 0xc013f4e2 0xc013f6d4 : mov 0x4(%edx),%eax 0xc013f6d7 : test %eax,%eax 0xc013f6d9 : jne 0xc013f6e3 0xc013f6db : ud2a 0xc013f6dd : inc %ecx 0xc013f6de : add %esp,0x8bc02686 0xc013f6e4 : dec %esp 0xc013f6e5 : and $0x14,%al 0xc013f6e7 : lock decl 0x4(%ecx) 0xc013f6eb : sete %al 0xc013f6ee : test %al,%al 0xc013f6f0 : je 0xc013f4e2 0xc013f6f6 : mov 0x14(%esp,1),%eax 0xc013f6fa : call 0xc01399a0 <__page_cache_release> 0xc013f6ff : jmp 0xc013f4e2 0xc013f704 : mov 0x50(%esp,1),%esi 0xc013f708 : mov (%esi),%eax 0xc013f70a : mov 0x4(%esi),%edx 0xc013f70d : shrd $0xc,%edx,%eax 0xc013f711 : shr $0xc,%edx 0xc013f714 : mov %eax,%edx 0xc013f716 : shr $0x10,%eax 0xc013f719 : movzbl 0xc02b3400(%eax),%eax 0xc013f720 : mov 0xc0347760(,%eax,4),%eax 0xc013f727 : sub 0x2658(%eax),%edx 0xc013f72d : mov 0x2650(%eax),%eax 0xc013f733 : lea (%edx,%edx,4),%edx 0xc013f736 : lea (%eax,%edx,8),%edx 0xc013f739 : push %edx 0xc013f73a : call 0xc013cb8c 0xc013f73f : mov 0x48(%esp,1),%ecx 0xc013f743 : shr $0x9,%ecx 0xc013f746 : and $0xff8,%ecx 0xc013f74c : lea (%ecx,%eax,1),%edi 0xc013f74f : mov (%edi),%eax 0xc013f751 : mov 0x4(%edi),%edx 0xc013f754 : add $0x4,%esp 0xc013f757 : xor %ecx,%ecx 0xc013f759 : test %eax,%eax 0xc013f75b : jne 0xc013f767 0xc013f75d : mov $0x1,%eax 0xc013f762 : test %edx,%edx 0xc013f764 : cmove %eax,%ecx 0xc013f767 : test %ecx,%ecx 0xc013f769 : je 0xc013f806 0xc013f76f : mov 0x14(%esp,1),%edx 0xc013f773 : mov (%edx),%eax 0xc013f775 : test $0x8,%ah 0xc013f778 : jne 0xc013f781 0xc013f77a : mov 0x3c(%esp,1),%ecx 0xc013f77e : incl 0x68(%ecx) 0xc013f781 : mov 0x14(%esp,1),%esi 0xc013f785 : movzbl 0x3(%esi),%eax 0xc013f789 : mov 0xc035a980(,%eax,4),%edx 0xc013f790 : mov 0x40(%esp,1),%ecx 0xc013f794 : mov %esi,%eax 0xc013f796 : sub 0xb84(%edx),%eax 0xc013f79c : imul $0xcccccccd,%eax,%eax 0xc013f7a2 : sar $0x3,%eax 0xc013f7a5 : add 0xb88(%edx),%eax 0xc013f7ab : mov %eax,%edx 0xc013f7ad : shr $0x14,%edx 0xc013f7b0 : mov %edx,0x24(%esp,1) 0xc013f7b4 : shl $0xc,%eax 0xc013f7b7 : or 0x10(%ecx),%eax 0xc013f7ba : mov %eax,0x20(%esp,1) 0xc013f7be : mov 0x20(%esp,1),%ecx 0xc013f7c2 : mov 0x24(%esp,1),%ebx 0xc013f7c6 : cmpl $0x0,0x48(%esp,1) 0xc013f7cb : je 0xc013f7e3 0xc013f7cd : mov 0x40(%esp,1),%esi 0xc013f7d1 : mov %ebx,%edx 0xc013f7d3 : mov %ecx,%eax 0xc013f7d5 : or $0x40,%al 0xc013f7d7 : mov %eax,%ecx 0xc013f7d9 : testb $0x2,0x14(%esi) 0xc013f7dd : je 0xc013f7e3 0xc013f7df : or $0x2,%al 0xc013f7e1 : mov %eax,%ecx 0xc013f7e3 : mov %ebx,0x4(%edi) 0xc013f7e6 : mov %ecx,(%edi) 0xc013f7e8 : cmpl $0x0,0x28(%esp,1) 0xc013f7ed : jne 0xc013f842 0xc013f7ef : push %ebp 0xc013f7f0 : mov 0x48(%esp,1),%ecx 0xc013f7f4 : mov 0x44(%esp,1),%edx 0xc013f7f8 : mov 0x18(%esp,1),%eax 0xc013f7fc : call 0xc0143398 0xc013f801 : add $0x4,%esp 0xc013f804 : jmp 0xc013f842 0xc013f806 : mov 0x14(%esp,1),%edi 0xc013f80a : mov (%edi),%eax 0xc013f80c : test $0x8,%ah 0xc013f80f : jne 0xc013f838 0xc013f811 : mov 0x4(%edi),%eax 0xc013f814 : test %eax,%eax 0xc013f816 : jne 0xc013f820 0xc013f818 : ud2a 0xc013f81a : inc %ecx 0xc013f81b : add %esp,0x8bc02686 0xc013f821 : push %esp 0xc013f822 : and $0x14,%al 0xc013f824 : lock decl 0x4(%edx) 0xc013f828 : sete %al 0xc013f82b : test %al,%al 0xc013f82d : je 0xc013f838 0xc013f82f : mov 0x14(%esp,1),%eax 0xc013f833 : call 0xc01399a0 <__page_cache_release> 0xc013f838 : mov 0x3c(%esp,1),%ecx 0xc013f83c : movb $0x1,0x30(%ecx) 0xc013f840 : jmp 0xc013f850 0xc013f842 : mov 0x3c(%esp,1),%esi 0xc013f846 : movb $0x1,0x30(%esi) 0xc013f84a : lea 0x0(%esi),%esi 0xc013f850 : mov 0x34(%esp,1),%eax 0xc013f854 : jmp 0xc013f892 0xc013f856 : mov 0x14(%esp,1),%edi 0xc013f85a : mov (%edi),%eax 0xc013f85c : test $0x8,%ah 0xc013f85f : jne 0xc013f888 0xc013f861 : mov 0x4(%edi),%eax 0xc013f864 : test %eax,%eax 0xc013f866 : jne 0xc013f870 0xc013f868 : ud2a 0xc013f86a : inc %ecx 0xc013f86b : add %esp,0x8bc02686 0xc013f871 : push %esp 0xc013f872 : and $0x14,%al 0xc013f874 : lock decl 0x4(%edx) 0xc013f878 : sete %al 0xc013f87b : test %al,%al 0xc013f87d : je 0xc013f888 0xc013f87f : mov 0x14(%esp,1),%eax 0xc013f883 : call 0xc01399a0 <__page_cache_release> 0xc013f888 : movl $0xffffffff,0x34(%esp,1) 0xc013f890 : jmp 0xc013f850 0xc013f892 : pop %ebx 0xc013f893 : pop %esi 0xc013f894 : pop %edi 0xc013f895 : pop %ebp 0xc013f896 : add $0x28,%esp 0xc013f899 : ret 0xc013f89a : mov %esi,%esi End of assembler dump.