Re: kernel bugs 2.6.31-rc6

Re: kernel bugs 2.6.31-rc6

[Linus Torvalds]

Christoph,
 please don't send kernel bug reports just to my personal email address. 
There are kernel mailing lists, and there are maintainers, and they all 
want to know about them - not just one person who has a lot to do anyway. 

Sending them just to me means that unless it's one of "my" areas, not a 
lot will be done, but also that 'google' etc won't see it and index it.

Eric - looks exactly like that bug Mikko reported but couldn't reproduce,
bugzilla entry 13729:

	http://bugzilla.kernel.org/show_bug.cgi?id=13729

it got closed because Mikko says he can't repro it since -rc3, but clearly 
it should be re-opened.

Looks like something 'event' is either incorrectly 'put' twice (so that 
you end up trying to free it before it's all done), or some corruption of 
the '&event->private_data_list'. Either way, it's likely a locking error, 
although an outright refcounting bug is possible.

For example, fsnotify_remove_priv_from_event() will remove the private 
data event from the list, but what if there are _multiple_ entries with 
the same 'group' entry? If so, it will remove just the first one. So it 
looks like the bug could trigger if somebody just adds event private data 
for the same group to the same event twice. Can that happen?

		Linus

On Sat, 15 Aug 2009, Christoph Thielecke wrote:
>
> Hello Linus,
> 
> I still got kernel bugs (which freeze my machine after log) with 2.6.31-rc6.
> 
> Please look whats going wrong. Btw: I use often switching from display :0 
> (user crissi with kde3 session) to display :1 (user kde-devel with kde4 
> session).  Mostly in this time I got the bugs.
> 
> Aug 15 10:03:24 develop kernel: ------------[ cut here ]------------
> Aug 15 10:03:24 develop kernel: kernel BUG at fs/notify/notification.c:93!
> Aug 15 10:03:24 develop kernel: invalid opcode: 0000 [#1] PREEMPT SMP 
> Aug 15 10:03:24 develop kernel: last sysfs file: /sys/class/net/eth2/address
> Aug 15 10:03:24 develop kernel: Modules linked in: nvidia(P) vboxnetadp vboxnetflt vboxdrv binfmt_misc ppdev parport_pc lp parport rfcomm l2cap bluetooth tun pppol2tp pppox ppp_generic slhc ipv6 capifs acpi_cpufreq cpufreq_ondemand cpufreq_powersave cpufreq_stats freq_table cpufreq_userspace cpufreq_conservative nfsd nfs lockd fscache nfs_acl auth_rpcgss sunrpc deflate zlib_deflate ctr twofish twofish_common camellia serpent blowfish cast5 des_generic cbc aes_i586 aes_generic xcbc rmd160 sha256_generic sha1_generic crypto_null af_key nls_iso8859_1 nls_cp437 vfat fat fuse dm_snapshot dm_mirror dm_region_hash dm_log dm_mod coretemp loop asix dm9601 pl2303 usbnet usbserial usbhid hid snd_hda_codec_idt snd_hda_intel snd_hda_codec snd_hwdep snd_pcm_oss snd_mixer_oss snd_pcm arc4 ecb snd_seq_dummy snd_seq_oss snd_seq_midi snd_rawmidi firewire_ohci firewire_core sdhci_pci snd_seq_midi_event iwl3945 joydev b44 crc_itu_t sdhci snd_seq iwlcore ssb intel_agp snd_timer snd_seq_device !
 mac80211 iTCO_wdt iTCO_vendor_support pcmcia pcmcia_core ohci1394 mmc_core i2c_i801 snd uhci_hcd ehci_hcd rtc_cmos rtc_core video psmouse mii agpgart ieee1394 led_class i2c_core soundcore snd_page_alloc cfg80211 usbcore rtc_lib battery button output serio_raw processor thermal wmi sg ac dell_laptop sr_mod rfkill evdev cdrom [last unloaded: nvidia]
> Aug 15 10:03:24 develop kernel: 
> Aug 15 10:03:24 develop kernel: Pid: 10303, comm: kdevelop Tainted: P           (2.6.31-rc6 #2) MP061                           
> Aug 15 10:03:24 develop kernel: EIP: 0060:[<c10dbb17>] EFLAGS: 00210283 CPU: 0
> Aug 15 10:03:24 develop kernel: EIP is at fsnotify_put_event+0x46/0x4a
> Aug 15 10:03:24 develop kernel: EAX: f67da50c EBX: f67da4d8 ECX: 00000000 EDX: bfb6e101
> Aug 15 10:03:24 develop kernel: ESI: bfb6e134 EDI: f67da4d8 EBP: d61aff0c ESP: d61aff08
> Aug 15 10:03:24 develop kernel: DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
> Aug 15 10:03:24 develop kernel: Process kdevelop (pid: 10303, ti=d61ae000 task=e72db3d0 task.ti=d61ae000)
> Aug 15 10:03:24 develop kernel: Stack:
> Aug 15 10:03:24 develop kernel: 00000020 d61aff64 c10ddc05 00000020 bfb6e114 e8e88140 e9be2374 e9be2358
> Aug 15 10:03:24 develop kernel: <0> e9be2340 bfb6e114 00000010 00000000 e72db3d0 c1046b8f e9be2378 e9be2378
> Aug 15 10:03:24 develop kernel: <0> 00000007 00000002 00000000 00000010 e8e88140 bfb6e114 00000020 d61aff8c
> Aug 15 10:03:24 develop kernel: Call Trace:
> Aug 15 10:03:24 develop kernel: [<c10ddc05>] ? inotify_read+0x24a/0x269
> Aug 15 10:03:24 develop kernel: [<c1046b8f>] ? autoremove_wake_function+0x0/0x3a
> Aug 15 10:03:24 develop kernel: [<c10b3626>] ? vfs_read+0x8b/0x142
> Aug 15 10:03:24 develop kernel: [<c10dd9bb>] ? inotify_read+0x0/0x269
> Aug 15 10:03:24 develop kernel: [<c10b3786>] ? sys_read+0x3d/0x6b
> Aug 15 10:03:24 develop kernel: [<c1003610>] ? sysenter_do_call+0x12/0x2c
> Aug 15 10:03:24 develop kernel: Code: 74 1f 8d 43 34 39 43 34 75 21 8b 43 2c e8 1e fe fc ff 89 da a1 c4 e3 54 c1 e8 dd fe fc ff 5b 5d c3 8d 43 14 e8 47 e6 fd ff eb d7 <0f> 0b eb fe 55 89 e5 57 56 53 83 ec 0c 89 c6 8d 40 18 89 45 e8 
> Aug 15 10:03:24 develop kernel: EIP: [<c10dbb17>] fsnotify_put_event+0x46/0x4a SS:ESP 0068:d61aff08
> Aug 15 10:03:24 develop kernel: ---[ end trace ecc7791937cd097a ]---
> Aug 15 10:03:37 develop kernel: BUG: unable to handle kernel paging request at 00100104
> Aug 15 10:03:37 develop kernel: IP: [<c10db6bc>] fsnotify_remove_priv_from_event+0x4f/0x6c
> Aug 15 10:03:37 develop kernel: *pde = 00000000 
> Aug 15 10:03:37 develop kernel: Oops: 0002 [#2] PREEMPT SMP 
> Aug 15 10:03:37 develop kernel: last sysfs file: /sys/class/net/eth2/address
> Aug 15 10:03:37 develop kernel: Modules linked in: nvidia(P) vboxnetadp vboxnetflt vboxdrv binfmt_misc ppdev parport_pc lp parport rfcomm l2cap bluetooth tun pppol2tp pppox ppp_generic slhc ipv6 capifs acpi_cpufreq cpufreq_ondemand cpufreq_powersave cpufreq_stats freq_table cpufreq_userspace cpufreq_conservative nfsd nfs lockd fscache nfs_acl auth_rpcgss sunrpc deflate zlib_deflate ctr twofish twofish_common camellia serpent blowfish cast5 des_generic cbc aes_i586 aes_generic xcbc rmd160 sha256_generic sha1_generic crypto_null af_key nls_iso8859_1 nls_cp437 vfat fat fuse dm_snapshot dm_mirror dm_region_hash dm_log dm_mod coretemp loop asix dm9601 pl2303 usbnet usbserial usbhid hid snd_hda_codec_idt snd_hda_intel snd_hda_codec snd_hwdep snd_pcm_oss snd_mixer_oss snd_pcm arc4 ecb snd_seq_dummy snd_seq_oss snd_seq_midi snd_rawmidi firewire_ohci firewire_core sdhci_pci snd_seq_midi_event iwl3945 joydev b44 crc_itu_t sdhci snd_seq iwlcore ssb intel_agp snd_timer snd_seq_device !
 mac80211 iTCO_wdt iTCO_vendor_support pcmcia pcmcia_core ohci1394 mmc_core i2c_i801 snd uhci_hcd ehci_hcd rtc_cmos rtc_core video psmouse mii agpgart ieee1394 led_class i2c_core soundcore snd_page_alloc cfg80211 usbcore rtc_lib battery button output serio_raw processor thermal wmi sg ac dell_laptop sr_mod rfkill evdev cdrom [last unloaded: nvidia]
> Aug 15 10:03:37 develop kernel: 
> Aug 15 10:03:37 develop kernel: Pid: 10578, comm: kopete Tainted: P      D    (2.6.31-rc6 #2) MP061                           
> Aug 15 10:03:37 develop kernel: EIP: 0060:[<c10db6bc>] EFLAGS: 00010246 CPU: 0
> Aug 15 10:03:37 develop kernel: EIP is at fsnotify_remove_priv_from_event+0x4f/0x6c
> Aug 15 10:03:37 develop kernel: EAX: 00200200 EBX: f67da7a0 ECX: e8047448 EDX: 00100100
> Aug 15 10:03:37 develop kernel: ESI: e98dd940 EDI: f67da76c EBP: e8f47f0c ESP: e8f47f04
> Aug 15 10:03:37 develop kernel: DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
> Aug 15 10:03:37 develop kernel: Process kopete (pid: 10578, ti=e8f46000 task=e9b68070 task.ti=e8f46000)
> Aug 15 10:03:37 develop kernel: Stack:
> Aug 15 10:03:37 develop kernel: f67da778 bf9dce94 e8f47f64 c10ddafa 00000060 bf9dce74 c9354c40 e98dd974
> Aug 15 10:03:37 develop kernel: <0> e98dd958 e98dd940 bf9dce94 0000000d 00000000 e9b68070 c1046b8f e98dd978
> Aug 15 10:03:37 develop kernel: <0> e98dd978 00000006 00000100 00000000 00000010 c9354c40 bf9dce74 00000080
> Aug 15 10:03:37 develop kernel: Call Trace:
> Aug 15 10:03:37 develop kernel: [<c10ddafa>] ? inotify_read+0x13f/0x269
> Aug 15 10:03:37 develop kernel: [<c1046b8f>] ? autoremove_wake_function+0x0/0x3a
> Aug 15 10:03:37 develop kernel: [<c10b3626>] ? vfs_read+0x8b/0x142
> Aug 15 10:03:37 develop kernel: [<c10dd9bb>] ? inotify_read+0x0/0x269
> Aug 15 10:03:37 develop kernel: [<c10b3786>] ? sys_read+0x3d/0x6b
> Aug 15 10:03:37 develop kernel: [<c1003610>] ? sysenter_do_call+0x12/0x2c
> Aug 15 10:03:37 develop kernel: Code: 34 39 c3 74 1d 39 70 fc 75 07 eb 1c 39 31 90 74 17 8d 4a fc 8b 51 04 0f 18 02 90 8d 41 04 39 c3 75 ea 31 c0 5b 5e 5d c3 8b 41 08 <89> 42 04 89 10 c7 41 04 00 01 10 00 c7 41 08 00 02 20 00 89 c8 
> Aug 15 10:03:37 develop kernel: EIP: [<c10db6bc>] fsnotify_remove_priv_from_event+0x4f/0x6c SS:ESP 0068:e8f47f04
> Aug 15 10:03:37 develop kernel: CR2: 0000000000100104
> Aug 15 10:03:37 develop kernel: ---[ end trace ecc7791937cd097b ]---
> Aug 15 10:03:37 develop kernel: note: kopete[10578] exited with preempt_count 1
> Aug 15 10:03:46 develop kernel: ------------[ cut here ]------------
> Aug 15 10:03:46 develop kernel: kernel BUG at fs/notify/notification.c:93!
> Aug 15 10:03:46 develop kernel: invalid opcode: 0000 [#3] PREEMPT SMP 
> Aug 15 10:03:46 develop kernel: last sysfs file: /sys/class/net/eth2/address
> Aug 15 10:03:46 develop kernel: Modules linked in: nvidia(P) vboxnetadp vboxnetflt vboxdrv binfmt_misc ppdev parport_pc lp parport rfcomm l2cap bluetooth tun pppol2tp pppox ppp_generic slhc ipv6 capifs acpi_cpufreq cpufreq_ondemand cpufreq_powersave cpufreq_stats freq_table cpufreq_userspace cpufreq_conservative nfsd nfs lockd fscache nfs_acl auth_rpcgss sunrpc deflate zlib_deflate ctr twofish twofish_common camellia serpent blowfish cast5 des_generic cbc aes_i586 aes_generic xcbc rmd160 sha256_generic sha1_generic crypto_null af_key nls_iso8859_1 nls_cp437 vfat fat fuse dm_snapshot dm_mirror dm_region_hash dm_log dm_mod coretemp loop asix dm9601 pl2303 usbnet usbserial usbhid hid snd_hda_codec_idt snd_hda_intel snd_hda_codec snd_hwdep snd_pcm_oss snd_mixer_oss snd_pcm arc4 ecb snd_seq_dummy snd_seq_oss snd_seq_midi snd_rawmidi firewire_ohci firewire_core sdhci_pci snd_seq_midi_event iwl3945 joydev b44 crc_itu_t sdhci snd_seq iwlcore ssb intel_agp snd_timer snd_seq_device !
 mac80211 iTCO_wdt iTCO_vendor_support pcmcia pcmcia_core ohci1394 mmc_core i2c_i801 snd uhci_hcd ehci_hcd rtc_cmos rtc_core video psmouse mii agpgart ieee1394 led_class i2c_core soundcore snd_page_alloc cfg80211 usbcore rtc_lib battery button output serio_raw processor thermal wmi sg ac dell_laptop sr_mod rfkill evdev cdrom [last unloaded: nvidia]
> Aug 15 10:03:46 develop kernel: 
> Aug 15 10:03:46 develop kernel: Pid: 10114, comm: kded4 Tainted: P      D    (2.6.31-rc6 #2) MP061                           
> Aug 15 10:03:46 develop kernel: EIP: 0060:[<c10dbb17>] EFLAGS: 00010283 CPU: 1
> Aug 15 10:03:46 develop kernel: EIP is at fsnotify_put_event+0x46/0x4a
> Aug 15 10:03:46 develop kernel: EAX: f67da944 EBX: f67da910 ECX: 00000000 EDX: bfac7601
> Aug 15 10:03:46 develop kernel: ESI: bfac7684 EDI: f67da910 EBP: f6291f0c ESP: f6291f08
> Aug 15 10:03:46 develop kernel: DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
> Aug 15 10:03:46 develop kernel: Process kded4 (pid: 10114, ti=f6290000 task=f6a250b0 task.ti=f6290000)
> Aug 15 10:03:46 develop kernel: Stack:
> Aug 15 10:03:46 develop kernel: 00000000 f6291f64 c10ddb5a 00000540 bfac7674 e9f36e40 ea0f54f4 ea0f54d8
> Aug 15 10:03:46 develop kernel: <0> ea0f54c0 bfac7674 082efcbd 00000000 f6a250b0 c1046b8f ea0f54f8 ea0f54f8
> Aug 15 10:03:46 develop kernel: <0> 000003bf 00008000 00000000 00000000 e9f36e40 bfac7674 00000540 f6291f8c
> Aug 15 10:03:46 develop kernel: Call Trace:
> Aug 15 10:03:46 develop kernel: [<c10ddb5a>] ? inotify_read+0x19f/0x269
> Aug 15 10:03:46 develop kernel: [<c1046b8f>] ? autoremove_wake_function+0x0/0x3a
> Aug 15 10:03:46 develop kernel: [<c10b3626>] ? vfs_read+0x8b/0x142
> Aug 15 10:03:46 develop kernel: [<c10dd9bb>] ? inotify_read+0x0/0x269
> Aug 15 10:03:46 develop kernel: [<c10b3786>] ? sys_read+0x3d/0x6b
> Aug 15 10:03:46 develop kernel: [<c1003610>] ? sysenter_do_call+0x12/0x2c
> Aug 15 10:03:46 develop kernel: Code: 74 1f 8d 43 34 39 43 34 75 21 8b 43 2c e8 1e fe fc ff 89 da a1 c4 e3 54 c1 e8 dd fe fc ff 5b 5d c3 8d 43 14 e8 47 e6 fd ff eb d7 <0f> 0b eb fe 55 89 e5 57 56 53 83 ec 0c 89 c6 8d 40 18 89 45 e8 
> Aug 15 10:03:46 develop kernel: EIP: [<c10dbb17>] fsnotify_put_event+0x46/0x4a SS:ESP 0068:f6291f08
> Aug 15 10:03:46 develop kernel: ---[ end trace ecc7791937cd097c ]---
> Aug 15 10:03:46 develop kernel: idr_remove called for id=1024 which is not allocated.
> Aug 15 10:03:46 develop kernel: Pid: 10114, comm: kded4 Tainted: P      D    2.6.31-rc6 #2
> Aug 15 10:03:46 develop kernel: Call Trace:
> Aug 15 10:03:46 develop kernel: [<c133a0b0>] ? printk+0x18/0x20
> Aug 15 10:03:46 develop kernel: [<c11d00c0>] idr_remove+0x79/0x1ad
> Aug 15 10:03:46 develop kernel: [<c10db9d1>] ? fsnotify_add_notify_event+0x105/0x205
> Aug 15 10:03:46 develop kernel: [<c10ddce3>] inotify_remove_from_idr+0x21/0x34
> Aug 15 10:03:46 develop kernel: [<c10de1ae>] inotify_ignored_and_remove_idr+0x85/0xb7
> Aug 15 10:03:46 develop kernel: [<c10dd753>] inotify_freeing_mark+0x8/0xa
> Aug 15 10:03:46 develop kernel: [<c10dc3ab>] fsnotify_destroy_mark_by_entry+0xf3/0x132
> Aug 15 10:03:46 develop kernel: [<c10dc532>] fsnotify_clear_marks_by_group+0x9b/0xc9
> Aug 15 10:03:46 develop kernel: [<c10dd8e5>] inotify_release+0x12/0x26
> Aug 15 10:03:46 develop kernel: [<c10b3dfa>] __fput+0xd3/0x1ba
> Aug 15 10:03:46 develop kernel: [<c10b3efc>] fput+0x1b/0x20
> Aug 15 10:03:46 develop kernel: [<c10b108e>] filp_close+0x41/0x5f
> Aug 15 10:03:46 develop kernel: [<c10342d5>] put_files_struct+0x68/0xa6
> Aug 15 10:03:46 develop kernel: [<c103434a>] exit_files+0x37/0x3c
> Aug 15 10:03:46 develop kernel: [<c1035777>] do_exit+0x146/0x6c6
> Aug 15 10:03:46 develop kernel: [<c1003f76>] ? apic_timer_interrupt+0x2a/0x30
> Aug 15 10:03:46 develop kernel: [<c133a0b0>] ? printk+0x18/0x20
> Aug 15 10:03:46 develop kernel: [<c103269c>] ? oops_exit+0x2f/0x31
> Aug 15 10:03:46 develop kernel: [<c1006e42>] oops_begin+0x0/0x95
> Aug 15 10:03:46 develop kernel: [<c1006ff5>] die+0x4a/0x5e
> Aug 15 10:03:46 develop kernel: [<c1004271>] do_trap+0x82/0xa8
> Aug 15 10:03:46 develop kernel: [<c100460e>] ? do_invalid_op+0x0/0x98
> Aug 15 10:03:46 develop kernel: [<c1004694>] do_invalid_op+0x86/0x98
> Aug 15 10:03:46 develop kernel: [<c10dbb17>] ? fsnotify_put_event+0x46/0x4a
> Aug 15 10:03:46 develop kernel: [<c133c8e6>] error_code+0x66/0x6c
> Aug 15 10:03:46 develop kernel: [<c10d007b>] ? sync_filesystems+0x83/0xe9
> Aug 15 10:03:46 develop kernel: [<c100460e>] ? do_invalid_op+0x0/0x98
> Aug 15 10:03:46 develop kernel: [<c10dbb17>] ? fsnotify_put_event+0x46/0x4a
> Aug 15 10:03:46 develop kernel: [<c10ddb5a>] inotify_read+0x19f/0x269
> Aug 15 10:03:46 develop kernel: [<c1046b8f>] ? autoremove_wake_function+0x0/0x3a
> Aug 15 10:03:46 develop kernel: [<c10b3626>] vfs_read+0x8b/0x142
> Aug 15 10:03:46 develop kernel: [<c10dd9bb>] ? inotify_read+0x0/0x269
> Aug 15 10:03:46 develop kernel: [<c10b3786>] sys_read+0x3d/0x6b
> Aug 15 10:03:46 develop kernel: [<c1003610>] sysenter_do_call+0x12/0x2c
> Aug 15 10:03:46 develop kernel: ------------[ cut here ]------------
> Aug 15 10:03:46 develop kernel: kernel BUG at mm/slab.c:2974!
> Aug 15 10:03:46 develop kernel: invalid opcode: 0000 [#4] PREEMPT SMP 
> Aug 15 10:03:46 develop kernel: last sysfs file: /sys/class/net/eth2/address
> Aug 15 10:03:46 develop kernel: Modules linked in: nvidia(P) vboxnetadp vboxnetflt vboxdrv binfmt_misc ppdev parport_pc lp parport rfcomm l2cap bluetooth tun pppol2tp pppox ppp_generic slhc ipv6 capifs acpi_cpufreq cpufreq_ondemand cpufreq_powersave cpufreq_stats freq_table cpufreq_userspace cpufreq_conservative nfsd nfs lockd fscache nfs_acl auth_rpcgss sunrpc deflate zlib_deflate ctr twofish twofish_common camellia serpent blowfish cast5 des_generic cbc aes_i586 aes_generic xcbc rmd160 sha256_generic sha1_generic crypto_null af_key nls_iso8859_1 nls_cp437 vfat fat fuse dm_snapshot dm_mirror dm_region_hash dm_log dm_mod coretemp loop asix dm9601 pl2303 usbnet usbserial usbhid hid snd_hda_codec_idt snd_hda_intel snd_hda_codec snd_hwdep snd_pcm_oss snd_mixer_oss snd_pcm arc4 ecb snd_seq_dummy snd_seq_oss snd_seq_midi snd_rawmidi firewire_ohci firewire_core sdhci_pci snd_seq_midi_event iwl3945 joydev b44 crc_itu_t sdhci snd_seq iwlcore ssb intel_agp snd_timer snd_seq_device !
 mac80211 iTCO_wdt iTCO_vendor_support pcmcia pcmcia_core ohci1394 mmc_core i2c_i801 snd uhci_hcd ehci_hcd rtc_cmos rtc_core video psmouse mii agpgart ieee1394 led_class i2c_core soundcore snd_page_alloc cfg80211 usbcore rtc_lib battery button output serio_raw processor thermal wmi sg ac dell_laptop sr_mod rfkill evdev cdrom [last unloaded: nvidia]
> Aug 15 10:03:46 develop kernel: 
> Aug 15 10:03:46 develop kernel: Pid: 10114, comm: kded4 Tainted: P      D    (2.6.31-rc6 #2) MP061                           
> Aug 15 10:03:46 develop kernel: EIP: 0060:[<c10ac105>] EFLAGS: 00010046 CPU: 1
> Aug 15 10:03:46 develop kernel: EIP is at cache_alloc_refill+0x1bb/0x4e8
> Aug 15 10:03:46 develop kernel: EAX: 000000cb EBX: f7209400 ECX: 00000033 EDX: f6864f40
> Aug 15 10:03:46 develop kernel: ESI: e8047000 EDI: 00000009 EBP: f6291c74 ESP: f6291c20
> Aug 15 10:03:46 develop kernel: DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068
> Aug 15 10:03:46 develop kernel: Process kded4 (pid: 10114, ti=f6290000 task=f6a250b0 task.ti=f6290000)
> Aug 15 10:03:46 develop kernel: Stack:
> Aug 15 10:03:46 develop kernel: f6291f34 ea0f54ec 00000032 00000010 00000050 00000050 f6864f40 f71fe264
> Aug 15 10:03:46 develop kernel: <0> f6863000 f71fe250 f71fe248 00000009 f71fe240 00000000 e8c24118 00000206
> Aug 15 10:03:46 develop kernel: <0> 00000000 ea0f5520 00000206 f6864f40 00000050 f6291c9c c10ac678 00000000
> Aug 15 10:03:46 develop kernel: Call Trace:
> Aug 15 10:03:46 develop kernel: [<c10ac678>] ? kmem_cache_alloc+0xed/0x105
> Aug 15 10:03:46 develop kernel: [<c10db738>] ? fsnotify_create_event+0x21/0x147
> Aug 15 10:03:46 develop kernel: [<c10de179>] ? inotify_ignored_and_remove_idr+0x50/0xb7
> Aug 15 10:03:46 develop kernel: [<c10dd753>] ? inotify_freeing_mark+0x8/0xa
> Aug 15 10:03:46 develop kernel: [<c10dc3ab>] ? fsnotify_destroy_mark_by_entry+0xf3/0x132
> Aug 15 10:03:46 develop kernel: [<c10dc532>] ? fsnotify_clear_marks_by_group+0x9b/0xc9
> Aug 15 10:03:46 develop kernel: [<c10dd8e5>] ? inotify_release+0x12/0x26
> Aug 15 10:03:46 develop kernel: [<c10b3dfa>] ? __fput+0xd3/0x1ba
> Aug 15 10:03:46 develop kernel: [<c10b3efc>] ? fput+0x1b/0x20
> Aug 15 10:03:46 develop kernel: [<c10b108e>] ? filp_close+0x41/0x5f
> Aug 15 10:03:46 develop kernel: [<c10342d5>] ? put_files_struct+0x68/0xa6
> Aug 15 10:03:46 develop kernel: [<c103434a>] ? exit_files+0x37/0x3c
> Aug 15 10:03:46 develop kernel: [<c1035777>] ? do_exit+0x146/0x6c6
> Aug 15 10:03:46 develop kernel: [<c1003f76>] ? apic_timer_interrupt+0x2a/0x30
> Aug 15 10:03:46 develop kernel: [<c133a0b0>] ? printk+0x18/0x20
> Aug 15 10:03:46 develop kernel: [<c103269c>] ? oops_exit+0x2f/0x31
> Aug 15 10:03:46 develop kernel: [<c1006e42>] ? oops_begin+0x0/0x95
> Aug 15 10:03:46 develop kernel: [<c1006ff5>] ? die+0x4a/0x5e
> Aug 15 10:03:46 develop kernel: [<c1004271>] ? do_trap+0x82/0xa8
> Aug 15 10:03:46 develop kernel: [<c100460e>] ? do_invalid_op+0x0/0x98
> Aug 15 10:03:46 develop kernel: [<c1004694>] ? do_invalid_op+0x86/0x98
> Aug 15 10:03:46 develop kernel: [<c10dbb17>] ? fsnotify_put_event+0x46/0x4a
> Aug 15 10:03:46 develop kernel: [<c133c8e6>] ? error_code+0x66/0x6c
> Aug 15 10:03:46 develop kernel: [<c10d007b>] ? sync_filesystems+0x83/0xe9
> Aug 15 10:03:46 develop kernel: [<c100460e>] ? do_invalid_op+0x0/0x98
> Aug 15 10:03:46 develop kernel: [<c10dbb17>] ? fsnotify_put_event+0x46/0x4a
> Aug 15 10:03:46 develop kernel: [<c10ddb5a>] ? inotify_read+0x19f/0x269
> Aug 15 10:03:46 develop kernel: [<c1046b8f>] ? autoremove_wake_function+0x0/0x3a
> Aug 15 10:03:46 develop kernel: [<c10b3626>] ? vfs_read+0x8b/0x142
> Aug 15 10:03:46 develop kernel: [<c10dd9bb>] ? inotify_read+0x0/0x269
> Aug 15 10:03:46 develop kernel: [<c10b3786>] ? sys_read+0x3d/0x6b
> Aug 15 10:03:46 develop kernel: [<c1003610>] ? sysenter_do_call+0x12/0x2c
> Aug 15 10:03:46 develop kernel: Code: 89 06 8b 45 d4 89 46 04 89 71 08 eb ae c7 40 34 01 00 00 00 8b 70 10 39 75 d0 74 a7 8b 46 10 8b 55 c4 3b 42 38 0f 82 1b ff ff ff <0f> 0b eb fe 8d 04 95 00 00 00 00 89 45 b0 89 d1 81 e1 ff ff ff 
> Aug 15 10:03:46 develop kernel: EIP: [<c10ac105>] cache_alloc_refill+0x1bb/0x4e8 SS:ESP 0068:f6291c20
> Aug 15 10:03:46 develop kernel: ---[ end trace ecc7791937cd097d ]---
> Aug 15 10:03:46 develop kernel: Fixing recursive fault but reboot is needed!
> Aug 15 10:03:46 develop kernel: BUG: scheduling while atomic: kded4/10114/0x00000002
> Aug 15 10:03:46 develop kernel: Modules linked in: nvidia(P) vboxnetadp vboxnetflt vboxdrv binfmt_misc ppdev parport_pc lp parport rfcomm l2cap bluetooth tun pppol2tp pppox ppp_generic slhc ipv6 capifs acpi_cpufreq cpufreq_ondemand cpufreq_powersave cpufreq_stats freq_table cpufreq_userspace cpufreq_conservative nfsd nfs lockd fscache nfs_acl auth_rpcgss sunrpc deflate zlib_deflate ctr twofish twofish_common camellia serpent blowfish cast5 des_generic cbc aes_i586 aes_generic xcbc rmd160 sha256_generic sha1_generic crypto_null af_key nls_iso8859_1 nls_cp437 vfat fat fuse dm_snapshot dm_mirror dm_region_hash dm_log dm_mod coretemp loop asix dm9601 pl2303 usbnet usbserial usbhid hid snd_hda_codec_idt snd_hda_intel snd_hda_codec snd_hwdep snd_pcm_oss snd_mixer_oss snd_pcm arc4 ecb snd_seq_dummy snd_seq_oss snd_seq_midi snd_rawmidi firewire_ohci firewire_core sdhci_pci snd_seq_midi_event iwl3945 joydev b44 crc_itu_t sdhci snd_seq iwlcore ssb intel_agp snd_timer snd_seq_device !
 mac80211 iTCO_wdt iTCO_vendor_support pcmcia pcmcia_core ohci1394 mmc_core i2c_i801 snd uhci_hcd ehci_hcd rtc_cmos rtc_core video psmouse mii agpgart ieee1394 led_class i2c_core soundcore snd_page_alloc cfg80211 usbcore rtc_lib battery button output serio_raw processor thermal wmi sg ac dell_laptop sr_mod rfkill evdev cdrom [last unloaded: nvidia]
> Aug 15 10:03:46 develop kernel: Pid: 10114, comm: kded4 Tainted: P      D    2.6.31-rc6 #2
> Aug 15 10:03:46 develop kernel: Call Trace:
> Aug 15 10:03:46 develop kernel: [<c133a0b0>] ? printk+0x18/0x20
> Aug 15 10:03:46 develop kernel: [<c10286c9>] __schedule_bug+0x5d/0x5f
> Aug 15 10:03:46 develop kernel: [<c133a3ce>] schedule+0x97/0x842
> Aug 15 10:03:46 develop kernel: [<c1032d5f>] ? release_console_sem+0x189/0x1c3
> Aug 15 10:03:46 develop kernel: [<c1035cf2>] do_exit+0x6c1/0x6c6
> Aug 15 10:03:46 develop kernel: [<c1032d5f>] ? release_console_sem+0x189/0x1c3
> Aug 15 10:03:46 develop kernel: [<c133a0b0>] ? printk+0x18/0x20
> Aug 15 10:03:46 develop kernel: [<c103269c>] ? oops_exit+0x2f/0x31
> Aug 15 10:03:46 develop kernel: [<c1006e42>] oops_begin+0x0/0x95
> Aug 15 10:03:46 develop kernel: [<c1006ff5>] die+0x4a/0x5e
> Aug 15 10:03:46 develop kernel: [<c1004271>] do_trap+0x82/0xa8
> Aug 15 10:03:46 develop kernel: [<c100460e>] ? do_invalid_op+0x0/0x98
> Aug 15 10:03:46 develop kernel: [<c1004694>] do_invalid_op+0x86/0x98
> Aug 15 10:03:46 develop kernel: [<c10ac105>] ? cache_alloc_refill+0x1bb/0x4e8
> Aug 15 10:03:46 develop kernel: [<c10092b5>] ? sched_clock+0x8/0xb
> Aug 15 10:03:46 develop kernel: [<c104b929>] ? sched_clock_cpu+0x63/0x37c
> Aug 15 10:03:46 develop kernel: [<c10092b5>] ? sched_clock+0x8/0xb
> Aug 15 10:03:46 develop kernel: [<c104b929>] ? sched_clock_cpu+0x63/0x37c
> Aug 15 10:03:46 develop kernel: [<c133c8e6>] error_code+0x66/0x6c
> Aug 15 10:03:46 develop kernel: [<c100460e>] ? do_invalid_op+0x0/0x98
> Aug 15 10:03:46 develop kernel: [<c10ac105>] ? cache_alloc_refill+0x1bb/0x4e8
> Aug 15 10:03:46 develop kernel: [<c10ac678>] kmem_cache_alloc+0xed/0x105
> Aug 15 10:03:46 develop kernel: [<c10db738>] ? fsnotify_create_event+0x21/0x147
> Aug 15 10:03:46 develop kernel: [<c10de179>] inotify_ignored_and_remove_idr+0x50/0xb7
> Aug 15 10:03:46 develop kernel: [<c10dd753>] inotify_freeing_mark+0x8/0xa
> Aug 15 10:03:46 develop kernel: [<c10dc3ab>] fsnotify_destroy_mark_by_entry+0xf3/0x132
> Aug 15 10:03:46 develop kernel: [<c10dc532>] fsnotify_clear_marks_by_group+0x9b/0xc9
> Aug 15 10:03:46 develop kernel: [<c10dd8e5>] inotify_release+0x12/0x26
> Aug 15 10:03:46 develop kernel: [<c10b3dfa>] __fput+0xd3/0x1ba
> Aug 15 10:03:46 develop kernel: [<c10b3efc>] fput+0x1b/0x20
> Aug 15 10:03:46 develop kernel: [<c10b108e>] filp_close+0x41/0x5f
> Aug 15 10:03:46 develop kernel: [<c10342d5>] put_files_struct+0x68/0xa6
> Aug 15 10:03:46 develop kernel: [<c103434a>] exit_files+0x37/0x3c
> Aug 15 10:03:46 develop kernel: [<c1035777>] do_exit+0x146/0x6c6
> Aug 15 10:03:46 develop kernel: [<c1003f76>] ? apic_timer_interrupt+0x2a/0x30
> Aug 15 10:03:46 develop kernel: [<c133a0b0>] ? printk+0x18/0x20
> Aug 15 10:03:46 develop kernel: [<c103269c>] ? oops_exit+0x2f/0x31
> Aug 15 10:03:46 develop kernel: [<c1006e42>] oops_begin+0x0/0x95
> Aug 15 10:03:46 develop kernel: [<c1006ff5>] die+0x4a/0x5e
> Aug 15 10:03:46 develop kernel: [<c1004271>] do_trap+0x82/0xa8
> Aug 15 10:03:46 develop kernel: [<c100460e>] ? do_invalid_op+0x0/0x98
> Aug 15 10:03:46 develop kernel: [<c1004694>] do_invalid_op+0x86/0x98
> Aug 15 10:03:46 develop kernel: [<c10dbb17>] ? fsnotify_put_event+0x46/0x4a
> Aug 15 10:03:46 develop kernel: [<c133c8e6>] error_code+0x66/0x6c
> Aug 15 10:03:46 develop kernel: [<c10d007b>] ? sync_filesystems+0x83/0xe9
> Aug 15 10:03:46 develop kernel: [<c100460e>] ? do_invalid_op+0x0/0x98
> Aug 15 10:03:46 develop kernel: [<c10dbb17>] ? fsnotify_put_event+0x46/0x4a
> Aug 15 10:03:46 develop kernel: [<c10ddb5a>] inotify_read+0x19f/0x269
> Aug 15 10:03:46 develop kernel: [<c1046b8f>] ? autoremove_wake_function+0x0/0x3a
> Aug 15 10:03:46 develop kernel: [<c10b3626>] vfs_read+0x8b/0x142
> Aug 15 10:03:46 develop kernel: [<c10dd9bb>] ? inotify_read+0x0/0x269
> Aug 15 10:03:46 develop kernel: [<c10b3786>] sys_read+0x3d/0x6b
> Aug 15 10:03:46 develop kernel: [<c1003610>] sysenter_do_call+0x12/0x2c

Re: kernel bugs 2.6.31-rc6

[Linus Torvalds]

On Sat, 15 Aug 2009, Linus Torvalds wrote:
> 
> For example, fsnotify_remove_priv_from_event() will remove the private 
> data event from the list, but what if there are _multiple_ entries with 
> the same 'group' entry? If so, it will remove just the first one.

Hmm. Looking closer, that shouldn't much matter. Each time we added an 
entry in private_data_list, we would have done a 
'fsnotify_get_event(event)' due to adding it to the 'golder->event_list'.

That said, there does seem to be some dubious code there. For example, 
in 'inotify_ignored_and_remove_idr()', we do this:

        fsnotify_add_notify_event(group, ignored_event, fsn_event_priv);

        /* did the private data get added? */
        if (list_empty(&fsn_event_priv->event_list))
                inotify_free_event_priv(fsn_event_priv);

and we do it without holding any locks at all. So as far as I can tell, 
what could happen is that 'fsnotify_add_notify_event()' actually adds the 
private event (fsn_event_priv), but then before we check that the 
event_list is empty, another user (on another CPU, or preempted on the 
same CPU - Christoph has both PREEMPT and SMP on) comes along, picks up 
the private event and frees it (and re-uses it).

That looks like a pretty small window, but preemption could make it much 
bigger. Who knows? Maybe there are other things like that.

And maybe I'm just full of sh*t, and the above can't even happen for some 
reason I'm missing.

		Linus

Re: kernel bugs 2.6.31-rc6

[Eric Paris]

On Sat, 2009-08-15 at 10:52 -0700, Linus Torvalds wrote:
> 
> On Sat, 15 Aug 2009, Linus Torvalds wrote:
> > 
> > For example, fsnotify_remove_priv_from_event() will remove the private 
> > data event from the list, but what if there are _multiple_ entries with 
> > the same 'group' entry? If so, it will remove just the first one.

I can happen, but ONLY for the staticly declared q_overflow_event in
notification.c.  If the refcnt on that ever hits 0 to trigger this bug
we are in some serious dodo.  

> Hmm. Looking closer, that shouldn't much matter. Each time we added an 
> entry in private_data_list, we would have done a 
> 'fsnotify_get_event(event)' due to adding it to the 'golder->event_list'.
> 
> That said, there does seem to be some dubious code there. For example, 
> in 'inotify_ignored_and_remove_idr()', we do this:
> 
>         fsnotify_add_notify_event(group, ignored_event, fsn_event_priv);
> 
>         /* did the private data get added? */
>         if (list_empty(&fsn_event_priv->event_list))
>                 inotify_free_event_priv(fsn_event_priv);

> and we do it without holding any locks at all. So as far as I can tell, 
> what could happen is that 'fsnotify_add_notify_event()' actually adds the 
> private event (fsn_event_priv), but then before we check that the 
> event_list is empty, another user (on another CPU, or preempted on the 
> same CPU - Christoph has both PREEMPT and SMP on) comes along, picks up 
> the private event and frees it (and re-uses it).

Actually you look correct in your assessment that there is a race here.
I guess I could imagine a way to make it panic like this, but I would
have expected a different problem in that after I freed this memory
(which wasn't mine any more) the other task which owned this memory
would have to still be able to run list_for_each_entry, but find that
it's group was no longer there.  Not sure how could screw up the group,
but not the list entries.

I'll fix this race tonight or in the morning.

I'm downloading and installing KDE, as I guess kde uses inotify pretty
hard since both Mikko and Christoph were using kde.

-Eric

Re: kernel bugs 2.6.31-rc6

[Zdenek Kabelac]

2009/8/16 Eric Paris <eparis@redhat.com>:
> On Sat, 2009-08-15 at 10:52 -0700, Linus Torvalds wrote:
>>
>> On Sat, 15 Aug 2009, Linus Torvalds wrote:
>> >
>> > For example, fsnotify_remove_priv_from_event() will remove the private
>> > data event from the list, but what if there are _multiple_ entries with
>> > the same 'group' entry? If so, it will remove just the first one.
>
> I can happen, but ONLY for the staticly declared q_overflow_event in
> notification.c.  If the refcnt on that ever hits 0 to trigger this bug
> we are in some serious dodo.
>
>> Hmm. Looking closer, that shouldn't much matter. Each time we added an
>> entry in private_data_list, we would have done a
>> 'fsnotify_get_event(event)' due to adding it to the 'golder->event_list'.
>>
>> That said, there does seem to be some dubious code there. For example,
>> in 'inotify_ignored_and_remove_idr()', we do this:
>>
>>         fsnotify_add_notify_event(group, ignored_event, fsn_event_priv);
>>
>>         /* did the private data get added? */
>>         if (list_empty(&fsn_event_priv->event_list))
>>                 inotify_free_event_priv(fsn_event_priv);
>
>> and we do it without holding any locks at all. So as far as I can tell,
>> what could happen is that 'fsnotify_add_notify_event()' actually adds the
>> private event (fsn_event_priv), but then before we check that the
>> event_list is empty, another user (on another CPU, or preempted on the
>> same CPU - Christoph has both PREEMPT and SMP on) comes along, picks up
>> the private event and frees it (and re-uses it).
>
> Actually you look correct in your assessment that there is a race here.
> I guess I could imagine a way to make it panic like this, but I would
> have expected a different problem in that after I freed this memory
> (which wasn't mine any more) the other task which owned this memory
> would have to still be able to run list_for_each_entry, but find that
> it's group was no longer there.  Not sure how could screw up the group,
> but not the list entries.
>
> I'll fix this race tonight or in the morning.
>
> I'm downloading and installing KDE, as I guess kde uses inotify pretty
> hard since both Mikko and Christoph were using kde.


Hi

I'm not sure how it is related - but I've got folllowing ooops while
running yum upgrade
I'm using gnome.

I've added the backtrace to the Bugzilla mentioned in this thread.

http://bugzilla.kernel.org/show_bug.cgi?id=13729#c7

Zdenek

Re: kernel bugs 2.6.31-rc6

[Eric Paris]

On Mon, 2009-08-24 at 11:06 +0200, Zdenek Kabelac wrote:
> 2009/8/16 Eric Paris <eparis@redhat.com>:
> > On Sat, 2009-08-15 at 10:52 -0700, Linus Torvalds wrote:
> >>
> >> On Sat, 15 Aug 2009, Linus Torvalds wrote:
> >> >
> >> > For example, fsnotify_remove_priv_from_event() will remove the private
> >> > data event from the list, but what if there are _multiple_ entries with
> >> > the same 'group' entry? If so, it will remove just the first one.
> >
> > I can happen, but ONLY for the staticly declared q_overflow_event in
> > notification.c.  If the refcnt on that ever hits 0 to trigger this bug
> > we are in some serious dodo.
> >
> >> Hmm. Looking closer, that shouldn't much matter. Each time we added an
> >> entry in private_data_list, we would have done a
> >> 'fsnotify_get_event(event)' due to adding it to the 'golder->event_list'.
> >>
> >> That said, there does seem to be some dubious code there. For example,
> >> in 'inotify_ignored_and_remove_idr()', we do this:
> >>
> >>         fsnotify_add_notify_event(group, ignored_event, fsn_event_priv);
> >>
> >>         /* did the private data get added? */
> >>         if (list_empty(&fsn_event_priv->event_list))
> >>                 inotify_free_event_priv(fsn_event_priv);
> >
> >> and we do it without holding any locks at all. So as far as I can tell,
> >> what could happen is that 'fsnotify_add_notify_event()' actually adds the
> >> private event (fsn_event_priv), but then before we check that the
> >> event_list is empty, another user (on another CPU, or preempted on the
> >> same CPU - Christoph has both PREEMPT and SMP on) comes along, picks up
> >> the private event and frees it (and re-uses it).
> >
> > Actually you look correct in your assessment that there is a race here.
> > I guess I could imagine a way to make it panic like this, but I would
> > have expected a different problem in that after I freed this memory
> > (which wasn't mine any more) the other task which owned this memory
> > would have to still be able to run list_for_each_entry, but find that
> > it's group was no longer there.  Not sure how could screw up the group,
> > but not the list entries.
> >
> > I'll fix this race tonight or in the morning.
> >
> > I'm downloading and installing KDE, as I guess kde uses inotify pretty
> > hard since both Mikko and Christoph were using kde.
> 
> 
> Hi
> 
> I'm not sure how it is related - but I've got folllowing ooops while
> running yum upgrade
> I'm using gnome.
> 
> I've added the backtrace to the Bugzilla mentioned in this thread.
> 
> http://bugzilla.kernel.org/show_bug.cgi?id=13729#c7

This is a whole new problem completely unrelated!  This is a pretty
clear 'use after free' since we are seeing 6b6b6b6b all of the place.
I'm looking at this one today.