lkml.org 
[lkml]   [1998]   [Oct]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectAnother OOPS in sound modules, this time by WSS + patch
Date
Hello!

The Oops below is due to unfreed irq (wrong device count in
ad1848 module) leading to wrong char pointer in irq table (description
or whatever). Patch against recent 2.1 at the end of message.

Affected all recent 2.1 kernels and some of 2.0.X kernels
(However then we need to use e.g. cs4232 module to trigger the oops
and this patch will not apply cleanly against 2.0.X)

BTW, why don't we add the check in processing of /proc/interrupts
about pointer to nowhere and display them as "corrupted irq"
instead of kernel Oops?

How to trigger (you can use any module that uses ad1848):

mordor:~# modprobe sgalaxy io=0x530 irq=7 dma=0 sgbase=0x220
[MSS: IRQ Conflict?]
mordor:~# rmmod sgalaxy
mordor:~# modprobe sgalaxy io=0x530 irq=9 dma=0 sgbase=0x220
mordor:~# rmmod sgalaxy
Trying to free free IRQ7
mordor:~# modprobe sgalaxy io=0x530 irq=9 dma=0 sgbase=0x220
ad1848: Unable to allocate IRQ
mordor:~# rmmod sgalaxy
Trying to free free IRQ7
mordor:~# rmmod ad1848
mordor:~# cat /proc/interrupts
Unable to handle kernel paging request at virtual address c1831b63
current->tss.cr3 = 007e3000, %cr3 = 007e3000
*pde = 0020d063
*pte = 00000000
Oops: 0000
CPU: 0
EIP: 0010:[<c018d383>]
EFLAGS: 00010297
eax: c1831b63 ebx: ffffffff ecx: c1831b63 edx: fffffffe
esi: ffffffff edi: c05fb0ff ebp: 00000000 esp: c074bed8
ds: 0018 es: 0018 ss: 0018
Process cat (pid: 170, process nr: 31, stackpage=c074b000)
Stack: 00000009 c05fb000 c0a8fce0 00000009 c05fb000 ffffffff 0000001b c05fb000
c018d52c c05fb0fd c018f88a c074bf18 c01098f2 c05fb0fd c018f887 c1831b63
c05fb0ee c018f881 c018f849 c05fb0e3 c018f87b 00000002 00000000 c074bf90
Call Trace: [<c018d52c>] [<c018f88a>] [<c01098f2>] [<c018f887>] [<c1831b63>] [<c018f881>] [<c018f849>]
[<c018f87b>] [<c0148d36>] [<c0148eee>] [<c010dd93>] [<c01231e6>] [<c0108914>]
Code: 80 38 00 74 07 40 4a 83 fa ff 75 f4 29 c8 89 c6 f7 c5 10 00
Segmentation fault

Using `/System.map' to map addresses to symbols.

>>EIP: c018d383 <vsprintf+28f/424>
Trace: c018d52c <sprintf+14/e73>
Trace: c018f88a <error_table+9c6/167c>
Trace: c01098f2 <get_irq_list+a6/fc>
Trace: c018f887 <error_table+9c3/167c>
Trace: c1831b63
Trace: c018f881 <error_table+9bd/167c>
Trace: c018f849 <error_table+985/167c>
Trace: c018f87b <error_table+9b7/167c>
Trace: c0148d36 <get_root_array+14a/1bc>
Trace: c0148eee <array_read+be/1e0>
Trace: c010dd93 <do_page_fault+143/310>
Trace: c01231e6 <sys_read+b2/104>
Trace: c0108914 <system_call+34/40>
Code: c018d383 <vsprintf+28f/424>
Code: c018d383 <vsprintf+28f/424> 80 38 00 cmpb $0x0,(%eax)
Code: c018d386 <vsprintf+292/424> 74 07 je c018d38f <vsprintf+29b/424>
Code: c018d388 <vsprintf+294/424> 40 incl %eax
Code: c018d389 <vsprintf+295/424> 4a decl %edx
Code: c018d38a <vsprintf+296/424> 83 fa ff cmpl $0xffffffff,%edx
Code: c018d38d <vsprintf+299/424> 75 f4 jne c018d383 <vsprintf+28f/424>
Code: c018d38f <vsprintf+29b/424> 29 c8 subl %ecx,%eax
Code: c018d391 <vsprintf+29d/424> 89 c6 movl %eax,%esi
Code: c018d393 <vsprintf+29f/424> f7 c5 10 00 00 testl $0x90000010,%ebp
Code: c018d399 <vsprintf+2a5/424> 90 nop
Code: c018d39a <vsprintf+2a6/424> 90 nop

Here is the fix.

begin 644 wss_oops_fix.diff.gz
M'XL("/EM'S8``W=S<U]O;W!S7V9I>"YD:69F`'U274_;,!1]=G[%!6DE69*V
M+@&:9*VJ(9Z&F-1I3ZR*W-C9+(K=.4G5"?'?\5=%06@/<>Q[SKWWW&.G:0H;
M+OK]B"J^8ZH=M;(7=$0HGF;383V4BO_&Z`?IX'O=`1X#OBHF>7&1`\[S:1#'
M\7_SWV1."WQ>9-AE+A:0XAQGR17$_K]8!!#`3G(*+K_JQ482&G+1`9?5FK0L
M`7M0?]V&/I)JNR'_UJ1^>(W49-OURG/;/T2Q2H>C`)Z"%-G\!![YGJD$*-O!
M#,9E$+\#N*`&.&(`\JJX:"1\UO%:`W<_;V]+HQLU4D'(+1<<Z%`8#(##%Q"J
M\@4TVI;`XSCR-DS.DTMC@_X[&Q!Z,@OR309$;VS?>[XJ#X@&#)[.#2BDF0$A
MIYM;TK->S(=\F^S"M<DN$SSQ?>RX.H/T5%MLE-T?%UVE<\LPB*W)F]`&YK-Q
M9(78"_<W55E(4QTGTI*,J+>3IZE5RAL(K<LGLW?61/J>S"C64#".&EKY@8DF
M**CV$6P".K;)S/1ZC/'*=CU8PC8M,_*W2E_[0_CM9GE7W2R7<.JJ%W!-Q%D'
GC>FLJ_":02=AS<`-RN@0ONKG./NT_R5.D\/KU`._`.O!OEI2`P``
`
end

Bye,
Oleg

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:44    [W:0.114 / U:0.260 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site