Messages in this thread Patch in this message | | | Date | Wed, 22 Jul 1998 16:37:29 +0200 (MET DST) | From | "Michael L. Galbraith" <> | Subject | Re: Important - MM panic in 2.1.109 [PATCH + Oops] |
| |
On Fri, 17 Jul 1998, Itai Nahshon wrote:
> 1. I sent a similar report some time ago.. the panic still happens. > The problem is when unmapping the last part (but not all) of > a segment acquired by shmget + shmat. Ref count goes down to 0 > and then the segment is reused!!
Hi Folks,
I've attached an oops for _real_ hackers to examine. Patch follows. It should illuminate the problem, and at least does stop the oops.
<CRINGE>
--- linux-2.1.111-pre1/ipc/shm.c.org Wed Jul 22 13:07:27 1998 +++ linux-2.1.111-pre1/ipc/shm.c Wed Jul 22 15:56:50 1998 @@ -626,7 +626,12 @@ remove_attach(shp,shmd); /* remove from shp->attaches */ shp->shm_lpid = current->pid; shp->shm_dtime = CURRENT_TIME; - if (--shp->shm_nattch <= 0 && shp->shm_perm.mode & SHM_DEST) + /* FIXME: If vm_end = vm_start, we are doing unmap_fixup(). + * This is very fragile and stupid. It's also the best I + * could come up with without special casing unmap_fixup(). + */ + if (--shp->shm_nattch <= 0 && shp->shm_perm.mode & SHM_DEST + && shmd->vm_end != shmd->vm_start) killseg (id); } </CRINGE> We accept VISA, MASTERCARD, cool ideas...
Energize Scotty! ;-)
-Mike shm_open: unused id=0 PANIC Unable to handle kernel NULL pointer dereference at virtual address 00000021 current->tss.cr3 = 00101000, %cr3 = 00101000 *pde = 00000000 Oops: 0002 CPU: 0 EIP: 0010:[<c013ea2a>] EFLAGS: 00010286 eax: c36a0c57 ebx: c1536800 ecx: ffffffff edx: 00000000 esi: 00000000 edi: 000ff000 ebp: c36a5f54 esp: c36a5f48 ds: 0018 es: 0018 ss: 0018 Process shm-test (pid: 3159, process nr: 27, stackpage=c36a5000) Stack: 40106000 c1536800 000ff000 c36a5f70 c011f0c1 c1536800 c4dd9460 c36a4000 40106000 c4295aa0 c36a5f84 c011591c c4dd9460 c4dd9460 c4dd9460 c36a5fb0 c011a215 c4dd9460 c36a4000 400ff06c 40106000 00000246 c36a4000 c36a4000 Call Trace: [<c011f0c1>] (0) [<c011591c>] (28) [<c011a215>] (20) [<c011a3b6>] (44) [<c010a861>] (12) [<ffffffff>] [<c01258c1>] 3159 [<c0124f37>] 3159 [<c01258c1>] 3159 [<c0124f37>] 3159 [<c01258c1>] 3159 [<c0124f37>] 3159 [<c0123617>] 3159 [<c011d7e2>] 3159 [<c01258c1>] 3159 [<c0124f37>] 3159 [<c01258c1>] 3159 [<c0124f37>] 3159 [<c01258c1>] 3159 [<c0124f37>] 3159 [<c01258c1>] 3159 [<c0124f37>] 3159 [<c0132b92>] 3159 [<c01277de>] 3159 [<c01462b5>] 3159 [<c0133a2c>] 3159 [<c01288ba>] 3159 [<c0123617>] 3159 [<c011d7e2>] 3159 [<c01258c1>] 3159 [<c0124f37>] 3159 [<c01258c1>] 3159 [<c0124f37>] 3159 [<c0123617>] 3159 [<c013e9f7>] 3159 [<c0111c8e>] 3159 Code: 66 89 41 22 a1 10 1b 2f c0 89 41 18 66 8b 41 24 89 c7 4f 66 Using `/boot/2.1.111/System.map' to map addresses to symbols.
>>EIP: c013ea2a <shm_close+43/76> Trace: c011f0c1 <exit_mmap+73/138> Trace: c011591c <mmput+2b/44> Trace: c011a215 <do_exit+bc/242> Trace: c011a3b6 <sys_wait4> Trace: c010a861 <system_call+41/50> Trace: ffffffff Trace: c01258c1 <free_page_and_swap_cache+e/67> Trace: c0124f37 <free_pages+13/11b> Trace: c01258c1 <free_page_and_swap_cache+e/67> Trace: c0124f37 <free_pages+13/11b> Trace: c01258c1 <free_page_and_swap_cache+e/67> Trace: c0124f37 <free_pages+13/11b> Trace: c0123617 <kmem_cache_free+13/16f> Trace: c011d7e2 <zap_page_range+13/1af> Trace: c01258c1 <free_page_and_swap_cache+e/67> Trace: c0124f37 <free_pages+13/11b> Trace: c01258c1 <free_page_and_swap_cache+e/67> Trace: c0124f37 <free_pages+13/11b> Trace: c01258c1 <free_page_and_swap_cache+e/67> Trace: c0124f37 <free_pages+13/11b> Trace: c01258c1 <free_page_and_swap_cache+e/67> Trace: c0124f37 <free_pages+13/11b> Trace: c0132b92 <locks_remove_flock+13/95> Trace: c01277de <__fput+13/63> Trace: c01462b5 <ext2_release_file+d/25> Trace: c0133a2c <dput+f/13d> Trace: c01288ba <insert_file_free+d/35> Trace: c0123617 <kmem_cache_free+13/16f> Trace: c011d7e2 <zap_page_range+13/1af> Trace: c01258c1 <free_page_and_swap_cache+e/67> Trace: c0124f37 <free_pages+13/11b> Trace: c01258c1 <free_page_and_swap_cache+e/67> Trace: c0124f37 <free_pages+13/11b> Trace: c0123617 <kmem_cache_free+13/16f> Trace: c013e9f7 <shm_close+10/76> Trace: c0111c8e <do_page_fault+13/2fa> Code: c013ea2a <shm_close+43/76> Code: c013ea2a <shm_close+43/76> 66 89 41 22 movw %ax,0x22(%ecx) Code: c013ea2e <shm_close+47/76> a1 10 1b 2f c0 movl 0xc02f1b10,%eax Code: c013ea33 <shm_close+4c/76> 89 41 18 movl %eax,0x18(%ecx) Code: c013ea3c <shm_close+55/76> 66 8b 41 24 movw 0x24(%ecx),%ax Code: c013ea40 <shm_close+59/76> 89 c7 movl %eax,%edi Code: c013ea42 <shm_close+5b/76> 4f decl %edi
| |