lkml.org 
[lkml]   [1998]   [Jul]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
SubjectRe: Important - MM panic in 2.1.109 [PATCH + Oops]
On Fri, 17 Jul 1998, Itai Nahshon wrote:

> 1. I sent a similar report some time ago.. the panic still happens.
> The problem is when unmapping the last part (but not all) of
> a segment acquired by shmget + shmat. Ref count goes down to 0
> and then the segment is reused!!

Hi Folks,

I've attached an oops for _real_ hackers to examine. Patch follows.
It should illuminate the problem, and at least does stop the oops.

<CRINGE>

--- linux-2.1.111-pre1/ipc/shm.c.org Wed Jul 22 13:07:27 1998
+++ linux-2.1.111-pre1/ipc/shm.c Wed Jul 22 15:56:50 1998
@@ -626,7 +626,12 @@
remove_attach(shp,shmd); /* remove from shp->attaches */
shp->shm_lpid = current->pid;
shp->shm_dtime = CURRENT_TIME;
- if (--shp->shm_nattch <= 0 && shp->shm_perm.mode & SHM_DEST)
+ /* FIXME: If vm_end = vm_start, we are doing unmap_fixup().
+ * This is very fragile and stupid. It's also the best I
+ * could come up with without special casing unmap_fixup().
+ */
+ if (--shp->shm_nattch <= 0 && shp->shm_perm.mode & SHM_DEST
+ && shmd->vm_end != shmd->vm_start)
killseg (id);
}

</CRINGE>
We accept VISA, MASTERCARD, cool ideas...

Energize Scotty! ;-)

-Mike
shm_open: unused id=0 PANIC
Unable to handle kernel NULL pointer dereference at virtual address 00000021
current->tss.cr3 = 00101000, %cr3 = 00101000
*pde = 00000000
Oops: 0002
CPU: 0
EIP: 0010:[<c013ea2a>]
EFLAGS: 00010286
eax: c36a0c57 ebx: c1536800 ecx: ffffffff edx: 00000000
esi: 00000000 edi: 000ff000 ebp: c36a5f54 esp: c36a5f48
ds: 0018 es: 0018 ss: 0018
Process shm-test (pid: 3159, process nr: 27, stackpage=c36a5000)
Stack: 40106000 c1536800 000ff000 c36a5f70 c011f0c1 c1536800 c4dd9460 c36a4000
40106000 c4295aa0 c36a5f84 c011591c c4dd9460 c4dd9460 c4dd9460 c36a5fb0
c011a215 c4dd9460 c36a4000 400ff06c 40106000 00000246 c36a4000 c36a4000
Call Trace: [<c011f0c1>] (0) [<c011591c>] (28) [<c011a215>] (20) [<c011a3b6>] (44) [<c010a861>] (12) [<ffffffff>] [<c01258c1>] 3159 [<c0124f37>] 3159 [<c01258c1>] 3159 [<c0124f37>] 3159 [<c01258c1>] 3159 [<c0124f37>] 3159 [<c0123617>] 3159 [<c011d7e2>] 3159 [<c01258c1>] 3159 [<c0124f37>] 3159 [<c01258c1>] 3159 [<c0124f37>] 3159 [<c01258c1>] 3159 [<c0124f37>] 3159 [<c01258c1>] 3159 [<c0124f37>] 3159 [<c0132b92>] 3159 [<c01277de>] 3159 [<c01462b5>] 3159 [<c0133a2c>] 3159 [<c01288ba>] 3159 [<c0123617>] 3159 [<c011d7e2>] 3159 [<c01258c1>] 3159 [<c0124f37>] 3159 [<c01258c1>] 3159 [<c0124f37>] 3159 [<c0123617>] 3159 [<c013e9f7>] 3159 [<c0111c8e>] 3159
Code: 66 89 41 22 a1 10 1b 2f c0 89 41 18 66 8b 41 24 89 c7 4f 66
Using `/boot/2.1.111/System.map' to map addresses to symbols.

>>EIP: c013ea2a <shm_close+43/76>
Trace: c011f0c1 <exit_mmap+73/138>
Trace: c011591c <mmput+2b/44>
Trace: c011a215 <do_exit+bc/242>
Trace: c011a3b6 <sys_wait4>
Trace: c010a861 <system_call+41/50>
Trace: ffffffff
Trace: c01258c1 <free_page_and_swap_cache+e/67>
Trace: c0124f37 <free_pages+13/11b>
Trace: c01258c1 <free_page_and_swap_cache+e/67>
Trace: c0124f37 <free_pages+13/11b>
Trace: c01258c1 <free_page_and_swap_cache+e/67>
Trace: c0124f37 <free_pages+13/11b>
Trace: c0123617 <kmem_cache_free+13/16f>
Trace: c011d7e2 <zap_page_range+13/1af>
Trace: c01258c1 <free_page_and_swap_cache+e/67>
Trace: c0124f37 <free_pages+13/11b>
Trace: c01258c1 <free_page_and_swap_cache+e/67>
Trace: c0124f37 <free_pages+13/11b>
Trace: c01258c1 <free_page_and_swap_cache+e/67>
Trace: c0124f37 <free_pages+13/11b>
Trace: c01258c1 <free_page_and_swap_cache+e/67>
Trace: c0124f37 <free_pages+13/11b>
Trace: c0132b92 <locks_remove_flock+13/95>
Trace: c01277de <__fput+13/63>
Trace: c01462b5 <ext2_release_file+d/25>
Trace: c0133a2c <dput+f/13d>
Trace: c01288ba <insert_file_free+d/35>
Trace: c0123617 <kmem_cache_free+13/16f>
Trace: c011d7e2 <zap_page_range+13/1af>
Trace: c01258c1 <free_page_and_swap_cache+e/67>
Trace: c0124f37 <free_pages+13/11b>
Trace: c01258c1 <free_page_and_swap_cache+e/67>
Trace: c0124f37 <free_pages+13/11b>
Trace: c0123617 <kmem_cache_free+13/16f>
Trace: c013e9f7 <shm_close+10/76>
Trace: c0111c8e <do_page_fault+13/2fa>
Code: c013ea2a <shm_close+43/76>
Code: c013ea2a <shm_close+43/76> 66 89 41 22 movw %ax,0x22(%ecx)
Code: c013ea2e <shm_close+47/76> a1 10 1b 2f c0 movl 0xc02f1b10,%eax
Code: c013ea33 <shm_close+4c/76> 89 41 18 movl %eax,0x18(%ecx)
Code: c013ea3c <shm_close+55/76> 66 8b 41 24 movw 0x24(%ecx),%ax
Code: c013ea40 <shm_close+59/76> 89 c7 movl %eax,%edi
Code: c013ea42 <shm_close+5b/76> 4f decl %edi
\
 
 \ /
  Last update: 2005-03-22 13:43    [W:0.065 / U:0.472 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site