lkml.org 
[lkml]   [2004]   [Oct]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectProbable module bug in linux-2.6.5-1.358

    The attached script shows that an attempt to open a device
    after its module was removed, will seg-fault the kernel.

    Cheers,
    Dick Johnson
    Penguin : Linux version 2.6.5-1.358-noreg on an i686 machine (5537.79 BogoMips).
    Note 96.31% of all statistics are fiction.


    Kernel 2.6.5-1.358 from Red Hat Fedora has a bug that
    causes a kernel oops when attempting to open a device
    that had a module removed.

    In the following, the first attempt at a user-mode open()
    causes the module to be properly loaded by modprobe, the
    module alias having been put into /etc/modprobe.conf.

    The module can be removed and inserted many times, each
    time the resources are deallocated and the module has no
    problem obtaining those resources again when it's reloaded.

    However, only the FIRST automatic load works. Any attempt
    to access the device (open it) after it has been removed,
    will not cause it to be reloaded. Instead the kernel will
    seg-fault during a call to sys_open().

    The virtual address 0x222e7880 is not in the symbol file and
    seems to be the address near where the open() in my module
    used to be before it was removed.

    I can duplicate this and a printk("%p\n", open); shows
    0x222e74a0, just after I boot. Subsequent loads show other
    addresses.


    Oct 6 17:03:30 chaos kernel: Analogic Corp Datalink Driver : Module removed
    Oct 6 17:03:38 chaos kernel: Unable to handle kernel paging request at virtual address 222e7880
    Oct 6 17:03:38 chaos kernel: printing eip:
    Oct 6 17:03:38 chaos kernel: 021556ad
    Oct 6 17:03:38 chaos kernel: *pde = 1f30c067
    Oct 6 17:03:38 chaos kernel: *pte = 00000000
    Oct 6 17:03:38 chaos kernel: Oops: 0000 [#1]
    Oct 6 17:03:38 chaos kernel: SMP
    Oct 6 17:03:38 chaos kernel: CPU: 0
    Oct 6 17:03:38 chaos kernel: EIP: 0060:[<021556ad>] Not tainted
    Oct 6 17:03:38 chaos kernel: EFLAGS: 00010206 (2.6.5-1.358-noreg)
    Oct 6 17:03:38 chaos kernel: EIP is at cdev_get+0x14/0x6a
    Oct 6 17:03:38 chaos kernel: eax: 20dee000 ebx: 222e7880 ecx: 1f564a80 edx: 13d19910
    Oct 6 17:03:38 chaos kernel: esi: 00000000 edi: 1edae208 ebp: 00000000 esp: 20deef20
    Oct 6 17:03:38 chaos kernel: ds: 007b es: 007b ss: 0068
    Oct 6 17:03:38 chaos kernel: Process ftest (pid: 3728, threadinfo=20dee000 task=1f7a0130)
    Oct 6 17:03:38 chaos kernel: Stack: 13d19910 00000000 021554bc 13d19910 1f564a80 1f564a80 1edae208 2138bf80
    Oct 6 17:03:38 chaos kernel: 1d49ac8c 0214d443 1edae208 1f564a80 00000002 00000003 1685a000 20dee000
    Oct 6 17:03:38 chaos kernel: 0214d364 20e18180 2138bf80 00000002 20e18180 2138bf80 00000ffc 00000001
    Oct 6 17:03:38 chaos kernel: Call Trace:
    Oct 6 17:03:38 chaos kernel: [<021554bc>] chrdev_open+0xb2/0x18b
    Oct 6 17:03:38 chaos kernel: [<0214d443>] dentry_open+0xd7/0x19b
    Oct 6 17:03:38 chaos kernel: [<0214d364>] filp_open+0x41/0x49
    Oct 6 17:03:38 chaos kernel: [<0214d703>] sys_open+0x31/0x82
    Oct 6 17:03:38 chaos kernel:
    Oct 6 17:03:38 chaos kernel: Code: 83 3b 02 8b 40 10 74 0e c1 e0 07 8d 04 18 ff 80 00 01 00 00
    Oct 6 17:08:11 chaos syslogd 1.4.1: restart.


    Script started on Wed 06 Oct 2004 05:09:06 PM EDT
    # sync
    # ./ftest
    Make sure a single board exists in a PCI slot and
    channel A output is connected to channel B input.
    Hit [Enter] to continue...
    Enabling both RX and TX
    Waiting for synchronization...
    Waiting for synchronization...
    Mailbox-A message = 0000000f
    Mailbox-B message = 0000000f
    Len = 6 Mb, time = 104468.00 us, rate = 64.334954 bytes/usec
    [SNIPPED...]
    Works...

    PCI slot = 516
    Driver version = V2.01
    FPGA version = 61128V00R000
    # ps laxw
    F UID PID PPID PRI NI VSZ RSS WCHAN STAT TTY TIME COMMAND
    4 0 1 0 16 0 3124 464 - S ? 0:04 init [5]
    [SNIPPED...]
    4 0 3128 3127 15 0 6080 1276 wait4 S pts/0 0:00 bash -i
    1 5418 3137 1 15 0 0 0 - SW ? 0:00 [DLB daemon]

    This shows the kernel daemon that manages the link.

    4 0 3140 3128 17 0 3824 584 - R pts/0 0:00 ps laxw
    # cat /proc/iomem
    00000000-0009fbff : System RAM
    0009fc00-0009ffff : reserved
    000a0000-000bffff : Video RAM area
    000c0000-000cfbff : Video ROM
    000d0000-000d0bff : Adapter ROM
    000d1000-000d57ff : Adapter ROM
    000f0000-000fffff : System ROM
    00100000-1f3fffff : System RAM
    00100000-002a8fff : Kernel code
    002a9000-0034fa7f : Kernel data
    1f400000-1f4003ff : 0000:00:1f.1
    1f401000-22403fff : Analogic Corp Datalink Driver
    e4500000-f45fffff : PCI Bus #01
    e8000000-efffffff : 0000:01:00.0
    f4580000-f45fffff : 0000:01:00.0
    f8000000-fbffffff : 0000:00:00.0
    fc700000-fe7fffff : PCI Bus #01
    fd000000-fdffffff : 0000:01:00.0
    fe900000-fe9fffff : 0000:02:04.0
    fe900000-fe9fffff : Analogic Corp Datalink Driver
    feafc000-feafcfff : 0000:02:08.0
    feafc000-feafcfff : e100
    feafd000-feafdfff : 0000:02:07.0
    feafe800-feafe9ff : 0000:02:04.0
    feafe800-feafe9ff : Analogic Corp Datalink Driver
    feafec00-feafec7f : 0000:02:01.0
    feaff000-feafffff : 0000:02:00.0
    feaff000-feafffff : aic7xxx
    febff400-febff4ff : 0000:00:1f.5
    febff800-febff9ff : 0000:00:1f.5
    febffc00-febfffff : 0000:00:1d.7
    # sync

    This shows resources used.

    # rmmod HeavyLink

    I remove the module okay.

    # cat /proc/iomem
    00000000-0009fbff : System RAM
    0009fc00-0009ffff : reserved
    000a0000-000bffff : Video RAM area
    000c0000-000cfbff : Video ROM
    000d0000-000d0bff : Adapter ROM
    000d1000-000d57ff : Adapter ROM
    000f0000-000fffff : System ROM
    00100000-1f3fffff : System RAM
    00100000-002a8fff : Kernel code
    002a9000-0034fa7f : Kernel data
    1f400000-1f4003ff : 0000:00:1f.1
    e4500000-f45fffff : PCI Bus #01
    e8000000-efffffff : 0000:01:00.0
    f4580000-f45fffff : 0000:01:00.0
    f8000000-fbffffff : 0000:00:00.0
    fc700000-fe7fffff : PCI Bus #01
    fd000000-fdffffff : 0000:01:00.0
    fe900000-fe9fffff : 0000:02:04.0
    feafc000-feafcfff : 0000:02:08.0
    feafc000-feafcfff : e100
    feafd000-feafdfff : 0000:02:07.0
    feafe800-feafe9ff : 0000:02:04.0
    feafec00-feafec7f : 0000:02:01.0
    feaff000-feafffff : 0000:02:00.0
    feaff000-feafffff : aic7xxx
    febff400-febff4ff : 0000:00:1f.5
    febff800-febff9ff : 0000:00:1f.5
    febffc00-febfffff : 0000:00:1d.7


    The resources are properly freed.

    # ps laxw
    F UID PID PPID PRI NI VSZ RSS WCHAN STAT TTY TIME COMMAND
    4 0 1 0 16 0 3124 464 - S ? 0:04 init [5]
    [SNIPPED...]
    4 42 3088 2989 16 0 20992 9148 - S ? 0:00 /usr/bin/gdmgreeter
    4 0 3089 2624 15 0 4676 1336 wait4 S tty1 0:00 -bash
    4 0 3126 3089 15 0 4632 464 - S tty1 0:00 script
    5 0 3127 3126 15 0 4636 496 - S tty1 0:00 script
    4 0 3128 3127 15 0 6080 1276 wait4 S pts/0 0:00 bash -i
    4 0 3154 3128 17 0 2444 588 - R pts/0 0:00 ps laxw

    The daemon is gone, properly exited.

    # insmod HeavyLink.ko

    Insert again. Works.

    # ./ftest
    Make sure a single board exists in a PCI slot and
    channel A output is connected to channel B input.
    Hit [Enter] to continue...
    Enabling both RX and TX
    Waiting for synchronization...
    Waiting for synchronization...
    Mailbox-A message = 0000000f
    Mailbox-B message = 0000000f
    Len = 8 Mb, time = 134457.00 us, rate = 64.362763 bytes/usec
    Mailbox-B message = 00000000
    [SNIPPED...]
    Works fine.....


    #
    # lsmod | grep Heavy
    HeavyLink 40456 0
    # rmmod HeavyLinka

    Remove the module as before. Fine.


    # sync
    # ./ftest

    Now, try to open the device without first manually inserting
    the module.

    Segmentation fault

    DEATH with a console screen display that doesn't get saved anywhere.

    The last call was sys_open()

    # exit

    Script done on Wed 06 Oct 2004 05:12:20 PM EDT
    \
     
     \ /
      Last update: 2005-03-22 14:06    [W:0.052 / U:0.476 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site