Attachment 305369 Details for Bug 446409 – analysis.txt

analysis.txt

analysis.txt (text/plain), 14.21 KB, created by Flavio Leitner on 2008-05-14 15:12:29 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Flavio Leitner

Created: 2008-05-14 15:12:29 UTC

Size: 14.21 KB

patch

obsolete

>1. PID 6976(java) performs epoll_wait().
>2. File descriptor is ready, and ep_send_event() call __put_user() to
>copy epoll_event structure to user space.
>3. Page_fault occurs because @page-out is generated by the user space.
>, and process switch occurs.
>   In this context, epitem links to txlinst(fs/eventpoll.c line:1443)
>of stack of PID:6976
>.
>4. In same fact, file descriptor is ready again. the above epitem links
> to rdllist of eventpol.
>.
>5. PID:8204(java) operates before PID:6976 starts.
>.
>6. PID:8204 performs epoll_wati().
>.
>7. "if block"(fs/eventpoll.c line:1488) is not performed because
>rdllist of eventpol is not empty in ep_poll().
>.
>8. ep_event_transfer()(fs/eventpoll.c line:1531) operates, and
>ep_collect_ready_itmes()(fs/eventpoll.c line:1454) operates.
>.
>9. ep_collect_ready_item() returns "0(zero)" not to be ready because
>epitem that links to rdllist links to txlist of PID:6976.
>.
>10. ep_event_transfer() returns "0(zero)" too.
>.
>11. ep_poll() confirms eventpoll again(fs/eventpoll.c line:1532).
>.
>Because the processing of 7-11 is repeated after this, kernel hangs up
>without generating the process switch.
>However, interrupt is accepted.
>.
>vmcore information below.
>.
>crash> bt -f 6976
>PID: 6976   TASK: 1002ee9c960       CPU: 0   COMMAND: "java"
> #0 [1002d12dc88] schedule at ffffffff8035fb2c
>    1002d12dc90: 0000000000000002 0000000300000000
>    1002d12dca0: 0000007328957e38 000001002ee9c960
>    1002d12dcb0: 0000000000000263 0000010028769650
>    1002d12dcc0: 000001002ee9cc48 000001002d12dce8
>    1002d12dcd0: 0000000000000246 0000000000000246
>    1002d12dce0: 000001002ee9c960 000001002ee9c960
>    1002d12dcf0: 000001002d12de28 000001002e84ae80
>    1002d12dd00: 0000000000000003 00000000417919a0
>    1002d12dd10: ffffffff8036157e
> #1 [1002d12dd10] __down_read at ffffffff8036157e
>    1002d12dd18: 000001002e84af10 000001002e84af10
>    1002d12dd28: 000001002ee9c960 ffffffff00000001
>    1002d12dd38: 000001002e84aed8 ffffffff80125e47
> #2 [1002d12dd40] do_page_fault at ffffffff80125e47
>    1002d12dd48: 000001002d12de28 ffffffff8037a57b
>    1002d12dd58: 0000000000000003 0000000b0000000e
>    1002d12dd68: 000001007c6ac240 0000010000030001
>    1002d12dd78: ffffffff804c7400 000001002ee9c960
>    1002d12dd88: ffffffff804c6aa0 ffffffff8035fb2c
>    1002d12dd98: 000001002d12de18 0000000000000002
>    1002d12dda8: 000001002ec5c670 00000073ffffffff
>    1002d12ddb8: 000001002ee9c960 0000000000000bb3
>    1002d12ddb8: 000001002ee9c960 0000000000000bb3
>    1002d12ddc8: 000001003c6623b0 000001002ee9cc48
>    1002d12ddd8: 000001002e84ae80 0000000000000246
>    1002d12dde8: 000001002d12de38 0000000000000001
>    1002d12ddf8: 00000000801110c9 000001002ddcfac0
>    1002d12de08: 0000000000000000 00000000417919a0
>    1002d12de18: 0000010027a29bc0 ffffffff80111415
> #3 [1002d12de20] error_exit at ffffffff80111415
>    [exception RIP: sys_epoll_wait+760]            <- ****** __put_user()
>    RIP: ffffffff801c3f9d  RSP: 000001002d12ded8  RFLAGS: 00010246
>    RAX: 0000000000000000  RBX: 0000010075779800  RCX: 0000000000000001
>    RDX: 0000000000000000  RSI: 0000000000000000  RDI: 0000000080000019
>    RBP: 0000010075779880   R8: 0000000000000000   R9: 000001002d4e3e58
>    R10: 0000000000000012  R11: ffffffff80320bc2  R12: 000001002ddcfac0
>    R13: 0000000000000000  R14: 00000000417919a0  R15: 0000010027a29bc0
>    ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018
>    1002d12de28: 0000010027a29bc0 00000000417919a0
>    1002d12de38: 0000000000000000 000001002ddcfac0
>    1002d12de48: 0000010075779880 0000010075779800
>    1002d12de58: ffffffff80320bc2 0000000000000012
>    1002d12de68: 000001002d4e3e58 0000000000000000
>    1002d12de78: 0000000000000000 0000000000000001
>    1002d12de88: 0000000000000000 0000000000000000
>    1002d12de98: 0000000080000019 ffffffffffffffff
>    1002d12dea8: ffffffff801c3f9d 0000000000000010
>    1002d12deb8: 0000000000010246 000001002d12ded8
>    1002d12dec8: 0000000000000018 ffffffff801c3f83
> #4 [1002d12ded0] sys_epoll_wait at ffffffff801c3f83
>    1002d12ded8: 000001002d12df58 0000000000004d86
>    1002d12dee8: 0000002000000004 000000007fffffff
>    1002d12def8: 0000000000000202 0000000000000216
>    1002d12df08: 0000010075779880 0000010075779880 <- ***** txlist
>    1002d12df18: 0000000000000000 000001002ee9c960
>    1002d12df28: ffffffff801355d9 0000000000100100
>    1002d12df38: 0000000000200200 0000000004343c40
>    1002d12df48: 0000000000000000 0000002abf04fa50
>    1002d12df58: 0000000000004e20 00000000417919a0
>    1002d12df68: 0000000000000020 0000000004347800
>    1002d12df78: 0000002ab0398be8 ffffffff80110a92
> #5 [1002d12df80] system_call at ffffffff80110a92
>    RIP: 0000003e7b7c6c9c  RSP: 0000000007f3d8a8  RFLAGS: 00010246
>    RAX: 00000000000000e8  RBX: ffffffff80110a92  RCX: 0000002a9579ca20
>    RDX: 0000000000000020  RSI: 00000000417919a0  RDI: 000000000000002d
>    RBP: 0000002ab0398be8   R8: 0000000041791b20   R9: 0000002ab0398ae8
>    R10: 0000000000004e20  R11: 0000000000000206  R12: 0000000004347800
>    R13: 0000000000000020  R14: 00000000417919a0  R15: 0000000000004e20
>    ORIG_RAX: 00000000000000e8  CS: 0033  SS: 002b
>.
>crash> bt
>PID: 8204   TASK: 10028769650       CPU: 0   COMMAND: "java"
> #0 [ffffffff804b73e0] netpoll_start_netdump at ffffffffa0254551
>    ffffffff804b73e8: 0000000000000046 0000000000000001
>    ffffffff804b73f8: 0000000000000000 ffffffff80126124
> #1 [ffffffff804b7400] do_page_fault at ffffffff80126124
>    ffffffff804b7408: ffffffff804b74e8 ffffffff8037a57b
>    ffffffff804b7418: 0000000000000002 0000000b0000000e
>    ffffffff804b7428: ffffffff804c821f 0000000000030001
>    ffffffff804b7438: 000000000000001f ffffffff8013b022
> #2 [ffffffff804b7440] vprintk at ffffffff8013b022
>    ffffffff804b7448: 0000000000000000 0000000000000246
>    ffffffff804b7458: 0000000000000000 0000000000000082
>    ffffffff804b7468: 0000010077e4d040 0000000000000082
>    ffffffff804b7478: 0000000000000000 0000000000000046
>    ffffffff804b7488: 0000000300000000 0000000000000046
>    ffffffff804b7498: ffffffff8045ec80 0000000000000063
>    ffffffff804b74a8: 000001006e365000 0000000000000001
>    ffffffff804b74b8: 00000000801110c9 000001006e365000
>    ffffffff804b74c8: 000001004fddfe08 0000000000000006
>    ffffffff804b74d8: 0000000000000001 ffffffff80111415
> #3 [ffffffff804b74e0] error_exit at ffffffff80111415
>    [exception RIP: sysrq_handle_crash]
>    RIP: ffffffff80274271  RSP: ffffffff804b7590  RFLAGS: 00010296
>    RAX: 000000000000001f  RBX: ffffffff8045ec80  RCX: 0000000000004e27
>    RDX: 000001006e365000  RSI: 000001004fddfe08  RDI: 0000000000000063
>    RBP: 0000000000000063   R8: 0000000000000005   R9: 0000000000000000
>    R10: 000001007d343000  R11: 0000000000000000  R12: 000001006e365000
>    R13: 000001004fddfe08  R14: 0000000000000006  R15: 0000000000000001
>    ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018
>    ffffffff804b74e8: 0000000000000001 0000000000000006
>    ffffffff804b74f8: 000001004fddfe08 000001006e365000
>    ffffffff804b7508: 0000000000000063 ffffffff8045ec80
>    ffffffff804b7518: 0000000000000000 000001007d343000
>    ffffffff804b7528: 0000000000000000 0000000000000005
>    ffffffff804b7538: 000000000000001f 0000000000004e27
>    ffffffff804b7548: 000001006e365000 000001004fddfe08
>    ffffffff804b7558: 0000000000000063 ffffffffffffffff
>    ffffffff804b7568: ffffffff80274271 0000000000000010
>    ffffffff804b7578: 0000000000010296 ffffffff804b7590
>    ffffffff804b7588: 0000000000000018 ffffffff8027450a
> #4 [ffffffff804b7590] __handle_sysrq at ffffffff8027450a
>    ffffffff804b7598: 0000000000000001 000001007c4e6e00
>    ffffffff804b75a8: 0000000000000001 000000000000002e
>    ffffffff804b75b8: 0000000000000001 ffffffff8026e608
> #5 [ffffffff804b75c0] kbd_event at ffffffff8026e608
>    ffffffff804b75c8: 000001007c8f1018 000001007c8f1018
>    ffffffff804b75d8: 000001007c4e6e00 000000000000002e
>    ffffffff804b75e8: 0000000000000001 ffffffff802e0419
> #6 [ffffffff804b75f0] input_event at ffffffff802e0419
>    ffffffff804b75f8: 0000000000000001 000001007c5a00c0
>    ffffffff804b7608: 000001007c8f1018 000001007c5a0000
>    ffffffff804b7618: 000001007c5a0000 ffffffff802dcc53
> #7 [ffffffff804b7620] hidinput_hid_event at ffffffff802dcc53
>    ffffffff804b7628: 0000000000000001 000001007c258000
>    ffffffff804b7638: 000001004fddfe08 0000000000000001
>    ffffffff804b7648: 000001007c5a00c0 ffffffff802d973b
> #8 [ffffffff804b7650] hid_process_event at ffffffff802d973b
>    ffffffff804b7658: 000001007c5a0000 0000000000000010
>    ffffffff804b7668: 00000100634f2200 0000000000000000
>    ffffffff804b7678: 0000000000000006 ffffffff802d9a93
> #9 [ffffffff804b7680] hid_input_report at ffffffff802d9a93
>    ffffffff804b7688: 0000000000000006 0000008b00000246
>    ffffffff804b7698: 0000000200000010 000001007fd1cc00
>    ffffffff804b76a8: 000001007d2ec000 000001007c258000
>    ffffffff804b76b8: 000001004fddfe08 000001007cad0080
>    ffffffff804b76c8: 000001007c258000 000001004fddfe08
>    ffffffff804b76d8: 000001007cad0080 000001007d10d5b0
>    ffffffff804b76e8: 0000010027a29bc0 ffffffff802d9bab
>#10 [ffffffff804b76f0] hid_irq_in at ffffffff802d9bab
>    ffffffff804b76f8: 000001007cad0080 000001007cad0080
>    ffffffff804b7708: 000001007c5b0980 ffffffff802ce02a
>#11 [ffffffff804b7710] usb_hcd_giveback_urb at ffffffff802ce02a
>    ffffffff804b7718: 000001007c5b0980 000001007cad0080
>    ffffffff804b7728: 000001004fddfe08 ffffffffa00ff27f
>#12 [ffffffff804b7730] uhci_finish_completion at ffffffffa00ff27f
>    ffffffff804b7738: 0000000000000001 000001007c5b0980
>    ffffffff804b7748: 0000000000000000 ffffffffa00ffa90
>#13 [ffffffff804b7750] uhci_irq at ffffffffa00ffa90
>    ffffffff804b7758: 0000000000000000 000001004fddfe28
>    ffffffff804b7768: 000001007c5b0d28 000001007c5b0d28
>    ffffffff804b7778: 000001004fddfe08 000001007c5b0980
>    ffffffff804b7788: 0000000000000001 00000000000000b1
>    ffffffff804b7798: 000001004fddfe08 00000000421899a0
>    ffffffff804b77a8: 0000010027a29bc0 ffffffff802cf401
>#14 [ffffffff804b77b0] usb_hcd_irq at ffffffff802cf401
>    ffffffff804b77b8: 000001007c5b1000 000001007c8e6b40
>    ffffffff804b77c8: 0000000000000001 ffffffff801137c6
>#15 [ffffffff804b77d0] handle_IRQ_event at ffffffff801137c6
>    ffffffff804b77d8: 0000000000000012 ffffffff80551e80
>    ffffffff804b77e8: 00000000000000b1 000001007c8e6100
>    ffffffff804b77f8: 000001004fddfe08 ffffffff80113d0e
>#16 [ffffffff804b7800] do_IRQ at ffffffff80113d0e
>--- <IRQ stack> ---
>#17 [1004fddfe08] ret_from_intr at ffffffff8011105b
>    [exception RIP: __up_read+336]
>    RIP: ffffffff8021d522  RSP: 000001004fddfeb8  RFLAGS: 00000246
>    RAX: 0000000000000001  RBX: 000001002ddcfb88  RCX: 000001002ddcfac8
>    RDX: 000000000000011b  RSI: 0000010075779800  RDI: 000001002ddcfac0
>    RBP: 000001002ddcfac0   R8: 0000000000000000   R9: 000001002d4e3e58
>    R10: 0000000000000012  R11: ffffffff80320bc2  R12: 000001002ddcfac0 <- **** eventpoll
>    R13: 0000000000000000  R14: 00000000421899a0  R15: 0000010027a29bc0
>    ORIG_RAX: ffffffffffffffb1  CS: 0010  SS: 0018
>    1004fddfe10: 00000000421899a0 0000000000000000
>    1004fddfe20: 000001002ddcfac0 000001002ddcfac0
>    1004fddfe30: 000001002ddcfb88 ffffffff80320bc2
>    1004fddfe40: 0000000000000012 000001002d4e3e58
>    1004fddfe50: 0000000000000000 0000000000000001
>    1004fddfe60: 000001002ddcfac8 000000000000011b
>    1004fddfe70: 0000010075779800 000001002ddcfac0
>    1004fddfe80: ffffffffffffffb1 ffffffff8021d522
>    1004fddfe90: 0000000000000010 0000000000000246
>    1004fddfea0: 000001004fddfeb8 0000000000000018
>    1004fddfeb0: 0000000000000246 0000000000000246
>    1004fddfec0: 000001002ddcfb88 0000000000000000
>    1004fddfed0: ffffffff801c40e1
>#18 [1004fddfed0] sys_epoll_wait at ffffffff801c40e1
>    1004fddfed8: 000001004fddff58 0000000000004d86
>    1004fddfee8: 00000020351c5410 0000007400000000
>    1004fddfef8: 0000000000000202 0000000000000202
>    1004fddff08: 000001004fddff08 000001004fddff08
>    1004fddff18: 0000000000000000 0000010028769650
>    1004fddff28: ffffffff801355d9 0000000000100100
>    1004fddff38: 0000000000200200 0000000006b62cd0
>    1004fddff48: 0000000000000000 0000002abf04fa50
>    1004fddff58: 0000000000004e20 00000000421899a0
>    1004fddff68: 0000000000000020 00000000040d4100
>    1004fddff78: 0000002aa1b90090 ffffffff80110a92
>#19 [1004fddff80] system_call at ffffffff80110a92
>    RIP: 0000003e7b7c6c9c  RSP: 0000000004c05748  RFLAGS: 00010246
>    RAX: 00000000000000e8  RBX: ffffffff80110a92  RCX: 0000002a9579ca20
>    RDX: 0000000000000020  RSI: 00000000421899a0  RDI: 000000000000002d
>    RBP: 0000002aa1b90090   R8: 0000000042189b20   R9: 0000002aa1b8ff90
>    R10: 0000000000004e20  R11: 0000000000000206  R12: 00000000040d4100
>    R13: 0000000000000020  R14: 00000000421899a0  R15: 0000000000004e20
>    ORIG_RAX: 00000000000000e8  CS: 0033  SS: 002b
>.
>crash> *eventpoll 0x1002ddcfac0
>struct eventpoll {
>  lock = <incomplete type>,
>  sem = {
>    activity = 1,
>    wait_lock = {
>      magic = 488917820,
>      lock = 0,
>      babble = 5,
>      module = 0xffffffff80384cd7 "lib/rwsem-spinlock.c",
>      owner = 0xffffffff80384cd7 "lib/rwsem-spinlock.c",
>      oline = 283
>    },
>    wait_list = {
>      next = 0x1002ddcfaf8,
>      prev = 0x1002ddcfaf8
>    }
>  },
>  wq = {
>    lock = {
>      magic = 488917820,
>      lock = 0,
>      babble = 10,
>      module = 0xffffffff803758c7 "include/linux/wait.h",
>      owner = 0xffffffff8037abb3 "kernel/fork.c",
>      oline = 131
>    },
>    task_list = {
>      next = 0x10028943f30,
>      prev = 0x10028943f30
>    }
>  },
>  poll_wait = {
>    lock = {
>      magic = 488917820,
>      lock = 0,
>      babble = 10,
>      module = 0xffffffff803758c7 "include/linux/wait.h",
>      owner = 0x0,
>      oline = 0
>    },
>    task_list = {
>      next = 0x1002ddcfb78,
>      prev = 0x1002ddcfb78
>    }
>  },
>  rdllist = {
>    next = 0x10075779820,
>    prev = 0x10075779820
>  },
>  rbr = {
>    rb_node = 0x10075779500
>  }
>}
>.
>crash> *epitem 0x10075779800
>struct epitem {
>  rbn = {
>    rb_parent = 0x10075779500,
>    rb_color = 0,
>    rb_right = 0x10075779e00,
>    rb_left = 0x10075779380
>  },
>  rdllink = {
>    next = 0x1002ddcfb88,
>    prev = 0x1002ddcfb88
>  },
>  ffd = {
>    file = 0x10034c9ae80,
>    fd = 164
>  },
>  nwait = 1,
>  pwqlist = {
>    next = 0x1007577ac20,
>    prev = 0x1007577ac20
>  },
>  ep = 0x1002ddcfac0,
>  event = {
>    events = 2147483673,
>    data = 183627192848
>  },
>  usecnt = {
>    counter = 1
>  },
>  fllink = {
>    next = 0x10034c9af58,
>    prev = 0x10034c9af58
>  },
>  txlink = {
>    next = 0x1002d12df08,
>    prev = 0x1002d12df08
>  },
>  revents = 1
>}
>.
>crash> list 0x1002d12df08
>1002d12df08
>10075779880

Actions: View

Attachments on bug 446409: 305369 | 305370 | 305739