Bug 678486 - list_add corruption
Summary: list_add corruption
Keywords:
Status: CLOSED NEXTRELEASE
Alias: None
Product: Fedora
Classification: Fedora
Component: kernel
Version: 14
Hardware: Unspecified
OS: Unspecified
unspecified
high
Target Milestone: ---
Assignee: Kernel Maintainer List
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2011-02-18 08:16 UTC by Andreas Schwab
Modified: 2011-10-11 18:49 UTC (History)
7 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2011-10-11 18:49:39 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Andreas Schwab 2011-02-18 08:16:49 UTC
WARNING: at lib/list_debug.c:30 __list_add+0x68/0x81()
Hardware name: 2241B48
list_add corruption. prev->next should be next (ffff880134e85918), but was (null). (prev=ffff880134e85918).
Modules linked in: tcp_diag inet_diag fuse ebtable_nat ebtables tun bridge stp llc rfcomm sco bnep l2cap nfsd lockd nfs_acl auth_rpcgss exportfs sunrpc cpufreq_ondemand acpi_cpufreq freq_table mperf ipt_MASQUERADE iptable_nat nf_nat ip6t_REJECT nf_conntrack_ipv6 ip6table_filter ip6_tables ipv6 sha256_generic cryptd aes_x86_64 aes_generic cbc dm_crypt kvm_intel kvm uinput snd_hda_codec_conexant btusb bluetooth arc4 ecb iwlagn r852 sm_common snd_hda_intel nand iwlcore nand_ids nand_ecc uvcvideo snd_hda_codec mtd mac80211 iTCO_wdt snd_hwdep thinkpad_acpi wmi snd_seq snd_seq_device snd_pcm e1000e videodev v4l2_compat_ioctl32 cfg80211 snd_timer i2c_i801 joydev iTCO_vendor_support snd rfkill soundcore microcode snd_page_alloc sdhci_pci sdhci ata_generic firewire_ohci mmc_core yenta_socket pata_acpi firewire_core crc_itu_t i915 drm_kms_helper drm i2c_algo_bit i2c_core video output [last unloaded: scsi_wait_scan]
Pid: 1574, comm: polkitd Not tainted 2.6.35.11-83.fc14.x86_64 #1
Call Trace:
 [<ffffffff8104d9ad>] warn_slowpath_common+0x85/0x9d
 [<ffffffff8104da68>] warn_slowpath_fmt+0x46/0x48
 [<ffffffff81226783>] __list_add+0x68/0x81
 [<ffffffff814691db>] ? __mutex_lock_common.clone.5+0x6b/0x196
 [<ffffffff8146923a>] __mutex_lock_common.clone.5+0xca/0x196
 [<ffffffff81106089>] ? __raw_local_irq_save+0x1d/0x23
 [<ffffffff81469319>] __mutex_lock_slowpath+0x13/0x15
 [<ffffffff81469156>] mutex_lock+0x36/0x50
 [<ffffffff81143632>] inotify_inode_queue_event+0x4e/0xeb
 [<ffffffff8111848e>] fput+0xa7/0x1ed
 [<ffffffff81115753>] filp_close+0x66/0x70
 [<ffffffff811157f2>] sys_close+0x95/0xd5
 [<ffffffff81009cf2>] system_call_fastpath+0x16/0x1b
BUG: unable to handle kernel NULL pointer dereference at (null)
IP: [<ffffffff8114363d>] inotify_inode_queue_event+0x59/0xeb
PGD 0 
Oops: 0000 [#1] SMP 
last sysfs file: /sys/devices/system/cpu/cpu1/cache/index2/shared_cpu_map
CPU 1 
Modules linked in: tcp_diag inet_diag fuse ebtable_nat ebtables tun bridge stp llc rfcomm sco bnep l2cap nfsd lockd nfs_acl auth_rpcgss exportfs sunrpc cpufreq_ondemand acpi_cpufreq freq_table mperf ipt_MASQUERADE iptable_nat nf_nat ip6t_REJECT nf_conntrack_ipv6 ip6table_filter ip6_tables ipv6 sha256_generic cryptd aes_x86_64 aes_generic cbc dm_crypt kvm_intel kvm uinput snd_hda_codec_conexant btusb bluetooth arc4 ecb iwlagn r852 sm_common snd_hda_intel nand iwlcore nand_ids nand_ecc uvcvideo snd_hda_codec mtd mac80211 iTCO_wdt snd_hwdep thinkpad_acpi wmi snd_seq snd_seq_device snd_pcm e1000e videodev v4l2_compat_ioctl32 cfg80211 snd_timer i2c_i801 joydev iTCO_vendor_support snd rfkill soundcore microcode snd_page_alloc sdhci_pci sdhci ata_generic firewire_ohci mmc_core yenta_socket pata_acpi firewire_core crc_itu_t i915 drm_kms_helper drm i2c_algo_bit i2c_core video output [last unloaded: scsi_wait_scan]
Pid: 4217, comm: dbus-daemon Tainted: G        W   2.6.35.11-83.fc14.x86_64 #1 2241B48/2241B48
RIP: 0010:[<ffffffff8114363d>]  [<ffffffff8114363d>] inotify_inode_queue_event+0x59/0xeb
RSP: 0018:ffff880134a95e68  EFLAGS: 00010287
RAX: ffff880134a94000 RBX: fffffffffffffff0 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000003 RDI: ffff880134e824a0
RBP: ffff880134a95ec8 R08: 0000000000000000 R09: 0000000000000000
R10: 00007ffff65839a0 R11: 0000000000000293 R12: 0000000000000010
R13: ffff880134e82490 R14: ffff880134de6180 R15: 0000000000000010
FS:  00007f5cc59867e0(0000) GS:ffff880002080000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 000000012611e000 CR4: 00000000000006e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process dbus-daemon (pid: 4217, threadinfo ffff880134a94000, task ffff880131140000)
Stack:
 ffff880134a95e88 0000000000000000 0000000000000000 0000000034de6600
<0> ffff880134e824a0 ffffffff81126e34 ffff880134a95ea8 ffff88006ec8dd80
<0> 0000000000000010 ffff880134e822b0 ffff880134de6180 ffff880134e822b0
Call Trace:
 [<ffffffff81126e34>] ? d_kill+0x3e/0x46
 [<ffffffff8111848e>] fput+0xa7/0x1ed
 [<ffffffff81115753>] filp_close+0x66/0x70
 [<ffffffff811157f2>] sys_close+0x95/0xd5
 [<ffffffff81009cf2>] system_call_fastpath+0x16/0x1b
Code: 89 4d b0 4c 89 45 a8 0f 84 a1 00 00 00 48 8d 87 f0 01 00 00 48 89 c7 48 89 45 c0 e8 ee 5a 32 00 48 8b 9b e0 01 00 00 48 83 eb 10 <4c> 8b 63 10 49 83 ec 10 eb 67 8b 43 3c 41 85 c7 74 53 48 8b 53 
RIP  [<ffffffff8114363d>] inotify_inode_queue_event+0x59/0xeb
 RSP <ffff880134a95e68>
CR2: 0000000000000000

Comment 1 Chuck Ebbert 2011-02-22 14:07:58 UTC
Did you do a hibernate and resume cycle before htting this error?

Comment 2 Andreas Schwab 2011-02-22 14:17:08 UTC
Yes.

Comment 3 Chuck Ebbert 2011-02-24 19:04:37 UTC
We should probably turn off hibernation support since nobody seems to know what is causing the corruption.

Comment 4 Andreas Schwab 2011-02-25 08:11:42 UTC
That would mean no suspend support would be left at all.

Comment 5 Eric Brunson 2011-03-22 16:20:03 UTC
I'm experiencing the same problem under VirtualBox with no suspend/resume or hibernation.


 at lib/list_debug.c:26 __list_add+0x54/0xb0() (Tainted: G        W  ---------------- )
Hardware name: VirtualBox
list_add corruption. next->prev should be prev (c0a01048), but was edd61690. (next=edd61690).
Modules linked in: bluetooth rfkill tun fuse vboxvideo(U) drm vboxsf(U) autofs4 sunrpc ipt_REJECT nf_conntrack_ipv4 nf_defrag_ipv4 iptable_filter ip_tables ip6t_REJECT nf_conntrack_ipv6 xt_state nf_conntrack ip6table_filter ip6_tables ipv6 dm_mirror dm_region_hash dm_log uinput ppdev parport_pc parport sg i2c_piix4 i2c_core vboxguest(U) e1000 ext4 mbcache jbd2 sd_mod crc_t10dif sr_mod cdrom ahci pata_acpi ata_generic ata_piix dm_mod [last unloaded: scsi_wait_scan]
Pid: 6611, comm: mount.vboxsf Tainted: G        W  ----------------  2.6.32-71.el6.i686 #1
Call Trace:
[<c04501c1>] ? warn_slowpath_common+0x81/0xc0
[<c05ef544>] ? __list_add+0x54/0xb0
[<c05ef544>] ? __list_add+0x54/0xb0
[<c0450293>] ? warn_slowpath_fmt+0x33/0x40
[<c05ef544>] ? __list_add+0x54/0xb0
[<c05f2797>] ? __percpu_counter_init+0x47/0x60
[<c04f2bbc>] ? bdi_init+0xdc/0x140
[<f0da3b35>] ? sf_init_backing_dev+0x25/0x60 [vboxsf]
[<f0da14b3>] ? sf_read_super_26+0x3d3/0x800 [vboxsf]
[<c0436c7c>] ? kmap_atomic+0x1c/0x30
[<c04e5092>] ? get_page_from_freelist+0x292/0x580
[<c05e224b>] ? idr_get_empty_slot+0xeb/0x270
[<c05e24cb>] ? ida_get_new_above+0xfb/0x1b0
[<c05e2a2c>] ? ida_pre_get+0x1c/0xd0
[<c05e76aa>] ? strlcpy+0x3a/0x60
[<c05205c6>] ? sget+0x306/0x380
[<c051f930>] ? set_anon_super+0x0/0xe0
[<c0520a20>] ? get_sb_nodev+0x40/0x80
[<c0520739>] ? vfs_kern_mount+0x69/0x170
[<f0da10e0>] ? sf_read_super_26+0x0/0x800 [vboxsf]
[<c05366d2>] ? get_fs_type+0x32/0xb0
[<c052089f>] ? do_kern_mount+0x3f/0xe0
[<c053954f>] ? do_mount+0x2ef/0x740
[<c05376d1>] ? copy_mount_options+0x41/0x120
[<c0539a0e>] ? sys_mount+0x6e/0xa0
[<c04099fb>] ? sysenter_do_call+0x12/0x28

Comment 6 eeriegeek 2011-05-31 14:01:54 UTC
Also getting this right after bootup from time to time, two sequential errors.
the system seems to run fine otherwise. I did not see this problem in Fedora
Core 12 on this hardware.

This is a Fedora Core 14 x86_64 install from the default repositories, updated.
Hardware is ASUS P5Q Pro Turbo with Intel Core 2 Duo E8600 and 8 GB memory at
normal clock rates.

[    0.000000] Linux version 2.6.35.13-91.fc14.x86_64 (mockbuild.fedoraproject.org) (gcc version 4.5.1 20100924 (Red Hat 4.5.1-4) (GCC) ) #1 SMP Tue May 3 13:23:06 UTC 20
11
[    0.000000] Command line: ro root=UUID=62865023-9881-4a23-b080-5f9a971d56c7 rd_NO_LUKS rd_NO_LVM rd_NO_MD rd_NO_DM LANG=en_US.UTF-8 SYSFONT=latarcyrheb-sun16 KEYBOARDTYPE=pc KEYTA

...

[    6.768116] WARNING: at lib/list_debug.c:26 __list_add+0x3f/0x81()
[    6.768117] Hardware name: System Product Name
[    6.768119] list_add corruption. next->prev should be prev (ffffffff81a7ae30), but was ffffffffa01bfa48. (next=ffffffffa0133fc8).
[    6.768120] Modules linked in: snd_seq_device snd_pcm snd_timer snd soundcore atl1e snd_page_alloc asus_atk0110 joydev microcode pata_acpi ata_generic firewire_ohci firewire_core crc_itu_t pata_jmicron radeon ttm drm_kms_helper drm i2c_algo_bit i2c_core
[    6.768133] Pid: 807, comm: modprobe Not tainted 2.6.35.13-91.fc14.x86_64 #1
[    6.768134] Call Trace:
[    6.768138]  [<ffffffff8104dcf1>] warn_slowpath_common+0x85/0x9d
[    6.768141]  [<ffffffff8104ddac>] warn_slowpath_fmt+0x46/0x48
[    6.768144]  [<ffffffff81469689>] ? _cond_resched+0xe/0x22
[    6.768146]  [<ffffffff81226e2a>] __list_add+0x3f/0x81
[    6.768149]  [<ffffffff8121885d>] module_bug_finalize+0xb9/0xca
[    6.768152]  [<ffffffff812257bc>] ? __sw_hweight64+0x5f/0x67
[    6.768155]  [<ffffffff8102885e>] module_finalize+0x156/0x165
[    6.768159]  [<ffffffff8107c6c7>] load_module+0x1170/0x1b74
[    6.768161]  [<ffffffff8107a049>] ? setup_modinfo_srcversion+0x0/0x29
[    6.768165]  [<ffffffff811e4fcd>] ? selinux_capable+0x37/0x40
[    6.768168]  [<ffffffff8107d11b>] sys_init_module+0x50/0x1e4
[    6.768170]  [<ffffffff81009cf2>] system_call_fastpath+0x16/0x1b
[    6.768172] ---[ end trace e90c29b7a056bbe3 ]---
[    6.768173] ------------[ cut here ]------------
[    6.768175] WARNING: at lib/list_debug.c:30 __list_add+0x68/0x81()
[    6.768176] Hardware name: System Product Name
[    6.768178] list_add corruption. prev->next should be next (ffffffffa0133fc8), but was ffffffffa01bfa48. (prev=ffffffff81a7ae30).
[    6.768179] Modules linked in: snd_seq_device snd_pcm snd_timer snd soundcore atl1e snd_page_alloc asus_atk0110 joydev microcode pata_acpi ata_generic firewire_ohci firewire_core crc_itu_t pata_jmicron radeon ttm drm_kms_helper drm i2c_algo_bit i2c_core
[    6.768190] Pid: 807, comm: modprobe Tainted: G        W   2.6.35.13-91.fc14.x86_64 #1
[    6.768191] Call Trace:
[    6.768193]  [<ffffffff8104dcf1>] warn_slowpath_common+0x85/0x9d
[    6.768195]  [<fffffff[    6.768202]  [<ffffffff8121885d>] module_bug_finalize+0xb9/0xca
[    6.768204]  [<ffffffff812257bc>] ? __sw_hweight64+0x5f/0x67
[    6.768206]  [<ffffffff8102885e>] module_finalize+0x156/0x165
[    6.768209]  [<ffffffff8107c6c7>] load_module+0x1170/0x1b74
[    6.768211]  [<ffffffff8107a049>] ? setup_modinfo_srcversion+0x0/0x29
[    6.768214]  [<ffffffff811e4fcd>] ? selinux_capable+0x37/0x40
[    6.768216]  [<ffffffff8107d11b>] sys_init_module+0x50/0x1e4
[    6.768218]  [<ffffffff81009cf2>] system_call_fastpath+0x16/0x1b
[    6.768220] ---[ end trace e90c29b7a056bbe4 ]---
f8104ddac>] warn_slowpath_fmt+0x46/0x48
[    6.768198]  [<ffffffff81469689>] ? _cond_resched+0xe/0x22
[    6.768200]  [<ffffffff81226e53>] __list_add+0x68/0x81

Comment 7 Dave Jones 2011-08-26 20:35:30 UTC
these other reports aren't necessarily the same as the original bug reported.
There are many linked lists in use in the kernel, and the debugging can be tripped up by many things.

If you're still seeing them, please file separate bugs.

Andreas, are you still seeing the original bug ?


Note You need to log in before you can comment on or make changes to this bug.