[ ssic-linux-Bugs-1941808 ] kernel BUG @ ipc/semc:1931

Bugs item #1941808, was opened at 2008-04-14 03:57
Message generated for change (Comment added) made by rogertsang
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=405834&aid=1941808&group_id=32541

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: IPC
Group: v1.9.3
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: John Hughes (hughesj)
Assigned to: Nobody/Anonymous (nobody)
Summary: kernel BUG @ ipc/semc:1931

Initial Comment:
Seen this one a couple of times:

Kills the keyboard, eventually node dies.

Possibly seeing it now 'cos I'm using the ALSA DMIX plugin on all my nodes (which uses semaphores).

------------[ cut here ]------------
kernel BUG at ipc/sem.c:1913!
invalid operand: 0000 [#1]
SMP
Modules linked in: smbfs i915 drm button ac battery parport_pc parport pcspkr snd_intel8x0 snd_ac97_codec snd_pcm_oss snd_mixer_oss snd_pcm snd_timer snd soundcore snd_page_alloc i2c_i801 i2c_core ata_piix libata hw_random ehci_hcd uhci_hcd sr_mod sd_mod mptsas mptscsih mptbase scsi_mod tg3 e1000
CPU:    0
EIP:    0060:[<c01d447c>]    Not tainted VLI
EFLAGS: 00010202   (2.6.11-jh-1)
EIP is at ssi_semexit+0xfc/0x110
eax: 00000001   ebx: 0005800a   ecx: 00000002   edx: e59f3f88
esi: e59f3f88   edi: 00030e83   ebp: f721fe64   esp: f721fe44
ds: 007b   es: 007b   ss: 0068
Process icssvr_daemon (pid: 262671, threadinfo=f721f000 task=f725ed70)
Stack: c07500c0 e59f3f88 0005800a dfdd8580 f721fe68 f721fe74 f7219400 c0753360
       f721feb8 c02614f1 0005800a 00030e83 00000004 0004020f 00000000 00000000
       00000000 00000000 00000000 0004020f 0004020f 0004020f 00100001 00000000
Call Trace:
 [<c010694f>] show_stack+0x7f/0xa0
 [<c0106b04>] show_registers+0x164/0x220
 [<c0106e94>] die+0xf4/0x1c0
 [<c0107015>] do_trap+0xb5/0xc0
 [<c01072cc>] do_invalid_op+0xbc/0xd0
 [<c01065a3>] error_code+0x2b/0x30
 [<c02614f1>] ripc_semexit+0x31/0x50
 [<c0256fb3>] svr_ripc_semexit+0xa3/0x100
 [<c020abb3>] icssvr_daemon+0x2f3/0xab0
 [<c01023a5>] kernel_thread_helper+0x5/0x10
Code: 8b 80 8c 00 00 00 89 41 04 43 39 fb 7c c1 a1 90 0d 74 c0 89 46 30 89 34 24 e8 c1 d9 ff ff e9 79 ff ff ff c7 01 00 00 00 00 eb bf <0f> 0b 79 07 8f b8 49 c0 e9 3d ff ff ff 8d b4 26 00 00 00 00 55



----------------------------------------------------------------------

>Comment By: Roger Tsang (rogertsang)
Date: 2008-04-14 21:16

Message:
Logged In: YES 
user_id=1246761
Originator: NO

Maybe semid changed before exit_sem() got sem_lock().  Try attached patch.
File Added: ipc_sem.c.patch

----------------------------------------------------------------------

Comment By: John Hughes (hughesj)
Date: 2008-04-14 04:24

Message:
Logged In: YES 
user_id=166336
Originator: YES

Here's the code:

static inline void __ssi_semexit(int semid, pid_t pid, struct sem_array
*sma)
{
        int nsems, i;
        struct sem_semundo *un, **unp;

        BUG_ON(sem_checkid(sma,semid));



----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=405834&aid=1941808&group_id=32541

-------------------------------------------------------------------------
This SF.net email is sponsored by the 2008 JavaOne(SM) Conference 
Don't miss this year's exciting event. There's still time to save $100. 
Use priority code J8TL2D2. 
http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone