[ ssic-linux-Bugs-1941808 ] kernel BUG @ ipc/semc:1931

Bugs item #1941808, was opened at 2008-04-14 00:57
Message generated for change (Comment added) made by nobody
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=405834&aid=1941808&group_id=32541

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: IPC
Group: v1.9.3
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: John Hughes (hughesj)
Assigned to: Nobody/Anonymous (nobody)
Summary: kernel BUG @ ipc/semc:1931

Initial Comment:
Seen this one a couple of times:

Kills the keyboard, eventually node dies.

Possibly seeing it now 'cos I'm using the ALSA DMIX plugin on all my nodes (which uses semaphores).

------------[ cut here ]------------
kernel BUG at ipc/sem.c:1913!
invalid operand: 0000 [#1]
SMP
Modules linked in: smbfs i915 drm button ac battery parport_pc parport pcspkr snd_intel8x0 snd_ac97_codec snd_pcm_oss snd_mixer_oss snd_pcm snd_timer snd soundcore snd_page_alloc i2c_i801 i2c_core ata_piix libata hw_random ehci_hcd uhci_hcd sr_mod sd_mod mptsas mptscsih mptbase scsi_mod tg3 e1000
CPU:    0
EIP:    0060:[<c01d447c>]    Not tainted VLI
EFLAGS: 00010202   (2.6.11-jh-1)
EIP is at ssi_semexit+0xfc/0x110
eax: 00000001   ebx: 0005800a   ecx: 00000002   edx: e59f3f88
esi: e59f3f88   edi: 00030e83   ebp: f721fe64   esp: f721fe44
ds: 007b   es: 007b   ss: 0068
Process icssvr_daemon (pid: 262671, threadinfo=f721f000 task=f725ed70)
Stack: c07500c0 e59f3f88 0005800a dfdd8580 f721fe68 f721fe74 f7219400 c0753360
       f721feb8 c02614f1 0005800a 00030e83 00000004 0004020f 00000000 00000000
       00000000 00000000 00000000 0004020f 0004020f 0004020f 00100001 00000000
Call Trace:
 [<c010694f>] show_stack+0x7f/0xa0
 [<c0106b04>] show_registers+0x164/0x220
 [<c0106e94>] die+0xf4/0x1c0
 [<c0107015>] do_trap+0xb5/0xc0
 [<c01072cc>] do_invalid_op+0xbc/0xd0
 [<c01065a3>] error_code+0x2b/0x30
 [<c02614f1>] ripc_semexit+0x31/0x50
 [<c0256fb3>] svr_ripc_semexit+0xa3/0x100
 [<c020abb3>] icssvr_daemon+0x2f3/0xab0
 [<c01023a5>] kernel_thread_helper+0x5/0x10
Code: 8b 80 8c 00 00 00 89 41 04 43 39 fb 7c c1 a1 90 0d 74 c0 89 46 30 89 34 24 e8 c1 d9 ff ff e9 79 ff ff ff c7 01 00 00 00 00 eb bf <0f> 0b 79 07 8f b8 49 c0 e9 3d ff ff ff 8d b4 26 00 00 00 00 55



----------------------------------------------------------------------

Comment By: Nobody/Anonymous (nobody)
Date: 2008-04-15 06:55

Message:
Logged In: NO 

I'm sorry Roger, I don't get the point of your patch.

I suppose the relevant bit is:

@@ -2027,7 +2025,7 @@ namesvr_semexit_go:
 				continue;
 			}
 
-			__ssi_semexit(semid, current->tgid, sma);
+			__ssi_semexit(u->semid, current->tgid, sma);
 		}
 	}

so if semid has been changed to be bad, or if u->semid was bad and has
changed to be good we won't panic.  I can't see how either of these
conditions can happen.

Also the call path that seems to be causing problems seems to be (from the
trace above):

[client node]
   exit_sem
   cli_ripc_semexit

[server node]
   [...]
   svr_ripc_semexit
   ripc_semexit
   ssi_semexit
   __ssi_semexit

and your patch touches the

   exit_sem
   __ssi_semexit

path.

I must admit I'm pretty suprised to see that the client/server stuff is
being used - I thought everything was staying node-local.

Maybe the fix is simply to bail out of __ssi_semexit if check_semid
doesn't match?  Couldn't it just indicate a sem_exit/IPC_RMID collision?


----------------------------------------------------------------------

Comment By: Roger Tsang (rogertsang)
Date: 2008-04-14 18:16

Message:
Logged In: YES 
user_id=1246761
Originator: NO

Maybe semid changed before exit_sem() got sem_lock().  Try attached patch.
File Added: ipc_sem.c.patch

----------------------------------------------------------------------

Comment By: John Hughes (hughesj)
Date: 2008-04-14 01:24

Message:
Logged In: YES 
user_id=166336
Originator: YES

Here's the code:

static inline void __ssi_semexit(int semid, pid_t pid, struct sem_array
*sma)
{
        int nsems, i;
        struct sem_semundo *un, **unp;

        BUG_ON(sem_checkid(sma,semid));



----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=405834&aid=1941808&group_id=32541

-------------------------------------------------------------------------
This SF.net email is sponsored by the 2008 JavaOne(SM) Conference 
Don't miss this year's exciting event. There's still time to save $100. 
Use priority code J8TL2D2. 
http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone