[ ssic-linux-Bugs-1941808 ] kernel BUG @ ipc/semc:1931
"SourceForge.net" <[email protected]>
| Newsgroups | gmane.linux.cluster.ssic.devel |
|---|---|
| Message-ID | <[email protected]> |
Bugs item #1941808, was opened at 2008-04-14 09:57
Message generated for change (Comment added) made by hughesj
You can respond by visiting:
https://sourceforge.net/tracker/?func=detail&atid=405834&aid=1941808&group_id=32541
Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: IPC
Group: v1.9.3
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: John Hughes (hughesj)
Assigned to: Nobody/Anonymous (nobody)
Summary: kernel BUG @ ipc/semc:1931
Initial Comment:
Seen this one a couple of times:
Kills the keyboard, eventually node dies.
Possibly seeing it now 'cos I'm using the ALSA DMIX plugin on all my nodes (which uses semaphores).
------------[ cut here ]------------
kernel BUG at ipc/sem.c:1913!
invalid operand: 0000 [#1]
SMP
Modules linked in: smbfs i915 drm button ac battery parport_pc parport pcspkr snd_intel8x0 snd_ac97_codec snd_pcm_oss snd_mixer_oss snd_pcm snd_timer snd soundcore snd_page_alloc i2c_i801 i2c_core ata_piix libata hw_random ehci_hcd uhci_hcd sr_mod sd_mod mptsas mptscsih mptbase scsi_mod tg3 e1000
CPU: 0
EIP: 0060:[<c01d447c>] Not tainted VLI
EFLAGS: 00010202 (2.6.11-jh-1)
EIP is at ssi_semexit+0xfc/0x110
eax: 00000001 ebx: 0005800a ecx: 00000002 edx: e59f3f88
esi: e59f3f88 edi: 00030e83 ebp: f721fe64 esp: f721fe44
ds: 007b es: 007b ss: 0068
Process icssvr_daemon (pid: 262671, threadinfo=f721f000 task=f725ed70)
Stack: c07500c0 e59f3f88 0005800a dfdd8580 f721fe68 f721fe74 f7219400 c0753360
f721feb8 c02614f1 0005800a 00030e83 00000004 0004020f 00000000 00000000
00000000 00000000 00000000 0004020f 0004020f 0004020f 00100001 00000000
Call Trace:
[<c010694f>] show_stack+0x7f/0xa0
[<c0106b04>] show_registers+0x164/0x220
[<c0106e94>] die+0xf4/0x1c0
[<c0107015>] do_trap+0xb5/0xc0
[<c01072cc>] do_invalid_op+0xbc/0xd0
[<c01065a3>] error_code+0x2b/0x30
[<c02614f1>] ripc_semexit+0x31/0x50
[<c0256fb3>] svr_ripc_semexit+0xa3/0x100
[<c020abb3>] icssvr_daemon+0x2f3/0xab0
[<c01023a5>] kernel_thread_helper+0x5/0x10
Code: 8b 80 8c 00 00 00 89 41 04 43 39 fb 7c c1 a1 90 0d 74 c0 89 46 30 89 34 24 e8 c1 d9 ff ff e9 79 ff ff ff c7 01 00 00 00 00 eb bf <0f> 0b 79 07 8f b8 49 c0 e9 3d ff ff ff 8d b4 26 00 00 00 00 55
----------------------------------------------------------------------
>Comment By: John Hughes (hughesj)
Date: 2008-04-17 10:08
Message:
Logged In: YES
user_id=166336
Originator: YES
Another BUG in the semaphore code - may indicate the underlying cause of
the problem?
It's trying to unlock a lock that isn't locked.
------------[ cut here ]------------
kernel BUG at include/asm/spinlock.h:112!
invalid operand: 0000 [#1]
SMP
Modules linked in: i915 drm button ac battery parport_pc parport floppy
pcspkr snd_intel8x0 snd_ac97_codec snd_pcm_oss snd_mixer_oss snd_pcm
snd_timer snd soundcore snd_page_alloc i2c_i801 i2c_core ata_piix libata
hw_random ehci_hcd uhci_hcd sr_mod sd_mod mptsas mptscsih mptbase scsi_mod
tg3 e1000
CPU: 0
EIP: 0060:[<c046290b>] Not tainted VLI
EFLAGS: 00010202 (2.6.11-jh-1)
EIP is at _spin_unlock+0x1b/0x30
eax: 00000001 ebx: c0750140 ecx: c0750101 edx: f7e12e08
esi: f70c2400 edi: c0753360 ebp: f7032f10 esp: f7032f10
ds: 007b es: 007b ss: 0068
Process icssvr_daemon (pid: 197135, threadinfo=f7032000 task=f70cd930)
Stack: f7032f18 c01cecbb f7032f28 c01ce77e f7e12e08 02668001 f7032f44
c0261dd5
02668001 f7e12e08 c0750140 00000001 f7032f5c f7032f6c c0258708
00000003
f7032f5c 02668001 00000000 00000000 02668001 00000002 00000002
f7032fec
Call Trace:
[<c010694f>] show_stack+0x7f/0xa0
[<c0106b04>] show_registers+0x164/0x220
[<c0106e94>] die+0xf4/0x1c0
[<c0107015>] do_trap+0xb5/0xc0
[<c01072cc>] do_invalid_op+0xbc/0xd0
[<c01065a3>] error_code+0x2b/0x30
[<c01cecbb>] ipc_unlock+0xb/0x10
[<c01ce77e>] ipc_drop_locks+0x1e/0x40
[<c0261dd5>] ripc_drop_locks+0x45/0x60
[<c0258708>] svr_ripc_drop_locks+0x58/0xb0
[<c020abb3>] icssvr_daemon+0x2f3/0xab0
[<c01023a5>] kernel_thread_helper+0x5/0x10
Code: 1c 0c 49 c0 eb e6 8d 76 00 8d bc 27 00 00 00 00 55 89 c2 89 e5 81 78
04 ad 4e ad de b1 01 75 15 0f b6 02 84 c0 7f 04 86 0a 5d c3 <0f> 0b 70 00
1c 0c 49 c0 eb f2 0f 0b 6f 00 1c 0c 49 c0 eb e1 90
----------------------------------------------------------------------
Comment By: John Hughes (hughesj)
Date: 2008-04-16 13:22
Message:
Logged In: YES
user_id=166336
Originator: YES
Here's another example, this time it was going through the local exit_sem
path:
------------[ cut here ]------------
kernel BUG at ipc/sem.c:1913!
invalid operand: 0000 [#1]
SMP
Modules linked in: smbfs i915 drm button ac battery parport_pc parport
pcspkr i2c_i801 i2c_core ata_piix libata snd_intel8x0 snd_ac97_codec
snd_pcm_oss snd_mixer_oss snd_pcm snd_timer snd soundcore snd_page_alloc
ehci_hcd uhci_hcd sr_mod sd_mod mptsas mptscsih mptbase scsi_mod tg3 e1000
CPU: 0
EIP: 0060:[<c01d3f29>] Not tainted VLI
EFLAGS: 00210202 (2.6.11-jh-1)
EIP is at exit_sem+0x229/0x2b0
eax: 00000001 ebx: c597e808 ecx: 00000001 edx: c597e808
esi: 000e800c edi: cbf682e0 ebp: d76fce6c esp: d76fcdd0
ds: 007b es: 007b ss: 0068
Process firefox-bin (pid: 743423, threadinfo=d76fc000 task=df5f58b0)
Stack: c07500c0 c597e808 000e800c 00000000 d76fce00 c015d84d c165eb80
d1e12ee4
d76fc000 00000001 000b0f63 d76fc000 cfcfd42c cfcfd420 d1e12ee4
defe7380
0000000b df5f5d78 d76fce28 defe7380 defe73c8 df5f5d78 d76fce3c
c0125456
Call Trace:
[<c010694f>] show_stack+0x7f/0xa0
[<c0106b04>] show_registers+0x164/0x220
[<c0106e94>] die+0xf4/0x1c0
[<c0107015>] do_trap+0xb5/0xc0
[<c01072cc>] do_invalid_op+0xbc/0xd0
[<c01065a3>] error_code+0x2b/0x30
[<c012a319>] do_exit+0xb9/0x3b0
[<c012a68c>] do_group_exit+0x3c/0xb0
[<c01350cf>] get_signal_to_deliver+0x1ff/0x310
[<c01057c4>] do_signal+0x74/0x140
[<c0105917>] do_notify_resume+0x87/0x8c
[<c0105a86>] work_notifysig+0x13/0x15
Code: 80 8c 00 00 00 89 41 04 46 3b 75 88 7c c0 a1 90 0d 74 c0 89 43 30 89
1c 24 e8 14 df ff ff e9 52 ff ff ff c7 01 00 00 00 00 eb be <0f> 0b 79 07
8f b8 49 c0 e9 05 ff ff ff 89 44 24 04 89 34 24 e8
So it's not to do with local/remote semaphores.
----------------------------------------------------------------------
Comment By: Nobody/Anonymous (nobody)
Date: 2008-04-15 15:55
Message:
Logged In: NO
I'm sorry Roger, I don't get the point of your patch.
I suppose the relevant bit is:
@@ -2027,7 +2025,7 @@ namesvr_semexit_go:
continue;
}
- __ssi_semexit(semid, current->tgid, sma);
+ __ssi_semexit(u->semid, current->tgid, sma);
}
}
so if semid has been changed to be bad, or if u->semid was bad and has
changed to be good we won't panic. I can't see how either of these
conditions can happen.
Also the call path that seems to be causing problems seems to be (from the
trace above):
[client node]
exit_sem
cli_ripc_semexit
[server node]
[...]
svr_ripc_semexit
ripc_semexit
ssi_semexit
__ssi_semexit
and your patch touches the
exit_sem
__ssi_semexit
path.
I must admit I'm pretty suprised to see that the client/server stuff is
being used - I thought everything was staying node-local.
Maybe the fix is simply to bail out of __ssi_semexit if check_semid
doesn't match? Couldn't it just indicate a sem_exit/IPC_RMID collision?
----------------------------------------------------------------------
Comment By: Roger Tsang (rogertsang)
Date: 2008-04-15 03:16
Message:
Logged In: YES
user_id=1246761
Originator: NO
Maybe semid changed before exit_sem() got sem_lock(). Try attached patch.
File Added: ipc_sem.c.patch
----------------------------------------------------------------------
Comment By: John Hughes (hughesj)
Date: 2008-04-14 10:24
Message:
Logged In: YES
user_id=166336
Originator: YES
Here's the code:
static inline void __ssi_semexit(int semid, pid_t pid, struct sem_array
*sma)
{
int nsems, i;
struct sem_semundo *un, **unp;
BUG_ON(sem_checkid(sma,semid));
----------------------------------------------------------------------
You can respond by visiting:
https://sourceforge.net/tracker/?func=detail&atid=405834&aid=1941808&group_id=32541
-------------------------------------------------------------------------
This SF.net email is sponsored by the 2008 JavaOne(SM) Conference
Don't miss this year's exciting event. There's still time to save $100.
Use priority code J8TL2D2.
http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone