[BUG] task->nsproxy was unexpectedly NULL (caught in exit_shm)

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]


Hello.

Below bug hit me today when I closed one of many tabs in Chrome.
The kernel is from debian wheezy current kernel package:
linux-image-3.2.0-1-amd64 (v3.2.4).


Feb 18 11:28:38 debian kernel: [ 3392.815292] BUG: unable to handle
kernel NULL pointer dereference at 0000000000000010
Feb 18 11:28:38 debian kernel: [ 3392.815309] IP: [<ffffffff811581c3>]
exit_shm+0xa/0x54
Feb 18 11:28:38 debian kernel: [ 3392.815325] PGD 0
Feb 18 11:28:38 debian kernel: [ 3392.815331] Oops: 0000 [#1] SMP
Feb 18 11:28:38 debian kernel: [ 3392.815340] CPU 0
Feb 18 11:28:38 debian kernel: [ 3392.815343] Modules linked in:
pci_stub vboxpci(O) vboxnetadp(O) vboxnetflt(O) vboxdrv(O) powernow_k8
mperf cpufreq_stats cpufreq_conservative cpufreq_userspace
cpufreq_powersave parport_pc ppdev lp parport binfmt_misc nfsd nfs
lockd fscache auth_rpcgss nfs_acl sunrpc kvm_amd kvm fuse ext2 loop
snd_hda_codec_hdmi nvidia(P) snd_hda_intel snd_hda_codec snd_intel8x0
snd_hwdep snd_ac97_codec ac97_bus snd_pcm_oss snd_mixer_oss snd_pcm
snd_seq_midi snd_rawmidi snd_seq_midi_event snd_seq snd_timer
snd_seq_device snd k8temp pcspkr edac_core edac_mce_amd soundcore
evdev snd_page_alloc i2c_nforce2 i2c_core processor button ext3 jbd
mbcache btrfs zlib_deflate crc32c libcrc32c dm_mirror dm_region_hash
dm_log dm_mod usbhid hid sr_mod cdrom sd_mod crc_t10dif ohci_hcd
ata_generic ahci pata_amd libahci pata_jmicron sata_nv thermal fan
thermal_sys floppy ehci_hcd libata usbcore scsi_mod forcedeth
usb_common [last unloaded: scs i_wait_scan]
Feb 18 11:28:38 debian kernel: [ 3392.815476]
Feb 18 11:28:38 debian kernel: [ 3392.815483] Pid: 3806, comm: chrome
Tainted: P           O 3.2.0-1-amd64 #1 Unknow Unknow/KN9
Series(NF-CK804)
Feb 18 11:28:38 debian kernel: [ 3392.815493] RIP:
0010:[<ffffffff811581c3>]  [<ffffffff811581c3>] exit_shm+0xa/0x54
Feb 18 11:28:38 debian kernel: [ 3392.815504] RSP:
0018:ffff88012de61ce8  EFLAGS: 00010292
Feb 18 11:28:38 debian kernel: [ 3392.815509] RAX: 0000000000000000
RBX: ffff880130264300 RCX: 0000000000000008
Feb 18 11:28:38 debian kernel: [ 3392.815515] RDX: ffff88012e3b28c0
RSI: ffff88010ef96480 RDI: ffff880130264300
Feb 18 11:28:38 debian kernel: [ 3392.815520] RBP: 000000000000000f
R08: ffff88012c4a3818 R09: ffff88012c4a38c8
Feb 18 11:28:38 debian kernel: [ 3392.815526] R10: ffff88012c4a3a28
R11: ffff88010ef96480 R12: ffff88010ef96480
Feb 18 11:28:38 debian kernel: [ 3392.815531] R13: ffff88012fc56600
R14: 0000000000000001 R15: 000000000000413c
Feb 18 11:28:38 debian kernel: [ 3392.815538] FS:
00007f7610f2f700(0000) GS:ffff880137c00000(0000)
knlGS:0000000000000000
Feb 18 11:28:38 debian kernel: [ 3392.815544] CS:  0010 DS: 0000 ES:
0000 CR0: 000000008005003b
Feb 18 11:28:38 debian kernel: [ 3392.815549] CR2: 0000000000000010
CR3: 000000012e479000 CR4: 00000000000006f0
Feb 18 11:28:38 debian kernel: [ 3392.815556] DR0: 0000000000000000
DR1: 0000000000000000 DR2: 0000000000000000
Feb 18 11:28:38 debian kernel: [ 3392.815561] DR3: 0000000000000000
DR6: 00000000ffff0ff0 DR7: 0000000000000400
Feb 18 11:28:38 debian kernel: [ 3392.815568] Process chrome (pid:
3806, threadinfo ffff88012de60000, task ffff880131264300)
Feb 18 11:28:38 debian kernel: [ 3392.815572] Stack:
Feb 18 11:28:38 debian kernel: [ 3392.815576]  0000000000000000
ffff880130264300 000000000000000f ffffffff81049af5
Feb 18 11:28:38 debian kernel: [ 3392.815585]  000000000000192a
ffff88012de61d08 ffff880131264300 ffffffff817a8508
Feb 18 11:28:38 debian kernel: [ 3392.815594]  00007f7610f2e000
ffff88010ef96480 0000000000000944 000000000000000f
Feb 18 11:28:38 debian kernel: [ 3392.815604] Call Trace:
Feb 18 11:28:38 debian kernel: [ 3392.815616]  [<ffffffff81049af5>] ?
do_exit+0x28b/0x732
Feb 18 11:28:38 debian kernel: [ 3392.815626]  [<ffffffff8104a21c>] ?
do_group_exit+0x74/0x9e
Feb 18 11:28:38 debian kernel: [ 3392.815635]  [<ffffffff81055b5b>] ?
get_signal_to_deliver+0x46d/0x48f
Feb 18 11:28:38 debian kernel: [ 3392.815644]  [<ffffffff810cff30>] ?
handle_pte_fault+0x739/0x79f
Feb 18 11:28:38 debian kernel: [ 3392.815655]  [<ffffffff8100ddd3>] ?
do_signal+0x38/0x610
Feb 18 11:28:38 debian kernel: [ 3392.815663]  [<ffffffff81037e98>] ?
set_next_entity+0x32/0x55
Feb 18 11:28:38 debian kernel: [ 3392.815672]  [<ffffffff8100d01d>] ?
paravirt_write_msr+0xb/0xe
Feb 18 11:28:38 debian kernel: [ 3392.815679]  [<ffffffff8100d694>] ?
__switch_to+0x138/0x20e
Feb 18 11:28:38 debian kernel: [ 3392.815690]  [<ffffffff8106f2dc>] ?
sys_futex+0x138/0x148
Feb 18 11:28:38 debian kernel: [ 3392.815698]  [<ffffffff8100e3e1>] ?
do_notify_resume+0x25/0x68
Feb 18 11:28:38 debian kernel: [ 3392.815707]  [<ffffffff813459e0>] ?
int_signal+0x12/0x17
Feb 18 11:28:38 debian kernel: [ 3392.815713] Code: 48 8d bd c0 00 00
00 48 89 ea 48 c7 c6 b8 7e 15 81 e8 e9 f6 04 00 48 89 df 5b 5b 5d e9
e9 a7 f0 ff 55 53 50 48 8b 87 78 04 00 00 <48> 8b 68 10 83 bd 98 00 00
00 00 74 39 48 8d 9d a0 00 00 00 48
Feb 18 11:28:38 debian kernel: [ 3392.815783] RIP
[<ffffffff811581c3>] exit_shm+0xa/0x54
Feb 18 11:28:38 debian kernel: [ 3392.815792]  RSP <ffff88012de61ce8>
Feb 18 11:28:38 debian kernel: [ 3392.815795] CR2: 0000000000000010
Feb 18 11:28:38 debian kernel: [ 3392.815801] ---[ end trace
1bd7e5ff0e6f1b66 ]---
Feb 18 11:28:38 debian kernel: [ 3392.815807] Fixing recursive fault
but reboot is needed!


Relevant code:


        void exit_shm(struct task_struct *task)

311     {
   0xffffffff811581b9 <+0>:     55                      push   %rbp
   0xffffffff811581ba <+1>:     53                      push   %rbx
   0xffffffff811581bb <+2>:     50                      push   %rax

312             struct ipc_namespace *ns = task->nsproxy->ipc_ns;
   0xffffffff811581bc <+3>:     48 8b 87 78 04 00 00    mov
0x478(%rdi),%rax  /* task->nsproxy */
   0xffffffff811581c3 <+10>:    48 8b 68 10             mov
0x10(%rax),%rbp   /*     ->ipc_ns  */

313
314             if (shm_ids(ns).in_use == 0)
   0xffffffff811581c7 <+14>:    83 bd 98 00 00 00 00    cmpl   $0x0,0x98(%rbp)
   0xffffffff811581ce <+21>:    74 39                   je
0xffffffff81158209 <exit_shm+80>

315                     return;
316
317             /* Destroy all already created segments, but not mapped yet */
318             down_write(&shm_ids(ns).rw_mutex);
   0xffffffff811581d0 <+23>:    48 8d 9d a0 00 00 00    lea    0xa0(%rbp),%rbx
   0xffffffff811581d7 <+30>:    48 89 df                mov    %rbx,%rdi
   0xffffffff811581da <+33>:    e8 08 7e 1e 00          callq
0xffffffff8133ffe7 <down_write>
...


So task->nsproxy was unexpectedly NULL atm.
The bug happened only once so far.

Regards.

-- 
Przemysław Pawełczyk
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[Other Archives]     [Linux Kernel Newbies]     [Linux Driver Development]     [Fedora Kernel]     [Linux Kernel Testers]     [Linux SH]     [Linux Omap]     [Linux Kbuild]     [Linux Tape]     [Linux Input]     [Linux Kernel Janitors]     [Linux Kernel Packagers]     [Linux Doc]     [Linux Man Pages]     [Linux API]     [Linux Memory Management]     [Linux Modules]     [Linux Standards]     [Kernel Announce]     [Netdev]     [Git]     [Linux PCI]     Linux CAN Development     [Linux I2C]     [Linux RDMA]     [Linux NUMA]     [Netfilter]     [Netfilter Devel]     [SELinux]     [Bugtraq]     [FIO]     [Linux Perf Users]     [Linux Serial]     [Linux PPP]     [Linux ISDN]     [Linux Next]     [Kernel Stable Commits]     [Linux Tip Commits]     [Kernel MM Commits]     [Linux Security Module]     [Filesystem Development]     [Ext3 Filesystem]     [Linux bcache]     [Ext4 Filesystem]     [Linux BTRFS]     [Linux CEPH Filesystem]     [Linux XFS]     [XFS]     [Linux NFS]     [Linux CIFS]     [Ecryptfs]     [Linux NILFS]     [Linux Cachefs]     [Reiser FS]     [Initramfs]     [Linux FB Devel]     [Linux OpenGL]     [DRI Devel]     [Fastboot]     [Linux RT Users]     [Linux RT Stable]     [eCos]     [Corosync]     [Linux Clusters]     [LVS Devel]     [Hot Plug]     [Linux Virtualization]     [KVM]     [KVM PPC]     [KVM ia64]     [Linux Containers]     [Linux Hexagon]     [Linux Cgroups]     [Util Linux]     [Wireless]     [Linux Bluetooth]     [Bluez Devel]     [Ethernet Bridging]     [Embedded Linux]     [Barebox]     [Linux MMC]     [Linux IIO]     [Sparse]     [Smatch]     [Linux Arch]     [x86 Platform Driver]     [Linux ACPI]     [Linux IBM ACPI]     [LM Sensors]     [CPU Freq]     [Linux Power Management]     [Linmodems]     [Linux DCCP]     [Linux SCTP]     [ALSA Devel]     [Linux USB]     [Linux PA RISC]     [Linux Samsung SOC]     [MIPS Linux]     [IBM S/390 Linux]     [ARM Linux]     [ARM Kernel]     [ARM MSM]     [Tegra Devel]     [Sparc Linux]     [Linux Security]     [Linux Sound]     [Linux Media]     [Video 4 Linux]     [Linux IRDA Users]     [Linux for the blind]     [Linux RAID]     [Linux ATA RAID]     [Device Mapper]     [Linux SCSI]     [SCSI Target Devel]     [Linux SCSI Target Infrastructure]     [Linux IDE]     [Linux SMP]     [Linux AXP]     [Linux Alpha]     [Linux M68K]     [Linux ia64]     [Linux 8086]     [Linux x86_64]     [Linux Config]     [Linux Apps]     [Linux MSDOS]     [Linux X.25]     [Linux Crypto]     [DM Crypt]     [Linux Trace Users]     [Linux Btrace]     [Linux Watchdog]     [Utrace Devel]     [Linux C Programming]     [Linux Assembly]     [Dash]     [DWARVES]     [Hail Devel]     [Linux Kernel Debugger]     [Linux gcc]     [Gcc Help]     [X.Org]     [Wine]

Add to Google Powered by Linux

[Older Kernel Discussion]     [Yosemite National Park Forum]     [Large Format Photos]     [Gimp]     [Yosemite Photos]     [Stuff]