At Fri, 8 Mar 2013 22:21:26 +0200, Tommi Rantala wrote:

Hello,

Saw this while fuzzing with trinity in a qemu virtual machine:

[6026] Random reseed: 625996896 [watchdog] 7640111 iterations. [F:6650299 S:989808] [6026] Random reseed: 472197910 [ 459.365417] misc rfkill: uevent: unknown action-string [ 459.521953] BUG: unable to handle kernel NULL pointer dereference at 0000000000000010 [ 459.522027] IP: [<ffffffff819865fb>] snd_info_get_line+0x3b/0xf0 [ 459.522027] PGD 52deb067 PUD 50bbc067 PMD 0 [ 459.522027] Oops: 0000 [#1] SMP [ 459.522027] CPU 0 [ 459.522027] Pid: 7781, comm: trinity-child53 Tainted: G W 3.9.0-rc1+ #103 Bochs Bochs [ 459.522027] RIP: 0010:[<ffffffff819865fb>] [<ffffffff819865fb>] snd_info_get_line+0x3b/0xf0 [ 459.522027] RSP: 0018:ffff880065455a88 EFLAGS: 00010202 [ 459.522027] RAX: 0000000000000001 RBX: ffff8800508e1760 RCX: 0000000000000000 [ 459.522027] RDX: ffff880065455b57 RSI: ffff880065455ad8 RDI: ffff8800599ceba0 [ 459.522027] RBP: ffff880065455a88 R08: 0000000000000010 R09: 0000000000000001 [ 459.522027] R10: ffff8800461f5630 R11: 0000000000000000 R12: ffff88007a470960 [ 459.522027] R13: ffff88007a43b980 R14: ffff88007a470000 R15: ffff88007a43b900 [ 459.522027] FS: 00007f9c07c94700(0000) GS:ffff88007f800000(0000) knlGS:0000000000000000 [ 459.522027] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 459.522027] CR2: 0000000000000010 CR3: 0000000060ee2000 CR4: 00000000000006f0 [ 459.522027] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 459.522027] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 459.522027] Process trinity-child53 (pid: 7781, threadinfo ffff880065454000, task ffff8800797c2290) [ 459.522027] Stack: [ 459.522027] ffff880065455b88 ffffffff819a3f7e ffff880065455ab8 ffff8800599ceba0 [ 459.522027] ffff8800508e1220 ffff8800508e1200 ffff880065455b48 ffffffff8136eafc [ 459.522027] ffff880065455ae8 ffffffff81091198 ffff88007cc01600 ffff8800508e1200 [ 459.522027] Call Trace: [ 459.522027] [<ffffffff819a3f7e>] snd_mixer_oss_proc_write+0x1ee/0x250 [ 459.522027] [<ffffffff8136eafc>] ? debug_check_no_obj_freed+0x17c/0x230 [ 459.522027] [<ffffffff81091198>] ? kmemcheck_shadow_lookup+0x28/0x80 [ 459.522027] [<ffffffff81985a38>] ? snd_info_entry_release+0x48/0xd0 [ 459.522027] [<ffffffff81199c0c>] ? kfree+0x1ac/0x1e0 [ 459.522027] [<ffffffff81985a50>] snd_info_entry_release+0x60/0xd0 [ 459.522027] [<ffffffff81211022>] proc_reg_release+0x132/0x180 [ 459.522027] [<ffffffff819859f0>] ? snd_info_entry_llseek+0x100/0x100 [ 459.522027] [<ffffffff811a807a>] __fput+0x11a/0x220 [ 459.522027] [<ffffffff811a8189>] ____fput+0x9/0x10 [ 459.522027] [<ffffffff810bcbbe>] task_work_run+0x9e/0xc0 [ 459.522027] [<ffffffff8109d85c>] do_exit+0x3ac/0xad0 [ 459.522027] [<ffffffff810afc29>] ? get_signal_to_deliver+0xf9/0x810 [ 459.522027] [<ffffffff8109e044>] do_group_exit+0x84/0xd0 [ 459.522027] [<ffffffff810b0269>] get_signal_to_deliver+0x739/0x810 [ 459.522027] [<ffffffff810583b2>] do_signal+0x52/0x570 [ 459.522027] [<ffffffff810cbaf3>] ? finish_task_switch+0x43/0x120 [ 459.522027] [<ffffffff810f3366>] ? trace_hardirqs_on_caller+0x16/0x1f0 [ 459.522027] [<ffffffff810f354d>] ? trace_hardirqs_on+0xd/0x10 [ 459.522027] [<ffffffff81fad85b>] ? _raw_spin_unlock_irq+0x2b/0x40 [ 459.522027] [<ffffffff810cbb30>] ? finish_task_switch+0x80/0x120 [ 459.522027] [<ffffffff810cbaf3>] ? finish_task_switch+0x43/0x120 [ 459.522027] [<ffffffff810588f7>] do_notify_resume+0x27/0x70 [ 459.522027] [<ffffffff813663fe>] ? trace_hardirqs_on_thunk+0x3a/0x3f [ 459.522027] [<ffffffff81faf0a2>] int_signal+0x12/0x17 [ 459.522027] Code: 00 8b 4f 14 85 c9 0f 85 cf 00 00 00 44 8b 5f 18 45 85 db 74 6b e9 c1 00 00 00 66 0f 1f 44 00 00 8b 47 08 4c 8b 07 89 c1 83 c0 01 <41> 0f b6 0c 08 89 47 08 44 0f be c1 41 83 f8 0a 75 2b 39 47 0c [ 459.522027] RIP [<ffffffff819865fb>] snd_info_get_line+0x3b/0xf0 [ 459.522027] RSP <ffff880065455a88> [ 459.522027] CR2: 0000000000000010 [ 459.652998] ---[ end trace a9ded493128a1bce ]--- [ 459.654880] Fixing recursive fault but reboot is needed! [6026] Random reseed: 807260652 [watchdog] pid 8469 hasn't made progress in 30 seconds! (last:2725563185 now:2725563215 diff:30). Stuck in syscall 70:msgrcv. Sending SIGKILL. [watchdog] 7677069 iterations. [F:6682605 S:994461] [6026] Random reseed: 575363686 [ 461.032969] misc ashmem: uevent: unknown action-string [6026] Random reseed: 1095114151 [6026] Regenerating random pages, fd's etc.

What kind of workload would this be? The parallel read and/or write to the same proc file, or write after fork, etc?

I took a look through the relevant code paths, but no obvious failure was caught.

thanks,

Takashi