bugThe GNU Hurd - Bugs: bug #18349, GNU Mach: ``General Protection...

 
 

bug #18349: GNU Mach: ``General Protection Trap'' in `ipc_kmsg_enqueue'

Submitter:  Thomas Schwinge <tschwinge>
Submitted:  Wed 22 Nov 2006 12:00:23 PM UTC
   
 
Category:  GNU Mach Severity:  4 - Important
Priority:  7 - High Item Group:  None
Status:  Ready For Test Privacy:  Public
Assigned to:  sthibaul Originator Name: 
Open/Closed:  Open Reproducibility:  Intermittent
Size (loc):  None Planned Release:  None
Effort:  0.00
Wiki-like text discussion box: 


* Mandatory Fields

Add a New Comment Rich Markup
   

Sat 10 Mar 2007 11:33:31 AM UTC, comment #3: 

Striving to fix this issue, the following has already been installed:

#v+
2007-03-05  Samuel Thibault  <samuel.thibault@ens-lyon.org>

--- ``General Protection Trap'' in `ipc_kmsg_enqueue'

  • linux/dev/glue/net.c (device_write): Call net_packet() with splimp

held.
#v-

Olaf, can you confirm that this also fixes the underlying problem for you?

I'll consider to apply the assertion-adding parts of the patch you posted in file #11971.


Thanks to both Olaf and Samuel for working on debugging this!

Thomas Schwinge <tschwinge>
Group administrator
Mon 12 Feb 2007 06:10:30 PM UTC, comment #2: 

It has been suggested already, and is certain now, that the problem actually
happens under high network load, probably if the network connection is more or
less saturated: I can reproduce it pretty reliably by running gv with a very
large PS figure ( http://dept-info.labri.fr/~thibault/tmp/graph-radial.ps ) on
a remote X server in my local network.

I also confirmed my guess that the problem is related to the gnumach BPF patch:
A kernel without the patch works, an otherwise identical kernel with the patch
(and the updated pfinet) crashes.

With the kernel debugger, I was able to find out that the crash actually
happens in the line

   _last->ikm_next = (kmsg);

in ipc_kmsg_enqueue_macro() (ipc/ipc_kmsg.h), because _last has the value
IKM_BOGUS. It turns out ipc_kmsg_enqueue() is called with a broken
ipc_kmsg_queue as "queue" parameter: It's head points to an element with "next"
and "prev" pointers both set to IKM_BOGUS.

However, I was not able to find out how this broken ipc_kmsg_queue gets
created. Probably some locking issue in device/net_io.c or so, but that's just
guessing. One possibility for such a broken queue to be created could be if
ipc_kmsg_rmqueue_first_macro() or ipc_kmsg_rmqueue() is called with a "queue"
parameter which doesn't actually point to the queue in which the kmsg entry is:
In this case, the "next" and "prev" pointers of the entry would get set to
IKM_BOGUS, but the head pointer of the queue wouldn't get updated accordingly.

-antrik-


(file #11971)

Anonymous
Wed 22 Nov 2006 03:09:28 PM UTC, comment #1: 

This has also been reported against the current Debian gnumach package, see <http://bugs.debian.org/396741>.

Thomas Schwinge <tschwinge>
Group administrator
Wed 22 Nov 2006 12:00:23 PM UTC, original submission:  

While compiling a package, I just hit a ``General Protection Trap''.

#v+
$ addr2line -f -e gnumach 0x10d117
ipc_kmsg_enqueue
../ipc/ipc_kmsg.c:83
#v-

ipc/ipc_kmsg.c
#v+
[...]
    78  void
    79  ipc_kmsg_enqueue(
    80          ipc_kmsg_queue_t        queue,
    81          ipc_kmsg_t              kmsg)
    82  {
    83          ipc_kmsg_enqueue_macro(queue, kmsg);
    84  }
[...]
#v-

Thomas Schwinge <tschwinge>
Group administrator

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #11971:  gnumach-kmsg_assert.diff added by None (4KiB - This patch adds some assertions to catch the bug, and similar corruptions. Doesn't help to find the cause of the corruption, though :-()

 

Depends on the following items: None found

Items that depend on this one

Digest:
   task dependencies.

 

Carbon-Copy List
  • -email is unavailable- added by tschwinge (Posted a comment)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 9 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2007-03-10 tschwinge Dependencies- task #6111 is dependent
    2007-03-10 tschwinge StatusConfirmed Ready For Test
        Assigned toNone sthibaul
        Carbon-Copy- Added -email is unavailable-
    2007-02-12 None Attached File- Added gnumach-kmsg_assert.diff, #11971
    2006-11-22 tschwinge Severity3 - Normal 4 - Important
        Priority5 - Normal 7 - High
        StatusNone Confirmed
        ReproducibilityOnce Intermittent

    Back to the top

    Powered by Savane 3.13-4448.
    Corresponding source code