bugThe GNU Hurd - Bugs: bug #18349, GNU Mach: ``General Protection...


bug #18349: GNU Mach: ``General Protection Trap'' in `ipc_kmsg_enqueue'

Submitted by:  Thomas Schwinge <tschwinge>
Submitted on:  Wed 22 Nov 2006 12:00:23 PM UTC  
Category: GNU MachSeverity: 4 - Important
Priority: 7 - HighItem Group: None
Status: Ready For TestPrivacy: Public
Assigned to: Samuel Thibault <sthibaul>Originator Name: 
Open/Closed: OpenReproducibility: Intermittent
Size (loc): NonePlanned Release: None
Effort: 0.00
Wiki-like text discussion box: 

Add a New Comment(Rich Markup)

You are not logged in

Please log in, so followups can be emailed to you.


Sat 10 Mar 2007 11:33:31 AM UTC, comment #3:

Striving to fix this issue, the following has already been installed:

2007-03-05 Samuel Thibault <samuel.thibault@ens-lyon.org>

--- ``General Protection Trap'' in `ipc_kmsg_enqueue'

  • linux/dev/glue/net.c (device_write): Call net_packet() with splimp


Olaf, can you confirm that this also fixes the underlying problem for you?

I'll consider to apply the assertion-adding parts of the patch you posted in file #11971.

Thanks to both Olaf and Samuel for working on debugging this!

Thomas Schwinge <tschwinge>
Project Administrator
Mon 12 Feb 2007 06:10:30 PM UTC, comment #2:

It has been suggested already, and is certain now, that the problem actually
happens under high network load, probably if the network connection is more or
less saturated: I can reproduce it pretty reliably by running gv with a very
large PS figure ( http://dept-info.labri.fr/~thibault/tmp/graph-radial.ps ) on
a remote X server in my local network.

I also confirmed my guess that the problem is related to the gnumach BPF patch:
A kernel without the patch works, an otherwise identical kernel with the patch
(and the updated pfinet) crashes.

With the kernel debugger, I was able to find out that the crash actually
happens in the line

_last->ikm_next = (kmsg);

in ipc_kmsg_enqueue_macro() (ipc/ipc_kmsg.h), because _last has the value
IKM_BOGUS. It turns out ipc_kmsg_enqueue() is called with a broken
ipc_kmsg_queue as "queue" parameter: It's head points to an element with "next"
and "prev" pointers both set to IKM_BOGUS.

However, I was not able to find out how this broken ipc_kmsg_queue gets
created. Probably some locking issue in device/net_io.c or so, but that's just
guessing. One possibility for such a broken queue to be created could be if
ipc_kmsg_rmqueue_first_macro() or ipc_kmsg_rmqueue() is called with a "queue"
parameter which doesn't actually point to the queue in which the kmsg entry is:
In this case, the "next" and "prev" pointers of the entry would get set to
IKM_BOGUS, but the head pointer of the queue wouldn't get updated accordingly.


(file #11971)

Wed 22 Nov 2006 03:09:28 PM UTC, comment #1:

This has also been reported against the current Debian gnumach package, see <http://bugs.debian.org/396741>.

Thomas Schwinge <tschwinge>
Project Administrator
Wed 22 Nov 2006 12:00:23 PM UTC, original submission:

While compiling a package, I just hit a ``General Protection Trap''.

$ addr2line -f -e gnumach 0x10d117

78 void
79 ipc_kmsg_enqueue(
80 ipc_kmsg_queue_t queue,
81 ipc_kmsg_t kmsg)
82 {
83 ipc_kmsg_enqueue_macro(queue, kmsg);
84 }

Thomas Schwinge <tschwinge>
Project Administrator


(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):

Attached Files
file #11971:  gnumach-kmsg_assert.diff added by None (4KiB - This patch adds some assertions to catch the bug, and similar corruptions. Doesn't help to find the cause of the corruption, though :-()


Depends on the following items: None found

Items that depend on this one

   task dependencies.


Carbon-Copy List
  • -unavailable- added by tschwinge (Posted a comment)

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.


    Please enter the title of George Orwell's famous dystopian book (it's a date):



    Follow 8 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Sat 10 Mar 2007 11:33:31 AM UTCtschwingeStatusConfirmed=>Ready For Test
      Assigned toNone=>sthibaul
      Carbon-Copy-=>Added -unavailable-
    Mon 12 Feb 2007 06:10:30 PM UTCNoneAttached File-=>Added gnumach-kmsg_assert.diff, #11971
    Wed 22 Nov 2006 03:10:18 PM UTCtschwingeSeverity3 - Normal=>4 - Important
      Priority5 - Normal=>7 - High

    Back to the top

    Powered by Savane 3.1-cleanup1