At Fri, 8 Mar 2013 22:21:26 +0200, Tommi Rantala wrote: > > Hello, > > Saw this while fuzzing with trinity in a qemu virtual machine: > > [6026] Random reseed: 625996896 > [watchdog] 7640111 iterations. [F:6650299 S:989808] > [6026] Random reseed: 472197910 > [ 459.365417] misc rfkill: uevent: unknown action-string > [ 459.521953] BUG: unable to handle kernel NULL pointer dereference > at 0000000000000010 > [ 459.522027] IP: [<ffffffff819865fb>] snd_info_get_line+0x3b/0xf0 > [ 459.522027] PGD 52deb067 PUD 50bbc067 PMD 0 > [ 459.522027] Oops: 0000 [#1] SMP > [ 459.522027] CPU 0 > [ 459.522027] Pid: 7781, comm: trinity-child53 Tainted: G W > 3.9.0-rc1+ #103 Bochs Bochs > [ 459.522027] RIP: 0010:[<ffffffff819865fb>] [<ffffffff819865fb>] > snd_info_get_line+0x3b/0xf0 > [ 459.522027] RSP: 0018:ffff880065455a88 EFLAGS: 00010202 > [ 459.522027] RAX: 0000000000000001 RBX: ffff8800508e1760 RCX: 0000000000000000 > [ 459.522027] RDX: ffff880065455b57 RSI: ffff880065455ad8 RDI: ffff8800599ceba0 > [ 459.522027] RBP: ffff880065455a88 R08: 0000000000000010 R09: 0000000000000001 > [ 459.522027] R10: ffff8800461f5630 R11: 0000000000000000 R12: ffff88007a470960 > [ 459.522027] R13: ffff88007a43b980 R14: ffff88007a470000 R15: ffff88007a43b900 > [ 459.522027] FS: 00007f9c07c94700(0000) GS:ffff88007f800000(0000) > knlGS:0000000000000000 > [ 459.522027] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > [ 459.522027] CR2: 0000000000000010 CR3: 0000000060ee2000 CR4: 00000000000006f0 > [ 459.522027] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 > [ 459.522027] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 > [ 459.522027] Process trinity-child53 (pid: 7781, threadinfo > ffff880065454000, task ffff8800797c2290) > [ 459.522027] Stack: > [ 459.522027] ffff880065455b88 ffffffff819a3f7e ffff880065455ab8 > ffff8800599ceba0 > [ 459.522027] ffff8800508e1220 ffff8800508e1200 ffff880065455b48 > ffffffff8136eafc > [ 459.522027] ffff880065455ae8 ffffffff81091198 ffff88007cc01600 > ffff8800508e1200 > [ 459.522027] Call Trace: > [ 459.522027] [<ffffffff819a3f7e>] snd_mixer_oss_proc_write+0x1ee/0x250 > [ 459.522027] [<ffffffff8136eafc>] ? debug_check_no_obj_freed+0x17c/0x230 > [ 459.522027] [<ffffffff81091198>] ? kmemcheck_shadow_lookup+0x28/0x80 > [ 459.522027] [<ffffffff81985a38>] ? snd_info_entry_release+0x48/0xd0 > [ 459.522027] [<ffffffff81199c0c>] ? kfree+0x1ac/0x1e0 > [ 459.522027] [<ffffffff81985a50>] snd_info_entry_release+0x60/0xd0 > [ 459.522027] [<ffffffff81211022>] proc_reg_release+0x132/0x180 > [ 459.522027] [<ffffffff819859f0>] ? snd_info_entry_llseek+0x100/0x100 > [ 459.522027] [<ffffffff811a807a>] __fput+0x11a/0x220 > [ 459.522027] [<ffffffff811a8189>] ____fput+0x9/0x10 > [ 459.522027] [<ffffffff810bcbbe>] task_work_run+0x9e/0xc0 > [ 459.522027] [<ffffffff8109d85c>] do_exit+0x3ac/0xad0 > [ 459.522027] [<ffffffff810afc29>] ? get_signal_to_deliver+0xf9/0x810 > [ 459.522027] [<ffffffff8109e044>] do_group_exit+0x84/0xd0 > [ 459.522027] [<ffffffff810b0269>] get_signal_to_deliver+0x739/0x810 > [ 459.522027] [<ffffffff810583b2>] do_signal+0x52/0x570 > [ 459.522027] [<ffffffff810cbaf3>] ? finish_task_switch+0x43/0x120 > [ 459.522027] [<ffffffff810f3366>] ? trace_hardirqs_on_caller+0x16/0x1f0 > [ 459.522027] [<ffffffff810f354d>] ? trace_hardirqs_on+0xd/0x10 > [ 459.522027] [<ffffffff81fad85b>] ? _raw_spin_unlock_irq+0x2b/0x40 > [ 459.522027] [<ffffffff810cbb30>] ? finish_task_switch+0x80/0x120 > [ 459.522027] [<ffffffff810cbaf3>] ? finish_task_switch+0x43/0x120 > [ 459.522027] [<ffffffff810588f7>] do_notify_resume+0x27/0x70 > [ 459.522027] [<ffffffff813663fe>] ? trace_hardirqs_on_thunk+0x3a/0x3f > [ 459.522027] [<ffffffff81faf0a2>] int_signal+0x12/0x17 > [ 459.522027] Code: 00 8b 4f 14 85 c9 0f 85 cf 00 00 00 44 8b 5f 18 > 45 85 db 74 6b e9 c1 00 00 00 66 0f 1f 44 00 00 8b 47 08 4c 8b 07 89 > c1 83 c0 01 <41> 0f b6 0c 08 89 47 08 44 0f be c1 41 83 f8 0a 75 2b 39 > 47 0c > [ 459.522027] RIP [<ffffffff819865fb>] snd_info_get_line+0x3b/0xf0 > [ 459.522027] RSP <ffff880065455a88> > [ 459.522027] CR2: 0000000000000010 > [ 459.652998] ---[ end trace a9ded493128a1bce ]--- > [ 459.654880] Fixing recursive fault but reboot is needed! > [6026] Random reseed: 807260652 > [watchdog] pid 8469 hasn't made progress in 30 seconds! > (last:2725563185 now:2725563215 diff:30). Stuck in syscall 70:msgrcv. > Sending SIGKILL. > [watchdog] 7677069 iterations. [F:6682605 S:994461] > [6026] Random reseed: 575363686 > [ 461.032969] misc ashmem: uevent: unknown action-string > [6026] Random reseed: 1095114151 > [6026] Regenerating random pages, fd's etc. What kind of workload would this be? The parallel read and/or write to the same proc file, or write after fork, etc? I took a look through the relevant code paths, but no obvious failure was caught. thanks, Takashi _______________________________________________ Alsa-devel mailing list Alsa-devel@xxxxxxxxxxxxxxxx http://mailman.alsa-project.org/mailman/listinfo/alsa-devel
