Date: Tue, 19 May 2009 17:18:44 -0400 From: Wesley Shields <wxs@FreeBSD.org> To: Thomas Backman <serenity@exscape.org> Cc: freebsd-current@freebsd.org Subject: Re: DTrace panic while probing syscall::open (and possibly many others) Message-ID: <20090519211844.GB39529@atarininja.org> In-Reply-To: <C994D84B-C67E-4BA3-9A7C-D5A3175BD29C@exscape.org> References: <949B5884-5303-4EFF-AC7D-293640FFA012@exscape.org> <20090518161148.GA56646@atarininja.org> <C994D84B-C67E-4BA3-9A7C-D5A3175BD29C@exscape.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On Mon, May 18, 2009 at 06:18:38PM +0200, Thomas Backman wrote: > > On May 18, 2009, at 06:11 PM, Wesley Shields wrote: > > > On Wed, May 13, 2009 at 03:19:05PM +0200, Thomas Backman wrote: > >> OK, so I first posted a thread on the forums about this in 7.2- > >> RELEASE: > >> http://forums.freebsd.org/showthread.php?t=3834 > >> Then filed a PR, kern/134408: > >> http://www.freebsd.org/cgi/query-pr.cgi?pr=134408 > >> > >> The very same bug remains in 8-CURRENT/amd64 as of May 13, ~10(am) > >> GMT+2. > >> > >> Steps to reproduce: > >> 1) Build DTrace capable kernel (I followed the wiki DTrace > >> instructions) > >> 2) Reboot; kldload dtraceall > >> 3) dtrace -n 'syscall::open:entry { self->path = arg0; } > >> syscall::open:return { printf("%s\n", copyinstr(self->path)); }' > >> 4) Crash. > >> > >> Backtrace: > >> [...] > > > > It's not the probe that is the problem. I suspect it's the copyinstr. > > > >> Same panic on two computers (a "real" one, A64 3200+, nForce4, 2GB > >> RAM; > >> and a Macbook Pro C2D running VMware Fusion). Same panic in 7.2 and > >> 8.0. > > > > I can easily reproduce this also. > > > > -- WXS > > Yup, it's copyinstr() crashing. It works if you simply replace > printf(...) with printf("file opened\n") which doesn't copy anything > in, and the backtrace seems (even to me ;) to point towards it. It's also worth noting that copyin() also causes the same panic. The ASSERT() in dtrace_copycheck() is catching it. The "Solaris Dynamic Tracing Guide" mentions that the specified address must correspond to a faulted-in page in the current process. I'm not sure how I could go about finding that out. -- WXS
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20090519211844.GB39529>