Date: Wed, 15 Sep 2004 10:52:16 -0700 From: Julian Elischer <julian@elischer.org> To: Robert Watson <robert@fledge.watson.org> Cc: current@freebsd.org Subject: Re: Possible NULL pointer deref in sched_add() via maybe_preempt() and kse_release() Message-ID: <41488150.8050605@elischer.org> In-Reply-To: <Pine.NEB.3.96L.1040915115816.89730E-100000@fledge.watson.org> References: <Pine.NEB.3.96L.1040915115816.89730E-100000@fledge.watson.org>
next in thread | previous in thread | raw e-mail | index | archive | help
>
>
>#7 0xc07aefc5 in trap (frame=
> {tf_fs = -283443176, tf_es = -1067319280, tf_ds = -1032323056,
>tf_edi = 3, tf_esi = 0, tf_ebp = -283436232, tf_isp = -283436268, tf_ebx =
>-1032909760, tf_edx = 0, tf_ecx = 0, tf_eax = -1032909672, tf_trapno = 12,
>tf_err = 0, tf_eip = -1067309858, tf_cs = 8, tf_eflags = 65670, tf_esp =
>0, tf_ss = -1032909760}) at ../../../i386/i386/trap.c:247
>#8 0xc079d1fa in calltrap () at ../../../i386/i386/exception.s:140
>#9 0xef1b0018 in ?? ()
>#10 0xc0620010 in link_elf_preload_parse_symbols (ef=0xc26f0c40)
> at ../../../kern/link_elf.c:348
>
huh? how did it get from setrunqueue() to link_elf_preload_parse_symbols() ?
when you are at #11, can you do a 'list' ?
>#11 0xc0622c07 in setrunqueue (td=0xc27867d0, flags=3) at
>kern_switch.c:419
>---Type <return> to continue, or q <return> to quit---
>#12 0xc06222ce in sched_switch (td=0xc27867d0, newtd=0xc2a93af0, flags=2)
> at ../../../kern/sched_4bsd.c:822
>#13 0xc0618882 in mi_switch (flags=2, newtd=0xc2a93af0)
> at ../../../kern/kern_synch.c:340
>#14 0xc0622d93 in maybe_preempt (td=0xc2a93af0) at kern_switch.c:544
>#15 0xc06225cb in sched_add (td=0xc2a93af0, flags=0)
> at ../../../kern/sched_4bsd.c:1021
>#16 0xc0622c07 in setrunqueue (td=0xc2a93af0, flags=0) at
>kern_switch.c:419
>#17 0xc0631bd3 in turnstile_unpend (ts=0x0)
> at ../../../kern/subr_turnstile.c:739
>#18 0xc060950c in _mtx_unlock_sleep (m=0xc2785cac, opts=0, file=0x0,
>line=0)
> at ../../../kern/kern_mutex.c:673
>#19 0xc062efdc in sleepq_catch_signals (wchan=0xc26f0c80)
> at ../../../kern/subr_sleepqueue.c:363
>#20 0xc06184e1 in msleep (ident=0xc26f0c80, mtx=0xc2785cac, priority=360,
> wmesg=0xc081471e "kserel", timo=127) at ../../../kern/kern_synch.c:208
>#21 0xc05ffb6f in kse_release (td=0xc27867d0, uap=0xef1b1d14)
> at ../../../kern/kern_kse.c:419
>#22 0xc07afbdb in syscall (frame=
> {tf_fs = 176750639, tf_es = 137363503, tf_ds = -1079443409, tf_edi =
>137379840, tf_esi = 0, tf_ebp = 137400260, tf_isp = -283435660, tf_ebx =
>674489788, tf_edx = 137372544, tf_ecx = 0, tf_eax = 383, tf_trapno = 0,
>tf_err = 2, tf_eip = 674474523, tf_cs = 31, tf_eflags = 518, tf_esp =
>137400200, tf_ss = 47})
>---Type <return> to continue, or q <return> to quit---
> at ../../../i386/i386/trap.c:1001
>#23 0xc079d24f in Xint0x80_syscall () at
>../../../i386/i386/exception.s:201
>
>It looks like kgdb is somehow confused regarding kern_link.c. kgdb won't
>let me walk up the stack because it complains about a corrupted frame. I
>can jump directly to it, however:
>
>(kgdb) frame 11
>#11 0xc0622c07 in setrunqueue (td=0xc27867d0, flags=3) at
>kern_switch.c:419
>419 sched_add(td2, flags);
>(kgdb) inspect *td
>$1 = {td_proc = 0xc2785c40, td_ksegrp = 0xc26f0c40, td_plist = {
> tqe_next = 0xc2a93af0, tqe_prev = 0xc2785c50}, td_kglist = {
> tqe_next = 0xc2a93af0, tqe_prev = 0xc26f0c4c}, td_slpq = {tqe_next =
>0x0,
> tqe_prev = 0xc2a93338}, td_lockq = {tqe_next = 0x0,
> tqe_prev = 0xef2d2c44}, td_runq = {tqe_next = 0x0,
> tqe_prev = 0xc26f0c54}, td_selq = {tqh_first = 0x0, tqh_last = 0x0},
> td_sleepqueue = 0x0, td_turnstile = 0xc2960c00, td_tid = 100105,
> td_flags = 16842760, td_inhibitors = 0, td_pflags = 392, td_dupfd = 0,
> td_wchan = 0xc26f0c80, td_wmesg = 0xc081471e "kserel", td_lastcpu = 0
>'\0',
> td_oncpu = 255 'ÿ', td_locks = 0, td_blocked = 0x0, td_ithd = 0x0,
> td_lockname = 0x0, td_contested = {lh_first = 0x0}, td_sleeplocks = 0x0,
> td_intr_nesting_level = 0, td_pinned = 0, td_mailbox = 0x0,
> td_ucred = 0xc2a7be00, td_standin = 0xc3d28af0, td_prticks = 0,
> td_upcall = 0xc2a92000, td_sticks = 138, td_uuticks = 0, td_usticks = 0,
> td_intrval = 0, td_oldsigmask = {__bits = {0, 0, 0, 0}}, td_sigmask = {
> __bits = {4294901503, 4294967295, 4294967295, 4294967295}}, td_siglist
>= {
> __bits = {0, 0, 0, 0}}, td_waitset = 0x0, td_umtx = {tqe_next = 0x0,
> tqe_prev = 0x0}, td_generation = 73879, td_sigstk = {ss_sp = 0x0,
> ss_size = 0, ss_flags = 0}, td_kflags = 1, td_xsig = 0,
> td_profil_addr = 0, td_profil_ticks = 0, td_base_pri = 104 'h',
> td_priority = 104 'h', td_pcb = 0xef1b1da0, td_state = TDS_RUNQ,
> td_retval = {0, 137372544}, td_slpcallout = {c_links = {sle = {
> sle_next = 0x0}, tqe = {tqe_next = 0x0, tqe_prev = 0xd62cf3e8}},
> c_time = 6666649, c_arg = 0xc27867d0,
> c_func = 0xc062f79c <sleepq_timeout>, c_flags = 14},
> td_frame = 0xef1b1d48, td_kstack_obj = 0xc274e084, td_kstack = 4011524096,
> td_kstack_pages = 2, td_altkstack_obj = 0x0, td_altkstack = 0,
> td_altkstack_pages = 0, td_critnest = 2, td_md = {md_savecrit = 582},
> td_sched = 0xc2786924}
>
>_______________________________________________
>freebsd-current@freebsd.org mailing list
>http://lists.freebsd.org/mailman/listinfo/freebsd-current
>To unsubscribe, send any mail to "freebsd-current-unsubscribe@freebsd.org"
>
>
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?41488150.8050605>