Re: [ring_buffer_entries] BUG: unable to handle kernel NULL pointerdereference at (null)

[Steven Rostedt]

On Wed, 2013-05-29 at 22:13 +0800, Fengguang Wu wrote:
> Hi Rostedt,
> 
> I got the below BUG and the first bad commit could be any of:
> 
> ce9bae55972b228cf7bac34350c4d2caf8ea0d0b
> 121aaee7b0a82605d33af200c7e9ebab6fd6e444
> 737223fbca3b1c91feb947c7f571b35749b743b6
> 45ad21ca5530efdca6a19e4a5ac5e7bd6e24f996
> a695cb5816228f86576f5f5c6809fdf8ed382ece
> 6de58e6269cd0568ca5fbae14423914eff0f7811
> ad909e21bbe69f1d39055d346540abd827190eca
> 0b85ffc293044393623059eda9904a7d5b644e36
> f5eb5588262cab7232ed1d77cf612b327db50767
> f1affcaaa861f27752a769f889bf1486ebd301fe
> f4e781c0a89d5810729772290441ac7d61f321ec
> 12883efb670c28dff57dcd7f4f995a1ffe153b2d
> 55034cd6e648155393b0d665eef76b38d49ad6bf
> 153e8ed913b022d2003866a848af9fadc041403f
> 
> We cannot bisect more due to broken builds.

No need to bisect. The bug is pretty obvious:

$ grep trace_test_buffer kernel/trace/trace_selftest.c
static int trace_test_buffer_cpu(struct trace_buffer *buf, int cpu)
static int trace_test_buffer(struct trace_buffer *buf, unsigned long
*count)
         * The trace_test_buffer_cpu runs a while loop to consume all
data.
                ret = trace_test_buffer_cpu(buf, cpu);
        ret = trace_test_buffer(&tr->trace_buffer, &count);
        ret = trace_test_buffer(&tr->trace_buffer, &count);
        ret = trace_test_buffer(&tr->trace_buffer, &count);
        ret = trace_test_buffer(&tr->trace_buffer, &count);
        ret = trace_test_buffer(&tr->trace_buffer, NULL);
                ret = trace_test_buffer(&tr->max_buffer, &count);
        ret = trace_test_buffer(&tr->trace_buffer, NULL);
                ret = trace_test_buffer(&tr->max_buffer, &count);
        ret = trace_test_buffer(&tr->trace_buffer, NULL);
        ret = trace_test_buffer(&tr->max_buffer, &count);
        ret = trace_test_buffer(&tr->trace_buffer, NULL);
        ret = trace_test_buffer(&tr->max_buffer, &count);
        ret = trace_test_buffer(&tr->trace_buffer, NULL);
                ret = trace_test_buffer(&tr->max_buffer, &count);
        ret = trace_test_buffer(&tr->trace_buffer, &count);
        ret = trace_test_buffer(tr, &count);


Notice that all but the last one passes in &tr->trace_buffer or
&tr->max_buffer. That last one happens to be in:
trace_selftest_startup_branch()

Thanks!

-- Steve


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/