crash in 1.3.32 (a.out)

Gonzalo Tornaria (gtornari@varela.reu.edu.uy)
Mon, 9 Oct 95 18:09:27 URU

I had a crash with 1.3.32 (a.out). I got *hundreds* of Oops at light
speed, no VC switching, nothing worked at all.. After a while it
stoped, and I could copy this: (last 60 lines or so, no VC
scrollback neither), it starts with the Call Trace of the previous
Oops, but it's only the same 13 addresses of the other Oops repeated
(I could see 10+ lines)

It seems like there is a NULL dereference in del_timer, that is
called from die_if_kernel, so it loops...
May be the circular timer_list got a NULL timer?

System is 386Dx/25 4Mb, minimal kernel: only math emulation, ide,
sysvipc, ext2 and proc. floppy, isofs, sbpcd, lp and sound were
insmod'ed. Ask me if you need more info.

Back to 1.3.24, it's preety stable.
Had problems with 1.3.29 too (not to mention 1.3.27 ;-).. And 1.3.23
crash sometimes when I "quit" gdb with a running process (I can
reproduce this crash), but is solved in 1.3.24 so I think you know
this one (I mention it just in case)...

Of course this is not a complain, just a bug report :-)

Gonzalo

---
 
       [ The same 13 addresses repeated a lot ]
       0010fff1 0010fdc6 0010fdcc 0010a77b 00150018 001108c4 00114e45 0010accf
       0010aa25 01000000 00800000 0010fff1 0010fdc6 0010fdcc 0010a77b 00150018
       001108c4
Code: 8b 00 3d a0 ad 16 00 75 cb 83 39 00 75 06 83 79 04 00 74 0d
Unable to handle kernel paging request at virtual address c7200720
current->tss.cr3 = 0041b000, %cr3 = 0041b000
*pde = 00000000
Oops: 0000
CPU:    0
EIP:    0010:001108c4
EFLAGS: 00010016
eax: 07200720   ebx: 00000002   ecx: 003da954   edx: 00261810
esi: 00000014   edi: 002ae000   ebp: 002acf9c   esp: 002acf98
ds: 0018   es: 0018   fs: 002b   gs: 002b   ss: 0018
Corrupted stack page
Process crond (pid: 45, process nr: 4, stackpage=002d2000)
Stack: 0000000b 002ad004 00114e45 003da954 00010016 0010accf 0000000b 0010aa25
       00000000 c7200720 00170000 002ad004 0000000d 01000000 00800000 00100018
       0010fff1 0010fdc6 002ad004 00170000 0010fdcc 00000014 002ae000 002ad044
Call Trace: 00114e45 0010accf 0010aa25 01000000 00800000 0010fff1 0010fdc6
       0010fdcc 0010a77b
Code: 8b 00 3d a0 ad 16 00 75 cb 83 39 00 75 06 83 79 04 00 74 0d
Unable to handle kernel NULL pointer dereference at virtual address c0000000
current->tss.cr3 = 0041b000, %cr3 = 0041b000
*pde = 00102067
*pte = 00000027
Oops: 0000
CPU:    0
EIP:    0010:001108c4
EFLAGS: 00010097
eax: 00000000   ebx: 00000002   ecx: 003da954   edx: 00261810
esi: 00000014   edi: 002ad000   ebp: 002acef4   esp: 002acef0
ds: 0018   es: 0018   fs: 002b   gs: 002b   ss: 0018
Corrupted stack page
Process crond (pid: 45, process nr: 4, stackpage=002d2000)
Stack: 0000000b 002acf5c 00114e45 003da954 002ad004 0010accf 0000000b 0010aa25
       00000000 c7200720 00170000 002acf5c 0000000d 01000000 00800000 00100018
       0010fff1 0010fdc6 002acf5c 00170000 0010fdcc 00000014 002ae000 002acf9c
Call Trace: 00114e45 0010accf 0010aa25 01000000 00800000 0010fff1 0010fdc6
       0010fdcc 0010a77b 00150018 001108c4 00114e45 0010accf 0010aa25 01000000
       00800000 0010fff1 0010fdc6 0010fdcc 0010a77b
Code: 8b 00 3d a0 ad 16 00 75 cb 83 39 00 75 06 83 79 04 00 74 0d
 
>>EIP: 1108c4 <_del_timer+44/70>
Trace: 114e45 <_do_exit+41/c8>
Trace: 10accf <_die_if_kernel+2a7/2c0>
Trace: 10aa25 <_page_fault+165/168>
Trace: 1000000
Trace: 800000
Trace: 10fff1 <_do_page_fault+225/294>
Trace: 10fdc6 <_si_meminfo+1aa/1b0>
Trace: 10fff1 <_do_page_fault+225/294>
Trace: 10a77b <error_code+4b/60>
Trace: 150018 <_n_tty_set_termios+a4/214>
Trace: 1108c4 <_del_timer+44/70>
Trace: 114e45 <_do_exit+41/c8>
Trace: 10accf <_die_if_kernel+2a7/2c0>
Trace: 10aa25 <_page_fault+165/168>
Trace: 1000000
Trace: 800000
Trace: 10fff1 <_do_page_fault+225/294>
Trace: 10fdc6 <_si_meminfo+1aa/1b0>
Trace: 10fff1 <_do_page_fault+225/294>
Trace: 10a77b <error_code+4b/60>
 
Code: 1108c4 <_del_timer+44/70> movl   (%eax),%eax
Code: 1108c6 <_del_timer+46/70> cmpl   $0x16ada0,%eax
Code: 1108cb <_del_timer+4b/70> jne    ffffffd4 <gcc2_compiled.+ffffffd4>
Code: 1108cd <_del_timer+4d/70> cmpl   $0x0,(%ecx)
Code: 1108d0 <_del_timer+50/70> jne    1108d8 <_del_timer+58/70>
Code: 1108d2 <_del_timer+52/70> cmpl   $0x0,0x4(%ecx)
Code: 1108d6 <_del_timer+56/70> je     1108e5 <_del_timer+65/70>