oops in nfs_wback_result 2.2.3

Godmar Back (gback@cs.utah.edu)
Wed, 17 Mar 1999 17:12:03 -0700 (MST)


I got this oops while accessing a FreeBSD NFS server.

Mar 17 16:27:48 peerless kernel: Unable to handle kernel NULL pointer dereference at virtual address 00000008
Mar 17 16:27:48 peerless kernel: current->tss.cr3 = 00101000, pr3 = 00101000
Mar 17 16:27:48 peerless kernel: *pde = 00000000
Mar 17 16:27:48 peerless kernel: Oops: 0000
Mar 17 16:27:48 peerless kernel: CPU: 0
Mar 17 16:27:48 peerless kernel: EIP: 0010:[<c014cc2a>]
Mar 17 16:27:48 peerless kernel: EFLAGS: 00010286
Mar 17 16:27:48 peerless kernel: eax: c014cc08 ebx: c435fc80 ecx: c435fc88 edx: 00000000
Mar 17 16:27:48 peerless kernel: esi: 00000000 edi: 00000001 ebp: c4fe1ec4 esp: c4741f98
Mar 17 16:27:48 peerless kernel: ds: 0018 es: 0018 ss: 0018
Mar 17 16:27:48 peerless kernel: Process rpciod (pid: 332, process nr: 27, stackpage=c4741000)
Mar 17 16:27:48 peerless kernel: Stack: 00000001 00000000 c0314848 c017f930 c435fc88 c435fc88 00000000 00000000
Mar 17 16:27:48 peerless kernel: 00000001 c017fa25 c435fc88 00000001 c435fc88 00000001 00000000 c4740000
Mar 17 16:27:48 peerless kernel: c020191c c018010d 00000100 c47a9e2c c42e4f76 c4742000 c01075b7 c020191c
Mar 17 16:27:48 peerless kernel: Call Trace: [<c017f930>] [<c017fa25>] [<c018010d>] [<c01075b7>]
Mar 17 16:27:48 peerless kernel: Code: 8b 7a 08 f6 05 60 1a 20 c0 08 74 2a 0f b7 83 94 00 00 00 50
Warning: trailing garbage ignored on Code: line
Text: 'Code: 8b 7a 08 f6 05 60 1a 20 c0 08 74 2a 0f b7 83 94 00 00 00 50 '
Garbage: ' '

>>EIP: c014cc2a <nfs_wback_result+22/188>
Trace: c017f930 <__rpc_execute+1a8/1b4>
Trace: c017fa25 <__rpc_schedule+89/cc>
Trace: c018010d <rpciod+115/20c>
Trace: c01075b7 <kernel_thread+23/30>
Code: c014cc2a <nfs_wback_result+22/188> 00000000 <_EIP>:
Code: c014cc2a <nfs_wback_result+22/188> 0: 8b 7a 08 movl 0x8(%edx),%edi
Code: c014cc2d <nfs_wback_result+25/188> 3: f6 05 60 1a 20 testb $0x8,0xc0201a60
Code: c014cc32 <nfs_wback_result+2a/188> 8: c0 08
Code: c014cc34 <nfs_wback_result+2c/188> a: 74 2a je 36 <_EIP+0x36> c014cc60 <nfs_wback_result+58/188>
Code: c014cc36 <nfs_wback_result+2e/188> c: 0f b7 83 94 00 movzwl 0x94(%ebx),%eax
Code: c014cc3b <nfs_wback_result+33/188> 11: 00 00
Code: c014cc3d <nfs_wback_result+35/188> 13: 50 pushl %eax

4 warnings issued. Results may not be reliable.

>From my reading of the code:

/*
* 2. Collect the result
*/
static void
nfs_wback_result(struct rpc_task *task)
{
struct nfs_wreq *req = (struct nfs_wreq *) task->tk_calldata;
struct file *file = req->wb_file;
struct page *page = req->wb_page;
int status = task->tk_status;
struct dentry *dentry = file->f_dentry;
struct inode *inode = dentry->d_inode;
...
}

which is compiled to:

nfs_wback_result:
subl $4,%esp
pushl %ebp
pushl %edi
pushl %esi
pushl %ebx
movl 24(%esp),%ecx
movl 72(%ecx),%ebx
movl 116(%ebx),%ebp
movl 120(%ebx),%ecx
movl %ecx,16(%esp)
movl 24(%esp),%ecx
movl 32(%ecx),%esi
movl 8(%ebp),%edx
movl 8(%edx),%edi <- oops b/c %edx == 0
testb $8,nfs_debug
je .L2044
movzwl 148(%ebx),%eax
pushl %eax

I'd guess that task->tk_calldata was null?

Anyway, what happened next was:
Mar 17 16:28:03 peerless kernel: nfs: task 33087 can't get a request slot
Mar 17 16:28:04 peerless kernel: nfs: task 33095 can't get a request slot
Mar 17 16:29:58 peerless kernel: nfs: task 33493 can't get a request slot
Mar 17 16:30:16 peerless kernel: nfs: task 33497 can't get a request slot

Then I tried to reboot, but it got stuck with:

NFS: Arghhh, stuck RPC requests!\n

So I reset it.

Hope that information is useful.

- Godmar

More random information:
[root@peerless nfs]# cat /proc/modules
ntfs 33880 2 (autoclean)
opl3 10248 1
cs4232 2264 1
uart401 5644 1 [cs4232]
ad1848 15180 1 [cs4232]
sound 55656 0 [opl3 cs4232 uart401 ad1848]
soundcore 2260 5 [sound]
[root@peerless nfs]# cat /proc/cpuinfo
processor : 0
vendor_id : GenuineIntel
cpu family : 6
model : 5
model name : Pentium II (Deschutes)
stepping : 1
cpu MHz : 350.801384
cache size : 512 KB
fdiv_bug : no
hlt_bug : no
sep_bug : no
f00f_bug : no
fpu : yes
fpu_exception : yes
cpuid level : 2
wp : yes
flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 mmx osfxsr
bogomips : 350.62

processor : 1
vendor_id : GenuineIntel
cpu family : 6
model : 5
model name : Pentium II (Deschutes)
stepping : 1
cpu MHz : 350.801384
cache size : 512 KB
fdiv_bug : no
hlt_bug : no
sep_bug : no
f00f_bug : no
fpu : yes
fpu_exception : yes
cpuid level : 2
wp : yes
flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 mmx osfxsr
bogomips : 349.80

[root@peerless nfs]# cat /proc/version
Linux version 2.2.3 (root@peerless.cs.utah.edu) (gcc version 2.7.2.3) #4 SMP Wed Mar 10 10:28:25 MST 1999

- Godmar

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/