Re: Possible NULL pointer deref in sched_add() via maybe_preempt() and kse_release()

From: Robert Watson <rwatson_at_FreeBSD.org>
Date: Wed, 15 Sep 2004 12:42:13 -0400 (EDT)
On Wed, 15 Sep 2004, Robert Watson wrote:

>  Fatal trap 12: page fault while in kernel mode
> cpuid = 0; apic id = 00
> fault virtual address   = 0x150
> fault code              = supervisor read, page not present
> instruction pointer     = 0x8:0xc06224de
> stack pointer           = 0x10:0xef1b1b28
> frame pointer           = 0x10:0xef1b1b38
> code segment            = base 0x0, limit 0xfffff, type 0x1b
>                         = DPL 0, pres 1, def32 1, gran 1
> processor eflags        = resume, IOPL = 0
> current process         = 572 (mysqld)

Here's what kgdb has to say about it:

(kgdb) bt
#0  doadump () at pcpu.h:159
#1  0xc045fb46 in db_fncall (dummy1=0, dummy2=0, dummy3=-283436652, 
    dummy4=0xef1b197c "°\031\033ï\200%") at ../../../ddb/db_command.c:531
#2  0xc045f954 in db_command (last_cmdp=0xc08b3444, cmd_table=0x0, 
    aux_cmd_tablep=0xc0833e58, aux_cmd_tablep_end=0xc0833e74)
    at ../../../ddb/db_command.c:349
#3  0xc045fa1c in db_command_loop () at ../../../ddb/db_command.c:455
#4  0xc0461595 in db_trap (type=12, code=0) at ../../../ddb/db_main.c:221
#5  0xc0629a6b in kdb_trap (type=12, code=0, tf=0x1)
    at ../../../kern/subr_kdb.c:418
#6  0xc07af89d in trap_fatal (frame=0xef1b1ae8, eva=336)
    at ../../../i386/i386/trap.c:804
#7  0xc07aefc5 in trap (frame=
      {tf_fs = -283443176, tf_es = -1067319280, tf_ds = -1032323056,
tf_edi = 3, tf_esi = 0, tf_ebp = -283436232, tf_isp = -283436268, tf_ebx =
-1032909760, tf_edx = 0, tf_ecx = 0, tf_eax = -1032909672, tf_trapno = 12,
tf_err = 0, tf_eip = -1067309858, tf_cs = 8, tf_eflags = 65670, tf_esp =
0, tf_ss = -1032909760}) at ../../../i386/i386/trap.c:247
#8  0xc079d1fa in calltrap () at ../../../i386/i386/exception.s:140
#9  0xef1b0018 in ?? ()
#10 0xc0620010 in link_elf_preload_parse_symbols (ef=0xc26f0c40)
    at ../../../kern/link_elf.c:348
#11 0xc0622c07 in setrunqueue (td=0xc27867d0, flags=3) at
kern_switch.c:419
---Type <return> to continue, or q <return> to quit--- 
#12 0xc06222ce in sched_switch (td=0xc27867d0, newtd=0xc2a93af0, flags=2)
    at ../../../kern/sched_4bsd.c:822
#13 0xc0618882 in mi_switch (flags=2, newtd=0xc2a93af0)
    at ../../../kern/kern_synch.c:340
#14 0xc0622d93 in maybe_preempt (td=0xc2a93af0) at kern_switch.c:544
#15 0xc06225cb in sched_add (td=0xc2a93af0, flags=0)
    at ../../../kern/sched_4bsd.c:1021
#16 0xc0622c07 in setrunqueue (td=0xc2a93af0, flags=0) at
kern_switch.c:419
#17 0xc0631bd3 in turnstile_unpend (ts=0x0)
    at ../../../kern/subr_turnstile.c:739
#18 0xc060950c in _mtx_unlock_sleep (m=0xc2785cac, opts=0, file=0x0,
line=0)
    at ../../../kern/kern_mutex.c:673
#19 0xc062efdc in sleepq_catch_signals (wchan=0xc26f0c80)
    at ../../../kern/subr_sleepqueue.c:363
#20 0xc06184e1 in msleep (ident=0xc26f0c80, mtx=0xc2785cac, priority=360, 
    wmesg=0xc081471e "kserel", timo=127) at ../../../kern/kern_synch.c:208
#21 0xc05ffb6f in kse_release (td=0xc27867d0, uap=0xef1b1d14)
    at ../../../kern/kern_kse.c:419
#22 0xc07afbdb in syscall (frame=
      {tf_fs = 176750639, tf_es = 137363503, tf_ds = -1079443409, tf_edi =
137379840, tf_esi = 0, tf_ebp = 137400260, tf_isp = -283435660, tf_ebx =
674489788, tf_edx = 137372544, tf_ecx = 0, tf_eax = 383, tf_trapno = 0,
tf_err = 2, tf_eip = 674474523, tf_cs = 31, tf_eflags = 518, tf_esp =
137400200, tf_ss = 47})
---Type <return> to continue, or q <return> to quit---
    at ../../../i386/i386/trap.c:1001
#23 0xc079d24f in Xint0x80_syscall () at
../../../i386/i386/exception.s:201

It looks like kgdb is somehow confused regarding kern_link.c.  kgdb won't
let me walk up the stack because it complains about a corrupted frame.  I
can jump directly to it, however:

(kgdb) frame 11
#11 0xc0622c07 in setrunqueue (td=0xc27867d0, flags=3) at
kern_switch.c:419
419                     sched_add(td2, flags);
(kgdb) inspect *td
$1 = {td_proc = 0xc2785c40, td_ksegrp = 0xc26f0c40, td_plist = {
    tqe_next = 0xc2a93af0, tqe_prev = 0xc2785c50}, td_kglist = {
    tqe_next = 0xc2a93af0, tqe_prev = 0xc26f0c4c}, td_slpq = {tqe_next =
0x0, 
    tqe_prev = 0xc2a93338}, td_lockq = {tqe_next = 0x0, 
    tqe_prev = 0xef2d2c44}, td_runq = {tqe_next = 0x0, 
    tqe_prev = 0xc26f0c54}, td_selq = {tqh_first = 0x0, tqh_last = 0x0}, 
  td_sleepqueue = 0x0, td_turnstile = 0xc2960c00, td_tid = 100105, 
  td_flags = 16842760, td_inhibitors = 0, td_pflags = 392, td_dupfd = 0, 
  td_wchan = 0xc26f0c80, td_wmesg = 0xc081471e "kserel", td_lastcpu = 0
'\0', 
  td_oncpu = 255 'ÿ', td_locks = 0, td_blocked = 0x0, td_ithd = 0x0, 
  td_lockname = 0x0, td_contested = {lh_first = 0x0}, td_sleeplocks = 0x0, 
  td_intr_nesting_level = 0, td_pinned = 0, td_mailbox = 0x0, 
  td_ucred = 0xc2a7be00, td_standin = 0xc3d28af0, td_prticks = 0, 
  td_upcall = 0xc2a92000, td_sticks = 138, td_uuticks = 0, td_usticks = 0, 
  td_intrval = 0, td_oldsigmask = {__bits = {0, 0, 0, 0}}, td_sigmask = {
    __bits = {4294901503, 4294967295, 4294967295, 4294967295}}, td_siglist
= {
    __bits = {0, 0, 0, 0}}, td_waitset = 0x0, td_umtx = {tqe_next = 0x0, 
    tqe_prev = 0x0}, td_generation = 73879, td_sigstk = {ss_sp = 0x0, 
    ss_size = 0, ss_flags = 0}, td_kflags = 1, td_xsig = 0, 
  td_profil_addr = 0, td_profil_ticks = 0, td_base_pri = 104 'h', 
  td_priority = 104 'h', td_pcb = 0xef1b1da0, td_state = TDS_RUNQ, 
  td_retval = {0, 137372544}, td_slpcallout = {c_links = {sle = {
        sle_next = 0x0}, tqe = {tqe_next = 0x0, tqe_prev = 0xd62cf3e8}}, 
    c_time = 6666649, c_arg = 0xc27867d0, 
    c_func = 0xc062f79c <sleepq_timeout>, c_flags = 14}, 
  td_frame = 0xef1b1d48, td_kstack_obj = 0xc274e084, td_kstack = 4011524096, 
  td_kstack_pages = 2, td_altkstack_obj = 0x0, td_altkstack = 0, 
  td_altkstack_pages = 0, td_critnest = 2, td_md = {md_savecrit = 582}, 
  td_sched = 0xc2786924}
Received on Wed Sep 15 2004 - 14:42:35 UTC

This archive was generated by hypermail 2.4.0 : Wed May 19 2021 - 11:38:12 UTC