2.6.32内核下使用system v 信号量导致内核crash？

anotherbug

在linux下测试一个程序，跑一段时候就发现内核crash，相关crash信息如下：

Nov 18 17:30:17 host kernel: BUG: unable to handle kernel paging request at 0000000000001000
Nov 18 17:30:17 host kernel: IP: [<ffffffff811dc2f4>] sys_semctl+0x64a/0x910
Nov 18 17:30:17 host kernel: PGD 71b2c067 PUD 748ee067 PMD 0
Nov 18 17:30:17 host kernel: Oops: 0000 [#1] SMP
Nov 18 17:30:17 host kernel: last sysfs file: /sys/devices/pci0000:00/0000:00:14.4/0000:02:04.0/msi_irqs
Nov 18 17:30:17 host kernel: CPU 0
Nov 18 17:30:17 host kernel: Modules linked in: autofs4(U) hidp(U) rfcomm(U) l2cap(U) bluetooth(U) rfkill(U) lockd(U) sunrpc(U) cpufreq_ondemand(U) powernow_k8(U) freq_table(U) nf_conntrack_ftp(U) nf_conntrack_netbios_ns(U) ipt_REJECT(U) nf_conntrack_ipv4(U) nf_defrag_ipv4(U) xt_state(U) nf_conntrack(U) iptable_filter(U) ip_tables(U) ip6t_REJECT(U) xt_tcpudp(U) ip6table_filter(U) ip6_tables(U) x_tables(U) be2iscsi(U) ib_iser(U) rdma_cm(U) ib_cm(U) iw_cm(U) ib_sa(U) ib_mad(U) ib_core(U) ib_addr(U) iscsi_tcp(U) bnx2i(U) cnic(U) uio(U) ipv6(U) cxgb3i(U) libcxgbi(U) cxgb3(U) mdio(U) libiscsi_tcp(U) libiscsi(U) scsi_transport_iscsi(U) video(U) output(U) sbs(U) sbshc(U) lp(U) snd_hda_codec_realtek(U) snd_hda_intel(U) snd_hda_codec(U) snd_hwdep(U) snd_seq_dummy(U) snd_seq_oss(U) radeon(U) snd_seq_midi_event(U) ttm(U) snd_seq(U) drm_kms_helper(U) snd_seq_device(U) drm(U) i2c_algo_bit(U) snd_pcm_oss(U) snd_mixer_oss(U) serio_raw(U) snd_pcm(U) 8139too(U) 8139cp(U) mii(U) snd_timer(U) snd(U) soundcore(U) k8temp(U) parpo
Nov 18 17:30:17 host kernel: t_pc(U) pata_atiixp(U) snd_page_alloc(U) pcspkr(U) parport(U) pata_acpi(U) edac_core(U) i2c_piix4(U) i2c_core(U) ata_generic(U) shpchp(U) ahci(U) uhci_hcd(U) ohci_hcd(U) ehci_hcd(U)
Nov 18 17:30:17 host kernel: Pid: 6605, comm: query_process Not tainted 2.6.32-100.26.2.el5 #1 RS690M2MA
Nov 18 17:30:17 host kernel: RIP: 0010:[<ffffffff811dc2f4>]  [<ffffffff811dc2f4>] sys_semctl+0x64a/0x910
Nov 18 17:30:17 host kernel: RSP: 0018:ffff880071b13c98  EFLAGS: 00010246
Nov 18 17:30:17 host kernel: RAX: 0000000000000800 RBX: 0000000000010001 RCX: 0000000000001000
Nov 18 17:30:17 host kernel: RDX: 0000000000001000 RSI: 0000000000000001 RDI: 0000000000001000
Nov 18 17:30:17 host kernel: RBP: ffff880071b13f78 R08: 0000000000001000 R09: ffff88006619c8a0
Nov 18 17:30:17 host kernel: R10: 000000000041547c R11: 0000000000000202 R12: ffff88006619c810
Nov 18 17:30:17 host kernel: R13: ffff88006619c8a0 R14: 000000000000000e R15: 0000000000000004
Nov 18 17:30:17 host kernel: FS:  00007f0c6b0426f0(0000) GS:ffff880002400000(0000) knlGS:0000000000000000
Nov 18 17:30:17 host kernel: CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
Nov 18 17:30:17 host kernel: CR2: 0000000000001000 CR3: 0000000057a06000 CR4: 00000000000006f0
Nov 18 17:30:17 host kernel: DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
Nov 18 17:30:17 host kernel: DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Nov 18 17:30:17 host kernel: Process query_process (pid: 6605, threadinfo ffff880071b12000, task ffff8800722905c0)
Nov 18 17:30:17 host kernel: Stack:
Nov 18 17:30:17 host kernel:  000019cd71b13ca8 000000000041547c 0000000171b13d3e 0000001100000000
Nov 18 17:30:17 host kernel: <0> ffff880071b13cd8 0000000000000001 ffff880071b13cd8 ffffffff811db253
Nov 18 17:30:17 host kernel: <0> ffff880071b13f68 ffffffff811dce0d ffff880071b13f30 ffff880031874800
Nov 18 17:30:17 host kernel: Call Trace:
Nov 18 17:30:17 host kernel:  [<ffffffff811db253>] ? sem_putref+0xe/0x10
Nov 18 17:30:17 host kernel:  [<ffffffff811dce0d>] ? sys_semtimedop+0x79c/0x7e7
Nov 18 17:30:17 host kernel:  [<ffffffff81121c68>] ? path_to_nameidata+0x1b/0x3e
Nov 18 17:30:17 host kernel:  [<ffffffff81124a13>] ? __link_path_walk+0x5e5/0x5fb
Nov 18 17:30:17 host kernel:  [<ffffffff81131524>] ? mntput_no_expire+0x22/0xa7
Nov 18 17:30:17 host kernel:  [<ffffffff8112340c>] ? putname+0x33/0x38
Nov 18 17:30:17 host kernel:  [<ffffffff811255ca>] ? user_path_at+0x62/0x91
Nov 18 17:30:17 host kernel:  [<ffffffff81043ee2>] ? __dequeue_entity+0x33/0x38
Nov 18 17:30:17 host kernel:  [<ffffffff81010f3e>] ? __switch_to+0x110/0x1e6
Nov 18 17:30:17 host kernel:  [<ffffffff8104a3a4>] ? finish_task_switch+0x48/0xab
Nov 18 17:30:17 host kernel:  [<ffffffff81121cdb>] ? path_put+0x22/0x27
Nov 18 17:30:17 host kernel:  [<ffffffff810a7ffa>] ? audit_syscall_entry+0x103/0x12f
Nov 18 17:30:17 host kernel:  [<ffffffff81011db2>] system_call_fastpath+0x16/0x1b
Nov 18 17:30:17 host kernel: Code: 22 66 39 32 75 17 66 83 7a 02 00 79 10 0f bf 42 04 25 00 08 00 00 83 f8 01 41 83 d7 00 ff c1 48 83 c2 06 44 39 c1 7c d9 48 89 fa <48> 8b 3a 49 8d 41 10 48 39 c2 0f 18 0f 75 bb e9 8d 02 00 00 8b
Nov 18 17:30:17 host kernel: RIP  [<ffffffff811dc2f4>] sys_semctl+0x64a/0x910
Nov 18 17:30:17 host kernel:  RSP <ffff880071b13c98>
Nov 18 17:30:17 host kernel: CR2: 0000000000001000
Nov 18 17:30:17 host kernel: ---[ end trace 961c2315e5a93db9 ]---
Nov 18 17:30:17 host kernel: Kernel panic - not syncing: Fatal exception
Nov 18 17:30:17 host kernel: Pid: 6605, comm: query_process Tainted: G      D    2.6.32-100.26.2.el5 #1
Nov 18 17:30:17 host kernel: Call Trace:
Nov 18 17:30:17 host kernel:  [<ffffffff81056ada>] panic+0xa5/0x162
Nov 18 17:30:17 host kernel:  [<ffffffff810128ae>] ? apic_timer_interrupt+0xe/0x20
Nov 18 17:30:17 host kernel:  [<ffffffff810567a7>] ? print_oops_end_marker+0x23/0x25
Nov 18 17:30:17 host kernel:  [<ffffffff8143aca6>] oops_end+0xb7/0xc7
Nov 18 17:30:17 host kernel:  [<ffffffff8103670a>] no_context+0x1f1/0x200
Nov 18 17:30:17 host kernel:  [<ffffffff8103695d>] __bad_area_nosemaphore+0x183/0x1a6
Nov 18 17:30:17 host kernel:  [<ffffffff81044227>] ? __enqueue_entity+0x79/0x7b
Nov 18 17:30:17 host kernel:  [<ffffffff810369c4>] __bad_area+0x44/0x4d
Nov 18 17:30:17 host kernel:  [<ffffffff810369f5>] bad_area+0x13/0x15
Nov 18 17:30:17 host kernel:  [<ffffffff8143c19c>] do_page_fault+0x1c6/0x299
Nov 18 17:30:17 host kernel:  [<ffffffff8143a1b5>] page_fault+0x25/0x30
Nov 18 17:30:17 host kernel:  [<ffffffff811dc2f4>] ? sys_semctl+0x64a/0x910
Nov 18 17:30:17 host kernel:  [<ffffffff811dbf8f>] ? sys_semctl+0x2e5/0x910
Nov 18 17:30:17 host kernel:  [<ffffffff811db253>] ? sem_putref+0xe/0x10
Nov 18 17:30:17 host kernel:  [<ffffffff811dce0d>] ? sys_semtimedop+0x79c/0x7e7
Nov 18 17:30:17 host kernel:  [<ffffffff81121c68>] ? path_to_nameidata+0x1b/0x3e
Nov 18 17:30:17 host kernel:  [<ffffffff81124a13>] ? __link_path_walk+0x5e5/0x5fb
Nov 18 17:30:17 host kernel:  [<ffffffff81131524>] ? mntput_no_expire+0x22/0xa7
Nov 18 17:30:17 host kernel:  [<ffffffff8112340c>] ? putname+0x33/0x38
Nov 18 17:30:17 host kernel:  [<ffffffff811255ca>] ? user_path_at+0x62/0x91
Nov 18 17:30:17 host kernel:  [<ffffffff81043ee2>] ? __dequeue_entity+0x33/0x38
Nov 18 17:30:17 host kernel:  [<ffffffff81010f3e>] ? __switch_to+0x110/0x1e6
Nov 18 17:30:17 host kernel:  [<ffffffff8104a3a4>] ? finish_task_switch+0x48/0xab
Nov 18 17:30:17 host kernel:  [<ffffffff81121cdb>] ? path_put+0x22/0x27
Nov 18 17:30:17 host kernel:  [<ffffffff810a7ffa>] ? audit_syscall_entry+0x103/0x12f

内核版本如下：
$ uname -a
Linux host.fish 2.6.32-100.26.2.el5 #1 SMP Tue Jan 18 20:11:49 EST 2011 x86_64 x86_64 x86_64 GNU/Linux

请各位帮忙分析分析，该程序是从hp-ux 和aix上移植过来的，本身应该没什么问题，就算有问题，也只将程序core掉？

ruslin

0000000000001000
应该在内核态访问这个地址时出现了缺页异常，然后就oops了。看看这个地址怎么来的，是不是那边没有初始化好什么的

anotherbug

多谢楼上回复～