Oops求指点一下啊

xiranchen

<0>general protection fault: 0000 [#1] SMP
<0>last sysfs file: /sys/devices/system/cpu/cpu11/cache/index2/shared_cpu_map
<0>
<0>< < < < < < < < < < < < < Oops Reboot [cmostime: 1342784900: jiffies: 3267667] > > > > > > > > > >> > >
<1>Not found BSP_PrintDevTemperatureVoltage
<4>CPU 0
<4>Modules linked in:
<4>Supported: Yes, External
<6>Pid: 182, comm: XXX Server Tainted: P          NX 2.6.32.12-0.7-default #1 Thurley
<6>RIP: 0010:[<ffffffffa0d8fca6>]  [<ffffffffa0d8fca6>] XXXX_FreeList+0x86/0xd0 [XXXX]
<6>RSP: 0018:ffff880105d8fb80  EFLAGS: 00010286
<6>RAX: dead000000200200 RBX: dead000000100100 RCX: 0000000000027d00
<6>RDX: dead000000100100 RSI: ffffffffa0d95e40 RDI: ffff88006b0d1800
<6>RBP: ffff880105d8fba0 R08: 0000000000000282 R09: ffff880105d8fc44
<6>R10: 0000000000000040 R11: 0000000000000000 R12: ffff88006b28e820
<6>R13: ffff880105d8fd07 R14: ffff880105d8fd50 R15: ffffffffa0082598
<6>FS:  00007ffcc2a556f0(0000) GS:ffff880048e00000(0000) knlGS:0000000000000000
<6>CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
<6>CR2: 00007ff034051000 CR3: 0000000001804000 CR4: 00000000000006f0
<6>DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
<6>DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
<4>Process MML Server (pid: 182, threadinfo ffff880105d8e000, task ffff88006647a6c0)
<0>Stack:
<4> 0000000000000010 0000000000000283 ffff88006b28e800 ffff88006b28e820
<4><0> ffff880105d8fbd0 ffffffffa0d8fe09 ffffffffffffff26 ffffffffa0d81d1f
<4><0> ffff88010261c000 0000000000000007 ffff880105d8fc20 ffffffffa0d81d28

而XXXX_FreeList函数实现如下:
void XXXX_FreeList(struct list_head* pstDelList)
{
    DEV_STRUCT *pstErrRepDev = NULL;
    struct list_head *pstErrDevList = NULL;
    struct list_head *pstTempList = NULL;

     if (!list_empty(v_pstDelList))
    {
        list_for_each_safe(pstErrDevList, pstTempList, pstDelList)
        {
                pstErrRepDev = list_entry(pstErrDevList, DEV_STRUCT, bDevNode);
                if (NULL == pstErrRepDev)
                {
                        continue;
          }


                list_del(pstErrDevList);
                kfree(pstErrRepDev);
                pstErrRepDev = NULL;
        }
    }
}

请各位大侠指点一下，不胜感激。

xiranchen

if (!list_empty(v_pstDelList))
应该为：
if (!list_empty(pstDelList))

jiangsheng84

是不是挂在list_for_each_safe地方了？怎么解决的，我也遇到了。

jiangsheng84

你是不是pstDelList链表没加锁啊

帅绝人寰

你的代码风格太丑陋了，kernel实在受不了，就Oops了

jiangsheng84

你用spin_lock_irqsave把操作链表的地方都保护起来呢

testh

<6>RIP: 0010:[<ffffffffa0d8fca6>]  [<ffffffffa0d8fca6>] XXXX_FreeList+0x86/0xd0 [XXXX]
根据这句，你看看vmlinux中XXXX_FreeList的起始地址是多少，然后找到从起始地址便移0x86的地方的源码

nalinaly

我也挂了....

general protection fault: 0000 [#1] SMP
CPU 5
Modules linked in: vhost_net(N) edd(N) bridge(N)
Supported: Yes

Pid: 11224, comm: nn_r Tainted: G           N  3.0.13-0.27-qcy #6
RIP: 0010:[<ffffffff810422ee>]  [<ffffffff810422ee>] __wake_up_common+0x6e/0x90
RSP: 0018:ffff880615ec3b78  EFLAGS: 00010046
RAX: dead000000100100 RBX: dead0000001000e8 RCX: ffff880c1a86cc00
RDX: 0000000000000000 RSI: 0000000000000092 RDI: 0000000000000092
RBP: ffff880615ec3ba8 R08: ffff880c3fc31600 R09: 0000000000000000
R10: 0000000000000000 R11: ffffffff8104b480 R12: 0000000000000000
R13: 0000000000000001 R14: ffff880c1968e6c8 R15: 0000000000000304
FS:  00007f4b1f061700(0000) GS:ffff880c3fc20000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: 00007f822533cc14 CR3: 0000000615fb9000 CR4: 00000000000026e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process nn_r (pid: 11224, threadinfo ffff880615ec2000, task ffff880617f2e2c0)
Stack:
0000000100000001 0000000000000286 ffff880c1968e6c0 0000000000000001
0000000000000304 0000000000000001 ffff880615ec3be8 ffffffff8104718e
0000000000000202 ffff880c182c5ac0 ffff880c17

[<ffffffff8104718e>] __wake_up_sync_key+0x4e/0x90
[<ffffffff81417342>] unix_write_space+0x42/0x70
[<ffffffff8137be83>] sock_wfree+0x73/0x80
[<ffffffff81417440>] unix_destruct_scm+0xd0/0xe0
[<ffffffff8137e3d2>] skb_release_head_state+0x62/0x110
[<ffffffff8137e689>] skb_release_all+0x9/0x20
[<ffffffff8137e119>] __kfree_skb+0x9/0x90
[<ffffffff81382b8c>] skb_free_datagram+0xc/0x40
[<ffffffff8141886d>] unix_dgram_recvmsg+0x1ad/0x370
[<ffffffff81375191>] sock_aio_read+0x121/0x130
[<ffffffff81153030>] do_sync_read+0xc0/0x100
[<ffffffff811537b5>] vfs_read+0x125/0x130
[<ffffffff811538c3>] sys_read+0x53/0xa0
[<ffffffff8144e412>] system_call_fastpath+0x16/0x1b
[<00007f4b1ebccf00>] 0x7f4b1ebcceff

我的做法：
进程A 和 进程B 用unix_dgram connect，然后进程B把fd发给内核线程C
内核线程C 调用 sock_sendmsg 发送数据

然后进程A read 后 free skb，触发 unix_write_space ，然后挂在 __wake_up_common 的 list_for_each_entry_safe 里了。
整个 list_for_each_entry_safe 函数就一个 wait_queue_head_t 对象是传入的。

nalinaly

xiranchen 发表于 2012-08-06 17:30
general protection fault: 0000 [#1] SMP
last sysfs file: /sys/devices/system/cpu/cpu11/cache/index ...

我的已经解决了，RAX: dead000000200200 代表不可访问的地址
出现的情况：一个listA链入了 list_head B ， 然后再次被链入了 lish_head C

然后 从 list B 里del A ，这时list A 的pre 和 next的地址就会是以 dead 开头的，这时从C 访问A ，就出这个错误了。

因此：根由是 链表没保护好， 操作有误