Date: Sat, 19 Jun 2004 13:58:53 +0200 From: Simon Barner <barner@in.tum.de> To: Bruce Evans <bde@zeta.org.au> Cc: current@freebsd.org Subject: Re: Bogus signal handler causes kernel panic (5.2.1-p8/i386) Message-ID: <20040619115853.GA904@zi025.glhnet.mhn.de> In-Reply-To: <20040619152924.F3372@gamplex.bde.org> References: <20040616105706.GC1140@zi025.glhnet.mhn.de> <20040617134101.V1345@gamplex.bde.org> <20040618134944.GC1049@zi025.glhnet.mhn.de> <20040619152924.F3372@gamplex.bde.org>
next in thread | previous in thread | raw e-mail | index | archive | help
--jy6Sn24JjFx/iggw
Content-Type: multipart/mixed; boundary="LyciRD1jyfeSSjG0"
Content-Disposition: inline
--LyciRD1jyfeSSjG0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
Hi,
I'll call that one patch3.
> Index: machdep.c
> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
> RCS file: /home/ncvs/src/sys/i386/i386/machdep.c,v
> retrieving revision 1.590
> diff -u -2 -r1.590 machdep.c
> --- machdep.c 11 Jun 2004 11:16:22 -0000 1.590
> +++ machdep.c 19 Jun 2004 05:27:18 -0000
> @@ -1134,4 +1134,7 @@
> }
>=20
> + /* XXX drop the FP state correctly, unlike in the next 3 statements. */
> + fpstate_drop(td);
> +
> /*
> * Initialize the math emulator (if any) for the current process.
> %%%
I was not sure whether to back out patch2 (against npx.c) before
applying patch3, so I tried both combinations.
Unfortunately, I have to refer you to the attached stack traces once
again :(
Anyway, thanks a lot for your time and effort!
Simon
--LyciRD1jyfeSSjG0
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: attachment; filename="panic-patch2+3.log"
Content-Transfer-Encoding: quoted-printable
Copyright 2002 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain condition=
s.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB. Type "show warranty" for details.
This GDB was configured as "i386-unknown-freebsd"...
panic: arithmetic trap
panic messages:
---
Fatal trap 6: arithmetic trap while in kernel mode
instruction pointer =3D 0x8:0xc061671a
stack pointer =3D 0x10:0xcc43d9e4
frame pointer =3D 0x10:0xcc43d9e4
code segment =3D base 0x0, limit 0xfffff, type 0x1b
=3D DPL 0, pres 1, def32 1, gran 1
processor eflags =3D resume, IOPL =3D 0
current process =3D 694 (a.out)
trap number =3D 6
panic: arithmetic trap
syncing disks, buffers remaining... 800 800 800 800 800 800 800 800 800 800=
800 800 800 800 800 800 800 800 800 800=20
giving up on 589 buffers
Uptime: 1m16s
Dumping 192 MB
16 32 48 64 80 96 112 128 144 160 176
---
Reading symbols from /usr/src/sys/i386/compile/KISTE/modules/usr/src/sys/mo=
dules/fdescfs/fdescfs.ko.debug...done.
Loaded symbols for /usr/src/sys/i386/compile/KISTE/modules/usr/src/sys/modu=
les/fdescfs/fdescfs.ko.debug
Reading symbols from /boot/kernel/green_saver.ko...done.
Loaded symbols for /boot/kernel/green_saver.ko
#0 doadump () at ../../../kern/kern_shutdown.c:240
240 dumping++;
(kgdb) bt
#0 doadump () at ../../../kern/kern_shutdown.c:240
#1 0xc04f0cbb in boot (howto=3D256) at ../../../kern/kern_shutdown.c:372
#2 0xc04f0f91 in panic () at ../../../kern/kern_shutdown.c:550
#3 0xc0611f70 in trap_fatal (frame=3D0xcc43d9a4, eva=3D0)
at ../../../i386/i386/trap.c:821
#4 0xc0611abc in trap (frame=3D
{tf_fs =3D 24, tf_es =3D 16, tf_ds =3D 16, tf_edi =3D 0, tf_esi =3D -=
1034840832, tf_ebp =3D -867968540, tf_isp =3D -867968560, tf_ebx =3D 514, t=
f_edx =3D -1034840832, tf_ecx =3D -867968368, tf_eax =3D -867968368, tf_tra=
pno =3D 6, tf_err =3D 0, tf_eip =3D -1067358438, tf_cs =3D 8, tf_eflags =3D=
65606, tf_esp =3D -867968524, tf_ss =3D -1067358516})
at ../../../i386/i386/trap.c:618
#5 0xc0605998 in calltrap () at {standard input}:94
#6 0xc06166cc in npxsetregs (td=3D0x0, addr=3D0x0) at ../../../i386/isa/np=
x.c:963
#7 0xc060bd73 in set_fpcontext (td=3D0xc2519500, mcp=3D0x0)
at ../../../i386/i386/machdep.c:2532
#8 0xc060a76a in sigreturn (td=3D0xc2519500, uap=3D0x0)
at ../../../i386/i386/machdep.c:982
#9 0xc0612253 in syscall (frame=3D
{tf_fs =3D 47, tf_es =3D 47, tf_ds =3D 47, tf_edi =3D -1077940888, tf=
_esi =3D -1077940880, tf_ebp =3D -1077940960, tf_isp =3D -867967628, tf_ebx=
=3D 1, tf_edx =3D 672409248, tf_ecx =3D 13, tf_eax =3D 417, tf_trapno =3D =
22, tf_err =3D 2, tf_eip =3D -1077936211, tf_cs =3D 31, tf_eflags =3D 582, =
tf_esp =3D -1077941832, tf_ss =3D 47})
at ../../../i386/i386/trap.c:1010
#10 0xc06059ed in Xint0x80_syscall () at {standard input}:136
---Can't read userspace from dump, or kernel process---
(kgdb) bt full
#0 doadump () at ../../../kern/kern_shutdown.c:240
No locals.
#1 0xc04f0cbb in boot (howto=3D256) at ../../../kern/kern_shutdown.c:372
No locals.
#2 0xc04f0f91 in panic () at ../../../kern/kern_shutdown.c:550
td =3D (struct thread *) 0xc2519500
bootopt =3D 256
newpanic =3D 0
ap =3D 0xcc43d94c "g\001e=C0"
buf =3D "arithmetic trap", '\0' <repeats 240 times>
#3 0xc0611f70 in trap_fatal (frame=3D0xcc43d9a4, eva=3D0)
at ../../../i386/i386/trap.c:821
code =3D 16
type =3D 6
ss =3D 16
esp =3D 0
softseg =3D {ssd_base =3D 0, ssd_limit =3D 1048575, ssd_type =3D 27,=20
ssd_dpl =3D 0, ssd_p =3D 1, ssd_xx =3D 5, ssd_xx1 =3D 1, ssd_def32 =3D 1,=
ssd_gran =3D 1}
#4 0xc0611abc in trap (frame=3D
{tf_fs =3D 24, tf_es =3D 16, tf_ds =3D 16, tf_edi =3D 0, tf_esi =3D -=
1034840832, tf_ebp =3D -867968540, tf_isp =3D -867968560, tf_ebx =3D 514, t=
f_edx =3D -1034840832, tf_ecx =3D -867968368, tf_eax =3D -867968368, tf_tra=
pno =3D 6, tf_err =3D 0, tf_eip =3D -1067358438, tf_cs =3D 8, tf_eflags =3D=
65606, tf_esp =3D -867968524, tf_ss =3D -1067358516})
at ../../../i386/i386/trap.c:618
---Type <return> to continue, or q <return> to quit---
td =3D (struct thread *) 0xc2519500
p =3D (struct proc *) 0xc251854c
sticks =3D 3260122444
i =3D 0
ucode =3D 0
type =3D 6
code =3D 0
eva =3D 0
#5 0xc0605998 in calltrap () at {standard input}:94
No locals.
#6 0xc06166cc in npxsetregs (td=3D0x0, addr=3D0x0) at ../../../i386/isa/np=
x.c:963
s =3D 514
#7 0xc060bd73 in set_fpcontext (td=3D0xc2519500, mcp=3D0x0)
at ../../../i386/i386/machdep.c:2532
addr =3D (union savefpu *) 0xcc43da90
#8 0xc060a76a in sigreturn (td=3D0xc2519500, uap=3D0x0)
at ../../../i386/i386/machdep.c:982
uc =3D {uc_sigmask =3D {__bits =3D {0, 0, 0, 0}}, uc_mcontext =3D {
mc_onstack =3D 0, mc_gs =3D 47, mc_fs =3D 47, mc_es =3D 47, mc_ds =3D 4=
7,=20
mc_edi =3D -1077940888, mc_esi =3D -1077940880, mc_ebp =3D -1077940960,=
=20
mc_isp =3D -867967628, mc_ebx =3D 1, mc_edx =3D 672409248, mc_ecx =3D 1=
3,=20
mc_eax =3D 1, mc_trapno =3D 12, mc_err =3D 2, mc_eip =3D 671874187, mc_=
cs =3D 31,=20
mc_eflags =3D 662, mc_esp =3D -1077941012, mc_ss =3D 47, mc_len =3D 640=
,=20
mc_fpformat =3D 65537, mc_ownedfp =3D 131074, mc_spare1 =3D {0}, mc_fps=
tate =3D {
---Type <return> to continue, or q <return> to quit---
-60801, -65536, -1, 0, 0, 0, -65536, 0, 0, 0, 0, 0, 0, 0, 0, 0,=20
1072726020, 0, -2147483648, 16355, 0, 1071874048, 40544256, -30851378=
,=20
1744846849, -1351024913, 1072994650, 0 <repeats 101 times>},=20
mc_spare2 =3D {0, 0, 0, 0, 0, 0, 0, 0}}, uc_link =3D 0x0, uc_stack =3D {
ss_sp =3D 0x0, ss_size =3D 0, ss_flags =3D 4}, uc_flags =3D 0, __spare_=
_ =3D {0, 0,=20
0, 0}}
p =3D (struct proc *) 0xc251854c
regs =3D (struct trapframe *) 0xcc43dd48
cs =3D 0
eflags =3D 662
error =3D 0
ret =3D 0
#9 0xc0612253 in syscall (frame=3D
{tf_fs =3D 47, tf_es =3D 47, tf_ds =3D 47, tf_edi =3D -1077940888, tf=
_esi =3D -1077940880, tf_ebp =3D -1077940960, tf_isp =3D -867967628, tf_ebx=
=3D 1, tf_edx =3D 672409248, tf_ecx =3D 13, tf_eax =3D 417, tf_trapno =3D =
22, tf_err =3D 2, tf_eip =3D -1077936211, tf_cs =3D 31, tf_eflags =3D 582, =
tf_esp =3D -1077941832, tf_ss =3D 47})
at ../../../i386/i386/trap.c:1010
params =3D 0xbfbfe9bc---Can't read userspace from dump, or kernel process-=
--
--LyciRD1jyfeSSjG0
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: attachment; filename="panic-patch3.log"
Content-Transfer-Encoding: quoted-printable
Copyright 2002 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain condition=
s.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB. Type "show warranty" for details.
This GDB was configured as "i386-unknown-freebsd"...
panic: arithmetic trap
panic messages:
---
Fatal trap 6: arithmetic trap while in kernel mode
instruction pointer =3D 0x8:0xc061671a
stack pointer =3D 0x10:0xcbd139e4
frame pointer =3D 0x10:0xcbd139e4
code segment =3D base 0x0, limit 0xfffff, type 0x1b
=3D DPL 0, pres 1, def32 1, gran 1
processor eflags =3D resume, IOPL =3D 0
current process =3D 655 (a.out)
trap number =3D 6
panic: arithmetic trap
syncing disks, buffers remaining... 818 818 817 817 817 817 817 817 817 817=
817 817 817 817 817 817 817 817 817 817 817 817=20
giving up on 598 buffers
Uptime: 1m12s
Dumping 192 MB
16 32 48 64 80 96 112 128 144 160 176
---
Reading symbols from /usr/src/sys/i386/compile/KISTE/modules/usr/src/sys/mo=
dules/fdescfs/fdescfs.ko.debug...done.
Loaded symbols for /usr/src/sys/i386/compile/KISTE/modules/usr/src/sys/modu=
les/fdescfs/fdescfs.ko.debug
Reading symbols from /boot/kernel/green_saver.ko...done.
Loaded symbols for /boot/kernel/green_saver.ko
#0 doadump () at ../../../kern/kern_shutdown.c:240
240 dumping++;
(kgdb) bt
#0 doadump () at ../../../kern/kern_shutdown.c:240
#1 0xc04f0cbb in boot (howto=3D256) at ../../../kern/kern_shutdown.c:372
#2 0xc04f0f91 in panic () at ../../../kern/kern_shutdown.c:550
#3 0xc0611f70 in trap_fatal (frame=3D0xcbd139a4, eva=3D0)
at ../../../i386/i386/trap.c:821
#4 0xc0611abc in trap (frame=3D
{tf_fs =3D 24, tf_es =3D 16, tf_ds =3D 16, tf_edi =3D 0, tf_esi =3D -=
1036587584, tf_ebp =3D -875480604, tf_isp =3D -875480624, tf_ebx =3D 514, t=
f_edx =3D -1036587584, tf_ecx =3D -875480432, tf_eax =3D -875480432, tf_tra=
pno =3D 6, tf_err =3D 0, tf_eip =3D -1067358438, tf_cs =3D 8, tf_eflags =3D=
65606, tf_esp =3D -875480588, tf_ss =3D -1067358516})
at ../../../i386/i386/trap.c:618
#5 0xc0605998 in calltrap () at {standard input}:94
#6 0xc06166cc in npxsetregs (td=3D0x0, addr=3D0x0) at ../../../i386/isa/np=
x.c:954
#7 0xc060bd73 in set_fpcontext (td=3D0xc236edc0, mcp=3D0x0)
at ../../../i386/i386/machdep.c:2532
#8 0xc060a76a in sigreturn (td=3D0xc236edc0, uap=3D0x0)
at ../../../i386/i386/machdep.c:982
#9 0xc0612253 in syscall (frame=3D
{tf_fs =3D 47, tf_es =3D 47, tf_ds =3D 47, tf_edi =3D -1077940888, tf=
_esi =3D -1077940880, tf_ebp =3D -1077940960, tf_isp =3D -875479692, tf_ebx=
=3D 1, tf_edx =3D 672409248, tf_ecx =3D 13, tf_eax =3D 417, tf_trapno =3D =
22, tf_err =3D 2, tf_eip =3D -1077936211, tf_cs =3D 31, tf_eflags =3D 582, =
tf_esp =3D -1077941832, tf_ss =3D 47})
at ../../../i386/i386/trap.c:1010
#10 0xc06059ed in Xint0x80_syscall () at {standard input}:136
---Can't read userspace from dump, or kernel process---
(kgdb) bt full
#0 doadump () at ../../../kern/kern_shutdown.c:240
No locals.
#1 0xc04f0cbb in boot (howto=3D256) at ../../../kern/kern_shutdown.c:372
No locals.
#2 0xc04f0f91 in panic () at ../../../kern/kern_shutdown.c:550
td =3D (struct thread *) 0xc236edc0
bootopt =3D 256
newpanic =3D 0
ap =3D 0xcbd1394c "g\001e=C0"
buf =3D "arithmetic trap", '\0' <repeats 240 times>
#3 0xc0611f70 in trap_fatal (frame=3D0xcbd139a4, eva=3D0)
at ../../../i386/i386/trap.c:821
code =3D 16
type =3D 6
ss =3D 16
esp =3D 0
softseg =3D {ssd_base =3D 0, ssd_limit =3D 1048575, ssd_type =3D 27,=20
ssd_dpl =3D 0, ssd_p =3D 1, ssd_xx =3D 0, ssd_xx1 =3D 0, ssd_def32 =3D 1,=
ssd_gran =3D 1}
#4 0xc0611abc in trap (frame=3D
{tf_fs =3D 24, tf_es =3D 16, tf_ds =3D 16, tf_edi =3D 0, tf_esi =3D -=
1036587584, tf_ebp =3D -875480604, tf_isp =3D -875480624, tf_ebx =3D 514, t=
f_edx =3D -1036587584, tf_ecx =3D -875480432, tf_eax =3D -875480432, tf_tra=
pno =3D 6, tf_err =3D 0, tf_eip =3D -1067358438, tf_cs =3D 8, tf_eflags =3D=
65606, tf_esp =3D -875480588, tf_ss =3D -1067358516})
at ../../../i386/i386/trap.c:618
---Type <return> to continue, or q <return> to quit---
td =3D (struct thread *) 0xc236edc0
p =3D (struct proc *) 0xc2523000
sticks =3D 3260166144
i =3D 0
ucode =3D 0
type =3D 6
code =3D 0
eva =3D 0
#5 0xc0605998 in calltrap () at {standard input}:94
No locals.
#6 0xc06166cc in npxsetregs (td=3D0x0, addr=3D0x0) at ../../../i386/isa/np=
x.c:954
s =3D 514
#7 0xc060bd73 in set_fpcontext (td=3D0xc236edc0, mcp=3D0x0)
at ../../../i386/i386/machdep.c:2532
addr =3D (union savefpu *) 0xcbd13a90
#8 0xc060a76a in sigreturn (td=3D0xc236edc0, uap=3D0x0)
at ../../../i386/i386/machdep.c:982
uc =3D {uc_sigmask =3D {__bits =3D {0, 0, 0, 0}}, uc_mcontext =3D {
mc_onstack =3D 0, mc_gs =3D 47, mc_fs =3D 47, mc_es =3D 47, mc_ds =3D 4=
7,=20
mc_edi =3D -1077940888, mc_esi =3D -1077940880, mc_ebp =3D -1077940960,=
=20
mc_isp =3D -875479692, mc_ebx =3D 1, mc_edx =3D 672409248, mc_ecx =3D 1=
3,=20
mc_eax =3D 1, mc_trapno =3D 12, mc_err =3D 2, mc_eip =3D 671874187, mc_=
cs =3D 31,=20
mc_eflags =3D 662, mc_esp =3D -1077941012, mc_ss =3D 47, mc_len =3D 640=
,=20
mc_fpformat =3D 65537, mc_ownedfp =3D 131074, mc_spare1 =3D {0}, mc_fps=
tate =3D {
---Type <return> to continue, or q <return> to quit---
-60801, -65536, -1, 0, 0, 0, -65536, 0, 0, 0, 0, 0, 0, 0, 0, 0,=20
1072726020, 0, -2147483648, 16355, 0, 1071874048, 177295360, -2650967=
6,=20
-805289983, 1914524621, 1072946227, 0 <repeats 101 times>}, mc_spare2=
=3D {
0, 0, 0, 0, 0, 0, 0, 0}}, uc_link =3D 0x0, uc_stack =3D {ss_sp =3D 0x=
0,=20
ss_size =3D 0, ss_flags =3D 4}, uc_flags =3D 0, __spare__ =3D {0, 0, 0,=
0}}
p =3D (struct proc *) 0xc2523000
regs =3D (struct trapframe *) 0xcbd13d48
cs =3D 0
eflags =3D 662
error =3D 0
ret =3D 0
#9 0xc0612253 in syscall (frame=3D
{tf_fs =3D 47, tf_es =3D 47, tf_ds =3D 47, tf_edi =3D -1077940888, tf=
_esi =3D -1077940880, tf_ebp =3D -1077940960, tf_isp =3D -875479692, tf_ebx=
=3D 1, tf_edx =3D 672409248, tf_ecx =3D 13, tf_eax =3D 417, tf_trapno =3D =
22, tf_err =3D 2, tf_eip =3D -1077936211, tf_cs =3D 31, tf_eflags =3D 582, =
tf_esp =3D -1077941832, tf_ss =3D 47})
at ../../../i386/i386/trap.c:1010
params =3D 0xbfbfe9bc---Can't read userspace from dump, or kernel process-=
--
--LyciRD1jyfeSSjG0--
--jy6Sn24JjFx/iggw
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature
Content-Disposition: inline
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (FreeBSD)
iD8DBQFA1Cp9Ckn+/eutqCoRAiCAAJ9haF7uis2ySYtJKZtayFm2bCsJIgCfd8Qp
uAW5algOfqbL4fYsxiHj0tQ=
=/E2U
-----END PGP SIGNATURE-----
--jy6Sn24JjFx/iggw--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20040619115853.GA904>