From owner-freebsd-hackers@FreeBSD.ORG Wed Jul 14 15:48:51 2004 Return-Path: Delivered-To: freebsd-hackers@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 78E2416A4CE; Wed, 14 Jul 2004 15:48:51 +0000 (GMT) Received: from grosbein.pp.ru (grgw.svzserv.kemerovo.su [213.184.64.130]) by mx1.FreeBSD.org (Postfix) with ESMTP id 696DA43D2D; Wed, 14 Jul 2004 15:48:43 +0000 (GMT) (envelope-from eugen@grosbein.pp.ru) Received: from grosbein.pp.ru (eugen@localhost [127.0.0.1]) by grosbein.pp.ru (8.12.11/8.12.11) with ESMTP id i6EFmeTb000624; Wed, 14 Jul 2004 23:48:40 +0800 (KRAST) (envelope-from eugen@grosbein.pp.ru) Received: (from eugen@localhost) by grosbein.pp.ru (8.12.11/8.12.11/Submit) id i6EFmeb7000623; Wed, 14 Jul 2004 23:48:40 +0800 (KRAST) (envelope-from eugen) Date: Wed, 14 Jul 2004 23:48:40 +0800 (KRAST) Message-Id: <200407141548.i6EFmeb7000623@grosbein.pp.ru> To: FreeBSD-gnats-submit@freebsd.org From: Eugene Grosbein X-send-pr-version: 3.113 X-GNATS-Notify: cc: hackers@freebsd.org Subject: kernel reads unmapped memory while unloading modules X-BeenThere: freebsd-hackers@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list Reply-To: Eugene Grosbein List-Id: Technical Discussions relating to FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 14 Jul 2004 15:48:51 -0000 >Submitter-Id: current-users >Originator: Eugene Grosbein >Organization: Svyaz Service JSC >Confidential: no >Synopsis: kernel reads unmapped memory while unloading modules >Severity: serious >Priority: low >Category: kern >Class: sw-bug >Release: FreeBSD 4.10-STABLE i386 >Environment: System: FreeBSD grosbein.pp.ru 4.10-STABLE FreeBSD 4.10-STABLE #11: Wed Jul 14 22:10:30 KRAST 2004 eu@grosbein.pp.ru:/usr/local/obj/usr/local/src/sys/DADV i386 >Description: Page fault while in kernel mode occures after kldload snd.ko/kldunload snd.ko regardless of presence of audio hardware. The same panic occures for custom kernel and for GENERIC, for Pentium notebook and for Celeron-900E desktop, with Yamaha OPL3-SA2, with Crystal Sound CS4232 or without any sound card. >How-To-Repeat: Boot a kernel without device pcm into single or multiuser mode, kldload /modules/snd.ko, kldunload snd.ko and get kernel panic. Single mode was used to simplify things. A patch for src/sys/kern/kern_linker.c,1.41.2.3 was used to obtain detailed debug printfs: --- kern_linker.c.orig Tue Jul 13 22:20:11 2004 +++ kern_linker.c Wed Jul 14 22:06:25 2004 @@ -27,6 +27,7 @@ */ #include "opt_ddb.h" +#define KLD_DEBUG #include #include @@ -47,7 +48,7 @@ #include #ifdef KLD_DEBUG -int kld_debug = 0; +int kld_debug = 1; #endif MALLOC_DEFINE(M_LINKER, "kld", "kernel linker"); @@ -180,6 +181,7 @@ * Since some things care about execution order, this is the * operation which ensures continued function. */ + KLD_DPF(FILE, ("linker_file_sysuninit: ls_items=%p\n", sysuninits->ls_items)); for (sipp = (struct sysinit **)sysuninits->ls_items; *sipp; sipp++) { for (xipp = sipp + 1; *xipp; xipp++) { if ((*sipp)->subsystem > (*xipp)->subsystem || @@ -202,6 +204,7 @@ continue; /* skip dummy task(s)*/ /* Call function */ + KLD_DPF(FILE, ("linker_file_sysuninit: calling function %p, address stored at %p", (*sipp)->func,&((*sipp)->func))); (*((*sipp)->func))((*sipp)->udata); } } Here is a script of debug session made using serial console, 0xc1f5bb8c is a value of (*sipp)->func in the last loop of function linker_file_sysuninit() that triggers panic and 0xc200530c is an address of variable (*sipp)->func itself. Default: 1:ad(1,a)/boot/loader boot: -h Console: serial port BIOS drive A: is disk0 BIOS drive C: is disk1 BIOS drive D: is disk2 BIOS 639kB/523200kB available memory FreeBSD/i386 bootstrap loader, Revision 0.8 (eu@grosbein.pp.ru, Tue Jul 6 02:01:55 KRAST 2004) Hit [Enter] to boot immediately, or any other key for command prompt. Booting [kernel] in 1 second... Type '?' for a list of commands, 'help' for more detailed help. ok boot -s Copyright (c) 1992-2004 The FreeBSD Project. Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994 The Regents of the University of California. All rights reserved. FreeBSD 4.10-STABLE #11: Wed Jul 14 22:10:30 KRAST 2004 eu@grosbein.pp.ru:/usr/local/obj/usr/local/src/sys/DADV Timecounter "i8254" frequency 1193168 Hz CPU: Intel Celeron (902.03-MHz 686-class CPU) Origin = "GenuineIntel" Id = 0x68a Stepping = 10 Features=0x383f9ff real memory = 536805376 (524224K bytes) config> flags atkbd 0x0 config> quit sio0: gdb debugging port avail memory = 518860800 (506700K bytes) linker_make_file: new file, filename=kernel Preloaded elf kernel "kernel" at 0xc036a000. Preloaded userconfig_script "/boot/kernel.conf" at 0xc036a0a8. VESA: v2.0, 65536k memory, flags:0x1, mode table:0xc03023a2 (1000022) VESA: ATI RADEON 9200 Pentium Pro MTRR support enabled Using $PIR table, 8 entries at 0xc00fdef0 apm0: on motherboard apm0: found APM BIOS v1.2, connected at v1.2 npx0: on motherboard npx0: INT 16 interface pcib0: on motherboard pci0: on pcib0 agp0: mem 0xe8000000-0xebffffff at device 0.0 on pci0 pcib1: at device 1.0 on pci0 pci1: on pcib1 pci1: at 0.0 irq 11 pci1: at 0.1 isab0: at device 7.0 on pci0 isa0: on isab0 atapci0: port 0xf000-0xf00f at device 7.1 on pci0 ata0: at 0x1f0 irq 14 on atapci0 ata1: at 0x170 irq 15 on atapci0 uhci0: port 0xe000-0xe01f irq 10 at device 7.2 on pci0 usb0: on uhci0 usb0: USB revision 1.0 uhub0: Intel UHCI root hub, class 9/0, rev 1.00/1.00, addr 1 uhub0: 2 ports with 2 removable, self powered uscanner0: Hewlett-Packard HP ScanJet 2200C, rev 1.10/1.00, addr 2 uhid0: American Power Conversion Back-UPS 500 FW: 6.5.I USB FW: c1, rev 1.10/1.00, addr 3, iclass 3/0 intpm0: port 0x5000-0x500f irq 9 at device 7.3 on pci0 intpm0: I/O mapped 5000 intpm0: intr IRQ 9 enabled revision 0 smbus0: on intsmb0 smb0: on smbus0 intpm0: PM I/O mapped 4000 fxp0: port 0xe400-0xe41f mem 0xef000000-0xef0fffff,0xef100000-0xef100fff irq 9 at device 16.0 on pci0 fxp0: Ethernet address 00:a0:c9:89:95:1f inphy0: on miibus0 inphy0: 10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, auto orm0: