lkml.org 
[lkml]   [2017]   [Sep]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectRe: [lkp-robot] [blk] 47e0fb461f: BUG:unable_to_handle_kernel
On Thu, Sep 21, 2017 at 12:02 AM, NeilBrown <neilb@suse.com> wrote:
>
> I think it is crashing in
> static inline bool ata_is_host_link(const struct ata_link *link)
> {
> return link == &link->ap->link || link == link->ap->slave_link;
> }

Yes. The code is

1a: 8b 3a mov (%edx),%edi
1c: 8d 8f 40 16 00 00 lea 0x1640(%edi),%ecx
22: 39 ca cmp %ecx,%edx
24: 74 49 je 0x6f
26: b9 01 00 00 00 mov $0x1,%ecx
2b:* 39 97 80 24 00 00 cmp %edx,0x2480(%edi) <-- trapping instruction
31: 74 3c je 0x6f

and that first "je" is the test for "link == &link->ap->link" (which
only takes the address relative to "link->ap" - thus the "lea"), and
that cmp that oopses is indeed loading that actual slave_link value.

So I agree. "link->ap" is NULL for some odd reason.

Hmm. Absolutely nothing has changed in libata-core.c recently,
certainly not that async_port_probe() thing.

So I suspect either it's just a timing difference, or it's some
unrelated memory corruption.

Xiaolong, I see that you have SLUB_DEBUG and SLUB_DEBUG_ON enabled,
but wonder if you can recreate this with DEBUG_PAGEALLOC and/or
DEBUG_OBJECTS enabled too?

Tejun, any ideas? The original report is at

https://lkml.org/lkml/2017/9/20/939

in case you don't see it in your inbox from lkml.

Linus

\
 
 \ /
  Last update: 2017-09-30 22:21    [W:0.145 / U:2.296 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site