On 15.08.10 18:22:04, Benjamin Herrenschmidt wrote:
quoted text
> > >From 4435322debc38097e9e863e14597ab3f78814d14 Mon Sep 17 00:00:00 2001
> > From: Robert Richter <robert.richter@amd.com>
> > Date: Fri, 13 Aug 2010 16:29:04 +0200
> > Subject: [PATCH] oprofile: fix crash when accessing freed task structs
> > 
> > This patch fixes a crash during shutdown reported below. The crash is
> > caused be accessing already freed task structs. The fix changes the
> > order for registering and unregistering notifier callbacks.
> > 
> > All notifiers must be initialized before buffers start working. To
> > stop buffer synchronization we cancel all workqueues, unregister the
> > notifier callback and then flush all buffers. After all of this we
> > finally can free all tasks listed.
> > 
> > This should avoid accessing freed tasks.
> > 
> > On 22.07.10 01:14:40, Benjamin Herrenschmidt wrote:
> > 
> > > So the initial observation is a spinlock bad magic followed by a crash
> > > in the spinlock debug code:
> > >
> > > [ 1541.586531] BUG: spinlock bad magic on CPU#5, events/5/136
> > > [ 1541.597564] Unable to handle kernel paging request for data at address 0x6b6b6b6b6b6b6d03
> > >
> > > Backtrace looks like:
> > >
> > >       spin_bug+0x74/0xd4
> > >       ._raw_spin_lock+0x48/0x184
> > >       ._spin_lock+0x10/0x24
> > >       .get_task_mm+0x28/0x8c
> > >       .sync_buffer+0x1b4/0x598
> > >       .wq_sync_buffer+0xa0/0xdc
> > >       .worker_thread+0x1d8/0x2a8
> > >       .kthread+0xa8/0xb4
> > >       .kernel_thread+0x54/0x70
> > >
> > > So we are accessing a freed task struct in the work queue when
> > > processing the samples.
> > 
> > Reported-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
> > Signed-off-by: Robert Richter <robert.richter@amd.com>

I have applied the patch to

 git://git.kernel.org/pub/scm/linux/kernel/git/rric/oprofile.git urgent

-Robert

-- 
Advanced Micro Devices, Inc.
Operating System Research Center

--
unsubscribe notice
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/