[BUG] n_tty: 4.0-rc3+: Unable to handle kernel paging request at virtual address 000044d0

[Peter Hurley]

[ +cc Will Deacon, linux-arm ]

Hi Ming,

On 03/13/2015 02:02 AM, Ming Lei wrote:
> Hi Guys,
> 
> Just found the following oops during kernel booting when I
> test the latest linus tree on one arm64 VM booted from uefi
> plus grub2:

Thanks for the bug report.

This looks like a compiler bug when generating code for
smp_load_acquire() (see below); what compiler are you using?


> Unable to handle kernel paging request at virtual address 000044d0
> pgd = ffffffc0007fb000
> [000044d0] *pgd=0000000079407003, *pud=0000000079407003,
> *pmd=0000000079408003, *pte=0060000008004707
> Internal error: Oops: 94000005 [#1] PREEMPT SMP
> Modules linked in:
> CPU: 1 PID: 632 Comm: kworker/1:1 Not tainted 4.0.0-rc3+ #121
> Hardware name: linux,dummy-virt (DT)
> Workqueue: events flush_to_ldisc
> task: ffffffc0395eac00 ti: ffffffc038cb0000 task.ti: ffffffc038cb0000
> PC is at n_tty_receive_buf_common+0x60/0xa28
> LR is at n_tty_receive_buf_common+0x4c/0xa28
> pc : [<ffffffc000362490>] lr : [<ffffffc00036247c>] pstate: 20000145
> sp : ffffffc038cb3c70
> x29: ffffffc038cb3c70 x28: ffffffc0385ab400
> x27: ffffffc03ffe3380 x26: 0000000000000008
> x25: ffffffc0006a5260 x24: ffffffc0385b0e28
> x23: ffffffc038557340 x22: ffffffc0385ab400
> x21: ffffffc0385b0e08 x20: ffffffc0385b0e00
> x19: ffffffc03854c800 x18: 0000007fda9ad810
> x17: 0000007f8291ee7c x16: ffffffc000185540
> x15: 0000007f8298f590 x14: 0000007472617473
> x13: 2d65727000000009 x12: 0000000000000020
> x11: 000000000000002c x10: 0000007fb1e23360
> x9 : ffffffc038cb3d40 x8 : ffffffc00079cb10
> x7 : ffffffc000362e58 x6 : ffffffc03854c820
> x5 : 00000000000044d0 x4 : ffffff8000278000
> x3 : 000000000000002e x2 : 0000000000000000
> x1 : 0000000000000001 x0 : ffffffc00058f250
> 
> Process kworker/1:1 (pid: 632, stack limit = 0xffffffc038cb0028)
> Stack: (0xffffffc038cb3c70 to 0xffffffc038cb4000)
> 3c60:                                     38cb3d20 ffffffc0 00362e68 ffffffc0
> 3c80: 3854c800 ffffffc0 385b0e00 ffffffc0 385b0e08 ffffffc0 385ab400 ffffffc0
> 3ca0: 38557340 ffffffc0 385b0e28 ffffffc0 006a5260 ffffffc0 00000008 00000000
> 3cc0: 3ffe3380 ffffffc0 00000000 00000000 3946c200 ffffffc0 3946c268 ffffffc0
> 3ce0: 385ab4d8 ffffffc0 00000001 00000000 00278000 ffffff80 3854c820 ffffffc0
> 3d00: 00000000 00000000 0000002e ffffffc0 385b0e58 ffffffc0 0058f250 ffffffc0
> 3d20: 38cb3d30 ffffffc0 00365b68 ffffffc0 38cb3d80 ffffffc0 000b522c ffffffc0
> 3d40: 38b84540 ffffffc0 385b0e08 ffffffc0 3ffe3380 ffffffc0 3ffe7600 ffffffc0
> 3d60: 00000000 00000000 00000000 00000000 006a5260 ffffffc0 000b5220 ffffffc0
> 3d80: 38cb3dd0 ffffffc0 000b5974 ffffffc0 38b84540 ffffffc0 3ffe3398 ffffffc0
> 3da0: 3ffe3380 ffffffc0 38b84570 ffffffc0 007c641d ffffffc0 00000001 00000000
> 3dc0: 006a5260 ffffffc0 00000008 00000000 38cb3e30 ffffffc0 000ba900 ffffffc0
> 3de0: 38c7d8c0 ffffffc0 007cced0 ffffffc0 006a3ee8 ffffffc0 38b84540 ffffffc0
> 3e00: 000b5828 ffffffc0 00000000 00000000 00000000 00000000 00000000 00000000
> 3e20: 00000000 00000000 00000000 00000000 00000000 00000000 00085bf0 ffffffc0
> 3e40: 000ba828 ffffffc0 38c7d8c0 ffffffc0 00000000 00000000 00000000 00000000
> 3e60: 00000000 00000000 000c0fbc ffffffc0 000ba828 ffffffc0 00000000 00000000
> 3e80: 00000000 00000000 38b84540 ffffffc0 00000000 00000000 00000000 00000000
> 3ea0: 38cb3ea0 ffffffc0 38cb3ea0 ffffffc0 00000000 ffffffc0 00000000 ffffffc0
> 3ec0: 38cb3ec0 ffffffc0 38cb3ec0 ffffffc0 00000000 00000000 00000000 00000000
> 3ee0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
> 3f00: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
> 3f20: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
> 3f40: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
> 3f60: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
> 3f80: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
> 3fa0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
> 3fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000005 00000000
> 3fe0: 00000000 00000000 00000000 00000000 afafafaf afafafaf afafafaf afafafaf
> Call trace:
> [<ffffffc000362490>] n_tty_receive_buf_common+0x60/0xa28
> [<ffffffc000362e64>] n_tty_receive_buf2+0xc/0x18
> [<ffffffc000365b64>] flush_to_ldisc+0xec/0x140
> [<ffffffc0000b5228>] process_one_work+0x138/0x338
> [<ffffffc0000b5970>] worker_thread+0x148/0x420
> [<ffffffc0000ba8fc>] kthread+0xd4/0xf0
> Code: 91094000 f90057a0 d2844d05 8b0500a5 (c8dffca3)

This code disassembles as:

   0:   91094000        add     x0, x0, #0x250
   4:   f90057a0        str     x0, [x29,#168]
   8:   d2844d05        mov     x5, #0x2268                	// #8808
   c:   8b0500a5        add     x5, x5, x5
  10:   c8dffca3        ldar    x3, [x5]           <==== faulting insn

Using latest trusty gcc 4.8.2,

    $ make ARCH=arm64 CROSS_COMPILE=aarch64-linux-gnu- O=../build/arm64/ drivers/tty/n_tty.lst

generates the corresponding mixed listing for n_tty_receive_buf_common + 0x60
(...3660b4 + 0x60 = ...366114), which is PC advanced to the insn after faulting:

    ffffffc0003660b4 <n_tty_receive_buf_common>:
    ....
                 * paired with store in *_copy_from_read_buf() -- guarantees
                 * the consumer has loaded the data in read_buf up to the new
                 * read_tail (so this producer will not overwrite unread data)
                 */
                 size_t tail = smp_load_acquire(&ldata->read_tail);
    ffffffc000366108:       d2844d00        mov     x0, #0x2268                // #8808
    ffffffc00036610c:       8b170000        add     x0, x0, x23
    ffffffc000366110:       c8dffc03        ldar    x3, [x0]      <==== corresponding insn


Note that in the correctly generated machine code above, the ea in x0 is

   x0 = x23 + 0x2268

but in the your broken binary it's

   x5 = 0x2268 + 0x2268   // 0x44d0

Regards,
Peter Hurley