LKML Archive on lore.kernel.org
help / color / mirror / Atom feed
* sched: divide error in sg_capacity_factor
@ 2015-03-09 17:46 Sasha Levin
  2015-03-10  4:29 ` Ingo Molnar
  0 siblings, 1 reply; 3+ messages in thread
From: Sasha Levin @ 2015-03-09 17:46 UTC (permalink / raw)
  To: Peter Zijlstra, Ingo Molnar; +Cc: Dave Jones, LKML, nicolas.pitre

Hi all,

While fuzzing with trinity inside the latest -next kernel using trinity I've stumbled on:

[  936.784266] divide error: 0000 [#1] PREEMPT SMP KASAN
[  936.789198] Dumping ftrace buffer:
[  936.793957]    (ftrace buffer empty)
[  936.793957] Modules linked in:
[  936.793957] CPU: 52 PID: 22110 Comm: trinity-c52 Tainted: G        W       4.0.0-rc1-sasha-00044-ge21109a #2039
[  936.793957] task: ffff8807ff293000 ti: ffff880f81fe8000 task.ti: ffff880f81fe8000
[  936.793957] RIP: find_busiest_group (kernel/sched/fair.c:6152 kernel/sched/fair.c:6223 kernel/sched/fair.c:6341 kernel/sched/fair.c:6603)
[  936.829403] RSP: 0000:ffff8810c28079a8  EFLAGS: 00010206
[  936.829403] RAX: 00000000000003ff RBX: 000000000000004e RCX: 0000000000002000
[  936.829403] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[  936.829403] RBP: ffff8810c2807be8 R08: 0000000000000001 R09: 0000000000000001
[  936.829403] R10: 0000000000000001 R11: 0000000000000008 R12: dffffc0000000000
[  936.829403] R13: 0000000000000001 R14: ffff8810c2807b40 R15: ffff8810c2807ce8
[  936.829403] FS:  00007f89c95ff700(0000) GS:ffff8810c2800000(0000) knlGS:0000000000000000
[  936.829403] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[  936.829403] CR2: 0000000003503ff8 CR3: 0000000f8237b000 CR4: 00000000000007a0
[  936.829403] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  936.829403] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000050602
[  936.829403] Stack:
[  936.829403]  0000000000000082 ffffffff00000001 ffff8810c28079d8 ffff8810c2817a88
[  936.829403]  0000000000000000 1ffff10218500f4b 00000000c2817a88 ffff8810c2807d14
[  936.829403]  ffff8810c2807b50 ffff8810c2807cfc ffff8810c0740010 0000000307418e2e
[  936.829403] Call Trace:
[  936.829403]  <IRQ>
[  936.829403] ? __enqueue_entity (kernel/sched/fair.c:501)
[  936.829403] ? update_group_capacity (kernel/sched/fair.c:6593)
[  936.829403] ? update_cfs_shares (kernel/sched/fair.c:2375)
[  936.829403] ? cpumask_next_and (lib/cpumask.c:40)
[  936.829403] load_balance (kernel/sched/fair.c:6857)
[  936.829403] ? _raw_spin_unlock_irqrestore (./arch/x86/include/asm/preempt.h:95 include/linux/spinlock_api_smp.h:163 kernel/locking/spinlock.c:191)
[  936.829403] ? update_blocked_averages (kernel/sched/fair.c:5743)
[  936.829403] ? find_busiest_group (kernel/sched/fair.c:6820)
[  936.829403] ? run_rebalance_domains (kernel/sched/fair.c:7450 kernel/sched/fair.c:7659)
[  936.829403] ? trace_hardirqs_on_caller (kernel/locking/lockdep.c:2566)
[  936.829403] run_rebalance_domains (kernel/sched/fair.c:7494 kernel/sched/fair.c:7659)
[  936.829403] ? run_rebalance_domains (kernel/sched/fair.c:7450 kernel/sched/fair.c:7659)
[  936.829403] ? pick_next_task_fair (kernel/sched/fair.c:7654)
[  936.829403] ? irq_exit (kernel/softirq.c:350 kernel/softirq.c:391)
[  936.829403] __do_softirq (kernel/softirq.c:273 include/linux/jump_label.h:114 include/trace/events/irq.h:126 kernel/softirq.c:274)
[  936.829403] irq_exit (kernel/softirq.c:350 kernel/softirq.c:391)
[  936.829403] smp_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:918)
[  936.829403] apic_timer_interrupt (arch/x86/kernel/entry_64.S:958)
[  936.829403]  <EOI>
[  936.829403] ? is_module_address (kernel/module.c:3835)
[  936.829403] ? __kernel_text_address (kernel/extable.c:104)
[  936.829403] print_context_stack (arch/x86/kernel/dumpstack.c:105)
[  936.829403] dump_trace (arch/x86/kernel/dumpstack_64.c:244)
[  936.829403] save_stack_trace (arch/x86/kernel/stacktrace.c:64)
[  936.829403] __set_page_owner (mm/page_owner.c:72)
[  936.829403] ? __reset_page_owner (mm/page_owner.c:61)
[  936.829403] ? __inc_zone_state (mm/vmstat.c:271)
[  936.829403] get_page_from_freelist (include/linux/page_owner.h:26 mm/page_alloc.c:2176)
[  936.829403] __alloc_pages_nodemask (mm/page_alloc.c:2844)
[  936.829403] ? alloc_pages_vma (mm/mempolicy.c:2007)
[  936.829403] ? debug_check_no_locks_freed (kernel/locking/lockdep.c:3051)
[  936.829403] ? debug_check_no_locks_freed (kernel/locking/lockdep.c:3051)
[  936.829403] ? __alloc_pages_direct_compact (mm/page_alloc.c:2797)
[  936.829403] ? debug_check_no_locks_freed (kernel/locking/lockdep.c:3051)
[  936.829403] ? arch_local_irq_restore (init/do_mounts.h:19)
[  936.829403] ? trace_hardirqs_on_caller (kernel/locking/lockdep.c:2566)
[  936.829403] alloc_pages_vma (mm/mempolicy.c:2007)
[  936.829403] ? handle_mm_fault (mm/memory.c:2156 mm/memory.c:3164 mm/memory.c:3269 mm/memory.c:3298)
[  936.829403] handle_mm_fault (mm/memory.c:2156 mm/memory.c:3164 mm/memory.c:3269 mm/memory.c:3298)
[  936.829403] ? debug_check_no_locks_freed (kernel/locking/lockdep.c:3051)
[  936.829403] ? __pmd_alloc (mm/memory.c:3280)
[  936.829403] ? perf_event_context_sched_in (kernel/events/core.c:2755)
[  936.829403] ? trace_hardirqs_on_caller (kernel/locking/lockdep.c:2566)
[  936.829403] ? __do_page_fault (arch/x86/mm/fault.c:1173)
[  936.829403] ? ___might_sleep (kernel/sched/core.c:7297 (discriminator 1))
[  936.829403] ? find_vma (mm/mmap.c:2035)
[  936.829403] __do_page_fault (arch/x86/mm/fault.c:1235)
[  936.829403] ? finish_task_switch (kernel/sched/core.c:2214)
[  936.829403] ? finish_task_switch (kernel/sched/sched.h:1058 kernel/sched/core.c:2210)
[  936.829403] trace_do_page_fault (arch/x86/mm/fault.c:1329)
[  936.829403] do_async_page_fault (arch/x86/kernel/kvm.c:280)
[  936.829403] async_page_fault (arch/x86/kernel/entry_64.S:1295)
[ 936.829403] Code: 89 f8 48 c1 e8 03 42 0f b6 04 20 84 c0 74 08 3c 03 0f 8e 3a 18 00 00 8b 7e 08 44 89 e8 48 c1 e0 0a 48 8d 44 07 ff 48 89 fe 48 99 <48> f7 ff 31 d2 48 89 c7 44 89 e8 f7 f7 45 89 c5 49 81 c5 00 02
All code
========
   0:	89 f8                	mov    %edi,%eax
   2:	48 c1 e8 03          	shr    $0x3,%rax
   6:	42 0f b6 04 20       	movzbl (%rax,%r12,1),%eax
   b:	84 c0                	test   %al,%al
   d:	74 08                	je     0x17
   f:	3c 03                	cmp    $0x3,%al
  11:	0f 8e 3a 18 00 00    	jle    0x1851
  17:	8b 7e 08             	mov    0x8(%rsi),%edi
  1a:	44 89 e8             	mov    %r13d,%eax
  1d:	48 c1 e0 0a          	shl    $0xa,%rax
  21:	48 8d 44 07 ff       	lea    -0x1(%rdi,%rax,1),%rax
  26:	48 89 fe             	mov    %rdi,%rsi
  29:	48 99                	cqto
  2b:*	48 f7 ff             	idiv   %rdi		<-- trapping instruction
  2e:	31 d2                	xor    %edx,%edx
  30:	48 89 c7             	mov    %rax,%rdi
  33:	44 89 e8             	mov    %r13d,%eax
  36:	f7 f7                	div    %edi
  38:	45 89 c5             	mov    %r8d,%r13d
  3b:	49                   	rex.WB
  3c:	81                   	.byte 0x81
  3d:	c5 00 02             	(bad)
	...

Code starting with the faulting instruction
===========================================
   0:	48 f7 ff             	idiv   %rdi
   3:	31 d2                	xor    %edx,%edx
   5:	48 89 c7             	mov    %rax,%rdi
   8:	44 89 e8             	mov    %r13d,%eax
   b:	f7 f7                	div    %edi
   d:	45 89 c5             	mov    %r8d,%r13d
  10:	49                   	rex.WB
  11:	81                   	.byte 0x81
  12:	c5 00 02             	(bad)
	...
[  936.829403] RIP find_busiest_group (kernel/sched/fair.c:6152 kernel/sched/fair.c:6223 kernel/sched/fair.c:6341 kernel/sched/fair.c:6603)
[  936.829403]  RSP <ffff8810c28079a8>


Thanks,
Sasha

^ permalink raw reply	[flat|nested] 3+ messages in thread

end of thread, other threads:[~2015-03-10 10:56 UTC | newest]

Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2015-03-09 17:46 sched: divide error in sg_capacity_factor Sasha Levin
2015-03-10  4:29 ` Ingo Molnar
2015-03-10 10:55   ` Sasha Levin

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).