[Xen-devel] c/s 23990:1c8789852eaf: xen crashes

[Christoph Egger <Christoph.Egger@xxxxxxx>]

Hi,

c/s 23990:1c8789852eaf crashes xen due to a NULL pointer dereference
within the xen kernel.

I have two different call traces:

(XEN) ----[ Xen-4.2-unstable  x86_64  debug=y  Tainted:    C ]----
(XEN) CPU:    0
(XEN) RIP:    e008:[<ffff82c480151409>] __find_first_bit+0x11/0x2b
(XEN) RFLAGS: 0000000000010246   CONTEXT: hypervisor
(XEN) rax: 0000000000000000   rbx: 0000000000000000   rcx: 0000000000000001
(XEN) rdx: 0000000000000000   rsi: 0000000000000047   rdi: 0000000000000000
(XEN) rbp: ffff82c4802afcf8   rsp: ffff82c4802afcf0   r8:  000000124c1fd4d5
(XEN) r9:  0000000000000007   r10: 0000000000000000   r11: 0000000000000246
(XEN) r12: ffff83012ffb8880   r13: ffff82c4802afe48   r14: 0000000000000000
(XEN) r15: 000000124bcd51be   cr0: 000000008005003b   cr4: 00000000000006f0
(XEN) cr3: 0000000228fb9000   cr2: 0000000000000000
(XEN) ds: 0017   es: 0017   fs: 0000   gs: 0000   ss: e010   cs: e008
(XEN) Xen stack trace from rsp=ffff82c4802afcf0:
(XEN)    0000000000000008 ffff82c4802afd78 ffff82c48019a3c0 0000000000000002
(XEN)    ffff82c4802afd28 ffff82c4802aff18 ffff83012ffb88a0 0000000000000000
(XEN)    0000000000000000 0000000000000000 0000000000000000 ffff8300cfafa15c
(XEN)    ffff83012ff000a4 ffff82c4802588c0 ffff82c4802afe48 0000000000000000
(XEN)    ffff83012ff00080 ffff82c4802afd88 ffff82c480199f83 ffff82c4802afdc8
(XEN)    ffff82c48017e3da ffff83012ff00080 ffff83012ff00080 ffff82c4802afdc8
(XEN)    ffff82c480160391 ffff82c48012478d ffff83012ff000a4 ffff82c4802afe38
(XEN)    ffff82c480165054 ffff82c4802afe38 0000000000000000 0000000000000000
(XEN)    0000000000000000 0000000000000000 0000000000000000 ffff82c4802afe38
(XEN)    ffff82c4802aff18 ffff8300cfcff000 ffff8300cfafa000 0000000000000002
(XEN)    000000124b882e0c 00007d3b7fd50197 ffff82c48015d646 000000124b882e0c
(XEN)    0000000000000002 ffff8300cfafa000 ffff8300cfcff000 ffff82c4802afef0
(XEN)    ffff82c4802aff18 0000000000000246 0000000000000000 0000000000000007
(XEN)    000000124c1fd4d5 ffff82c4802fd4f0 0000000000000000 ffff82c4802e3460
(XEN)    ffff82c4802aff18 ffff8300cfcff000 000000f000000000 ffff82c48015603c
(XEN)    000000000000e008 0000000000000246 ffff82c4802afef0 000000000000e010
(XEN)    ffff82c4802aff10 ffff82c480156089 ffff82c4801241db 0000000000000000
(XEN)    ffff82c4802afd18 0000000000000000 ffffa0002312f840 ffffa0002312d110
(XEN)    ffffffff80c5cac0 ffffa00023344c40 ffffa0002312f840 0000000000000246
(XEN)    0000000000000000 0000000000000000 0000000000000000 0000000000000000
(XEN) Xen call trace:
(XEN)    [<ffff82c480151409>] __find_first_bit+0x11/0x2b
(XEN)    [<ffff82c48019a3c0>] handle_hpet_broadcast+0x97/0x24b
(XEN)    [<ffff82c480199f83>] hpet_legacy_irq_tick+0x42/0x50
(XEN)    [<ffff82c48017e3da>] timer_interrupt+0x24/0x198
(XEN)    [<ffff82c480165054>] do_IRQ+0x542/0x5ef
(XEN)    [<ffff82c48015d646>] common_interrupt+0x26/0x30
(XEN)    [<ffff82c48015603c>] default_idle+0x60/0x65
(XEN)    [<ffff82c480156089>] idle_loop+0x48/0x56
(XEN)
(XEN) Pagetable walk from 0000000000000000:
(XEN)  L4[0x000] = 000000012b778027 0000000000004887
(XEN)  L3[0x000] = 000000012b6cf027 0000000000004930
(XEN)  L2[0x000] = 0000000000000000 ffffffffffffffff
(XEN)
(XEN) ****************************************
(XEN) Panic on CPU 0:
(XEN) FATAL PAGE FAULT
(XEN) [error_code=0000]
(XEN) Faulting linear address: 0000000000000000
(XEN) ****************************************
(XEN)
(XEN) Reboot in five seconds...


(XEN) ----[ Xen-4.2-unstable  x86_64  debug=y  Tainted:    C ]----
(XEN) CPU:    0
(XEN) RIP:    e008:[<ffff82c480151329>] __find_first_bit+0x11/0x2b
(XEN) RFLAGS: 0000000000010246   CONTEXT: hypervisor
(XEN) rax: 0000000000000000   rbx: 0000000000000000   rcx: 0000000000000001
(XEN) rdx: 0000000000000000   rsi: 0000000000000047   rdi: 0000000000000000
(XEN) rbp: ffff82c4802afdc8   rsp: ffff82c4802afdc0   r8:  0000000000000000
(XEN) r9:  00007f7ff7b2d000   r10: 00007f7ff661f800   r11: 0000000000000246
(XEN) r12: ffff83012ffb8880   r13: ffff82c4802aff18   r14: 0000000000000000
(XEN) r15: 00000011bd0ab1c3   cr0: 000000008005003b   cr4: 00000000000006f0
(XEN) cr3: 000000012ab4e000   cr2: 0000000000000000
(XEN) ds: 0017   es: 0017   fs: 0000   gs: 0000   ss: 0000   cs: e008
(XEN) Xen stack trace from rsp=ffff82c4802afdc0:
(XEN)    0000000000000008 ffff82c4802afe48 ffff82c48019a2c0 ffff82c4802afdf8
(XEN)    ffff82c4802afdf8 ffff82c4802aff18 ffff83012ffb88a0 0000000000000000
(XEN)    0000000000000000 0000000000000000 0000000000000000 ffff82c4802afef8
(XEN)    ffff83012ff000a4 ffff82c4802586c0 ffff82c4802aff18 0000000000000000
(XEN)    ffff83012ff00080 ffff82c4802afe58 ffff82c480199e83 ffff82c4802afe98
(XEN)    ffff82c48017e2da ffff83012ff00080 ffff83012ff00080 ffff82c4802afe98
(XEN)    ffff82c480160291 ffff82c4801246ed ffff83012ff000a4 ffff82c4802aff08
(XEN)    ffff82c480164f54 ffffffff80102160 0000000000000000 00000000f543802a
(XEN)    0000000000000000 0000000000000246 00007f7fffffd418 000000000000e02b
(XEN)    00007f7ff7fe6000 00007f7ff7b2f000 0000000000000013 0000000000000001
(XEN)    00007f7ff7b2f000 00007d3b7fd500c7 ffff82c48015d546 00007f7ff7b2f000
(XEN)    0000000000000001 0000000000000013 00007f7ff7b2f000 00007f7fffffd4d0
(XEN)    00007f7ff7fe6000 0000000000000246 00007f7ff661f800 00007f7ff7b2d000
(XEN)    0000000000000000 0000000000000021 00007f7ff543802a 0000000000000000
(XEN)    00007f7fffffd48c 0000000000000011 000000f000000000 000000000047004e
(XEN)    000000000000e033 0000000000000206 00007f7fffffd4b0 000000000000e02b
(XEN)    000000000000beef 000000000000beef 000000000000beef 000000000000beef
(XEN)    0000000000000000 ffff8300cfafa000 0000000000000000 0000000000000000
(XEN) Xen call trace:
(XEN)    [<ffff82c480151329>] __find_first_bit+0x11/0x2b
(XEN)    [<ffff82c48019a2c0>] handle_hpet_broadcast+0x97/0x24b
(XEN)    [<ffff82c480199e83>] hpet_legacy_irq_tick+0x42/0x50
(XEN)    [<ffff82c48017e2da>] timer_interrupt+0x24/0x198
(XEN)    [<ffff82c480164f54>] do_IRQ+0x542/0x5ef
(XEN)
(XEN) Pagetable walk from 0000000000000000:
(XEN)  L4[0x000] = 000000012aeea027 0000000000005115
(XEN)  L3[0x000] = 000000021f809027 00000000000027f6
(XEN)  L2[0x000] = 0000000000000000 ffffffffffffffff
(XEN)
(XEN) ****************************************
(XEN) Panic on CPU 0:
(XEN) FATAL PAGE FAULT
(XEN) [error_code=0000]
(XEN) Faulting linear address: 0000000000000000
(XEN) ****************************************
(XEN)
(XEN) Reboot in five seconds...



--
---to satisfy European Law for business letters:
Advanced Micro Devices GmbH
Einsteinring 24, 85689 Dornach b. Muenchen
Geschaeftsfuehrer: Alberto Bozzo, Andrew Bowd
Sitz: Dornach, Gemeinde Aschheim, Landkreis Muenchen
Registergericht Muenchen, HRB Nr. 43632


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel