On Wed, Mar 22, 2017 at 11:35:58AM +0100, Peter Zijlstra wrote:
> By changing futex_lock_pi() to use rt_mutex_*_proxy_lock() we arrive
> at a point where all wait_list modifications are done under both
> hb->lock and wait_lock.
[...]
Hey Peter,
I'm seeing the following, which seems to be related to this patch:
[ 21.762875] ODEBUG: free active (active state 0) object type: hrtimer hint:
hrtimer_wakeup (kernel/time/hrtimer.c:1423)
[ 21.771034] ------------[ cut here ]------------
[ 21.771657] WARNING: CPU: 6 PID: 1974 at lib/debugobjects.c:289
debug_print_object (lib/debugobjects.c:286)
[ 21.772872] Modules linked in:
[ 21.773323] CPU: 6 PID: 1974 Comm: trinity-c92 Not tainted
4.11.0-rc5-next-20170407-dirty #21
[ 21.774534] task: ffff880389063e40 task.stack: ffff880389158000
[ 21.775383] RIP: 0010:debug_print_object (??:?)
[ 21.776081] RSP: 0018:ffff88038915f108 EFLAGS: 00010086
[ 21.776815] RAX: 0000000000000057 RBX: 0000000000000003 RCX: 0000000000000000
[ 21.777791] RDX: 0000000000000057 RSI: 1ffff1007122bdc0 RDI: ffffed007122be17
[ 21.778773] RBP: ffff88038915f130 R08: 203a47554245444f R09: 7463612065657266
[ 21.779756] R10: 0000000000000000 R11: 000000000000147e R12: ffffffff834598e0
[ 21.780741] R13: ffffffff8127c150 R14: 0000000000000000 R15: ffffffff8410e588
[ 21.782945] FS: 00007fd5e261f700(0000) GS:ffff88039cb80000(0000)
knlGS:0000000000000000
[ 21.783942] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 21.784638] CR2: 00007fd5e21f2520 CR3: 000000038d4c9000 CR4: 00000000000406a0
[ 21.785718] DR0: 00007fd5e00df000 DR1: 0000000000000000 DR2: 0000000000000000
[ 21.786675] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
[ 21.787684] Call Trace:
[ 21.788050] debug_object_free (lib/debugobjects.c:603)
[ 21.791105] destroy_hrtimer_on_stack (kernel/time/hrtimer.c:427)
[ 21.791746] futex_lock_pi (kernel/futex.c:2740)
[ 21.800721] do_futex (kernel/futex.c:3399)
[ 21.818395] SyS_futex (kernel/futex.c:3447 kernel/futex.c:3415)
[ 21.822260] do_syscall_64 (arch/x86/entry/common.c:284)
[ 21.827328] entry_SYSCALL64_slow_path (arch/x86/entry/entry_64.S:249)
[
21.827960] RIP: 0033:0x7fd5e1f2e8e9^M
[
21.828455] RSP: 002b:00007ffcfe586f48 EFLAGS: 00000246 ORIG_RAX:
00000000000000ca^M
[ 21.829931] RAX: ffffffffffffffda RBX: 00000000000000ca RCX:
00007fd5e1f2e8e9^M
[ 21.830875] RDX: 0000000000004000 RSI: 0000000000000086 RDI:
00007fd5e00df000^M
[ 21.831783] RBP: 00007fd5e0a12000 R08: 00007fd5e2426000 R09:
008008000100a000^M
[ 21.832775] R10: 00007fd5e00e1000 R11: 0000000000000246 R12:
0000000000000002^M
[ 21.833705] R13: 00007fd5e0a12048 R14: 00007fd5e261f698 R15:
00007fd5e0a12000^M
[ 21.834644] Code: 0d 48 89 75 d8 e8 30 01 8b ff 48 8b 75 d8 48
8b 14 dd 40 8f 51 83 4d 89 e9 4d 89 e0 44 89 f1 48 c7 c7 e0 85 51 83 e8 e3 29
75 ff <0f> ff 83 05 4a 1e 16 02 01 48 83 c4 08 5b 41 5c 41 5d 41 5e 5d
All code
========
0: 0d 48 89 75 d8 or $0xd8758948,%eax
5: e8 30 01 8b ff callq 0xffffffffff8b013a
a: 48 8b 75 d8 mov -0x28(%rbp),%rsi
e: 48 8b 14 dd 40 8f 51 mov -0x7cae70c0(,%rbx,8),%rdx
15: 83
16: 4d 89 e9 mov %r13,%r9
19: 4d 89 e0 mov %r12,%r8
1c: 44 89 f1 mov %r14d,%ecx
1f: 48 c7 c7 e0 85 51 83 mov $0xffffffff835185e0,%rdi
26: e8 e3 29 75 ff callq 0xffffffffff752a0e
2b:* 0f ff (bad) <-- trapping instruction
2d: 83 05 4a 1e 16 02 01 addl $0x1,0x2161e4a(%rip) # 0x2161e7e
34: 48 83 c4 08 add $0x8,%rsp
38: 5b pop %rbx
39: 41 5c pop %r12
3b: 41 5d pop %r13
3d: 41 5e pop %r14
3f: 5d pop %rbp
...
Code starting with the faulting instruction
===========================================
0: 0f ff (bad)
2: 83 05 4a 1e 16 02 01 addl $0x1,0x2161e4a(%rip) # 0x2161e53
9: 48 83 c4 08 add $0x8,%rsp
d: 5b pop %rbx
e: 41 5c pop %r12
10: 41 5d pop %r13
12: 41 5e pop %r14
14: 5d pop %rbp
...
[ 21.837142] ---[ end trace 9e2690a9beaffa07 ]---
--
Thanks,
Sasha
