Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

mmcblk0 error -110 errors (regression?) #280

Closed
oerik opened this issue Apr 22, 2013 · 149 comments

Comments

Projects
None yet
@oerik
Copy link

commented Apr 22, 2013

On 3.8.8+ kernel with an class 10 4Gb card (unknown brand) gives me mmcblk0 errors, the 3.6.11 version didn't give me these errors (was running 2 weeks non-stop with 3.6.11 kernel). A second rpi with an Transcend SDTRHC8GB is working just fine. I'm going the replace the SD card anyway.
Note, the 4Gb card doesn't support fstrim, the 8Gb does.

[13288.492420] mmc0: final write to SD card still running
[13298.479242] mmc0: Timeout waiting for hardware interrupt - cmd12.
[13298.480375] mmcblk0: error -110 sending stop command, original cmd response 0x900, card status 0x900
[13298.930974] mmc0: final write to SD card still running
[13308.919721] mmc0: Timeout waiting for hardware interrupt - cmd12.
[13308.920845] mmcblk0: error -110 sending stop command, original cmd response 0x900, card status 0x900
[15090.374963] mmc0: final write to SD card still running
[15100.403772] mmc0: Timeout waiting for hardware interrupt - cmd12.
[15100.404897] mmcblk0: error -110 sending stop command, original cmd response 0x900, card status 0x900
[15100.856441] mmc0: final write to SD card still running
[15110.884252] mmc0: Timeout waiting for hardware interrupt - cmd12.
[15110.885382] mmcblk0: error -110 sending stop command, original cmd response 0x900, card status 0x900

@popcornmix

This comment has been minimized.

Copy link
Collaborator

commented Apr 22, 2013

I've not seen this so far. Can you revert back to 3.6.11 firmware on same sdcard and confirm the messages are gone?

Anyone else seeing sdcard errors on 3.8.8 that were not present on 3.6.11?

@oerik

This comment has been minimized.

Copy link
Author

commented Apr 22, 2013

Ok, I've reverted back to 3.6.11 and keep it running for a night. There is at least every hour some write access to the disk. I'll report tomorrow . The 3.8.8 kernel was reporting errors within a few hours.

@oerik

This comment has been minimized.

Copy link
Author

commented Apr 23, 2013

3.6.11 was running all night without any mmc errors logged. Activated 3.8.8 and during boot time:
[ 26.797844] mmc0: Timeout waiting for hardware interrupt - cmd12.
[ 26.807896] mmcblk0: error -110 sending stop command, original cmd response 0x900, card status 0x900

These are the contents of /sys/block/mmcblk0/device :

root@raspberrypi:/sys/block/mmcblk0/device# cat cid && cat csd && cat date && cat fwrev && cat hwrev && cat manfid && cat oemid && cat scr && cat serial && cat erase_size && cat preferred_erase_size
4134325344344742300065558e00ca00
400e00325b5900001da77f800a400000
10/2012
0x0
0x3
0x000041
0x3432
0235800001000000
0x0065558e
512
4194304

I'll have to admit it is the cheapest micro SD class 10 card I could find. but so far it was working reliable.

@popcornmix

This comment has been minimized.

Copy link
Collaborator

commented Apr 23, 2013

I'll have a look at the changes and see if there's anything I can try reverting.

@hvenzke

This comment has been minimized.

Copy link

commented Apr 23, 2013

Have the same issue with Transcend SD HC class 10 16GB card
Not happend on 3.8.7 .

Initializing Linux on physical CPU 0x0
[    0.000000] Initializing cgroup subsys cpu
[    0.000000] Linux version 3.8.8-4-raspberrypi (root@lb1) (gcc version 4.6.3 (Debian 4.6.3-14+rpi1) ) #2 PREEMPT Tue Apr 23 16:29:45 CEST 2013
[    0.000000] CPU: ARMv6-compatible processor [410fb767] revision 7 (ARMv7), cr=00c5387d
[    0.000000] CPU: PIPT / VIPT nonaliasing data cache, VIPT nonaliasing instruction cache
[    0.000000] Machine: BCM2708
[    0.000000] cma: CMA: reserved 16 MiB at 1d000000
[    0.000000] Memory policy: ECC disabled, Data cache writeback
[    0.000000] On node 0 totalpages: 122880
[    0.000000] free_area_init_node: node 0, pgdat 406765f0, node_mem_map 40725000
[    0.000000]   Normal zone: 960 pages used for memmap
[    0.000000]   Normal zone: 0 pages reserved
[    0.000000]   Normal zone: 121920 pages, LIFO batch:31
[    0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
[    0.000000] pcpu-alloc: [0] 0
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 121920
[    0.000000] Kernel command line: dma.dmachans=0x7f35 bcm2708_fb.fbwidth=656 bcm2708_fb.fbheight=416 bcm2708.boardrev=0xf bcm2708.serial=0xf30d7eb6 smsc95xx.macaddr=B8:27:EB:0D:7E:B6 sdhci-bcm2708.emmc_clock_freq=100000000 vc_mem.mem_base=0x1ec00000 vc_mem.mem_size=0x20000000  dwc_otg.lpm_enable=0 console=ttyAMA0,115200 kgdboc=ttyAMA0,115200 console=tty1 root=/dev/mmcblk0p2 rootfstype=ext4 rootflags=commit=120,data=writeback elevator=deadline rootwait
[    0.000000] PID hash table entries: 2048 (order: 1, 8192 bytes)
[    0.000000] Dentry cache hash table entries: 65536 (order: 6, 262144 bytes)
[    0.000000] Inode-cache hash table entries: 32768 (order: 5, 131072 bytes)
[    0.000000] __ex_table already sorted, skipping sort
[    0.000000] allocated 983040 bytes of page_cgroup
[    0.000000] please try 'cgroup_disable=memory' option if you don't want memory cgroups
[    0.000000] Memory: 480MB = 480MB total
[    0.000000] Memory: 462536k/462536k available, 28984k reserved, 0K highmem
[    0.000000] Virtual kernel memory layout:
[    0.000000]     vector  : 0xffff0000 - 0xffff1000   (   4 kB)
[    0.000000]     fixmap  : 0xfff00000 - 0xfffe0000   ( 896 kB)
[    0.000000]     vmalloc : 0x5e800000 - 0xff000000   (2568 MB)
[    0.000000]     lowmem  : 0x40000000 - 0x5e000000   ( 480 MB)
[    0.000000]     modules : 0x3f000000 - 0x40000000   (  16 MB)
[    0.000000]       .text : 0x40008000 - 0x4060a688   (6154 kB)
[    0.000000]       .init : 0x4060b000 - 0x406351c4   ( 169 kB)
[    0.000000]       .data : 0x40636000 - 0x40676e60   ( 260 kB)
[    0.000000]        .bss : 0x40676e60 - 0x40724b54   ( 696 kB)
[    0.000000] NR_IRQS:330
[    0.000000] sched_clock: 32 bits at 1000kHz, resolution 1000ns, wraps every 4294967ms
[    0.000000] Switching to timer-based delay loop
[    0.000000] Console: colour dummy device 80x30
[    0.000000] console [tty1] enabled
[    0.001192] Calibrating delay loop (skipped), value calculated using timer frequency.. 2.00 BogoMIPS (lpj=10000)
[    0.001253] pid_max: default: 32768 minimum: 301
[    0.001403] Security Framework initialized
[    0.001462] AppArmor: AppArmor disabled by boot time parameter
[    0.001745] Mount-cache hash table entries: 512
[    0.002500] Initializing cgroup subsys cpuacct
[    0.002555] Initializing cgroup subsys memory
[    0.002634] Initializing cgroup subsys devices
[    0.002669] Initializing cgroup subsys freezer
[    0.002700] Initializing cgroup subsys net_cls
[    0.002728] Initializing cgroup subsys blkio
[    0.002755] Initializing cgroup subsys perf_event
[    0.002801] Initializing cgroup subsys net_prio
[    0.002922] CPU: Testing write buffer coherency: ok
[    0.003416] Setting up static identity map for 0x466838 - 0x466894
[    0.005078] devtmpfs: initialized
[    0.014607] regulator-dummy: no parameters
[    0.016927] NET: Registered protocol family 16
[    0.023188] DMA: preallocated 4096 KiB pool for atomic coherent allocations
[    0.024550] bcm2708.uart_clock = 0
[    0.026543] hw-breakpoint: found 6 breakpoint and 1 watchpoint registers.
[    0.026595] hw-breakpoint: maximum watchpoint size is 4 bytes.
[    0.026631] mailbox: Broadcom VideoCore Mailbox driver
[    0.026734] bcm2708_vcio: mailbox at f200b880
[    0.026838] bcm_power: Broadcom power driver
[    0.026875] bcm_power_open() -> 0
[    0.026900] bcm_power_request(0, 8)
[    0.527590] bcm_mailbox_read -> 00000080, 0
[    0.527628] bcm_power_request -> 0
[    0.527863] Serial: AMBA PL011 UART driver
[    0.528034] dev:f1: ttyAMA0 at MMIO 0x20201000 (irq = 83) is a PL011 rev3
[    0.901800] console [ttyAMA0] enabled
[    0.929010] bio: create slab  at 0
[    0.934393] SCSI subsystem initialized
[    0.938387] usbcore: registered new interface driver usbfs
[    0.944106] usbcore: registered new interface driver hub
[    0.949675] usbcore: registered new device driver usb
[    0.956034] NetLabel: Initializing
[    0.959475] NetLabel:  domain hash size = 128
[    0.963839] NetLabel:  protocols = UNLABELED CIPSOv4
[    0.968979] NetLabel:  unlabeled traffic allowed by default
[    0.975238] Switching to clocksource stc
[    0.979452] FS-Cache: Loaded
[    0.982671] CacheFiles: Loaded
[    1.002058] NET: Registered protocol family 2
[    1.007306] TCP established hash table entries: 4096 (order: 3, 32768 bytes)
[    1.014558] TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
[    1.021113] TCP: Hash tables configured (established 4096 bind 4096)
[    1.027554] TCP: reno registered
[    1.030847] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    1.036715] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    1.043391] NET: Registered protocol family 1
[    1.048306] RPC: Registered named UNIX socket transport module.
[    1.054359] RPC: Registered udp transport module.
[    1.059080] RPC: Registered tcp transport module.
[    1.063828] RPC: Registered tcp NFSv4.1 backchannel transport module.
[    1.071276] NetWinder Floating Point Emulator V0.97 (extended precision)
[    1.078203] bcm2708_dma: DMA manager at f2007000
[    1.083008] bcm2708_gpio: bcm2708_gpio_probe 406445f0
[    1.088539] vc-mem: phys_addr:0x00000000 mem_base=0x1ec00000 mem_size:0x20000000(512 MiB)
[    1.097197] major device number 252
[    1.097218] vma list size 12, page list size 2008, page size 4096
[    1.097237] allocated dma channel 2 (f2007200), initial state 00000008
[    1.097247] post-reset 00000008
[    1.098051] audit: initializing netlink socket (disabled)
[    1.103601] type=2000 audit(0.950:1): initialized
[    1.287257] VFS: Disk quotas dquot_6.5.2
[    1.291410] Dquot-cache hash table entries: 1024 (order 0, 4096 bytes)
[    1.298523] FS-Cache: Netfs 'nfs' registered for caching
[    1.304330] NFS: Registering the id_resolver key type
[    1.309617] Key type id_resolver registered
[    1.313821] Key type id_legacy registered
[    1.318223] msgmni has been set to 935
[    1.324505] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 251)
[    1.332360] io scheduler noop registered
[    1.336314] io scheduler deadline registered (default)
[    1.341613] io scheduler cfq registered
[    1.351837] crc32: CRC_LE_BITS = 64, CRC_BE BITS = 64
[    1.356914] crc32: self tests passed, processed 225944 bytes in 3099000 nsec
[    1.366554] crc32c: CRC_LE_BITS = 64
[    1.370183] crc32c: self tests passed, processed 225944 bytes in 1246000 nsec
[    1.479986] uart-pl011 dev:f1: no DMA platform data
[    1.484946] kgdb: Registered I/O driver kgdboc.
[    1.490290] vc-cma: Videocore CMA driver
[    1.494242] vc-cma: vc_cma_base      = 0x00000000
[    1.498954] vc-cma: vc_cma_size      = 0x00000000 (0 MiB)
[    1.504419] vc-cma: vc_cma_initial   = 0x00000000 (0 MiB)
[    1.520567] brd: module loaded
[    1.529630] loop: module loaded
[    1.533195] vchiq: vchiq_init_state: slot_zero = 0x5d000000, is_master = 0
[    1.541307] Loading iSCSI transport class v2.0-870.
[    1.547613] Rounding down aligned max_sectors from 4294967295 to 4294967288
[    1.555266] usbcore: registered new interface driver smsc95xx
[    1.561206] dwc_otg: version 3.00a 10-AUG-2012 (platform bus)
[    1.767059] Core Release: 2.80a
[    1.770312] Setting default values for core params
[    1.775160] Finished setting default values for core params
[    1.980855] Using Buffer DMA mode
[    1.984196] Periodic Transfer Interrupt Enhancement - disabled
[    1.990070] Multiprocessor Interrupt Enhancement - disabled
[    1.995658] OTG VER PARAM: 0, OTG VER FLAG: 0
[    2.000055] Dedicated Tx FIFOs mode
[    2.005105] dwc_otg: Microframe scheduler enabled
[    2.005322] dwc_otg bcm2708_usb: DWC OTG Controller
[    2.010347] dwc_otg bcm2708_usb: new USB bus registered, assigned bus number 1
[    2.017693] dwc_otg bcm2708_usb: irq 75, io mem 0x00000000
[    2.023263] Init: Port Power? op_state=1
[    2.027198] Init: Power Port (0)
[    2.030582] usb usb1: New USB device found, idVendor=1d6b, idProduct=0002
[    2.037397] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1
[    2.044682] usb usb1: Product: DWC OTG Controller
[    2.049443] usb usb1: Manufacturer: Linux 3.8.8-4-raspberrypi dwc_otg_hcd
[    2.056251] usb usb1: SerialNumber: bcm2708_usb
[    2.061676] hub 1-0:1.0: USB hub found
[    2.065484] hub 1-0:1.0: 1 port detected
[    2.069964] dwc_otg: FIQ disabled
[    2.069981] dwc_otg: NAK holdoff enabled
[    2.070002] Module dwc_common_port init
[    2.070244] Initializing USB Mass Storage driver...
[    2.075338] usbcore: registered new interface driver usb-storage
[    2.081460] USB Mass Storage support registered.
[    2.086652] mousedev: PS/2 mouse device common for all mice
[    2.093054] bcm2835-cpufreq: min=700000 max=950000 cur=700000
[    2.098915] bcm2835-cpufreq: switching to governor performance
[    2.104814] bcm2835-cpufreq: switching to governor performance
[    2.111519] cpuidle: using governor ladder
[    2.115631] cpuidle: using governor menu
[    2.119661] sdhci: Secure Digital Host Controller Interface driver
[    2.125851] sdhci: Copyright(c) Pierre Ossman
[    2.130340] sdhci: Enable low-latency mode
[    2.134764] platform supply vqmmc not found, using dummy regulator
[    2.141140] platform supply vmmc not found, using dummy regulator
[    2.147525]  platform: could not set regulator OCR (-22)
[    2.152921] mmc0: Switching to 3.3V signalling voltage  failed
[    2.189424] mmc0: SDHCI controller on BCM2708_Arasan [platform] using platform's DMA
[    2.197406] mmc0: BCM2708 SDHC host at 0x20300000 DMA 0 IRQ 16
[    2.203484] sdhci-pltfm: SDHCI platform and OF driver helper
[    2.211257] ledtrig-cpu: registered to indicate activity on CPUs
[    2.222750] usbcore: registered new interface driver usbhid
[    2.228426] usbhid: USB HID core driver
[    2.234379] zram: num_devices not specified. Using default: 1
[    2.242241] zram: Creating 1 devices ...
[    2.255134] TCP: cubic registered
[    2.258487] TCP: highspeed registered
[    2.262261] TCP: lp registered
[    2.265404] Initializing XFRM netlink socket
[    2.269912] Indeed it is in host mode hprt0 = 00021501
[    2.279370] NET: Registered protocol family 10
[    2.284721] NET: Registered protocol family 17
[    2.299389] Key type dns_resolver registered
[    2.304178] VFP support v0.3: implementor 41 architecture 1 part 20 variant b rev 5
[    2.314061] mmc0: read SD Status register (SSR) after 2 attempts
[    2.330106] registered taskstats version 1
[    2.336327] mmc0: new high speed SDHC card at address b368
[    2.349254] IMA: No TPM chip found, activating TPM-bypass!
[    2.355702] mmcblk0: mmc0:b368 SDC   15.0 GiB
[    2.370486] ### of_selftest(): No testcase data in device tree; not running tests
[    2.378418]  mmcblk0: p1 p2
[    2.409507] EXT4-fs (mmcblk0p2): mounted filesystem with writeback data mode. Opts: commit=120,data=writeback
[    2.419633] VFS: Mounted root (ext4 filesystem) on device 179:2.
[    2.435689] devtmpfs: mounted
[    2.439190] Freeing init memory: 168K
[    2.519351] usb 1-1: new high-speed USB device number 2 using dwc_otg
[    2.527271] Indeed it is in host mode hprt0 = 00001101
[    2.729784] usb 1-1: New USB device found, idVendor=0424, idProduct=9512
[    2.736531] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[    2.745302] hub 1-1:1.0: USB hub found
[    2.750107] hub 1-1:1.0: 3 ports detected
[    3.029550] usb 1-1.1: new high-speed USB device number 3 using dwc_otg
[    3.139942] usb 1-1.1: New USB device found, idVendor=0424, idProduct=ec00
[    3.146880] usb 1-1.1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[    3.170024] smsc95xx v1.0.4
[    3.235045] smsc95xx 1-1.1:1.0 eth0: register 'smsc95xx' at usb-bcm2708_usb-1.1, smsc95xx USB 2.0 Ethernet, b8:27:eb:0d:7e:b6
[    3.339593] usb 1-1.2: new full-speed USB device number 4 using dwc_otg
[    3.474004] usb 1-1.2: New USB device found, idVendor=0bda, idProduct=8150
[    3.482413] usb 1-1.2: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[    3.489852] usb 1-1.2: Product: USB 10/100 LAN
[    3.494336] usb 1-1.2: Manufacturer: REALTEK
[    3.498635] usb 1-1.2: SerialNumber: 1609
[    4.174850] udevd[161]: starting version 175
[    5.798122] rtl8150 1-1.2:1.0: eth1: rtl8150 is detected
[    5.836073] usbcore: registered new interface driver rtl8150
[   12.519210] mmc0: final write to SD card still running
[   22.469261] mmc0: Timeout waiting for hardware interrupt - cmd12.
[   22.476555] mmcblk0: error -110 sending stop command, original cmd response 0x900, card status 0x900
[   24.630698] mmc0: final write to SD card still running
[   34.589270] mmc0: Timeout waiting for hardware interrupt - cmd12.
[   34.596567] mmcblk0: error -110 sending stop command, original cmd response 0x900, card status 0x900
[   34.618797] EXT4-fs (mmcblk0p2): re-mounted. Opts: (null)
[   35.187991] EXT4-fs (mmcblk0p2): re-mounted. Opts: (null)
[   35.983110] nf_conntrack version 0.5.0 (7485 buckets, 29940 max)
[   36.010562] IPVS: Registered protocols (TCP, UDP, SCTP, AH, ESP)
[   36.016701] IPVS: Connection hash table configured (size=4096, memory=32Kbytes)
[   36.034023] IPVS: Each connection entry needs 212 bytes at least
[   36.034380] IPVS: Creating netns size=1200 id=0
[   36.039010] IPVS: ipvs loaded.
[   36.052568] IPVS: [dh] scheduler registered.
[   36.323262] IPVS: [lblc] scheduler registered.
[   36.413012] IPVS: [lblcr] scheduler registered.
[   36.492519] IPVS: [lc] scheduler registered.
[   36.590294] IPVS: [nq] scheduler registered.
[   36.671104] IPVS: [rr] scheduler registered.
[   36.750347] IPVS: [sed] scheduler registered.
[   36.829947] IPVS: [sh] scheduler registered.
[   36.918399] IPVS: [wlc] scheduler registered.
[   36.999563] IPVS: [wrr] scheduler registered.
[   37.163309] device-mapper: ioctl: 4.23.1-ioctl (2012-12-18) initialised: dm-devel@redhat.com
[   43.152590] mmc0: missed completion of cmd 18 DMA (512/512 [1]/[1]) - ignoring it
[   43.160210] mmc0: DMA IRQ 6 ignored - results were reset
[   43.166739] mmc0: missed completion of cmd 18 DMA (512/512 [1]/[1]) - ignoring it
[   43.174294] mmc0: DMA IRQ 6 ignored - results were reset
[   43.180716] mmc0: missed completion of cmd 18 DMA (512/512 [1]/[1]) - ignoring it
[   43.188272] mmc0: DMA IRQ 6 ignored - results were reset
[   43.194672] mmc0: missed completion of cmd 18 DMA (512/512 [1]/[1]) - ignoring it
[   43.202222] mmc0: DMA IRQ 6 ignored - results were reset
[   43.208591] mmc0: missed completion of cmd 18 DMA (512/512 [1]/[1]) - ignoring it
[   43.216147] mmc0: DMA IRQ 6 ignored - results were reset
[   43.222475] mmc0: missed completion of cmd 18 DMA (512/512 [1]/[1]) - ignoring it
[   43.230031] mmc0: DMA IRQ 6 ignored - results were reset
[   43.236351] mmc0: missed completion of cmd 18 DMA (512/512 [1]/[1]) - ignoring it
[   43.243927] mmc0: DMA IRQ 6 ignored - results were reset
[   43.260173] mmc0: missed completion of cmd 18 DMA (512/512 [1]/[1]) - ignoring it
[   43.267750] mmc0: DMA IRQ 6 ignored - results were reset
[   43.274182] mmc0: missed completion of cmd 18 DMA (512/512 [1]/[1]) - ignoring it
[   43.281834] mmc0: DMA IRQ 6 ignored - results were reset
[   43.292858] mmc0: missed completion of cmd 18 DMA (512/512 [1]/[1]) - ignoring it
[   43.300493] mmc0: DMA IRQ 6 ignored - results were reset
[   43.306855] mmc0: missed completion of cmd 18 DMA (512/512 [1]/[1]) - ignoring it
[   43.314484] mmc0: DMA IRQ 6 ignored - results were reset
[   43.320781] mmc0: missed completion of cmd 18 DMA (512/512 [1]/[1]) - ignoring it
[   43.328354] mmc0: DMA IRQ 6 ignored - results were reset
[   43.334706] mmc0: missed completion of cmd 18 DMA (512/512 [1]/[1]) - ignoring it
[   43.342340] mmc0: DMA IRQ 6 ignored - results were reset
[   43.348584] mmc0: missed completion of cmd 18 DMA (512/512 [1]/[1]) - ignoring it
[   43.356217] mmc0: DMA IRQ 6 ignored - results were reset
[   43.362491] mmc0: missed completion of cmd 18 DMA (512/512 [1]/[1]) - ignoring it
[   43.370118] mmc0: DMA IRQ 6 ignored - results were reset
[   43.376332] mmc0: missed completion of cmd 18 DMA (512/512 [1]/[1]) - ignoring it
[   43.383955] mmc0: DMA IRQ 6 ignored - results were reset
[   43.390184] mmc0: missed completion of cmd 18 DMA (512/512 [1]/[1]) - ignoring it
[   43.397793] mmc0: DMA IRQ 6 ignored - results were reset
[   43.410295] mmc0: missed completion of cmd 18 DMA (512/512 [1]/[1]) - ignoring it
[   43.417870] mmc0: DMA IRQ 6 ignored - results were reset
[   43.424434] mmc0: missed completion of cmd 18 DMA (512/512 [1]/[1]) - ignoring it
[   43.432071] mmc0: DMA IRQ 6 ignored - results were reset
[   43.438516] mmc0: missed completion of cmd 18 DMA (512/512 [1]/[1]) - ignoring it
[   43.446146] mmc0: DMA IRQ 6 ignored - results were reset
[   43.452631] mmc0: missed completion of cmd 18 DMA (512/512 [1]/[1]) - ignoring it
[   43.460254] mmc0: DMA IRQ 6 ignored - results were reset
[   43.466637] mmc0: missed completion of cmd 18 DMA (512/512 [1]/[1]) - ignoring it
[   43.474262] mmc0: DMA IRQ 6 ignored - results were reset
[   43.480723] mmc0: missed completion of cmd 18 DMA (512/512 [1]/[1]) - ignoring it
[   43.488309] mmc0: DMA IRQ 6 ignored - results were reset
[   43.494742] mmc0: missed completion of cmd 18 DMA (512/512 [1]/[1]) - ignoring it
[   43.502379] mmc0: DMA IRQ 6 ignored - results were reset
[   43.508754] mmc0: missed completion of cmd 18 DMA (512/512 [1]/[1]) - ignoring it
[   43.516393] mmc0: DMA IRQ 6 ignored - results were reset
[   43.522872] mmc0: missed completion of cmd 18 DMA (512/512 [1]/[1]) - ignoring it
[   43.530495] mmc0: DMA IRQ 6 ignored - results were reset
[   43.536855] mmc0: missed completion of cmd 18 DMA (512/512 [1]/[1]) - ignoring it
[   43.544490] mmc0: DMA IRQ 6 ignored - results were reset
[   43.550858] mmc0: missed completion of cmd 18 DMA (512/512 [1]/[1]) - ignoring it
[   43.558422] mmc0: DMA IRQ 6 ignored - results were reset
[   43.564755] mmc0: missed completion of cmd 18 DMA (512/512 [1]/[1]) - ignoring it
[   43.572385] mmc0: DMA IRQ 6 ignored - results were reset
[   43.578636] mmc0: missed completion of cmd 18 DMA (512/512 [1]/[1]) - ignoring it
[   43.586274] mmc0: DMA IRQ 6 ignored - results were reset
[   43.592567] mmc0: missed completion of cmd 18 DMA (512/512 [1]/[1]) - ignoring it
[   43.600196] mmc0: DMA IRQ 6 ignored - results were reset
[   43.606447] mmc0: missed completion of cmd 18 DMA (512/512 [1]/[1]) - ignoring it
[   43.614078] mmc0: DMA IRQ 6 ignored - results were reset
[   43.620413] mmc0: missed completion of cmd 18 DMA (512/512 [1]/[1]) - ignoring it
[   43.627976] mmc0: DMA IRQ 6 ignored - results were reset
[   46.851581] net eth1: eth1: allmulti set
[   46.851803] net eth1: eth1: allmulti set
[   46.852033] net eth1: eth1: allmulti set
[   46.852319] net eth1: eth1: allmulti set
[   47.093767] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready
[   47.277767] net eth1: eth1: allmulti set
[   48.019432] net eth1: eth1: allmulti set
[   48.317305] sctp: Hash tables configured (established 16384 bind 32768)
[   48.348036] DLM installed
[   48.556089] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[   48.556930] smsc95xx 1-1.1:1.0 eth0: link up, 100Mbps, full-duplex, lpa 0xC5E1
[   52.119291] [sched_delayed] sched: RT throttling activated
[   53.664479] fenced (2328): /proc/2328/oom_adj is deprecated, please use /proc/2328/oom_score_adj instead.
[   59.457392] dlm: Using TCP for communications
[   79.509094] mmc0: missed completion of cmd 18 DMA (512/512 [1]/[1]) - ignoring it
[   79.509152] mmc0: DMA IRQ 6 ignored - results were reset
[   79.510299] mmc0: missed completion of cmd 18 DMA (512/512 [1]/[1]) - ignoring it
[   79.510358] mmc0: DMA IRQ 6 ignored - results were reset
[   79.511814] mmc0: missed completion of cmd 18 DMA (512/512 [1]/[1]) - ignoring it
[   79.511873] mmc0: DMA IRQ 6 ignored - results were reset
[   79.513033] mmc0: missed completion of cmd 18 DMA (512/512 [1]/[1]) - ignoring it
[   79.513091] mmc0: DMA IRQ 6 ignored - results were reset
[   79.903897] mmc0: missed completion of cmd 18 DMA (512/512 [1]/[1]) - ignoring it
[   79.903954] mmc0: DMA IRQ 6 ignored - results were reset
[   79.905083] mmc0: missed completion of cmd 18 DMA (512/512 [1]/[1]) - ignoring it
[   79.905143] mmc0: DMA IRQ 6 ignored - results were reset
[   79.906603] mmc0: missed completion of cmd 18 DMA (512/512 [1]/[1]) - ignoring it
[   79.906660] mmc0: DMA IRQ 6 ignored - results were reset
[   79.907709] mmc0: missed completion of cmd 18 DMA (512/512 [1]/[1]) - ignoring it
[   79.907766] mmc0: DMA IRQ 6 ignored - results were reset
[   85.733000] Adding 102396k swap on /var/swap.  Priority:-1 extents:129 across:1754856k SS
[   99.970093] mmc0: final write to SD card still running
[  109.989881] mmc0: Timeout waiting for hardware interrupt - cmd12.
[  109.991062] mmcblk0: error -110 sending stop command, original cmd response 0x900, card status 0x900
[  110.894941] mmc0: final write to SD card still running
[  120.850409] mmc0: Timeout waiting for hardware interrupt - cmd12.
[  120.851588] mmcblk0: error -110 sending stop command, original cmd response 0x900, card status 0x900
[  122.210909] mmc0: final write to SD card still running
[  132.230938] mmc0: Timeout waiting for hardware interrupt - cmd12.
[  132.231139] mmcblk0: error -110 sending stop command, original cmd response 0x900, card status 0x900
[  135.950697] mmc0: final write to SD card still running
[  145.951591] mmc0: Timeout waiting for hardware interrupt - cmd12.
[  145.951771] mmcblk0: error -110 sending stop command, original cmd response 0x900, card status 0x900
[  146.627959] mmc0: final write to SD card still running
[  156.592104] mmc0: Timeout waiting for hardware interrupt - cmd12.
[  156.592282] mmcblk0: error -110 sending stop command, original cmd response 0x900, card status 0x900
[  160.637568] mmc0: final write to SD card still running
[  170.592766] mmc0: Timeout waiting for hardware interrupt - cmd12.
[  170.593944] mmcblk0: error -110 sending stop command, original cmd response 0x900, card status 0x900
[  173.444624] mmc0: final write to SD card still running
[  183.473371] mmc0: Timeout waiting for hardware interrupt - cmd12.
[  183.474546] mmcblk0: error -110 sending stop command, original cmd response 0x900, card status 0x900
[  192.866128] mmc0: final write to SD card still running
[  202.874301] mmc0: Timeout waiting for hardware interrupt - cmd12.
[  202.875486] mmcblk0: error -110 sending stop command, original cmd response 0x900, card status 0x900
[  204.578845] mmc0: final write to SD card still running
[  214.594866] mmc0: Timeout waiting for hardware interrupt - cmd12.
[  214.596044] mmcblk0: error -110 sending stop command, original cmd response 0x900, card status 0x900
[  214.689822] mmc0: final write to SD card still running
[  224.715338] mmc0: Timeout waiting for hardware interrupt - cmd12.
[  224.715590] mmcblk0: error -110 sending stop command, original cmd response 0x900, card status 0x900
[  224.793116] mmc0: final write to SD card still running
[  234.795837] mmc0: Timeout waiting for hardware interrupt - cmd12.
[  234.797008] mmcblk0: error -110 sending stop command, original cmd response 0x900, card status 0x900
[  234.893710] mmc0: final write to SD card still running
[  244.916311] mmc0: Timeout waiting for hardware interrupt - cmd12.
[  244.917503] mmcblk0: error -110 sending stop command, original cmd response 0x900, card status 0x900
[  257.502511] mmc0: final write to SD card still running
[  267.517383] mmc0: Timeout waiting for hardware interrupt - cmd12.
[  267.517604] mmcblk0: error -110 sending stop command, original cmd response 0x900, card status 0x900
[  269.601266] mmc0: final write to SD card still running
[  279.557951] mmc0: Timeout waiting for hardware interrupt - cmd12.
[  279.559153] mmcblk0: error -110 sending stop command, original cmd response 0x900, card status 0x900
[  301.676887] mmc0: final write to SD card still running
[  311.679476] mmc0: Timeout waiting for hardware interrupt - cmd12.
[  311.680788] mmcblk0: error -110 sending stop command, original cmd response 0x900, card status 0x900
[  336.640707] mmc0: Timeout waiting for hardware interrupt - cmd25.
[  336.640744] mmc0: resetting ongoing cmd 25DMA before 4096/4096 [12]/[19] complete
[  336.646472] mmcblk0: error -110 transferring data, sector 22771336, nr 152, cmd response 0x900, card status 0xc00
[  336.646663] mmc0: DMA IRQ 6 ignored - results were reset
[  336.646749] end_request: I/O error, dev mmcblk0, sector 22771425
[  336.646783] end_request: I/O error, dev mmcblk0, sector 22771432
[  336.646797] end_request: I/O error, dev mmcblk0, sector 22771440
[  336.646809] end_request: I/O error, dev mmcblk0, sector 22771448
[  336.646819] end_request: I/O error, dev mmcblk0, sector 22771456
[  336.646829] end_request: I/O error, dev mmcblk0, sector 22771464
[  336.646840] end_request: I/O error, dev mmcblk0, sector 22771472
[  336.646850] end_request: I/O error, dev mmcblk0, sector 22771480
[  336.646898] Buffer I/O error on device mmcblk0p2, logical block 2831057
[  336.646967] Buffer I/O error on device mmcblk0p2, logical block 2831058
[  336.646988] Buffer I/O error on device mmcblk0p2, logical block 2831059
[  336.647014] Buffer I/O error on device mmcblk0p2, logical block 2831060
[  336.647030] Buffer I/O error on device mmcblk0p2, logical block 2831061
[  336.647044] Buffer I/O error on device mmcblk0p2, logical block 2831062
[  336.647057] Buffer I/O error on device mmcblk0p2, logical block 2831063
[  336.647069] Buffer I/O error on device mmcblk0p2, logical block 2831064
[  336.647081] Buffer I/O error on device mmcblk0p2, logical block 2831065
[  336.647093] Buffer I/O error on device mmcblk0p2, logical block 2831066
[  336.647105] Buffer I/O error on device mmcblk0p2, logical block 2831067
[  336.647128] Buffer I/O error on device mmcblk0p2, logical block 2831068
[  336.647144] Buffer I/O error on device mmcblk0p2, logical block 2831069
[  336.647157] Buffer I/O error on device mmcblk0p2, logical block 2831070
[  336.647170] Buffer I/O error on device mmcblk0p2, logical block 2831071
[  336.647183] Buffer I/O error on device mmcblk0p2, logical block 2831072
[  336.647195] Buffer I/O error on device mmcblk0p2, logical block 2831073
[  336.647207] Buffer I/O error on device mmcblk0p2, logical block 2831074
[  336.647220] Buffer I/O error on device mmcblk0p2, logical block 2831075
[  336.647269] EXT4-fs warning (device mmcblk0p2): ext4_end_bio:317: I/O error writing to inode 4400 (offset 44896256 size 77824 starting block 2846436)
[  344.988318] IPVS: __ip_vs_del_service: enter
[  345.064394] IPVS: __ip_vs_del_service: enter
[  346.701146] mmc0: Timeout waiting for hardware interrupt - cmd25.
[  346.701183] mmc0: resetting ongoing cmd 25DMA before 4096/4096 [8]/[17] complete
[  346.705247] mmcblk0: error -110 transferring data, sector 22740832, nr 136, cmd response 0x900, card status 0xc00
[  346.705477] mmc0: DMA IRQ 6 ignored - results were reset
[  346.705569] end_request: I/O error, dev mmcblk0, sector 22740889
[  346.705586] end_request: I/O error, dev mmcblk0, sector 22740896
[  346.705599] end_request: I/O error, dev mmcblk0, sector 22740904
[  346.705626] end_request: I/O error, dev mmcblk0, sector 22740912
[  346.705640] end_request: I/O error, dev mmcblk0, sector 22740920
[  346.705651] end_request: I/O error, dev mmcblk0, sector 22740928
[  346.705662] end_request: I/O error, dev mmcblk0, sector 22740936
[  346.705672] end_request: I/O error, dev mmcblk0, sector 22740944
[  346.705682] end_request: I/O error, dev mmcblk0, sector 22740952
[  346.705692] end_request: I/O error, dev mmcblk0, sector 22740960
[  346.705713] Buffer I/O error on device mmcblk0p2, logical block 2827244
[  346.705750] Buffer I/O error on device mmcblk0p2, logical block 2827245
[  346.705767] Buffer I/O error on device mmcblk0p2, logical block 2827246
[  346.705781] Buffer I/O error on device mmcblk0p2, logical block 2827247
[  346.705794] Buffer I/O error on device mmcblk0p2, logical block 2827248
[  346.705807] Buffer I/O error on device mmcblk0p2, logical block 2827249
[  346.705819] Buffer I/O error on device mmcblk0p2, logical block 2827250
[  346.705831] Buffer I/O error on device mmcblk0p2, logical block 2827251
[  346.705843] Buffer I/O error on device mmcblk0p2, logical block 2827252
[  346.705854] Buffer I/O error on device mmcblk0p2, logical block 2827253
[  346.705881] Buffer I/O error on device mmcblk0p2, logical block 2827254
[  346.705896] Buffer I/O error on device mmcblk0p2, logical block 2827255
[  346.705908] Buffer I/O error on device mmcblk0p2, logical block 2827256
[  346.705920] Buffer I/O error on device mmcblk0p2, logical block 2827257
[  346.705932] Buffer I/O error on device mmcblk0p2, logical block 2827258
[  346.705944] Buffer I/O error on device mmcblk0p2, logical block 2827259
[  346.705956] Buffer I/O error on device mmcblk0p2, logical block 2827260
[  346.705994] EXT4-fs warning (device mmcblk0p2): ext4_end_bio:317: I/O error writing to inode 6807 (offset 247382016 size 69632 starting block 2842621)
[  348.439316] EXT4-fs error (device mmcblk0p2): htree_dirblock_to_tree:892: inode #200: block 7340: comm bash: bad entry in directory: directory entry across range - offset=0(0), inode=956301312, rec_len=11888, name_len=111
[  349.976650] mmc0: final write to SD card still running
[  360.001793] mmc0: Timeout waiting for hardware interrupt - cmd12.
[  360.002025] mmcblk0: error -110 sending stop command, original cmd response 0x900, card status 0x900
[  360.221943] EXT4-fs error (device mmcblk0p2): htree_dirblock_to_tree:892: inode #200: block 7340: comm ls: bad entry in directory: directory entry across range - offset=0(0), inode=956301312, rec_len=11888, name_len=111
[  380.022721] mmc0: Timeout waiting for hardware interrupt - cmd25.
[  380.022759] mmc0: resetting ongoing cmd 25DMA before 4096/4096 [14]/[19] complete
[  380.026330] mmcblk0: error -110 transferring data, sector 22740960, nr 152, cmd response 0x900, card status 0xc00
[  380.026505] mmc0: DMA IRQ 6 ignored - results were reset
[  380.026591] end_request: I/O error, dev mmcblk0, sector 22741063
[  380.026608] end_request: I/O error, dev mmcblk0, sector 22741064
[  380.026619] end_request: I/O error, dev mmcblk0, sector 22741072
[  380.026630] end_request: I/O error, dev mmcblk0, sector 22741080
[  380.026658] end_request: I/O error, dev mmcblk0, sector 22741088
[  380.026670] end_request: I/O error, dev mmcblk0, sector 22741096
[  380.026681] end_request: I/O error, dev mmcblk0, sector 22741104
[  380.026702] Buffer I/O error on device mmcblk0p2, logical block 2827260
[  380.026724] Buffer I/O error on device mmcblk0p2, logical block 2827261
[  380.026739] Buffer I/O error on device mmcblk0p2, logical block 2827262
[  380.026751] Buffer I/O error on device mmcblk0p2, logical block 2827263
[  380.026791] Buffer I/O error on device mmcblk0p2, logical block 2827264
[  380.026847] Buffer I/O error on device mmcblk0p2, logical block 2827265
[  380.026867] Buffer I/O error on device mmcblk0p2, logical block 2827266
[  380.026882] Buffer I/O error on device mmcblk0p2, logical block 2827267
[  380.026908] Buffer I/O error on device mmcblk0p2, logical block 2827268
[  380.026924] Buffer I/O error on device mmcblk0p2, logical block 2827269
[  380.026938] Buffer I/O error on device mmcblk0p2, logical block 2827270
[  380.026950] Buffer I/O error on device mmcblk0p2, logical block 2827271
[  380.026963] Buffer I/O error on device mmcblk0p2, logical block 2827272
[  380.026975] Buffer I/O error on device mmcblk0p2, logical block 2827273
[  380.026988] Buffer I/O error on device mmcblk0p2, logical block 2827274
[  380.027000] Buffer I/O error on device mmcblk0p2, logical block 2827275
[  380.027022] Buffer I/O error on device mmcblk0p2, logical block 2827276
[  380.027038] Buffer I/O error on device mmcblk0p2, logical block 2827277
[  380.027052] Buffer I/O error on device mmcblk0p2, logical block 2827278
[  380.027090] EXT4-fs warning (device mmcblk0p2): ext4_end_bio:317: I/O error writing to inode 6807 (offset 247447552 size 77824 starting block 2842639)
root@lb1:/usr/src# cd /sys/block/mmcblk0/device
root@lb1:/sys/block/mmcblk0/device# ls
block  csd   driver      fwrev  manfid  oemid  preferred_erase_size  serial     type
cid    date  erase_size  hwrev  name    power  scr                   subsystem  uevent
root@lb1:/sys/block/mmcblk0/device# for i in `ls *`
> do cat $i
> done
744a455344432020100805e67d00cb00
400e00325b590000782d7f800a400000
11/2012
512
0x0
0x1
0x000074
SDC
0x4a45
4194304
0235800000000000
0x0805e67d
SD
DRIVER=mmcblk
MMC_TYPE=SD
MMC_NAME=SDC
MODALIAS=mmc:block
cat: block:: Datei oder Verzeichnis nicht gefunden
cat: mmcblk0: Datei oder Verzeichnis nicht gefunden
cat: driver:: Datei oder Verzeichnis nicht gefunden
cat: bind: Datei oder Verzeichnis nicht gefunden
cat: mmc0:b368: Datei oder Verzeichnis nicht gefunden
DRIVER=mmcblk
MMC_TYPE=SD
MMC_NAME=SDC
MODALIAS=mmc:block
cat: unbind: Datei oder Verzeichnis nicht gefunden
cat: power:: Datei oder Verzeichnis nicht gefunden
cat: autosuspend_delay_ms: Datei oder Verzeichnis nicht gefunden
cat: control: Datei oder Verzeichnis nicht gefunden
cat: runtime_active_time: Datei oder Verzeichnis nicht gefunden
cat: runtime_status: Datei oder Verzeichnis nicht gefunden
cat: runtime_suspended_time: Datei oder Verzeichnis nicht gefunden
cat: subsystem:: Datei oder Verzeichnis nicht gefunden
cat: devices: Datei oder Verzeichnis nicht gefunden
cat: drivers: Datei oder Verzeichnis nicht gefunden
cat: drivers_autoprobe: Datei oder Verzeichnis nicht gefunden
cat: drivers_probe: Datei oder Verzeichnis nicht gefunden
DRIVER=mmcblk
MMC_TYPE=SD
MMC_NAME=SDC
MODALIAS=mmc:block
[  872.457680] EXT4-fs error (device mmcblk0p2): htree_dirblock_to_tree:892: inode #200: block 7340: comm ls: bad entry in directory: directory entry across range - offset=0(0), inode=956301312, rec_len=11888, name_len=111
[ 1077.819335] request_module: runaway loop modprobe binfmt-0000
[ 1080.424542] request_module: runaway loop modprobe binfmt-0000
...
[ 1087.992397] request_module: runaway loop modprobe binfmt-0000
[ 1104.143688] mmc0: final write to SD card still running
[ 1114.157600] mmc0: Timeout waiting for hardware interrupt - cmd12.
[ 1114.157790] mmcblk0: error -110 sending stop command, original cmd response 0x900, card status 0x900
[ 1116.131697] mmc0: final write to SD card still running
[ 1126.158135] mmc0: Timeout waiting for hardware interrupt - cmd12.
[ 1126.158360] mmcblk0: error -110 sending stop command, original cmd response 0x900, card status 0x900
[ 1126.527009] mmc0: final write to SD card still running
fsck offline the sdcard .. 
 fsck /dev/sdb2
fsck from util-linux 2.21.2
e2fsck 1.42.6 (21-Sep-2012)
/dev/sdb2: recovering journal
fsck.ext4: Bad magic number in super-block while trying to re-open /dev/sdb2
Signal (11) SIGSEGV si_code=SEGV_MAPERR fault addr=0x61
fsck.ext4[0x8071b26]
linux-gate.so.1(__kernel_rt_sigreturn+0x0)[0xb773d410]
/lib/libext2fs.so.2(ext2fs_mmp_stop+0x27)[0xb7712877]
fsck.ext4(fatal_error+0x4e)[0x80682de]
fsck.ext4(e2fsck_run_ext3_journal+0x316)[0x80677b6]
fsck.ext4(main+0x5ec)[0x805038c]
/lib/libc.so.6(__libc_start_main+0xf5)[0xb754c525]
fsck.ext4[0x8052e75]
rpool2:/mnt # dmesg | grep -i EXT4 | grep sdb
[  379.879229] EXT4-fs (sdb2): mounted filesystem with ordered data mode. Opts: (null)
[  441.177255] EXT4-fs error (device sdb2): ext4_lookup:1384: inode #2: comm ls: deleted inode referenced: 8194
[  441.399216] EXT4-fs error (device sdb2): ext4_lookup:1384: inode #2: comm ls: deleted inode referenced: 8193
cd /usr
 ls -la
ls: cannot access lib: Input/output error
ls: cannot access sbin: Input/output error
ls: cannot access bin: Input/output error
ls: cannot access games: Input/output error
ls: cannot access share: Input/output error
ls: cannot access include: Input/output error
total 24
drwxr-xr-x 10 root root 4096 Dec 15 18:31 .
drwxr-xr-x 24 root root 4096 Apr 22 16:39 ..
d?????????  ? ?    ?       ?            ? bin
d?????????  ? ?    ?       ?            ? games
d?????????  ? ?    ?       ?            ? include
d?????????  ? ?    ?       ?            ? lib
drwxrwsr-x 11 root   50 4096 Apr 19 03:25 local
d?????????  ? ?    ?       ?            ? sbin
d?????????  ? ?    ?       ?            ? share
-rw-r--r--  1 root root 9427 Jan 14 20:33 src

so what , the OS been corupped using EXT4 on an SD class 10 card .. somewhat.

Past .config kernel compile changes since my last 3.8.7
(my working base is http://www.raspberrypi.org/phpBB3/download/file.php?id=3174 with 3.8.7 )

 diff a/linux/.config linux-rpi-3.8.7-temp/.config
109c109
< # CONFIG_CGROUP_PERF is not set
---
> CONFIG_CGROUP_PERF=y
673a674
> # CONFIG_NETFILTER_XT_TARGET_LED is not set
976c977
< CONFIG_NET_CLS_CGROUP=m
---
> CONFIG_NET_CLS_CGROUP=y
1006c1007
< CONFIG_NETPRIO_CGROUP=m
---
> CONFIG_NETPRIO_CGROUP=y
1166a1168
> # CONFIG_MAC80211_LEDS is not set
1172a1175
> CONFIG_RFKILL_LEDS=y
1316c1319
< # CONFIG_OF_SELFTEST is not set
---
> CONFIG_OF_SELFTEST=y
1529c1532,1537
< # CONFIG_TARGET_CORE is not set
---
> CONFIG_TARGET_CORE=y
> CONFIG_TCM_IBLOCK=m
> CONFIG_TCM_FILEIO=m
> CONFIG_TCM_PSCSI=m
> CONFIG_LOOPBACK_TARGET=m
> CONFIG_ISCSI_TARGET=m
1755a1764
> CONFIG_RT2X00_LIB_LEDS=y
1821a1831
> # CONFIG_KEYBOARD_LM8323 is not set
1867a1878
> # CONFIG_INPUT_PWM_BEEPER is not set
1868a1880
> # CONFIG_INPUT_PCAP is not set
1944a1957
> CONFIG_HVC_DRIVER=y
1946c1959
< # CONFIG_VIRTIO_CONSOLE is not set
---
> CONFIG_VIRTIO_CONSOLE=m
2188c2201
< # CONFIG_MFD_CORE is not set
---
> CONFIG_MFD_CORE=m
2195,2197c2208,2210
< # CONFIG_HTC_EGPIO is not set
< # CONFIG_HTC_PASIC3 is not set
< # CONFIG_HTC_I2CPLD is not set
---
> CONFIG_HTC_EGPIO=y
> CONFIG_HTC_PASIC3=m
> CONFIG_HTC_I2CPLD=y
2241c2254
< # CONFIG_EZX_PCAP is not set
---
> CONFIG_EZX_PCAP=y
2265a2279
> # CONFIG_REGULATOR_PCAP is not set
2483c2497
< # CONFIG_FB_SYS_FOPS is not set
---
> CONFIG_FB_SYS_FOPS=m
2498a2513
> # CONFIG_FB_TMIO is not set
2520a2536
> # CONFIG_BACKLIGHT_PWM is not set
2538c2554
< # CONFIG_LOGO_LINUX_MONO is not set
---
> CONFIG_LOGO_LINUX_MONO=y
2540,2541c2556,2557
< CONFIG_LOGO_LINUX_CLUT224=y
< # CONFIG_FB_SSD1307 is not set
---
> # CONFIG_LOGO_LINUX_CLUT224 is not set
> CONFIG_FB_SSD1307=m
2653a2670
> # CONFIG_HID_PICOLCD_LEDS is not set
2670a2688,2689
> # CONFIG_HID_WACOM is not set
> # CONFIG_HID_WIIMOTE is not set
2904c2923,2964
< # CONFIG_NEW_LEDS is not set
---
> CONFIG_NEW_LEDS=y
> CONFIG_LEDS_CLASS=m
>
> #
> # LED drivers
> #
> CONFIG_LEDS_ATMEL_PWM=m
> CONFIG_LEDS_LM3530=m
> CONFIG_LEDS_LM3642=m
> CONFIG_LEDS_PCA9532=m
> CONFIG_LEDS_PCA9532_GPIO=y
> CONFIG_LEDS_GPIO=m
> CONFIG_LEDS_LP3944=m
> CONFIG_LEDS_LP5521=m
> CONFIG_LEDS_LP5523=m
> CONFIG_LEDS_PCA955X=m
> CONFIG_LEDS_PCA9633=m
> CONFIG_LEDS_DAC124S085=m
> CONFIG_LEDS_REGULATOR=m
> CONFIG_LEDS_BD2802=m
> CONFIG_LEDS_LT3593=m
> CONFIG_LEDS_TCA6507=m
> CONFIG_LEDS_LM355x=m
> CONFIG_LEDS_OT200=m
> CONFIG_LEDS_BLINKM=m
> CONFIG_LEDS_TRIGGERS=y
>
> #
> # LED Triggers
> #
> CONFIG_LEDS_TRIGGER_TIMER=m
> CONFIG_LEDS_TRIGGER_ONESHOT=m
> CONFIG_LEDS_TRIGGER_HEARTBEAT=m
> CONFIG_LEDS_TRIGGER_BACKLIGHT=m
> CONFIG_LEDS_TRIGGER_CPU=y
> CONFIG_LEDS_TRIGGER_GPIO=m
> CONFIG_LEDS_TRIGGER_DEFAULT_ON=m
>
> #
> # iptables trigger is under Netfilter config (LED target)
> #
> CONFIG_LEDS_TRIGGER_TRANSIENT=m
2906c2966,2969
< # CONFIG_EDAC is not set
---
> CONFIG_EDAC=y
> CONFIG_EDAC_LEGACY_SYSFS=y
> # CONFIG_EDAC_DEBUG is not set
> CONFIG_EDAC_MM_EDAC=m
2981a3045
> # CONFIG_RTC_DRV_PCAP is not set
3091c3155
< # CONFIG_DGRP is not set
---
> CONFIG_DGRP=m
3131c3195
< # CONFIG_PWM is not set
---
> CONFIG_PWM=y
@popcornmix

This comment has been minimized.

Copy link
Collaborator

commented Apr 23, 2013

Can you update (sudo BRANCH=next rpi-update) and then replace the kernel file with this one:
https://dl.dropboxusercontent.com/u/3669512/temp/kernel_mmc_revert.img

This backs out the changes between 3.6 and 3.8 kernels for sdhci.c. Let me know if it fixes anything.

@hvenzke

This comment has been minimized.

Copy link

commented Apr 23, 2013

will give it an try as far as i have OS back working.
at moment im force an fsck with extra options .. filesystem editing path guide by Tso .-)

/dev/sdb2 contains a file system with errors, check forced.
Pass 1: Checking inodes, blocks, and sizes

Running additional passes to resolve blocks claimed by more than one inode...

Pass 1B: Rescanning for multiply-claimed blocks

well an here the reason why the ext4 died

1B:
Illegal block number passed to ext2fs_test_block_bitmap #268435455 for multiply claimed block map
Illegal block number passed to ext2fs_test_block_bitmap #1065259007 for multiply claimed block map

...
1D:
clone_file_block: internal error: can't find dup_blk for 33026

@oerik

This comment has been minimized.

Copy link
Author

commented Apr 23, 2013

Negative at boot time:

[ 2.139912] mmc0: read SD Status register (SSR) after 3 attempts
[ 2.162078] mmc0: new high speed SDHC card at address 0007
[ 2.170416] mmcblk0: mmc0:0007 SD4GB 3.70 GiB
[ 2.179081] mmcblk0: p1 p2

[ 15.286984] EXT4-fs (mmcblk0p2): re-mounted. Opts: (null)
[ 15.934531] mmc0: final write to SD card still running
[ 25.957972] mmc0: Timeout waiting for hardware interrupt - cmd12.
[ 25.967136] mmcblk0: error -110 sending stop command, original cmd response 0x900, card status 0x900
[ 1019.457103] mmc0: final write to SD card still running
[ 1029.464236] mmc0: Timeout waiting for hardware interrupt - cmd12.
[ 1029.465397] mmcblk0: error -110 sending stop command, original cmd response 0x900, card status 0x900

Rebooted twice, same error. I'll keep it running for a night. I've seen these kind of errors before on other platforms, it had something to do with the initial/calculated SD clock frequency.

uname -a
Linux raspberrypi 3.8.8+ #421 PREEMPT Tue Apr 23 16:57:08 BST 2013 armv6l GNU/Linux

@hvenzke

This comment has been minimized.

Copy link

commented Apr 23, 2013

Due the ext4 died , had to reinstall rasbian and restore my configs .
I droped the overlocking to None .
Willl stress the kernel_mmc_revert.img kernel over night with kernel make 3.8.8 and revert tomorrow

@hvenzke

This comment has been minimized.

Copy link

commented Apr 24, 2013

So my test results +12h later ( still compiling 3.8.8 code from git 3.8.y ) : NO issues YET.

I assume this error
" mmc0: DMA IRQ 6 ignored - results were reset "
relalated to the not per default enabled dmaer_master module.

I assume this error :
"mc0: Timeout waiting for hardware interrupt - cmd12.
[ 183.474546] mmcblk0: error -110 sending stop command, original cmd response 0x900, card status 0x900"

Realated to the over-clocked and over-voltaged SD card controler - that Going OUT OF spec
Class 6 and 10 use lover volages the class 2 and 4 as i read some RPI Forums and specs past half day.

therefore ... for CLASS 6 and 10 Cards : Overclock is FORBIDDEN

resolution of the "BUG" :
add Kernel waring for users that Overcloking class 6 and 10 WILL CAUSE Filesystem corruption - ALLWAYS !!!
Ill update my Own Hack page and add an warning asap.

@popcornmix

This comment has been minimized.

Copy link
Collaborator

commented Apr 24, 2013

@remsnet are you talking about default 3.8.y kernel or kernel_mmc_revert.img?

"mmc0: DMA IRQ 6 ignored - results were reset" is harmless, and should probably be removed.
(as is "mmc0: missed completion of cmd 18 DMA (512/512 [1]/[1]) - ignoring it")

"mmc0: Timeout waiting for hardware interrupt - cmd12."/"mmcblk0: error -110 sending stop command" are dangerous.

Overclocking can cause sdcard errors. It tends to be board specific (i.e. some Pi's are more tolerant to overclock and sdcard corruption). I believe it is generally core_freq that causes the sdcard corruption (rather than arm_freq or sdram_freq).

I don't think this is related to class6/class10. Overclock doesn't affect the speed we communicate with sdcards.
We should never use the sdcard speeds that require a lower sdcard IO voltage. We certainly didn't for 3.6.y kernel, but the code has changed in 3.8.y kernel, so it is possible that is no longer behaving as expected.

kernel_mmc_revert.img reverts the mmc driver to 3.6.y version.

@hvenzke

This comment has been minimized.

Copy link

commented Apr 24, 2013

yes !

kernel_mmc_revert.img, test done past 14H with that.
I did that to be shure not caused by code changes.

Will give the 3.8.y same try as far as it been compiled .. still it runs yet..

yes the RPI is somewhat tolerant faults .. Thanks to driver coders as well.
BUT the Standard & Today ( kingston ,Transceed, others ) class 6/10 cards always use lower voltages then 2 & 4 .
This are seems SPEC realated if i not readed wrongly . Google for it .. you will find some usefull Infos.

root@lb1:/usr/src/linux# dmesg
[ 0.000000] Booting Linux on physical CPU 0x0
[ 0.000000] Initializing cgroup subsys cpu
[ 0.000000] Linux version 3.8.8+ (dc4@dc4-arm-01) (gcc version 4.7.2 20120731 (prerelease) (crosstool-NG linaro-1.13.1+bzr2458 - Linaro GCC 2012.08) ) #421 PREEMPT Tue Apr 23 16:57:08 BST 2013
[ 0.000000] CPU: ARMv6-compatible processor [410fb767] revision 7 (ARMv7), cr=00c5387d
[ 0.000000] CPU: PIPT / VIPT nonaliasing data cache, VIPT nonaliasing instruction cache
[ 0.000000] Machine: BCM2708
[ 0.000000] cma: CMA: reserved 16 MiB at 1d000000
[ 0.000000] Memory policy: ECC disabled, Data cache writeback
[ 0.000000] On node 0 totalpages: 122880
[ 0.000000] free_area_init_node: node 0, pgdat c0580244, node_mem_map c062a000
[ 0.000000] Normal zone: 960 pages used for memmap
[ 0.000000] Normal zone: 0 pages reserved
[ 0.000000] Normal zone: 121920 pages, LIFO batch:31
[ 0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
[ 0.000000] pcpu-alloc: [0] 0
[ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 121920
[ 0.000000] Kernel command line: dma.dmachans=0x7f35 bcm2708_fb.fbwidth=656 bcm2708_fb.fbheight=416 bcm2708.boardrev=0xf bcm2708.serial=0xf30d7eb6 smsc95xx.macaddr=B8:27:EB:0D:7E:B6 sdhci-bcm2708.emmc_clock_freq=100000000 vc_mem.mem_base=0x1ec00000 vc_mem.mem_size=0x20000000 dwc_otg.lpm_enable=0 console=ttyAMA0,115200 kgdboc=ttyAMA0,115200 console=tty1 root=/dev/mmcblk0p2 rootfstype=ext4 elevator=deadline rootwait
[ 0.000000] PID hash table entries: 2048 (order: 1, 8192 bytes)
[ 0.000000] Dentry cache hash table entries: 65536 (order: 6, 262144 bytes)
[ 0.000000] Inode-cache hash table entries: 32768 (order: 5, 131072 bytes)
[ 0.000000] __ex_table already sorted, skipping sort
[ 0.000000] Memory: 480MB = 480MB total
[ 0.000000] Memory: 464500k/464500k available, 27020k reserved, 0K highmem
[ 0.000000] Virtual kernel memory layout:
[ 0.000000] vector : 0xffff0000 - 0xffff1000 ( 4 kB)
[ 0.000000] fixmap : 0xfff00000 - 0xfffe0000 ( 896 kB)
[ 0.000000] vmalloc : 0xde800000 - 0xff000000 ( 520 MB)
[ 0.000000] lowmem : 0xc0000000 - 0xde000000 ( 480 MB)
[ 0.000000] modules : 0xbf000000 - 0xc0000000 ( 16 MB)
[ 0.000000] .text : 0xc0008000 - 0xc05287e4 (5250 kB)
[ 0.000000] .init : 0xc0529000 - 0xc054a52c ( 134 kB)
[ 0.000000] .data : 0xc054c000 - 0xc0580ac0 ( 211 kB)
[ 0.000000] .bss : 0xc0580ac0 - 0xc0629180 ( 674 kB)
[ 0.000000] NR_IRQS:330
[ 0.000000] sched_clock: 32 bits at 1000kHz, resolution 1000ns, wraps every 4294967ms
[ 0.000000] Switching to timer-based delay loop
[ 0.000000] Console: colour dummy device 80x30
[ 0.000000] console [tty1] enabled
[ 0.001176] Calibrating delay loop (skipped), value calculated using timer frequency.. 2.00 BogoMIPS (lpj=10000)
[ 0.001241] pid_max: default: 32768 minimum: 301
[ 0.001582] Mount-cache hash table entries: 512
[ 0.002287] Initializing cgroup subsys cpuacct
[ 0.002343] Initializing cgroup subsys devices
[ 0.002377] Initializing cgroup subsys freezer
[ 0.002408] Initializing cgroup subsys blkio
[ 0.002502] CPU: Testing write buffer coherency: ok
[ 0.002936] Setting up static identity map for 0x3cf7b8 - 0x3cf814
[ 0.004497] devtmpfs: initialized
[ 0.015083] NET: Registered protocol family 16
[ 0.021070] DMA: preallocated 4096 KiB pool for atomic coherent allocations
[ 0.022141] bcm2708.uart_clock = 0
[ 0.023428] hw-breakpoint: found 6 breakpoint and 1 watchpoint registers.
[ 0.023481] hw-breakpoint: maximum watchpoint size is 4 bytes.
[ 0.023518] mailbox: Broadcom VideoCore Mailbox driver
[ 0.023628] bcm2708_vcio: mailbox at f200b880
[ 0.023728] bcm_power: Broadcom power driver
[ 0.023766] bcm_power_open() -> 0
[ 0.023792] bcm_power_request(0, 8)
[ 0.524485] bcm_mailbox_read -> 00000080, 0
[ 0.524525] bcm_power_request -> 0
[ 0.524552] Serial: AMBA PL011 UART driver
[ 0.524699] dev:f1: ttyAMA0 at MMIO 0x20201000 (irq = 83) is a PL011 rev3
[ 0.855162] console [ttyAMA0] enabled
[ 0.877564] bio: create slab at 0
[ 0.882475] SCSI subsystem initialized
[ 0.886562] usbcore: registered new interface driver usbfs
[ 0.892145] usbcore: registered new interface driver hub
[ 0.897743] usbcore: registered new device driver usb
[ 0.904081] Switching to clocksource stc
[ 0.908325] FS-Cache: Loaded
[ 0.911458] CacheFiles: Loaded
[ 0.926614] NET: Registered protocol family 2
[ 0.931904] TCP established hash table entries: 4096 (order: 3, 32768 bytes)
[ 0.939154] TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
[ 0.945676] TCP: Hash tables configured (established 4096 bind 4096)
[ 0.952150] TCP: reno registered
[ 0.955406] UDP hash table entries: 256 (order: 0, 4096 bytes)
[ 0.961310] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[ 0.967873] NET: Registered protocol family 1
[ 0.972782] RPC: Registered named UNIX socket transport module.
[ 0.978826] RPC: Registered udp transport module.
[ 0.983548] RPC: Registered tcp transport module.
[ 0.988295] RPC: Registered tcp NFSv4.1 backchannel transport module.
[ 0.995444] bcm2708_dma: DMA manager at f2007000
[ 1.000229] bcm2708_gpio: bcm2708_gpio_probe c0559cd0
[ 1.005720] vc-mem: phys_addr:0x00000000 mem_base=0x1ec00000 mem_size:0x20000000(512 MiB)
[ 1.014898] audit: initializing netlink socket (disabled)
[ 1.020499] type=2000 audit(0.890:1): initialized
[ 1.146917] VFS: Disk quotas dquot_6.5.2
[ 1.151057] Dquot-cache hash table entries: 1024 (order 0, 4096 bytes)
[ 1.158047] FS-Cache: Netfs 'nfs' registered for caching
[ 1.163808] NFS: Registering the id_resolver key type
[ 1.169094] Key type id_resolver registered
[ 1.173299] Key type id_legacy registered
[ 1.177737] msgmni has been set to 939
[ 1.183525] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 252)
[ 1.191341] io scheduler noop registered
[ 1.195297] io scheduler deadline registered (default)
[ 1.200582] io scheduler cfq registered
[ 1.212225] Console: switching to colour frame buffer device 82x26
[ 1.223652] kgdb: Registered I/O driver kgdboc.
[ 1.230795] vc-cma: Videocore CMA driver
[ 1.236603] vc-cma: vc_cma_base = 0x00000000
[ 1.243216] vc-cma: vc_cma_size = 0x00000000 (0 MiB)
[ 1.250418] vc-cma: vc_cma_initial = 0x00000000 (0 MiB)
[ 1.266419] brd: module loaded
[ 1.276169] loop: module loaded
[ 1.281401] vchiq: vchiq_init_state: slot_zero = 0xdd000000, is_master = 0
[ 1.290823] Loading iSCSI transport class v2.0-870.
[ 1.298424] usbcore: registered new interface driver smsc95xx
[ 1.306152] dwc_otg: version 3.00a 10-AUG-2012 (platform bus)
[ 1.513807] Core Release: 2.80a
[ 1.518721] Setting default values for core params
[ 1.525232] Finished setting default values for core params
[ 1.732621] Using Buffer DMA mode
[ 1.737627] Periodic Transfer Interrupt Enhancement - disabled
[ 1.745149] Multiprocessor Interrupt Enhancement - disabled
[ 1.752434] OTG VER PARAM: 0, OTG VER FLAG: 0
[ 1.758512] Dedicated Tx FIFOs mode
[ 1.764173] dwc_otg: Microframe scheduler enabled
[ 1.764371] dwc_otg bcm2708_usb: DWC OTG Controller
[ 1.771073] dwc_otg bcm2708_usb: new USB bus registered, assigned bus number 1
[ 1.780101] dwc_otg bcm2708_usb: irq 32, io mem 0x00000000
[ 1.787314] Init: Port Power? op_state=1
[ 1.792950] Init: Power Port (0)
[ 1.797953] usb usb1: New USB device found, idVendor=1d6b, idProduct=0002
[ 1.806682] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1
[ 1.815790] usb usb1: Product: DWC OTG Controller
[ 1.822378] usb usb1: Manufacturer: Linux 3.8.8+ dwc_otg_hcd
[ 1.829892] usb usb1: SerialNumber: bcm2708_usb
[ 1.837020] hub 1-0:1.0: USB hub found
[ 1.842663] hub 1-0:1.0: 1 port detected
[ 1.848681] dwc_otg: FIQ enabled
[ 1.848700] dwc_otg: NAK holdoff enabled
[ 1.848738] Module dwc_common_port init
[ 1.848956] Initializing USB Mass Storage driver...
[ 1.855768] usbcore: registered new interface driver usb-storage
[ 1.863623] USB Mass Storage support registered.
[ 1.870315] mousedev: PS/2 mouse device common for all mice
[ 1.878321] bcm2835-cpufreq: min=700000 max=700000 cur=700000
[ 1.885931] bcm2835-cpufreq: switching to governor powersave
[ 1.893337] bcm2835-cpufreq: switching to governor powersave
[ 1.900681] cpuidle: using governor ladder
[ 1.906409] cpuidle: using governor menu
[ 1.911998] sdhci: Secure Digital Host Controller Interface driver
[ 1.919843] sdhci: Copyright(c) Pierre Ossman
[ 1.925895] sdhci: Enable low-latency mode
[ 1.968209] mmc0: SDHCI controller on BCM2708_Arasan [platform] using platform's DMA
[ 1.979542] mmc0: BCM2708 SDHC host at 0x20300000 DMA 2 IRQ 77
[ 1.987191] sdhci-pltfm: SDHCI platform and OF driver helper
[ 1.997169] usbcore: registered new interface driver usbhid
[ 2.007690] usbhid: USB HID core driver
[ 2.015931] TCP: cubic registered
[ 2.023099] Initializing XFRM netlink socket
[ 2.031245] NET: Registered protocol family 17
[ 2.039680] Key type dns_resolver registered
[ 2.048310] Indeed it is in host mode hprt0 = 00021501
[ 2.058552] VFP support v0.3: implementor 41 architecture 1 part 20 variant b rev 5
[ 2.078931] registered taskstats version 1
[ 2.094414] Waiting for root device /dev/mmcblk0p2...
[ 2.103555] mmc0: new high speed SDHC card at address b368
[ 2.118854] mmcblk0: mmc0:b368 SDC 15.0 GiB
[ 2.139948] mmcblk0: p1 p2
[ 2.278262] usb 1-1: new high-speed USB device number 2 using dwc_otg
[ 2.286838] Indeed it is in host mode hprt0 = 00001101
[ 2.459588] EXT4-fs (mmcblk0p2): mounted filesystem with ordered data mode. Opts: (null)
[ 2.471846] VFS: Mounted root (ext4 filesystem) on device 179:2.
[ 2.488530] usb 1-1: New USB device found, idVendor=0424, idProduct=9512
[ 2.497562] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 2.507158] devtmpfs: mounted
[ 2.512764] hub 1-1:1.0: USB hub found
[ 2.519025] Freeing init memory: 132K
[ 2.525122] hub 1-1:1.0: 3 ports detected
[ 2.808535] usb 1-1.1: new high-speed USB device number 3 using dwc_otg
[ 2.919094] usb 1-1.1: New USB device found, idVendor=0424, idProduct=ec00
[ 2.928396] usb 1-1.1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 2.941035] smsc95xx v1.0.4
[ 3.003224] smsc95xx 1-1.1:1.0 eth0: register 'smsc95xx' at usb-bcm2708_usb-1.1, smsc95xx USB 2.0 Ethernet, b8:27:eb:0d:7e:b6
[ 3.098557] usb 1-1.2: new full-speed USB device number 4 using dwc_otg
[ 3.242685] usb 1-1.2: New USB device found, idVendor=0bda, idProduct=8150
[ 3.259592] usb 1-1.2: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 3.278888] usb 1-1.2: Product: USB 10/100 LAN
[ 3.285593] usb 1-1.2: Manufacturer: REALTEK
[ 3.292025] usb 1-1.2: SerialNumber: 1609
[ 3.398606] usb 1-1.3: new low-speed USB device number 5 using dwc_otg
[ 3.538302] usb 1-1.3: New USB device found, idVendor=1c4f, idProduct=0002
[ 3.547329] usb 1-1.3: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[ 3.560467] usb 1-1.3: Product: USB Keykoard
[ 3.566865] usb 1-1.3: Manufacturer: USB
[ 3.586903] input: USB USB Keykoard as /devices/platform/bcm2708_usb/usb1/1-1/1-1.3/1-1.3:1.0/input/input0
[ 3.603528] hid-generic 0003:1C4F:0002.0001: input,hidraw0: USB HID v1.10 Keyboard [USB USB Keykoard] on usb-bcm2708_usb-1.3/input0
[ 3.633548] input: USB USB Keykoard as /devices/platform/bcm2708_usb/usb1/1-1/1-1.3/1-1.3:1.1/input/input1
[ 3.664429] hid-generic 0003:1C4F:0002.0002: input,hidraw1: USB HID v1.10 Device [USB USB Keykoard] on usb-bcm2708_usb-1.3/input1
[ 4.231671] udevd[155]: starting version 175
[ 5.535883] rtl8150 1-1.2:1.0: eth1: rtl8150 is detected
[ 5.633633] usbcore: registered new interface driver rtl8150
[ 10.665452] EXT4-fs (mmcblk0p2): re-mounted. Opts: (null)
[ 11.159572] EXT4-fs (mmcblk0p2): re-mounted. Opts: (null)
[ 11.972767] bcm2835 ALSA card created!
[ 11.986398] bcm2835 ALSA chip created!
[ 11.997720] bcm2835 ALSA chip created!
[ 12.005726] bcm2835 ALSA chip created!
[ 12.016127] bcm2835 ALSA chip created!
[ 12.027131] bcm2835 ALSA chip created!
[ 12.035041] bcm2835 ALSA chip created!
[ 12.046275] bcm2835 ALSA chip created!
[ 20.685266] net eth1: eth1: allmulti set
[ 21.118462] net eth1: eth1: allmulti set
[ 22.393466] smsc95xx 1-1.1:1.0 eth0: link up, 100Mbps, full-duplex, lpa 0xC5E1
[ 24.016884] bcm2835-cpufreq: switching to governor ondemand
[ 24.016931] bcm2835-cpufreq: switching to governor ondemand
[ 25.188346] nf_conntrack version 0.5.0 (7515 buckets, 30060 max)
[ 25.288554] NET: Registered protocol family 10
[ 25.290952] net eth1: eth1: allmulti set
[ 25.291275] net eth1: eth1: allmulti set
[ 25.328352] IPVS: Registered protocols (TCP, UDP, SCTP, AH, ESP)
[ 25.328473] IPVS: Connection hash table configured (size=4096, memory=32Kbytes)
[ 25.328865] IPVS: Creating netns size=1200 id=0
[ 25.328948] IPVS: ipvs loaded.
[ 26.045631] IPVS: sync thread started: state = MASTER, mcast_ifn = eth1, syncid = 0, id = 0
[ 28.354748] net eth1: eth1: allmulti set
[ 29.571133] Adding 102396k swap on /var/swap. Priority:-1 extents:129 across:1754856k SS
[ 45.111214] IPVS: [wlc] scheduler registered.
[ 568.924629] device-mapper: ioctl: 4.23.1-ioctl (2012-12-18) initialised: dm-devel@redhat.com
[ 884.732541] IPVS: __ip_vs_del_service: enter
[ 5595.335291] net eth1: eth1: allmulti set
[35927.007688] major device number 248
[35927.007713] vma list size 12, page list size 2008, page size 4096
[35927.007749] allocated dma channel 0 (f2007000), initial state 00000008
[35927.007761] post-reset 00000008
[38509.667439] smsc95xx 1-1.1:1.0 eth0: kevent 2 may have been dropped
root@lb1:/usr/src/linux# update
-su: update: Kommando nicht gefunden.
root@lb1:/usr/src/linux# uptime
12:49:02 up 12:31, 1 user, load average: 1,31, 1,24, 1,28

ls -la /boot
insgesamt 25004
drwxr-xr-x 2 root root 16384 Jan 1 1970 .
drwxr-xr-x 24 root root 4096 Apr 23 21:57 ..
-rwxr-xr-x 1 root root 17764 Apr 23 22:00 bootcode.bin
-rwxr-xr-x 1 root root 142 Dez 15 18:43 cmdline.txt
-rwxr-xr-x 1 root root 1234 Apr 23 20:02 config.txt
-rwxr-xr-x 1 root root 41 Apr 23 22:00 .firmware_revision
-rwxr-xr-x 1 root root 2264 Apr 23 22:00 fixup_cd.dat
-rwxr-xr-x 1 root root 5902 Apr 23 22:00 fixup.dat
-rwxr-xr-x 1 root root 8826 Apr 23 22:00 fixup_x.dat
-rwxr-xr-x 1 root root 137 Dez 16 20:51 issue.txt
-rwxr-xr-x 1 root root 2946872 Apr 23 22:00 kernel.3.8.8.img
-rwxr-xr-x 1 root root 9703816 Apr 23 22:00 kernel_emergency.img
-rwxr-xr-x 1 root root 2946864 Apr 23 22:03 kernel.img
-rwxr-xr-x 1 root root 2946864 Apr 23 22:03 kernel_mmc_revert.img
-rwxr-xr-x 1 root root 569976 Apr 23 22:00 start_cd.elf
-rwxr-xr-x 1 root root 2697556 Apr 23 22:00 start.elf
-rwxr-xr-x 1 root root 3661156 Apr 23 22:00 start_x.elf

.

@oerik

This comment has been minimized.

Copy link
Author

commented Apr 24, 2013

@popcornmix I've swapped the 4G SD card (It is an Kingston 4G microsd card) with an 8GB Transcend TS8GSDHC10. The Transcend does not return any errors.

If you want I can send the 4G card to you.

@popcornmix

This comment has been minimized.

Copy link
Collaborator

commented Apr 24, 2013

@oerik
Can you confirm the card's behaviour. Is it:
Works without problem on 3.6.11
Produces errors with 3.8.8
Produces errors with kernel_mmc_revert.img
?

@oerik

This comment has been minimized.

Copy link
Author

commented Apr 24, 2013

@popcornmix Yes confirmed, I've tripple checked it.

@oerik

This comment has been minimized.

Copy link
Author

commented Apr 25, 2013

@popcornmix Another rpi is having the same issues, same brand of (micro) SD card. Defaults settings (no overclocking):
[ 888.348054] mmc0: final write to SD card still running
[ 898.305008] mmc0: Timeout waiting for hardware interrupt - cmd12.
[ 898.306222] mmcblk0: error -110 sending stop command, original cmd response 0x900, card status 0x900
[ 898.797336] mmc0: final write to SD card still running
[ 908.825241] mmc0: Timeout waiting for hardware interrupt - cmd12.
[ 908.826431] mmcblk0: error -110 sending stop command, original cmd response 0x900, card status 0x900

uname -a
Linux raspberrypi 3.8.8+ #420 PREEMPT Tue Apr 23 16:17:46 BST 2013 armv6l GNU/Linux

@hvenzke

This comment has been minimized.

Copy link

commented Apr 26, 2013

@popcornmix , stresstested with 3.8.y with kernel compile : NO issues seen yet - Overclock disabled.
May you tell me what code differences may made between 3.6.y 3.8.y in some few words as you said ?

So it shuold not - from my point - an code issue with named branded sd cards , if i am not wrong.

Possible issues with No name cards that are not listed as supported at elinux.org.
as there listed some "Micro*" branded cards with RED flag.

@oerik may you able to update the list at http://elinux.org/RPi_SD_cards ?
add your blaming SD to not (yet ) support once...

If not send me the details i´ll do that for you. pictures i.e

@popcornmix , I added an Overclock Waring for class6 and 10 cards at http://elinux.org to drop down
Blaming Kernel DEV with Overclock SD Cards issues.
137 threads at raspberry.org ´s Forum are more then required about this...

@oerik

This comment has been minimized.

Copy link
Author

commented Apr 26, 2013

@remsnet, My el cheapo SD cards are working flawless under 3.6.11, even when overclocking 900. So there is a regression. I'm afraid that I am not the only one with this problem once 3.8 is going in various distro's. I'll update the rpi_sd_cards list.

@hvenzke

This comment has been minimized.

Copy link

commented Apr 26, 2013

@oerik well, yeah ... maybe there may an regression..
.. but hard to find without an fully debug flaged kernel( and IO, USB & Storange parts i.e )
and an 230K serial speed attached kdb debugger +log server ..
.. that whuold the next step on you site i.e , provide mass output on kernel debug level trace ..

Thats why i think´d to add an better an warning, either due the too many Forum threads, bevor we overload Gurus here. I think Stabily may more important then get the SD Stuff to work & stable on Overclocked mode. Call me party stuid or whatesoever.. . In the 199x i was doing equial tests things either with Alan and others for serval kernel parts due interests in HamRadio ( i am dg2sbv ) On Linux. .. my First kernel was 0.4.2

I don´t thing there will be an short fix YET abalible soon - correct me some one if you on other mood ..

@oerik

This comment has been minimized.

Copy link
Author

commented Apr 29, 2013

Small update, no improvement in Linux raspberrypi 3.8.10+ #429 PREEMPT Sun Apr 28 20:55:17 BST 2013 armv6l GNU/Linux.

@hvenzke

This comment has been minimized.

Copy link

commented May 8, 2013

Small update as well ,

Due to EXT4 filesystem cashes , 2 of my Pis where go offline and the wuole partion table was GONE !!
All files & dirs went to lost+found

( i allways have somewhere an fdisk -l stored .. so no data lost after fsck -)

Aother issue with EXT4 outage happen while fresh installed rabian december release at FIRST repoot with resizefs2.

I have my data on XFS due that now .

@popcornmix

This comment has been minimized.

Copy link
Collaborator

commented May 8, 2013

I spotted a possible spinlock issue in sdcard driver (on 3.8 tree), and have committed a fix.
I've pushed it to next firmware tree.
Can you test it?

@Vincent-C

This comment has been minimized.

Copy link

commented May 8, 2013

I think the fix might have worked...previously, with 3.8.11 and older from the firmware -next branch, I would see the same errors as above, but they don't show up in dmesg anymore after a reboot and waiting for about half a hour.

$ dmesg | grep mmc
[ 0.000000] Kernel command line: dma.dmachans=0x7f35 bcm2708_fb.fbwidth=656 bcm2708_fb.fbheight=416 bcm2708.boardrev=0xe bcm2708.serial=0x68e0c684 smsc95xx.macaddr=B8:27:EB:E0:C6:84 sdhci-bcm2708.emmc_clock_freq=100000000 vc_mem.mem_base=0x1fa00000 vc_mem.mem_size=0x20000000 dwc_otg.lpm_enable=0 console=ttyAMA0,115200 kgdboc=ttyAMA0,115200 console=tty1 root=/dev/mmcblk0p2 rootfstype=ext4 elevator=deadline rootwait
[ 1.988793] mmc0: SDHCI controller on BCM2708_Arasan [platform] using platform's DMA
[ 2.000188] mmc0: BCM2708 SDHC host at 0x20300000 DMA 2 IRQ 77
[ 2.119692] Waiting for root device /dev/mmcblk0p2...
[ 2.150906] mmc0: read SD Status register (SSR) after 2 attempts
[ 2.172736] mmc0: new high speed SDHC card at address b368
[ 2.186914] mmcblk0: mmc0:b368 NCard 7.47 GiB
[ 2.195053] mmcblk0: p1 p2
[ 2.265249] EXT4-fs (mmcblk0p2): mounted filesystem with ordered data mode. Opts: (null)
[ 28.998259] EXT4-fs (mmcblk0p2): re-mounted. Opts: (null)
[ 29.432833] EXT4-fs (mmcblk0p2): re-mounted. Opts: (null)
$ uname -a
Linux vcheng.org 3.8.12+ #440 PREEMPT Wed May 8 23:14:03 BST 2013 armv6l GNU/Linux

@oerik

This comment has been minimized.

Copy link
Author

commented May 9, 2013

@popcornmix Negative, same errors are reported on 3.8.12+.

@hvenzke

This comment has been minimized.

Copy link

commented May 9, 2013

@oerik did you overclock ?

@Vincent-C , try stress the sd card & FS i.e with an kernel or samba4 compile,
this create doszens of tons of mini files .

During the past lost-found digging near 90% all dirs contained just that files . some where realy DUPLICATED ID´s
Some where EXT4 COMPRESSED flagged ( how can that be , if i not explicit enable that ..)

@popcornmix updated , starting blaming the FS with kernel compile 3.9.y ..
no errors yet.

Linux nagios1 3.8.12+ #440 PREEMPT Wed May 8 23:14:03 BST 2013 armv6l GNU/Linux

@oerik

This comment has been minimized.

Copy link
Author

commented May 9, 2013

@remsnet Tested with default settings (no overclock). Other powersupply, overclocking (to the extreme), other RPI boards, doesn't matter. I have 4 of these SD cards and the behave all the same. At rootfs mount time the errors occur immediately.

@hvenzke

This comment has been minimized.

Copy link

commented May 10, 2013

[2443.807495] mmc0: Timeout waiting for hardware interrupt - cmd12.
[82443.808657] mmcblk0: error -110 sending stop command, original cmd response 0x900, card status 0x900
[82447.703908] mmc0: final write to SD card still running
[82457.728280] mmc0: Timeout waiting for hardware interrupt - cmd12.
[82457.729432] mmcblk0: error -110 sending stop command, original cmd response 0x900, card status 0x900
[82487.865070] mmc0: final write to SD card still running
[82497.890562] mmc0: Timeout waiting for hardware interrupt - cmd12.
[82497.891728] mmcblk0: error -110 sending stop command, original cmd response 0x900, card status 0x900
nagios1 ~ $ uptime
 11:14:58 up 22:56,  2 users,  load average: 0,60, 0,49, 0,26

Corruped within 1 day . last job on system - compiled 3.9.y kern

@hvenzke

This comment has been minimized.

Copy link

commented May 10, 2013

started doing an experiment : move /dev/mmcblk0p2 ( root ) to ext2 with 4 k blocks

@Ferroin

This comment has been minimized.

Copy link
Contributor

commented May 10, 2013

I have seen this transiently myself with a PNY brand class 4 16GB microSDHC card, but only on one of my two systems (interestingly the one with the problem is the newer of the two boards).

Only seems to happen for me on the first few boots after an unclean shutdown (first time I saw it was after having to reboot the system using SysRq after it had hung).

@ChristophHaag

This comment has been minimized.

Copy link
Contributor

commented Jun 8, 2013

@remsnet Thanks, I have tried a bit but it gets only worse.

For example, after a few tries with different parameters I am at

[    0.000000] Kernel command line: dma.dmachans=0x7f35 bcm2708_fb.fbwidth=1920 bcm2708_fb.fbheight=1080 bcm2708.boardrev=0xf bcm2708.serial=0x5a095a2a smsc95xx.macaddr=B8:27:EB:09:5A:2A sdhci-bcm2708.emmc_clock_freq=100000000 vc-cma-mem=0/0x1c00000@0x1d000000 mem=0x1c000000@0x0 mem=0x1c00000@0x1d000000 vc_mem.mem_base=0x1ec00000 vc_mem.mem_size=0x20000000  smsc95xx.turbo_mode=Y dwc_otg.lpm_enable=0 console=ttyAMA0,115200 kgdboc=ttyAMA0,115200 console=tty1 root=/dev/mmcblk0p2 rootfstype=ext4 elevator=noop sdhci-bcm2708.missing_status=0 sdhci-bcm2708.sync_after_dma=0 sdhci-bcm2708.enable_llm=0 rootwait

But this completeley broke the filesystem again I think.

[  432.589743] mmc0: Controller never released inhibit bit(s).
[  432.616597] mmcblk0: unknown error -5 sending read/write command, card status 0x900
[  432.649096] end_request: I/O error, dev mmcblk0, sector 191640
[  432.676154] Buffer I/O error on device mmcblk0p2, logical block 659
[  432.704513] lost page write due to I/O error on mmcblk0p2
[  440.986807] mmc0: Controller never released inhibit bit(s).
[  441.020302] mmcblk0: unknown error -5 sending read/write command, card status 0x900
[  441.052789] end_request: I/O error, dev mmcblk0, sector 449536
[  441.080042] end_request: I/O error, dev mmcblk0, sector 449544
[  441.107445] end_request: I/O error, dev mmcblk0, sector 449552
[  441.134766] Buffer I/O error on device mmcblk0p2, logical block 32896
[  441.163971] Buffer I/O error on device mmcblk0p2, logical block 32897
[  441.193202] Buffer I/O error on device mmcblk0p2, logical block 32898
[  441.222433] EXT4-fs warning (device mmcblk0p2): ext4_end_bio:294: I/O error writing to inode 7780 (offset 0 size 12288 starting block 56195)
[  463.595652] mmc0: Controller never released inhibit bit(s).
[  463.629907] mmcblk0: unknown error -5 sending read/write command, card status 0x900
[  463.662804] end_request: I/O error, dev mmcblk0, sector 645296
[  463.690352] Buffer I/O error on device mmcblk0p2, logical block 57366
[  463.719880] EXT4-fs warning (device mmcblk0p2): ext4_end_bio:294: I/O error writing to inode 18384 (offset 0 size 4096 starting block 80663)

etc.

Can PLEASE the manufacturer of the hardware step in and have a look why so many people can't write reliably to the intended device that holds the root file system?

@ghollingworth

This comment has been minimized.

Copy link
Contributor

commented Jun 8, 2013

For the last two months I've been asking people who've reported a reproducible issue to send me their Pi, power supply and sdcard with instructions on how to best reproduce it...

Unfortunately nobody has so we cannot make any progress

Gordon

@ChristophHaag

This comment has been minimized.

Copy link
Contributor

commented Jun 8, 2013

Well, I'm in germany and I think sending it around half the world is not the best solution. If ssh access (with root access of course) would help I'd be happy to give it though.

As for the sd card, I only know that it's a sandisk ultra 16 gb sdhc with 30 MB/s but there are still different cards that fit that description, even with class 6 and class 10.

@licaon-kter

This comment has been minimized.

Copy link

commented Jun 8, 2013

Gordon is UK based afaik :)

@ghollingworth

This comment has been minimized.

Copy link
Contributor

commented Jun 8, 2013

Yes raspberry Pi is based in the UK

@ChristophHaag

This comment has been minimized.

Copy link
Contributor

commented Jun 8, 2013

UK sounds almost ok, but it's still an international shipping I'd only want to do if really necessary.

So... is ssh access really not enough, do you need to look at the hardware?

@ghollingworth

This comment has been minimized.

Copy link
Contributor

commented Jun 9, 2013

Yes,

I need to plug in the JTAG debug for the GPU, to understand what is
happening and that can't be done over ssh.

I'll make sure someone sends you a complete new set back out so you can
get something that worksŠ

Gordon Hollingworth,
Raspberry Pi,
Mount Pleasant House,
Mount Pleasant,
Cambridge
CB3 0RN
UK

@ChristophHaag

This comment has been minimized.

Copy link
Contributor

commented Jun 9, 2013

Ok, I'll send you the whole package on monday, the usb hub I used, the sd card with my archlinux (using linux-raspberrypi-latest 3.9.4) and the passwords and the raspberry pi itself.
I don't use it for much currently and I have other devices so a few days or weeks without one are not a problem for me.

@ghollingworth

This comment has been minimized.

Copy link
Contributor

commented Jun 9, 2013

Thanks,

Can you give expected time to failure and how you've reproduced the problem?

Gordon

@ChristophHaag

This comment has been minimized.

Copy link
Contributor

commented Jun 9, 2013

With the default configs I get this error:

[13288.492420] mmc0: final write to SD card still running
[13298.479242] mmc0: Timeout waiting for hardware interrupt - cmd12.
[13298.480375] mmcblk0: error -110 sending stop command, original cmd response 0x900, card status 0x900

Often it appears already while booting. If not, it is provoked in a matter of seconds to a few minutes just doing some disk i/o, copying stuff or updating or something like that. I think this error results in mostly (?) slowdowns while it recovers, but other I/O errors almost surely lead to serious file system corruption.

I have tried some of the combinations of kernel parameters posted over the course of this thread and sometimes the errors got more rare, but I don't think they ever vanished. Only for some combinations that error was replaced with more serious I/O errors like the one I posted above (but I think I still had it overclocked at this point and pretty much forgot to test whether it would vanish with default frequencies and now it's already packed up). But anyway, I think they main point is that neither errors should appear and rather have workarounds implemented.

@hvenzke

This comment has been minimized.

Copy link

commented Jun 10, 2013

Hello fellows ,

my thinking are

  • no use of Overclock at all
  • no use preempt kernels for sd cards bigger then 4G

@popcornmix / @ghollingworth ,
may you able to provide an Non-preempt kernel.img with branch next please as an seperat image i.e as "server_kernel.img" PLEASE.

@ghollingworth @popcornmix

I have the 0x900 issue as well with Pi Model A with class 4 Transcend 16G SDHC cards .

@ghollingworth

This comment has been minimized.

Copy link
Contributor

commented Jun 13, 2013

So have been looking into the problem from @ChristophHaag and it seems it's purely related to the card.

Imaging the card and copying to a class 4 card and the problem goes away... Just need to understand SDCard specification and the timing issues to find out what's happened now... Christoph, am returning your kit with replaced Class 4 4G card + camera (sorry don't have any 16G cards in the office) so thought a camera might be a good replacement

Thanks

Gordon

@oerik

This comment has been minimized.

Copy link
Author

commented Jun 16, 2013

As creator of this ticket I wonder if this is the right time to close it. I was able to resolve my issue with the 3.8 and 3.9 kernels with 'sdhci_bcm2708.sync_after_dma=0' in cmdline.txt. I believe the phenomenon is not fully understood but the workarounds seem ok to me. I just rebooted a rpi after 15 days uptime (every hour there is data written) and no problems detected

@ghollingworth I have a 4Gb class 10 micro sd card that works oob with 3.6 and failed on 3.8 and 3.9 (multiple rPI's testen). Let me know if you are interested in this card.

@ottuzzi

This comment has been minimized.

Copy link

commented Jun 18, 2013

@ghollingworth I think that in this thread we have different cases:

  • SD corruption
    • @ChristophHaag with a problematic SD
    • @oerik with another problematic SD but it looks like it is fixed using sdhci_bcm2708.sync_after_dma=0 in cmdline.txt
  • SD corruption under overclocking conditions (my own situation)

I think we should split all of these as they are probably different: I would propose to close this 'very rich' thread and move on single entity reporting.
I also think that it should be made clear if SD corruption under overclocking is a problem or not: as a user I would like my raspi can be overclocked at 1000MHz without problem but I can understand if you say 'if you overclock you are on your own'. To sum up: should you reject SD corruption under overclock? If it is so of all this thread I think the only real issue is @oerik's one.

Bye
Piero

@popcornmix

This comment has been minimized.

Copy link
Collaborator

commented Jun 18, 2013

My best guess is that overclock based sdcard corruption is probably determined by the quality of the power supply. If you can play with a variety of power supplies, I'd be interested in hearing results.

Other than that, if you are suffering sdcard corruption when overclocking, reduce the overclock, or try booting from a USB/NFS rootfs.

We are intending on spending some effort on understanding this fully, but resources are limited.

I'll close this issue, as oerik is happy. If anyone has new information, then continue to post here. If your issue is not covered here, then create a new issue.

@popcornmix popcornmix closed this Jun 18, 2013

@ottuzzi

This comment has been minimized.

Copy link

commented Jun 18, 2013

Hi @popcornmix,

in my own setup (8GB Class 10 Samsung SD MB-SP8GA/EU, linux 3.6.11+) I tried two different power supplies (one is a 2A Nexus 7 charger from Asus) and in both cases I saw SD corruption when overclocking: the culprit in my setup seems to be overclocking.
I actually bought a second raspberry pi, a second power supply [1] and a new SD [2] and I'll experiment on this: I'll let you know if I find something interesting.

Thanks for your work
Bye
Piero

[1]http://raspberrypi.rsdelivers.com/product/rs/hnp10i-microusb/micro-usb-multi-head-power-supply-for-raspberry-pi/7653311.aspx
[2]http://www.sony.co.uk/product/sd-expert-uhs-94mbs-sdhc-cards/sf8ux

@Srokap

This comment has been minimized.

Copy link

commented Aug 2, 2013

FYI I have this problem without overclocking, on original card, but when using power supply that gives only 550mA (700mA is theoretical absolute minimum requirement).

@popcornmix

This comment has been minimized.

Copy link
Collaborator

commented Aug 2, 2013

Yes, we believe overclocking related sdcard corruption is caused by voltage drops from power supply.
Your power supply is likely to drop voltage when current reaches 550mA.

@natevw

This comment has been minimized.

Copy link

commented Oct 29, 2013

I've been powering my RasPi off an Asus RT-N16 and dealing with all sorts of SD Card lockup and corruption issues. I'm not overclocking but am starting to suspect the router's USB port is only supplying ~500mA and this may still be the cause. I'll try a dedicated USB power transformer after the next system rebuild.

anholt pushed a commit to anholt/linux that referenced this issue Oct 12, 2015

Geert Uytterhoeven Thomas Gleixner
irqchip/renesas-irqc: Use a separate lockdep class
The renesas-irqc interrupt controller is cascaded to the GIC. Hence when
propagating wake-up settings to its parent interrupt controller, the
following lockdep warning is printed:

    =============================================
    [ INFO: possible recursive locking detected ]
    4.2.0-ape6evm-10725-g50fcd7643c034198 raspberrypi#280 Not tainted
    ---------------------------------------------
    s2ram/1072 is trying to acquire lock:
    (&irq_desc_lock_class){-.-...}, at: [<c008d3fc>] __irq_get_desc_lock+0x58/0x98

    but task is already holding lock:
    (&irq_desc_lock_class){-.-...}, at: [<c008d3fc>] __irq_get_desc_lock+0x58/0x98

    other info that might help us debug this:
    Possible unsafe locking scenario:

	  CPU0
	  ----
     lock(&irq_desc_lock_class);
     lock(&irq_desc_lock_class);

    *** DEADLOCK ***

    May be due to missing lock nesting notation

    6 locks held by s2ram/1072:
    #0:  (sb_writers#7){.+.+.+}, at: [<c012eb14>] __sb_start_write+0xa0/0xa8
    #1:  (&of->mutex){+.+.+.}, at: [<c019396c>] kernfs_fop_write+0x4c/0x1bc
    #2:  (s_active#24){.+.+.+}, at: [<c0193974>] kernfs_fop_write+0x54/0x1bc
    #3:  (pm_mutex){+.+.+.}, at: [<c008213c>] pm_suspend+0x10c/0x510
    #4:  (&dev->mutex){......}, at: [<c02af3c4>] __device_suspend+0xdc/0x2cc
    #5:  (&irq_desc_lock_class){-.-...}, at: [<c008d3fc>] __irq_get_desc_lock+0x58/0x98

    stack backtrace:
    CPU: 0 PID: 1072 Comm: s2ram Not tainted 4.2.0-ape6evm-10725-g50fcd7643c034198 raspberrypi#280
    Hardware name: Generic R8A73A4 (Flattened Device Tree)
    [<c0018078>] (unwind_backtrace) from [<c00144f0>] (show_stack+0x10/0x14)
    [<c00144f0>] (show_stack) from [<c0451f14>] (dump_stack+0x88/0x98)
    [<c0451f14>] (dump_stack) from [<c007b29c>] (__lock_acquire+0x15cc/0x20e4)
    [<c007b29c>] (__lock_acquire) from [<c007c6e0>] (lock_acquire+0xac/0x12c)
    [<c007c6e0>] (lock_acquire) from [<c0457c00>] (_raw_spin_lock_irqsave+0x40/0x54)
    [<c0457c00>] (_raw_spin_lock_irqsave) from [<c008d3fc>] (__irq_get_desc_lock+0x58/0x98)
    [<c008d3fc>] (__irq_get_desc_lock) from [<c008ebbc>] (irq_set_irq_wake+0x20/0xf8)
    [<c008ebbc>] (irq_set_irq_wake) from [<c0260770>] (irqc_irq_set_wake+0x20/0x4c)
    [<c0260770>] (irqc_irq_set_wake) from [<c008ec28>] (irq_set_irq_wake+0x8c/0xf8)
    [<c008ec28>] (irq_set_irq_wake) from [<c02cb8c0>] (gpio_keys_suspend+0x74/0xc0)
    [<c02cb8c0>] (gpio_keys_suspend) from [<c02ae8cc>] (dpm_run_callback+0x54/0x124)

Avoid this false positive by using a separate lockdep class for IRQC
interrupts.

Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Cc: Grygorii Strashko <grygorii.strashko@ti.com>
Cc: Magnus Damm <magnus.damm@gmail.com>
Cc: Jason Cooper <jason@lakedaemon.net>
Link: http://lkml.kernel.org/r/1441798974-25716-2-git-send-email-geert%2Brenesas@glider.be
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>

popcornmix pushed a commit that referenced this issue Apr 3, 2018

net: fix possible out-of-bound read in skb_network_protocol()
skb mac header is not necessarily set at the time skb_network_protocol()
is called. Use skb->data instead.

BUG: KASAN: slab-out-of-bounds in skb_network_protocol+0x46b/0x4b0 net/core/dev.c:2739
Read of size 2 at addr ffff8801b3097a0b by task syz-executor5/14242

CPU: 1 PID: 14242 Comm: syz-executor5 Not tainted 4.16.0-rc6+ #280
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x194/0x24d lib/dump_stack.c:53
 print_address_description+0x73/0x250 mm/kasan/report.c:256
 kasan_report_error mm/kasan/report.c:354 [inline]
 kasan_report+0x23c/0x360 mm/kasan/report.c:412
 __asan_report_load_n_noabort+0xf/0x20 mm/kasan/report.c:443
 skb_network_protocol+0x46b/0x4b0 net/core/dev.c:2739
 harmonize_features net/core/dev.c:2924 [inline]
 netif_skb_features+0x509/0x9b0 net/core/dev.c:3011
 validate_xmit_skb+0x81/0xb00 net/core/dev.c:3084
 validate_xmit_skb_list+0xbf/0x120 net/core/dev.c:3142
 packet_direct_xmit+0x117/0x790 net/packet/af_packet.c:256
 packet_snd net/packet/af_packet.c:2944 [inline]
 packet_sendmsg+0x3aed/0x60b0 net/packet/af_packet.c:2969
 sock_sendmsg_nosec net/socket.c:629 [inline]
 sock_sendmsg+0xca/0x110 net/socket.c:639
 ___sys_sendmsg+0x767/0x8b0 net/socket.c:2047
 __sys_sendmsg+0xe5/0x210 net/socket.c:2081

Fixes: 19acc32 ("gso: Handle Trans-Ether-Bridging protocol in skb_network_protocol()")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Pravin B Shelar <pshelar@ovn.org>
Reported-by: Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

nathanchance pushed a commit to nathanchance/pi-kernel that referenced this issue Apr 12, 2018

net: fix possible out-of-bound read in skb_network_protocol()
[ Upstream commit 1dfe82e ]

skb mac header is not necessarily set at the time skb_network_protocol()
is called. Use skb->data instead.

BUG: KASAN: slab-out-of-bounds in skb_network_protocol+0x46b/0x4b0 net/core/dev.c:2739
Read of size 2 at addr ffff8801b3097a0b by task syz-executor5/14242

CPU: 1 PID: 14242 Comm: syz-executor5 Not tainted 4.16.0-rc6+ raspberrypi#280
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x194/0x24d lib/dump_stack.c:53
 print_address_description+0x73/0x250 mm/kasan/report.c:256
 kasan_report_error mm/kasan/report.c:354 [inline]
 kasan_report+0x23c/0x360 mm/kasan/report.c:412
 __asan_report_load_n_noabort+0xf/0x20 mm/kasan/report.c:443
 skb_network_protocol+0x46b/0x4b0 net/core/dev.c:2739
 harmonize_features net/core/dev.c:2924 [inline]
 netif_skb_features+0x509/0x9b0 net/core/dev.c:3011
 validate_xmit_skb+0x81/0xb00 net/core/dev.c:3084
 validate_xmit_skb_list+0xbf/0x120 net/core/dev.c:3142
 packet_direct_xmit+0x117/0x790 net/packet/af_packet.c:256
 packet_snd net/packet/af_packet.c:2944 [inline]
 packet_sendmsg+0x3aed/0x60b0 net/packet/af_packet.c:2969
 sock_sendmsg_nosec net/socket.c:629 [inline]
 sock_sendmsg+0xca/0x110 net/socket.c:639
 ___sys_sendmsg+0x767/0x8b0 net/socket.c:2047
 __sys_sendmsg+0xe5/0x210 net/socket.c:2081

Fixes: 19acc32 ("gso: Handle Trans-Ether-Bridging protocol in skb_network_protocol()")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Pravin B Shelar <pshelar@ovn.org>
Reported-by: Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

popcornmix pushed a commit that referenced this issue Apr 16, 2018

net: fix possible out-of-bound read in skb_network_protocol()
[ Upstream commit 1dfe82e ]

skb mac header is not necessarily set at the time skb_network_protocol()
is called. Use skb->data instead.

BUG: KASAN: slab-out-of-bounds in skb_network_protocol+0x46b/0x4b0 net/core/dev.c:2739
Read of size 2 at addr ffff8801b3097a0b by task syz-executor5/14242

CPU: 1 PID: 14242 Comm: syz-executor5 Not tainted 4.16.0-rc6+ #280
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x194/0x24d lib/dump_stack.c:53
 print_address_description+0x73/0x250 mm/kasan/report.c:256
 kasan_report_error mm/kasan/report.c:354 [inline]
 kasan_report+0x23c/0x360 mm/kasan/report.c:412
 __asan_report_load_n_noabort+0xf/0x20 mm/kasan/report.c:443
 skb_network_protocol+0x46b/0x4b0 net/core/dev.c:2739
 harmonize_features net/core/dev.c:2924 [inline]
 netif_skb_features+0x509/0x9b0 net/core/dev.c:3011
 validate_xmit_skb+0x81/0xb00 net/core/dev.c:3084
 validate_xmit_skb_list+0xbf/0x120 net/core/dev.c:3142
 packet_direct_xmit+0x117/0x790 net/packet/af_packet.c:256
 packet_snd net/packet/af_packet.c:2944 [inline]
 packet_sendmsg+0x3aed/0x60b0 net/packet/af_packet.c:2969
 sock_sendmsg_nosec net/socket.c:629 [inline]
 sock_sendmsg+0xca/0x110 net/socket.c:639
 ___sys_sendmsg+0x767/0x8b0 net/socket.c:2047
 __sys_sendmsg+0xe5/0x210 net/socket.c:2081

Fixes: 19acc32 ("gso: Handle Trans-Ether-Bridging protocol in skb_network_protocol()")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Pravin B Shelar <pshelar@ovn.org>
Reported-by: Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

popcornmix pushed a commit that referenced this issue Oct 22, 2018

ipv6: mcast: fix a use-after-free in inet6_mc_check
syzbot found a use-after-free in inet6_mc_check [1]

The problem here is that inet6_mc_check() uses rcu
and read_lock(&iml->sflock)

So the fact that ip6_mc_leave_src() is called under RTNL
and the socket lock does not help us, we need to acquire
iml->sflock in write mode.

In the future, we should convert all this stuff to RCU.

[1]
BUG: KASAN: use-after-free in ipv6_addr_equal include/net/ipv6.h:521 [inline]
BUG: KASAN: use-after-free in inet6_mc_check+0xae7/0xb40 net/ipv6/mcast.c:649
Read of size 8 at addr ffff8801ce7f2510 by task syz-executor0/22432

CPU: 1 PID: 22432 Comm: syz-executor0 Not tainted 4.19.0-rc7+ #280
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1c4/0x2b4 lib/dump_stack.c:113
 print_address_description.cold.8+0x9/0x1ff mm/kasan/report.c:256
 kasan_report_error mm/kasan/report.c:354 [inline]
 kasan_report.cold.9+0x242/0x309 mm/kasan/report.c:412
 __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:433
 ipv6_addr_equal include/net/ipv6.h:521 [inline]
 inet6_mc_check+0xae7/0xb40 net/ipv6/mcast.c:649
 __raw_v6_lookup+0x320/0x3f0 net/ipv6/raw.c:98
 ipv6_raw_deliver net/ipv6/raw.c:183 [inline]
 raw6_local_deliver+0x3d3/0xcb0 net/ipv6/raw.c:240
 ip6_input_finish+0x467/0x1aa0 net/ipv6/ip6_input.c:345
 NF_HOOK include/linux/netfilter.h:289 [inline]
 ip6_input+0xe9/0x600 net/ipv6/ip6_input.c:426
 ip6_mc_input+0x48a/0xd20 net/ipv6/ip6_input.c:503
 dst_input include/net/dst.h:450 [inline]
 ip6_rcv_finish+0x17a/0x330 net/ipv6/ip6_input.c:76
 NF_HOOK include/linux/netfilter.h:289 [inline]
 ipv6_rcv+0x120/0x640 net/ipv6/ip6_input.c:271
 __netif_receive_skb_one_core+0x14d/0x200 net/core/dev.c:4913
 __netif_receive_skb+0x2c/0x1e0 net/core/dev.c:5023
 netif_receive_skb_internal+0x12c/0x620 net/core/dev.c:5126
 napi_frags_finish net/core/dev.c:5664 [inline]
 napi_gro_frags+0x75a/0xc90 net/core/dev.c:5737
 tun_get_user+0x3189/0x4250 drivers/net/tun.c:1923
 tun_chr_write_iter+0xb9/0x154 drivers/net/tun.c:1968
 call_write_iter include/linux/fs.h:1808 [inline]
 do_iter_readv_writev+0x8b0/0xa80 fs/read_write.c:680
 do_iter_write+0x185/0x5f0 fs/read_write.c:959
 vfs_writev+0x1f1/0x360 fs/read_write.c:1004
 do_writev+0x11a/0x310 fs/read_write.c:1039
 __do_sys_writev fs/read_write.c:1112 [inline]
 __se_sys_writev fs/read_write.c:1109 [inline]
 __x64_sys_writev+0x75/0xb0 fs/read_write.c:1109
 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x457421
Code: 75 14 b8 14 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 34 b5 fb ff c3 48 83 ec 08 e8 1a 2d 00 00 48 89 04 24 b8 14 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 63 2d 00 00 48 89 d0 48 83 c4 08 48 3d 01
RSP: 002b:00007f2d30ecaba0 EFLAGS: 00000293 ORIG_RAX: 0000000000000014
RAX: ffffffffffffffda RBX: 000000000000003e RCX: 0000000000457421
RDX: 0000000000000001 RSI: 00007f2d30ecabf0 RDI: 00000000000000f0
RBP: 0000000020000500 R08: 00000000000000f0 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000293 R12: 00007f2d30ecb6d4
R13: 00000000004c4890 R14: 00000000004d7b90 R15: 00000000ffffffff

Allocated by task 22437:
 save_stack+0x43/0xd0 mm/kasan/kasan.c:448
 set_track mm/kasan/kasan.c:460 [inline]
 kasan_kmalloc+0xc7/0xe0 mm/kasan/kasan.c:553
 __do_kmalloc mm/slab.c:3718 [inline]
 __kmalloc+0x14e/0x760 mm/slab.c:3727
 kmalloc include/linux/slab.h:518 [inline]
 sock_kmalloc+0x15a/0x1f0 net/core/sock.c:1983
 ip6_mc_source+0x14dd/0x1960 net/ipv6/mcast.c:427
 do_ipv6_setsockopt.isra.9+0x3afb/0x45d0 net/ipv6/ipv6_sockglue.c:743
 ipv6_setsockopt+0xbd/0x170 net/ipv6/ipv6_sockglue.c:933
 rawv6_setsockopt+0x59/0x140 net/ipv6/raw.c:1069
 sock_common_setsockopt+0x9a/0xe0 net/core/sock.c:3038
 __sys_setsockopt+0x1ba/0x3c0 net/socket.c:1902
 __do_sys_setsockopt net/socket.c:1913 [inline]
 __se_sys_setsockopt net/socket.c:1910 [inline]
 __x64_sys_setsockopt+0xbe/0x150 net/socket.c:1910
 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe

Freed by task 22430:
 save_stack+0x43/0xd0 mm/kasan/kasan.c:448
 set_track mm/kasan/kasan.c:460 [inline]
 __kasan_slab_free+0x102/0x150 mm/kasan/kasan.c:521
 kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528
 __cache_free mm/slab.c:3498 [inline]
 kfree+0xcf/0x230 mm/slab.c:3813
 __sock_kfree_s net/core/sock.c:2004 [inline]
 sock_kfree_s+0x29/0x60 net/core/sock.c:2010
 ip6_mc_leave_src+0x11a/0x1d0 net/ipv6/mcast.c:2448
 __ipv6_sock_mc_close+0x20b/0x4e0 net/ipv6/mcast.c:310
 ipv6_sock_mc_close+0x158/0x1d0 net/ipv6/mcast.c:328
 inet6_release+0x40/0x70 net/ipv6/af_inet6.c:452
 __sock_release+0xd7/0x250 net/socket.c:579
 sock_close+0x19/0x20 net/socket.c:1141
 __fput+0x385/0xa30 fs/file_table.c:278
 ____fput+0x15/0x20 fs/file_table.c:309
 task_work_run+0x1e8/0x2a0 kernel/task_work.c:113
 tracehook_notify_resume include/linux/tracehook.h:193 [inline]
 exit_to_usermode_loop+0x318/0x380 arch/x86/entry/common.c:166
 prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline]
 syscall_return_slowpath arch/x86/entry/common.c:268 [inline]
 do_syscall_64+0x6be/0x820 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe

The buggy address belongs to the object at ffff8801ce7f2500
 which belongs to the cache kmalloc-192 of size 192
The buggy address is located 16 bytes inside of
 192-byte region [ffff8801ce7f2500, ffff8801ce7f25c0)
The buggy address belongs to the page:
page:ffffea000739fc80 count:1 mapcount:0 mapping:ffff8801da800040 index:0x0
flags: 0x2fffc0000000100(slab)
raw: 02fffc0000000100 ffffea0006f6e548 ffffea000737b948 ffff8801da800040
raw: 0000000000000000 ffff8801ce7f2000 0000000100000010 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8801ce7f2400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8801ce7f2480: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
>ffff8801ce7f2500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                         ^
 ffff8801ce7f2580: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
 ffff8801ce7f2600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

popcornmix pushed a commit that referenced this issue Nov 4, 2018

ipv6: mcast: fix a use-after-free in inet6_mc_check
[ Upstream commit dc012f3 ]

syzbot found a use-after-free in inet6_mc_check [1]

The problem here is that inet6_mc_check() uses rcu
and read_lock(&iml->sflock)

So the fact that ip6_mc_leave_src() is called under RTNL
and the socket lock does not help us, we need to acquire
iml->sflock in write mode.

In the future, we should convert all this stuff to RCU.

[1]
BUG: KASAN: use-after-free in ipv6_addr_equal include/net/ipv6.h:521 [inline]
BUG: KASAN: use-after-free in inet6_mc_check+0xae7/0xb40 net/ipv6/mcast.c:649
Read of size 8 at addr ffff8801ce7f2510 by task syz-executor0/22432

CPU: 1 PID: 22432 Comm: syz-executor0 Not tainted 4.19.0-rc7+ #280
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1c4/0x2b4 lib/dump_stack.c:113
 print_address_description.cold.8+0x9/0x1ff mm/kasan/report.c:256
 kasan_report_error mm/kasan/report.c:354 [inline]
 kasan_report.cold.9+0x242/0x309 mm/kasan/report.c:412
 __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:433
 ipv6_addr_equal include/net/ipv6.h:521 [inline]
 inet6_mc_check+0xae7/0xb40 net/ipv6/mcast.c:649
 __raw_v6_lookup+0x320/0x3f0 net/ipv6/raw.c:98
 ipv6_raw_deliver net/ipv6/raw.c:183 [inline]
 raw6_local_deliver+0x3d3/0xcb0 net/ipv6/raw.c:240
 ip6_input_finish+0x467/0x1aa0 net/ipv6/ip6_input.c:345
 NF_HOOK include/linux/netfilter.h:289 [inline]
 ip6_input+0xe9/0x600 net/ipv6/ip6_input.c:426
 ip6_mc_input+0x48a/0xd20 net/ipv6/ip6_input.c:503
 dst_input include/net/dst.h:450 [inline]
 ip6_rcv_finish+0x17a/0x330 net/ipv6/ip6_input.c:76
 NF_HOOK include/linux/netfilter.h:289 [inline]
 ipv6_rcv+0x120/0x640 net/ipv6/ip6_input.c:271
 __netif_receive_skb_one_core+0x14d/0x200 net/core/dev.c:4913
 __netif_receive_skb+0x2c/0x1e0 net/core/dev.c:5023
 netif_receive_skb_internal+0x12c/0x620 net/core/dev.c:5126
 napi_frags_finish net/core/dev.c:5664 [inline]
 napi_gro_frags+0x75a/0xc90 net/core/dev.c:5737
 tun_get_user+0x3189/0x4250 drivers/net/tun.c:1923
 tun_chr_write_iter+0xb9/0x154 drivers/net/tun.c:1968
 call_write_iter include/linux/fs.h:1808 [inline]
 do_iter_readv_writev+0x8b0/0xa80 fs/read_write.c:680
 do_iter_write+0x185/0x5f0 fs/read_write.c:959
 vfs_writev+0x1f1/0x360 fs/read_write.c:1004
 do_writev+0x11a/0x310 fs/read_write.c:1039
 __do_sys_writev fs/read_write.c:1112 [inline]
 __se_sys_writev fs/read_write.c:1109 [inline]
 __x64_sys_writev+0x75/0xb0 fs/read_write.c:1109
 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x457421
Code: 75 14 b8 14 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 34 b5 fb ff c3 48 83 ec 08 e8 1a 2d 00 00 48 89 04 24 b8 14 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 63 2d 00 00 48 89 d0 48 83 c4 08 48 3d 01
RSP: 002b:00007f2d30ecaba0 EFLAGS: 00000293 ORIG_RAX: 0000000000000014
RAX: ffffffffffffffda RBX: 000000000000003e RCX: 0000000000457421
RDX: 0000000000000001 RSI: 00007f2d30ecabf0 RDI: 00000000000000f0
RBP: 0000000020000500 R08: 00000000000000f0 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000293 R12: 00007f2d30ecb6d4
R13: 00000000004c4890 R14: 00000000004d7b90 R15: 00000000ffffffff

Allocated by task 22437:
 save_stack+0x43/0xd0 mm/kasan/kasan.c:448
 set_track mm/kasan/kasan.c:460 [inline]
 kasan_kmalloc+0xc7/0xe0 mm/kasan/kasan.c:553
 __do_kmalloc mm/slab.c:3718 [inline]
 __kmalloc+0x14e/0x760 mm/slab.c:3727
 kmalloc include/linux/slab.h:518 [inline]
 sock_kmalloc+0x15a/0x1f0 net/core/sock.c:1983
 ip6_mc_source+0x14dd/0x1960 net/ipv6/mcast.c:427
 do_ipv6_setsockopt.isra.9+0x3afb/0x45d0 net/ipv6/ipv6_sockglue.c:743
 ipv6_setsockopt+0xbd/0x170 net/ipv6/ipv6_sockglue.c:933
 rawv6_setsockopt+0x59/0x140 net/ipv6/raw.c:1069
 sock_common_setsockopt+0x9a/0xe0 net/core/sock.c:3038
 __sys_setsockopt+0x1ba/0x3c0 net/socket.c:1902
 __do_sys_setsockopt net/socket.c:1913 [inline]
 __se_sys_setsockopt net/socket.c:1910 [inline]
 __x64_sys_setsockopt+0xbe/0x150 net/socket.c:1910
 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe

Freed by task 22430:
 save_stack+0x43/0xd0 mm/kasan/kasan.c:448
 set_track mm/kasan/kasan.c:460 [inline]
 __kasan_slab_free+0x102/0x150 mm/kasan/kasan.c:521
 kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528
 __cache_free mm/slab.c:3498 [inline]
 kfree+0xcf/0x230 mm/slab.c:3813
 __sock_kfree_s net/core/sock.c:2004 [inline]
 sock_kfree_s+0x29/0x60 net/core/sock.c:2010
 ip6_mc_leave_src+0x11a/0x1d0 net/ipv6/mcast.c:2448
 __ipv6_sock_mc_close+0x20b/0x4e0 net/ipv6/mcast.c:310
 ipv6_sock_mc_close+0x158/0x1d0 net/ipv6/mcast.c:328
 inet6_release+0x40/0x70 net/ipv6/af_inet6.c:452
 __sock_release+0xd7/0x250 net/socket.c:579
 sock_close+0x19/0x20 net/socket.c:1141
 __fput+0x385/0xa30 fs/file_table.c:278
 ____fput+0x15/0x20 fs/file_table.c:309
 task_work_run+0x1e8/0x2a0 kernel/task_work.c:113
 tracehook_notify_resume include/linux/tracehook.h:193 [inline]
 exit_to_usermode_loop+0x318/0x380 arch/x86/entry/common.c:166
 prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline]
 syscall_return_slowpath arch/x86/entry/common.c:268 [inline]
 do_syscall_64+0x6be/0x820 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe

The buggy address belongs to the object at ffff8801ce7f2500
 which belongs to the cache kmalloc-192 of size 192
The buggy address is located 16 bytes inside of
 192-byte region [ffff8801ce7f2500, ffff8801ce7f25c0)
The buggy address belongs to the page:
page:ffffea000739fc80 count:1 mapcount:0 mapping:ffff8801da800040 index:0x0
flags: 0x2fffc0000000100(slab)
raw: 02fffc0000000100 ffffea0006f6e548 ffffea000737b948 ffff8801da800040
raw: 0000000000000000 ffff8801ce7f2000 0000000100000010 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8801ce7f2400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8801ce7f2480: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
>ffff8801ce7f2500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                         ^
 ffff8801ce7f2580: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
 ffff8801ce7f2600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

popcornmix pushed a commit that referenced this issue Nov 4, 2018

ipv6: mcast: fix a use-after-free in inet6_mc_check
[ Upstream commit dc012f3 ]

syzbot found a use-after-free in inet6_mc_check [1]

The problem here is that inet6_mc_check() uses rcu
and read_lock(&iml->sflock)

So the fact that ip6_mc_leave_src() is called under RTNL
and the socket lock does not help us, we need to acquire
iml->sflock in write mode.

In the future, we should convert all this stuff to RCU.

[1]
BUG: KASAN: use-after-free in ipv6_addr_equal include/net/ipv6.h:521 [inline]
BUG: KASAN: use-after-free in inet6_mc_check+0xae7/0xb40 net/ipv6/mcast.c:649
Read of size 8 at addr ffff8801ce7f2510 by task syz-executor0/22432

CPU: 1 PID: 22432 Comm: syz-executor0 Not tainted 4.19.0-rc7+ #280
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1c4/0x2b4 lib/dump_stack.c:113
 print_address_description.cold.8+0x9/0x1ff mm/kasan/report.c:256
 kasan_report_error mm/kasan/report.c:354 [inline]
 kasan_report.cold.9+0x242/0x309 mm/kasan/report.c:412
 __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:433
 ipv6_addr_equal include/net/ipv6.h:521 [inline]
 inet6_mc_check+0xae7/0xb40 net/ipv6/mcast.c:649
 __raw_v6_lookup+0x320/0x3f0 net/ipv6/raw.c:98
 ipv6_raw_deliver net/ipv6/raw.c:183 [inline]
 raw6_local_deliver+0x3d3/0xcb0 net/ipv6/raw.c:240
 ip6_input_finish+0x467/0x1aa0 net/ipv6/ip6_input.c:345
 NF_HOOK include/linux/netfilter.h:289 [inline]
 ip6_input+0xe9/0x600 net/ipv6/ip6_input.c:426
 ip6_mc_input+0x48a/0xd20 net/ipv6/ip6_input.c:503
 dst_input include/net/dst.h:450 [inline]
 ip6_rcv_finish+0x17a/0x330 net/ipv6/ip6_input.c:76
 NF_HOOK include/linux/netfilter.h:289 [inline]
 ipv6_rcv+0x120/0x640 net/ipv6/ip6_input.c:271
 __netif_receive_skb_one_core+0x14d/0x200 net/core/dev.c:4913
 __netif_receive_skb+0x2c/0x1e0 net/core/dev.c:5023
 netif_receive_skb_internal+0x12c/0x620 net/core/dev.c:5126
 napi_frags_finish net/core/dev.c:5664 [inline]
 napi_gro_frags+0x75a/0xc90 net/core/dev.c:5737
 tun_get_user+0x3189/0x4250 drivers/net/tun.c:1923
 tun_chr_write_iter+0xb9/0x154 drivers/net/tun.c:1968
 call_write_iter include/linux/fs.h:1808 [inline]
 do_iter_readv_writev+0x8b0/0xa80 fs/read_write.c:680
 do_iter_write+0x185/0x5f0 fs/read_write.c:959
 vfs_writev+0x1f1/0x360 fs/read_write.c:1004
 do_writev+0x11a/0x310 fs/read_write.c:1039
 __do_sys_writev fs/read_write.c:1112 [inline]
 __se_sys_writev fs/read_write.c:1109 [inline]
 __x64_sys_writev+0x75/0xb0 fs/read_write.c:1109
 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x457421
Code: 75 14 b8 14 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 34 b5 fb ff c3 48 83 ec 08 e8 1a 2d 00 00 48 89 04 24 b8 14 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 63 2d 00 00 48 89 d0 48 83 c4 08 48 3d 01
RSP: 002b:00007f2d30ecaba0 EFLAGS: 00000293 ORIG_RAX: 0000000000000014
RAX: ffffffffffffffda RBX: 000000000000003e RCX: 0000000000457421
RDX: 0000000000000001 RSI: 00007f2d30ecabf0 RDI: 00000000000000f0
RBP: 0000000020000500 R08: 00000000000000f0 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000293 R12: 00007f2d30ecb6d4
R13: 00000000004c4890 R14: 00000000004d7b90 R15: 00000000ffffffff

Allocated by task 22437:
 save_stack+0x43/0xd0 mm/kasan/kasan.c:448
 set_track mm/kasan/kasan.c:460 [inline]
 kasan_kmalloc+0xc7/0xe0 mm/kasan/kasan.c:553
 __do_kmalloc mm/slab.c:3718 [inline]
 __kmalloc+0x14e/0x760 mm/slab.c:3727
 kmalloc include/linux/slab.h:518 [inline]
 sock_kmalloc+0x15a/0x1f0 net/core/sock.c:1983
 ip6_mc_source+0x14dd/0x1960 net/ipv6/mcast.c:427
 do_ipv6_setsockopt.isra.9+0x3afb/0x45d0 net/ipv6/ipv6_sockglue.c:743
 ipv6_setsockopt+0xbd/0x170 net/ipv6/ipv6_sockglue.c:933
 rawv6_setsockopt+0x59/0x140 net/ipv6/raw.c:1069
 sock_common_setsockopt+0x9a/0xe0 net/core/sock.c:3038
 __sys_setsockopt+0x1ba/0x3c0 net/socket.c:1902
 __do_sys_setsockopt net/socket.c:1913 [inline]
 __se_sys_setsockopt net/socket.c:1910 [inline]
 __x64_sys_setsockopt+0xbe/0x150 net/socket.c:1910
 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe

Freed by task 22430:
 save_stack+0x43/0xd0 mm/kasan/kasan.c:448
 set_track mm/kasan/kasan.c:460 [inline]
 __kasan_slab_free+0x102/0x150 mm/kasan/kasan.c:521
 kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528
 __cache_free mm/slab.c:3498 [inline]
 kfree+0xcf/0x230 mm/slab.c:3813
 __sock_kfree_s net/core/sock.c:2004 [inline]
 sock_kfree_s+0x29/0x60 net/core/sock.c:2010
 ip6_mc_leave_src+0x11a/0x1d0 net/ipv6/mcast.c:2448
 __ipv6_sock_mc_close+0x20b/0x4e0 net/ipv6/mcast.c:310
 ipv6_sock_mc_close+0x158/0x1d0 net/ipv6/mcast.c:328
 inet6_release+0x40/0x70 net/ipv6/af_inet6.c:452
 __sock_release+0xd7/0x250 net/socket.c:579
 sock_close+0x19/0x20 net/socket.c:1141
 __fput+0x385/0xa30 fs/file_table.c:278
 ____fput+0x15/0x20 fs/file_table.c:309
 task_work_run+0x1e8/0x2a0 kernel/task_work.c:113
 tracehook_notify_resume include/linux/tracehook.h:193 [inline]
 exit_to_usermode_loop+0x318/0x380 arch/x86/entry/common.c:166
 prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline]
 syscall_return_slowpath arch/x86/entry/common.c:268 [inline]
 do_syscall_64+0x6be/0x820 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe

The buggy address belongs to the object at ffff8801ce7f2500
 which belongs to the cache kmalloc-192 of size 192
The buggy address is located 16 bytes inside of
 192-byte region [ffff8801ce7f2500, ffff8801ce7f25c0)
The buggy address belongs to the page:
page:ffffea000739fc80 count:1 mapcount:0 mapping:ffff8801da800040 index:0x0
flags: 0x2fffc0000000100(slab)
raw: 02fffc0000000100 ffffea0006f6e548 ffffea000737b948 ffff8801da800040
raw: 0000000000000000 ffff8801ce7f2000 0000000100000010 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8801ce7f2400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8801ce7f2480: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
>ffff8801ce7f2500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                         ^
 ffff8801ce7f2580: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
 ffff8801ce7f2600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

popcornmix pushed a commit that referenced this issue Apr 8, 2019

mm,oom: don't kill global init via memory.oom.group
[ Upstream commit d342a0b ]

Since setting global init process to some memory cgroup is technically
possible, oom_kill_memcg_member() must check it.

  Tasks in /test1 are going to be killed due to memory.oom.group set
  Memory cgroup out of memory: Killed process 1 (systemd) total-vm:43400kB, anon-rss:1228kB, file-rss:3992kB, shmem-rss:0kB
  oom_reaper: reaped process 1 (systemd), now anon-rss:0kB, file-rss:0kB, shmem-rss:0kB
  Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000008b

#include <stdio.h>
#include <string.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>

int main(int argc, char *argv[])
{
	static char buffer[10485760];
	static int pipe_fd[2] = { EOF, EOF };
	unsigned int i;
	int fd;
	char buf[64] = { };
	if (pipe(pipe_fd))
		return 1;
	if (chdir("/sys/fs/cgroup/"))
		return 1;
	fd = open("cgroup.subtree_control", O_WRONLY);
	write(fd, "+memory", 7);
	close(fd);
	mkdir("test1", 0755);
	fd = open("test1/memory.oom.group", O_WRONLY);
	write(fd, "1", 1);
	close(fd);
	fd = open("test1/cgroup.procs", O_WRONLY);
	write(fd, "1", 1);
	snprintf(buf, sizeof(buf) - 1, "%d", getpid());
	write(fd, buf, strlen(buf));
	close(fd);
	snprintf(buf, sizeof(buf) - 1, "%lu", sizeof(buffer) * 5);
	fd = open("test1/memory.max", O_WRONLY);
	write(fd, buf, strlen(buf));
	close(fd);
	for (i = 0; i < 10; i++)
		if (fork() == 0) {
			char c;
			close(pipe_fd[1]);
			read(pipe_fd[0], &c, 1);
			memset(buffer, 0, sizeof(buffer));
			sleep(3);
			_exit(0);
		}
	close(pipe_fd[0]);
	close(pipe_fd[1]);
	sleep(3);
	return 0;
}

[   37.052923][ T9185] a.out invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=0
[   37.056169][ T9185] CPU: 4 PID: 9185 Comm: a.out Kdump: loaded Not tainted 5.0.0-rc4-next-20190131 #280
[   37.059205][ T9185] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 04/13/2018
[   37.062954][ T9185] Call Trace:
[   37.063976][ T9185]  dump_stack+0x67/0x95
[   37.065263][ T9185]  dump_header+0x51/0x570
[   37.066619][ T9185]  ? trace_hardirqs_on+0x3f/0x110
[   37.068171][ T9185]  ? _raw_spin_unlock_irqrestore+0x3d/0x70
[   37.069967][ T9185]  oom_kill_process+0x18d/0x210
[   37.071515][ T9185]  out_of_memory+0x11b/0x380
[   37.072936][ T9185]  mem_cgroup_out_of_memory+0xb6/0xd0
[   37.074601][ T9185]  try_charge+0x790/0x820
[   37.076021][ T9185]  mem_cgroup_try_charge+0x42/0x1d0
[   37.077629][ T9185]  mem_cgroup_try_charge_delay+0x11/0x30
[   37.079370][ T9185]  do_anonymous_page+0x105/0x5e0
[   37.080939][ T9185]  __handle_mm_fault+0x9cb/0x1070
[   37.082485][ T9185]  handle_mm_fault+0x1b2/0x3a0
[   37.083819][ T9185]  ? handle_mm_fault+0x47/0x3a0
[   37.085181][ T9185]  __do_page_fault+0x255/0x4c0
[   37.086529][ T9185]  do_page_fault+0x28/0x260
[   37.087788][ T9185]  ? page_fault+0x8/0x30
[   37.088978][ T9185]  page_fault+0x1e/0x30
[   37.090142][ T9185] RIP: 0033:0x7f8b183aefe0
[   37.091433][ T9185] Code: 20 f3 44 0f 7f 44 17 d0 f3 44 0f 7f 47 30 f3 44 0f 7f 44 17 c0 48 01 fa 48 83 e2 c0 48 39 d1 74 a3 66 0f 1f 84 00 00 00 00 00 <66> 44 0f 7f 01 66 44 0f 7f 41 10 66 44 0f 7f 41 20 66 44 0f 7f 41
[   37.096917][ T9185] RSP: 002b:00007fffc5d329e8 EFLAGS: 00010206
[   37.098615][ T9185] RAX: 00000000006010e0 RBX: 0000000000000008 RCX: 0000000000c30000
[   37.100905][ T9185] RDX: 00000000010010c0 RSI: 0000000000000000 RDI: 00000000006010e0
[   37.103349][ T9185] RBP: 0000000000000000 R08: 00007f8b188f4740 R09: 0000000000000000
[   37.105797][ T9185] R10: 00007fffc5d32420 R11: 00007f8b183aef40 R12: 0000000000000005
[   37.108228][ T9185] R13: 0000000000000000 R14: ffffffffffffffff R15: 0000000000000000
[   37.110840][ T9185] memory: usage 51200kB, limit 51200kB, failcnt 125
[   37.113045][ T9185] memory+swap: usage 0kB, limit 9007199254740988kB, failcnt 0
[   37.115808][ T9185] kmem: usage 0kB, limit 9007199254740988kB, failcnt 0
[   37.117660][ T9185] Memory cgroup stats for /test1: cache:0KB rss:49484KB rss_huge:30720KB shmem:0KB mapped_file:0KB dirty:0KB writeback:0KB inactive_anon:0KB active_anon:49700KB inactive_file:0KB active_file:0KB unevictable:0KB
[   37.123371][ T9185] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0,oom_memcg=/test1,task_memcg=/test1,task=a.out,pid=9188,uid=0
[   37.128158][ T9185] Memory cgroup out of memory: Killed process 9188 (a.out) total-vm:14456kB, anon-rss:10324kB, file-rss:504kB, shmem-rss:0kB
[   37.132710][ T9185] Tasks in /test1 are going to be killed due to memory.oom.group set
[   37.132833][   T54] oom_reaper: reaped process 9188 (a.out), now anon-rss:0kB, file-rss:0kB, shmem-rss:0kB
[   37.135498][ T9185] Memory cgroup out of memory: Killed process 1 (systemd) total-vm:43400kB, anon-rss:1228kB, file-rss:3992kB, shmem-rss:0kB
[   37.143434][ T9185] Memory cgroup out of memory: Killed process 9182 (a.out) total-vm:14456kB, anon-rss:76kB, file-rss:588kB, shmem-rss:0kB
[   37.144328][   T54] oom_reaper: reaped process 1 (systemd), now anon-rss:0kB, file-rss:0kB, shmem-rss:0kB
[   37.147585][ T9185] Memory cgroup out of memory: Killed process 9183 (a.out) total-vm:14456kB, anon-rss:6228kB, file-rss:512kB, shmem-rss:0kB
[   37.157222][ T9185] Memory cgroup out of memory: Killed process 9184 (a.out) total-vm:14456kB, anon-rss:6228kB, file-rss:508kB, shmem-rss:0kB
[   37.157259][ T9185] Memory cgroup out of memory: Killed process 9185 (a.out) total-vm:14456kB, anon-rss:6228kB, file-rss:512kB, shmem-rss:0kB
[   37.157291][ T9185] Memory cgroup out of memory: Killed process 9186 (a.out) total-vm:14456kB, anon-rss:4180kB, file-rss:508kB, shmem-rss:0kB
[   37.157306][   T54] oom_reaper: reaped process 9183 (a.out), now anon-rss:0kB, file-rss:0kB, shmem-rss:0kB
[   37.157328][ T9185] Memory cgroup out of memory: Killed process 9187 (a.out) total-vm:14456kB, anon-rss:4180kB, file-rss:512kB, shmem-rss:0kB
[   37.157452][ T9185] Memory cgroup out of memory: Killed process 9189 (a.out) total-vm:14456kB, anon-rss:6228kB, file-rss:512kB, shmem-rss:0kB
[   37.158733][ T9185] Memory cgroup out of memory: Killed process 9190 (a.out) total-vm:14456kB, anon-rss:552kB, file-rss:512kB, shmem-rss:0kB
[   37.160083][   T54] oom_reaper: reaped process 9186 (a.out), now anon-rss:0kB, file-rss:0kB, shmem-rss:0kB
[   37.160187][   T54] oom_reaper: reaped process 9189 (a.out), now anon-rss:0kB, file-rss:0kB, shmem-rss:0kB
[   37.206941][   T54] oom_reaper: reaped process 9185 (a.out), now anon-rss:0kB, file-rss:0kB, shmem-rss:0kB
[   37.212300][ T9185] Memory cgroup out of memory: Killed process 9191 (a.out) total-vm:14456kB, anon-rss:4180kB, file-rss:512kB, shmem-rss:0kB
[   37.212317][   T54] oom_reaper: reaped process 9190 (a.out), now anon-rss:0kB, file-rss:0kB, shmem-rss:0kB
[   37.218860][ T9185] Memory cgroup out of memory: Killed process 9192 (a.out) total-vm:14456kB, anon-rss:1080kB, file-rss:512kB, shmem-rss:0kB
[   37.227667][   T54] oom_reaper: reaped process 9192 (a.out), now anon-rss:0kB, file-rss:0kB, shmem-rss:0kB
[   37.292323][ T9193] abrt-hook-ccpp (9193) used greatest stack depth: 10480 bytes left
[   37.351843][    T1] Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000008b
[   37.354833][    T1] CPU: 7 PID: 1 Comm: systemd Kdump: loaded Not tainted 5.0.0-rc4-next-20190131 #280
[   37.357876][    T1] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 04/13/2018
[   37.361685][    T1] Call Trace:
[   37.363239][    T1]  dump_stack+0x67/0x95
[   37.365010][    T1]  panic+0xfc/0x2b0
[   37.366853][    T1]  do_exit+0xd55/0xd60
[   37.368595][    T1]  do_group_exit+0x47/0xc0
[   37.370415][    T1]  get_signal+0x32a/0x920
[   37.372449][    T1]  ? _raw_spin_unlock_irqrestore+0x3d/0x70
[   37.374596][    T1]  do_signal+0x32/0x6e0
[   37.376430][    T1]  ? exit_to_usermode_loop+0x26/0x9b
[   37.378418][    T1]  ? prepare_exit_to_usermode+0xa8/0xd0
[   37.380571][    T1]  exit_to_usermode_loop+0x3e/0x9b
[   37.382588][    T1]  prepare_exit_to_usermode+0xa8/0xd0
[   37.384594][    T1]  ? page_fault+0x8/0x30
[   37.386453][    T1]  retint_user+0x8/0x18
[   37.388160][    T1] RIP: 0033:0x7f42c06974a8
[   37.389922][    T1] Code: Bad RIP value.
[   37.391788][    T1] RSP: 002b:00007ffc3effd388 EFLAGS: 00010213
[   37.394075][    T1] RAX: 000000000000000e RBX: 00007ffc3effd390 RCX: 0000000000000000
[   37.396963][    T1] RDX: 000000000000002a RSI: 00007ffc3effd390 RDI: 0000000000000004
[   37.399550][    T1] RBP: 00007ffc3effd680 R08: 0000000000000000 R09: 0000000000000000
[   37.402334][    T1] R10: 00000000ffffffff R11: 0000000000000246 R12: 0000000000000001
[   37.404890][    T1] R13: ffffffffffffffff R14: 0000000000000884 R15: 000056460b1ac3b0

Link: http://lkml.kernel.org/r/201902010336.x113a4EO027170@www262.sakura.ne.jp
Fixes: 3d8b38e ("mm, oom: introduce memory.oom.group")
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Acked-by: Michal Hocko <mhocko@suse.com>
Cc: Roman Gushchin <guro@fb.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

popcornmix pushed a commit that referenced this issue Apr 8, 2019

mm,oom: don't kill global init via memory.oom.group
[ Upstream commit d342a0b ]

Since setting global init process to some memory cgroup is technically
possible, oom_kill_memcg_member() must check it.

  Tasks in /test1 are going to be killed due to memory.oom.group set
  Memory cgroup out of memory: Killed process 1 (systemd) total-vm:43400kB, anon-rss:1228kB, file-rss:3992kB, shmem-rss:0kB
  oom_reaper: reaped process 1 (systemd), now anon-rss:0kB, file-rss:0kB, shmem-rss:0kB
  Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000008b

#include <stdio.h>
#include <string.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>

int main(int argc, char *argv[])
{
	static char buffer[10485760];
	static int pipe_fd[2] = { EOF, EOF };
	unsigned int i;
	int fd;
	char buf[64] = { };
	if (pipe(pipe_fd))
		return 1;
	if (chdir("/sys/fs/cgroup/"))
		return 1;
	fd = open("cgroup.subtree_control", O_WRONLY);
	write(fd, "+memory", 7);
	close(fd);
	mkdir("test1", 0755);
	fd = open("test1/memory.oom.group", O_WRONLY);
	write(fd, "1", 1);
	close(fd);
	fd = open("test1/cgroup.procs", O_WRONLY);
	write(fd, "1", 1);
	snprintf(buf, sizeof(buf) - 1, "%d", getpid());
	write(fd, buf, strlen(buf));
	close(fd);
	snprintf(buf, sizeof(buf) - 1, "%lu", sizeof(buffer) * 5);
	fd = open("test1/memory.max", O_WRONLY);
	write(fd, buf, strlen(buf));
	close(fd);
	for (i = 0; i < 10; i++)
		if (fork() == 0) {
			char c;
			close(pipe_fd[1]);
			read(pipe_fd[0], &c, 1);
			memset(buffer, 0, sizeof(buffer));
			sleep(3);
			_exit(0);
		}
	close(pipe_fd[0]);
	close(pipe_fd[1]);
	sleep(3);
	return 0;
}

[   37.052923][ T9185] a.out invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=0
[   37.056169][ T9185] CPU: 4 PID: 9185 Comm: a.out Kdump: loaded Not tainted 5.0.0-rc4-next-20190131 #280
[   37.059205][ T9185] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 04/13/2018
[   37.062954][ T9185] Call Trace:
[   37.063976][ T9185]  dump_stack+0x67/0x95
[   37.065263][ T9185]  dump_header+0x51/0x570
[   37.066619][ T9185]  ? trace_hardirqs_on+0x3f/0x110
[   37.068171][ T9185]  ? _raw_spin_unlock_irqrestore+0x3d/0x70
[   37.069967][ T9185]  oom_kill_process+0x18d/0x210
[   37.071515][ T9185]  out_of_memory+0x11b/0x380
[   37.072936][ T9185]  mem_cgroup_out_of_memory+0xb6/0xd0
[   37.074601][ T9185]  try_charge+0x790/0x820
[   37.076021][ T9185]  mem_cgroup_try_charge+0x42/0x1d0
[   37.077629][ T9185]  mem_cgroup_try_charge_delay+0x11/0x30
[   37.079370][ T9185]  do_anonymous_page+0x105/0x5e0
[   37.080939][ T9185]  __handle_mm_fault+0x9cb/0x1070
[   37.082485][ T9185]  handle_mm_fault+0x1b2/0x3a0
[   37.083819][ T9185]  ? handle_mm_fault+0x47/0x3a0
[   37.085181][ T9185]  __do_page_fault+0x255/0x4c0
[   37.086529][ T9185]  do_page_fault+0x28/0x260
[   37.087788][ T9185]  ? page_fault+0x8/0x30
[   37.088978][ T9185]  page_fault+0x1e/0x30
[   37.090142][ T9185] RIP: 0033:0x7f8b183aefe0
[   37.091433][ T9185] Code: 20 f3 44 0f 7f 44 17 d0 f3 44 0f 7f 47 30 f3 44 0f 7f 44 17 c0 48 01 fa 48 83 e2 c0 48 39 d1 74 a3 66 0f 1f 84 00 00 00 00 00 <66> 44 0f 7f 01 66 44 0f 7f 41 10 66 44 0f 7f 41 20 66 44 0f 7f 41
[   37.096917][ T9185] RSP: 002b:00007fffc5d329e8 EFLAGS: 00010206
[   37.098615][ T9185] RAX: 00000000006010e0 RBX: 0000000000000008 RCX: 0000000000c30000
[   37.100905][ T9185] RDX: 00000000010010c0 RSI: 0000000000000000 RDI: 00000000006010e0
[   37.103349][ T9185] RBP: 0000000000000000 R08: 00007f8b188f4740 R09: 0000000000000000
[   37.105797][ T9185] R10: 00007fffc5d32420 R11: 00007f8b183aef40 R12: 0000000000000005
[   37.108228][ T9185] R13: 0000000000000000 R14: ffffffffffffffff R15: 0000000000000000
[   37.110840][ T9185] memory: usage 51200kB, limit 51200kB, failcnt 125
[   37.113045][ T9185] memory+swap: usage 0kB, limit 9007199254740988kB, failcnt 0
[   37.115808][ T9185] kmem: usage 0kB, limit 9007199254740988kB, failcnt 0
[   37.117660][ T9185] Memory cgroup stats for /test1: cache:0KB rss:49484KB rss_huge:30720KB shmem:0KB mapped_file:0KB dirty:0KB writeback:0KB inactive_anon:0KB active_anon:49700KB inactive_file:0KB active_file:0KB unevictable:0KB
[   37.123371][ T9185] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0,oom_memcg=/test1,task_memcg=/test1,task=a.out,pid=9188,uid=0
[   37.128158][ T9185] Memory cgroup out of memory: Killed process 9188 (a.out) total-vm:14456kB, anon-rss:10324kB, file-rss:504kB, shmem-rss:0kB
[   37.132710][ T9185] Tasks in /test1 are going to be killed due to memory.oom.group set
[   37.132833][   T54] oom_reaper: reaped process 9188 (a.out), now anon-rss:0kB, file-rss:0kB, shmem-rss:0kB
[   37.135498][ T9185] Memory cgroup out of memory: Killed process 1 (systemd) total-vm:43400kB, anon-rss:1228kB, file-rss:3992kB, shmem-rss:0kB
[   37.143434][ T9185] Memory cgroup out of memory: Killed process 9182 (a.out) total-vm:14456kB, anon-rss:76kB, file-rss:588kB, shmem-rss:0kB
[   37.144328][   T54] oom_reaper: reaped process 1 (systemd), now anon-rss:0kB, file-rss:0kB, shmem-rss:0kB
[   37.147585][ T9185] Memory cgroup out of memory: Killed process 9183 (a.out) total-vm:14456kB, anon-rss:6228kB, file-rss:512kB, shmem-rss:0kB
[   37.157222][ T9185] Memory cgroup out of memory: Killed process 9184 (a.out) total-vm:14456kB, anon-rss:6228kB, file-rss:508kB, shmem-rss:0kB
[   37.157259][ T9185] Memory cgroup out of memory: Killed process 9185 (a.out) total-vm:14456kB, anon-rss:6228kB, file-rss:512kB, shmem-rss:0kB
[   37.157291][ T9185] Memory cgroup out of memory: Killed process 9186 (a.out) total-vm:14456kB, anon-rss:4180kB, file-rss:508kB, shmem-rss:0kB
[   37.157306][   T54] oom_reaper: reaped process 9183 (a.out), now anon-rss:0kB, file-rss:0kB, shmem-rss:0kB
[   37.157328][ T9185] Memory cgroup out of memory: Killed process 9187 (a.out) total-vm:14456kB, anon-rss:4180kB, file-rss:512kB, shmem-rss:0kB
[   37.157452][ T9185] Memory cgroup out of memory: Killed process 9189 (a.out) total-vm:14456kB, anon-rss:6228kB, file-rss:512kB, shmem-rss:0kB
[   37.158733][ T9185] Memory cgroup out of memory: Killed process 9190 (a.out) total-vm:14456kB, anon-rss:552kB, file-rss:512kB, shmem-rss:0kB
[   37.160083][   T54] oom_reaper: reaped process 9186 (a.out), now anon-rss:0kB, file-rss:0kB, shmem-rss:0kB
[   37.160187][   T54] oom_reaper: reaped process 9189 (a.out), now anon-rss:0kB, file-rss:0kB, shmem-rss:0kB
[   37.206941][   T54] oom_reaper: reaped process 9185 (a.out), now anon-rss:0kB, file-rss:0kB, shmem-rss:0kB
[   37.212300][ T9185] Memory cgroup out of memory: Killed process 9191 (a.out) total-vm:14456kB, anon-rss:4180kB, file-rss:512kB, shmem-rss:0kB
[   37.212317][   T54] oom_reaper: reaped process 9190 (a.out), now anon-rss:0kB, file-rss:0kB, shmem-rss:0kB
[   37.218860][ T9185] Memory cgroup out of memory: Killed process 9192 (a.out) total-vm:14456kB, anon-rss:1080kB, file-rss:512kB, shmem-rss:0kB
[   37.227667][   T54] oom_reaper: reaped process 9192 (a.out), now anon-rss:0kB, file-rss:0kB, shmem-rss:0kB
[   37.292323][ T9193] abrt-hook-ccpp (9193) used greatest stack depth: 10480 bytes left
[   37.351843][    T1] Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000008b
[   37.354833][    T1] CPU: 7 PID: 1 Comm: systemd Kdump: loaded Not tainted 5.0.0-rc4-next-20190131 #280
[   37.357876][    T1] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 04/13/2018
[   37.361685][    T1] Call Trace:
[   37.363239][    T1]  dump_stack+0x67/0x95
[   37.365010][    T1]  panic+0xfc/0x2b0
[   37.366853][    T1]  do_exit+0xd55/0xd60
[   37.368595][    T1]  do_group_exit+0x47/0xc0
[   37.370415][    T1]  get_signal+0x32a/0x920
[   37.372449][    T1]  ? _raw_spin_unlock_irqrestore+0x3d/0x70
[   37.374596][    T1]  do_signal+0x32/0x6e0
[   37.376430][    T1]  ? exit_to_usermode_loop+0x26/0x9b
[   37.378418][    T1]  ? prepare_exit_to_usermode+0xa8/0xd0
[   37.380571][    T1]  exit_to_usermode_loop+0x3e/0x9b
[   37.382588][    T1]  prepare_exit_to_usermode+0xa8/0xd0
[   37.384594][    T1]  ? page_fault+0x8/0x30
[   37.386453][    T1]  retint_user+0x8/0x18
[   37.388160][    T1] RIP: 0033:0x7f42c06974a8
[   37.389922][    T1] Code: Bad RIP value.
[   37.391788][    T1] RSP: 002b:00007ffc3effd388 EFLAGS: 00010213
[   37.394075][    T1] RAX: 000000000000000e RBX: 00007ffc3effd390 RCX: 0000000000000000
[   37.396963][    T1] RDX: 000000000000002a RSI: 00007ffc3effd390 RDI: 0000000000000004
[   37.399550][    T1] RBP: 00007ffc3effd680 R08: 0000000000000000 R09: 0000000000000000
[   37.402334][    T1] R10: 00000000ffffffff R11: 0000000000000246 R12: 0000000000000001
[   37.404890][    T1] R13: ffffffffffffffff R14: 0000000000000884 R15: 000056460b1ac3b0

Link: http://lkml.kernel.org/r/201902010336.x113a4EO027170@www262.sakura.ne.jp
Fixes: 3d8b38e ("mm, oom: introduce memory.oom.group")
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Acked-by: Michal Hocko <mhocko@suse.com>
Cc: Roman Gushchin <guro@fb.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.