Re: Random panic in load_balance() with 3.16-rc

[Steven Rostedt <rostedt@goodmis.org>]

On Fri, 25 Jul 2014 11:29:06 -0700
Linus Torvalds <torvalds@linux-foundation.org> wrote:

> On Fri, Jul 25, 2014 at 7:02 AM, Steven Rostedt <rostedt@goodmis.org> wrote:
> >
> > But wouldn't it be rather trivial to run a static analyzer on the final
> > vmlinux to make sure there are no red zones? I mean, you would only need
> > to read each function and check to make sure that the offset of rbp is
> > within the change of rsp, wouldn't you?
> >
> > Almost seems like an objdump -rd into a perl script could do this.
> 
> I'm sure it's possible, but it sounds potentially complicated. It's
> not like the function prologue is fixed, and gcc will create code
> (including conditional branches etc) before the whole frame setup if
> there are simple things that can be done purely with the
> callee-clobbered registers etc.
> 
> Some simple pattern to make sure that the "sub $frame-size,%rsp" comes
> before any accesses to (%rbp) (when frame pointers are enabled)
> *might* work, but it might also end up missing things.
> 
> You want to try?
> 

Yeah, I could write something up. I probably wont get to it for a week
or two, but it shouldn't be too hard.

As you said, it will probably miss the complex cases where gcc finishes
the frame later in the function or with branches and such. But at least
it should be able to catch any totally retard set up. I compiled
Michel's file and I'll make sure that it at least catches that:

    3572:       48 c7 85 78 ff ff ff    movq   $0x0,-0x88(%rbp)
    3579:       00 00 00 00 
                        3579: R_X86_64_32S      load_balance_mask
    357d:       48 81 ec b8 00 00 00    sub    $0xb8,%rsp


-- Steve