Bug#724802: linux-image-3.2.0(-rt)-amd64: kernel memory corruption with forks and futexes

[Brian Silverman <bsilver16384@gmail.com>]

Package: src:linux

Version: 3.2.46-1+deb7u1

Severity: normal

I have some code that triggers kernel oopses, hangs, and assorted other seemingly random errors on both my machine and in a QEMU VM. I have kdump-tools set up to take crashdumps in the VM, but it only succeeds sometimes; sometimes the VM just reboots (goes back out through grub and everything) without taking a crashdump. Sometimes it instead just hangs or prints out any of a variety of kernel error messages. I have gotten several crashdumps out of it and they all look nothing alike (and at least one of them is so corrupted that it segfaults crash(8) (I'm going to file another bug for that)). I have also seen my userspace test code behave incorrectly before the kernel dies and more. It also triggered a KVM "internal error" (I'm going to file a bug for that too). All of these symptoms make me think that it's a memory corruption issue somewhere in the kernel.

I have succeeded in reproducing this both with linux-image-3.2.0-amd64 and linux-image-3.2.0-rt-amd64 (same version), and in a QEMU VM with just 1 processor. It seems to be easier to reproduce on the -rt kernel with 4 cores (that's how many my hardware has) with my test code, but I think that's partially because race conditions in my test code cause it to deadlock itself on the non-rt kernel instead of triggering the kernel bug.

My test code (attached) has pieces of a mutex and condition variable implementation using PI futexes and a really simple test of them (I got rid of all the parts of the mutex/condvar stuff that aren't used in this particular test). It doesn't require any special compile flags (just make sure not to define NDEBUG) (and -m32 doesn't change anything). The code forks off 100 processes which each loop infinitely, forking off another process which waits on the condition variable, signalling the condition variable, and then waiting for the short-lived process. I'm not sure exactly which part of this code causes the kernel bug, but it seems to be related to the large amount of forking and FUTEX_(WAIT/CMP)_REQUEUE_PI calls. It seems to always crash my VM running a -rt kernel with 4 cores within seconds and usually takes much longer to crash the -rt kernel with only 1 core or the non-rt kernel.

Here's the `reportbug -q --template -T none -s none -S normal -b --list-cc none -q linux-image-3.2.0-4-rt-amd64` output on my machine:

-- Package-specific info:

** Version:

Linux version 3.2.0-4-rt-amd64 (debian-kernel@lists.debian.org) (gcc version 4.6.3 (Debian 4.6.3-14) ) #1 SMP PREEMPT RT Debian 3.2.46-1+deb7u1

** Command line:

BOOT_IMAGE=/vmlinuz-3.2.0-4-rt-amd64 root=UUID=48656ad1-7e3b-437f-a3ef-74be4d26c33b ro quiet

** Not tainted

** Kernel log:

[73189.678080] kvm: disabling virtualization on CPU1

[73189.678088] CPU 1 is now offline

[73189.688330] kvm: disabling virtualization on CPU2

[73189.688346] CPU 2 is now offline

[73189.694806] kvm: disabling virtualization on CPU3

[73189.795367] CPU 3 is now offline

[73189.795968] Extended CMOS year: 2000

[73189.796049] PM: Creating hibernation image:

[73189.852972] PM: Need to copy 392219 pages

[73189.852974] PM: Normal pages needed: 392219 + 1024, available pages: 634287

[73189.796080] PM: Restoring platform NVS memory

[73189.796654] CPU0: Thermal monitoring handled by SMI

[73189.796710] Extended CMOS year: 2000

[73189.796738] Enabling non-boot CPUs ...

[73189.805308] Booting Node 0 Processor 1 APIC 0x1

[73189.805311] smpboot cpu 1: start_ip = 98000

[73189.816226] Calibrating delay loop (skipped) already calibrated this CPU

[73189.816238] Disabled fast string operations

[73189.816250] CPU1: Thermal monitoring handled by SMI

[73189.816272] kvm: enabling virtualization on CPU1

[73189.836716] NMI watchdog enabled, takes one hw-pmu counter.

[73189.841226] CPU1 is up

[73189.849783] Booting Node 0 Processor 2 APIC 0x2

[73189.849785] smpboot cpu 2: start_ip = 98000

[73189.860698] Calibrating delay loop (skipped) already calibrated this CPU

[73189.860710] Disabled fast string operations

[73189.860722] CPU2: Thermal monitoring handled by SMI

[73189.860742] kvm: enabling virtualization on CPU2

[73189.881283] NMI watchdog enabled, takes one hw-pmu counter.

[73189.881704] CPU2 is up

[73189.882020] Booting Node 0 Processor 3 APIC 0x3

[73189.882021] smpboot cpu 3: start_ip = 98000

[73189.893033] Calibrating delay loop (skipped) already calibrated this CPU

[73189.893044] Disabled fast string operations

[73189.893055] CPU3: Thermal monitoring handled by SMI

[73189.893075] kvm: enabling virtualization on CPU3

[73189.913855] NMI watchdog enabled, takes one hw-pmu counter.

[73189.914267] CPU3 is up

[73189.917358] ACPI: Waking up from system sleep state S4

[73189.945172] PM: early restore of devices complete after 1.119 msecs

[73190.088849] i915 0000:00:02.0: setting latency timer to 64

[73190.088855] ehci_hcd 0000:00:1a.0: setting latency timer to 64

[73190.088867] snd_hda_intel 0000:00:1b.0: setting latency timer to 64

[73190.088889] usb usb1: root hub lost power or was reset

[73190.088918] snd_hda_intel 0000:00:1b.0: irq 47 for MSI/MSI-X

[73190.089206] ehci_hcd 0000:00:1d.0: setting latency timer to 64

[73190.089235] usb usb4: root hub lost power or was reset

[73190.091592] ahci 0000:00:1f.2: setting latency timer to 64

[73190.091710] xhci_hcd 0000:02:00.0: setting latency timer to 64

[73190.091732] iwlwifi 0000:01:00.0: RF_KILL bit toggled to enable radio.

[73190.091734] usb usb2: root hub lost power or was reset

[73190.091736] usb usb3: root hub lost power or was reset

[73190.092782] ehci_hcd 0000:00:1a.0: cache line size of 64 is not supported

[73190.093117] ehci_hcd 0000:00:1d.0: cache line size of 64 is not supported

[73190.093144] sd 0:0:0:0: [sda] Starting disk

[73190.098914] xhci_hcd 0000:02:00.0: irq 41 for MSI/MSI-X

[73190.098918] xhci_hcd 0000:02:00.0: irq 42 for MSI/MSI-X

[73190.098923] xhci_hcd 0000:02:00.0: irq 43 for MSI/MSI-X

[73190.098927] xhci_hcd 0000:02:00.0: irq 44 for MSI/MSI-X

[73190.098931] xhci_hcd 0000:02:00.0: irq 45 for MSI/MSI-X

[73190.120159] [drm] Enabling RC6 states: RC6 on, RC6p off, RC6pp off

[73190.207165] Extended CMOS year: 2000

[73190.411225] ata2: SATA link up 1.5 Gbps (SStatus 113 SControl 300)

[73190.411303] ata1: SATA link up 3.0 Gbps (SStatus 123 SControl 300)

[73190.414251] ata1.00: configured for UDMA/133

[73190.415607] ata2.00: configured for UDMA/100

[73190.419154] ata5: SATA link down (SStatus 0 SControl 300)

[73190.583260] usb 2-2: reset low-speed USB device number 4 using xhci_hcd

[73190.613525] xhci_hcd 0000:02:00.0: xHCI xhci_drop_endpoint called with disabled ep ffff88010e838480

[73190.613537] usb 2-2: ep 0x81 - rounding interval to 64 microframes, ep desc says 80 microframes

[73190.714809] usb 1-1: reset high-speed USB device number 2 using ehci_hcd

[73190.958432] usb 4-1: reset high-speed USB device number 2 using ehci_hcd

[73191.162374] usb 1-1.4: reset high-speed USB device number 4 using ehci_hcd

[73191.370094] usb 4-1.5: reset full-speed USB device number 3 using ehci_hcd

[73191.465254] btusb 4-1.5:1.0: no reset_resume for driver btusb?

[73191.465257] btusb 4-1.5:1.1: no reset_resume for driver btusb?

[73191.713593] PM: restore of devices complete after 1627.246 msecs

[73191.713911] PM: Image restored successfully.

[73191.713914] Restarting tasks ... done.

[73191.714884] PM: Basic memory bitmaps freed

[73191.721881] video LNXVIDEO:00: Restoring backlight state

[    0.008000] Marking TSC unstable due to KVM discovered backwards TSC

[73307.848046] Switching to clocksource hpet

[73348.964375] iwlwifi 0000:01:00.0: L1 Enabled; Disabling L0S

[73348.971232] iwlwifi 0000:01:00.0: Radio type=0x2-0x2-0x1

[73349.084520] ADDRCONF(NETDEV_UP): wlan0: link is not ready

[73349.799041] r8169 0000:03:00.0: eth0: link down

[73349.799057] r8169 0000:03:00.0: eth0: link down

[73349.799358] ADDRCONF(NETDEV_UP): eth0: link is not ready

[73351.324370] r8169 0000:03:00.0: eth0: link up

[73351.325020] ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready

[73375.717939] wlan0: authenticate with 00:18:e7:f3:81:0e (try 1)

[73375.720489] wlan0: authenticated

[73375.721119] wlan0: associate with 00:18:e7:f3:81:0e (try 1)

[73375.725761] wlan0: RX AssocResp from 00:18:e7:f3:81:0e (capab=0x31 status=0 aid=1)

[73375.725773] wlan0: associated

[73375.732003] ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready

[73380.726700] iwlwifi 0000:01:00.0: Tx aggregation enabled on ra = 00:18:e7:f3:81:0e tid = 0

[74034.495012] iwlwifi 0000:01:00.0: Tx aggregation enabled on ra = 00:18:e7:f3:81:0e tid = 6

[75202.743658] kvm: SMP vm created on host with unstable TSC; guest TSC will not be reliable

** Model information

sys_vendor: Dell Inc.         

product_name: Dell System Inspiron N4110

product_version: 

chassis_vendor: Dell Inc.         

chassis_version: 0.1

bios_vendor: Dell Inc.         

bios_version: A04

board_vendor: Dell Inc.

board_name: 05TM8C

board_version: A00

** Loaded modules:

ftdi_sio

usbserial

nls_utf8

nls_cp437

vfat

fat

aes_x86_64

aes_generic

bnep

rfcomm

cpufreq_stats

cpufreq_userspace

cpufreq_conservative

cpufreq_powersave

binfmt_misc

uinput

fuse

ext2

mbcache

loop

kvm_intel

kvm

uvcvideo

videodev

v4l2_compat_ioctl32

media

arc4

snd_hda_codec_hdmi

snd_hda_codec_realtek

joydev

btusb

bluetooth

i915

coretemp

iwlwifi

crc16

crc32c_intel

dell_wmi

snd_hda_intel

snd_hda_codec

drm_kms_helper

snd_hwdep

drm

mac80211

ghash_clmulni_intel

snd_pcm

snd_page_alloc

sparse_keymap

cfg80211

wmi

snd_seq

snd_seq_device

snd_timer

i2c_algo_bit

dell_laptop

cryptd

i2c_i801

psmouse

serio_raw

evdev

acpi_cpufreq

pcspkr

mperf

snd

ac

video

processor

battery

button

rfkill

power_supply

iTCO_wdt

iTCO_vendor_support

i2c_core

dcdbas

soundcore

xfs

dm_mod

sg

ums_realtek

usb_storage

sd_mod

sr_mod

cdrom

crc_t10dif

usbhid

hid

xhci_hcd

thermal

r8169

thermal_sys

mii

ahci

libahci

libata

ehci_hcd

scsi_mod

usbcore

usb_common

** PCI devices:

00:00.0 Host bridge [0600]: Intel Corporation 2nd Generation Core Processor Family DRAM Controller [8086:0104] (rev 09)

Subsystem: Dell Device [1028:04d7]

Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx-

Status: Cap+ 66MHz- UDF- FastB2B+ ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort+ >SERR- <PERR- INTx-

Latency: 0

Capabilities: <access denied>

Kernel driver in use: agpgart-intel

00:02.0 VGA compatible controller [0300]: Intel Corporation 2nd Generation Core Processor Family Integrated Graphics Controller [8086:0116] (rev 09) (prog-if 00 [VGA controller])

Subsystem: Dell Device [1028:04d7]

Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+

Status: Cap+ 66MHz- UDF- FastB2B+ ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-

Latency: 0

Interrupt: pin A routed to IRQ 49

Region 0: Memory at d0000000 (64-bit, non-prefetchable) [size=4M]

Region 2: Memory at c0000000 (64-bit, prefetchable) [size=256M]

Region 4: I/O ports at 4000 [size=64]

Expansion ROM at <unassigned> [disabled]

Capabilities: <access denied>

Kernel driver in use: i915

00:16.0 Communication controller [0780]: Intel Corporation 6 Series/C200 Series Chipset Family MEI Controller #1 [8086:1c3a] (rev 04)

Subsystem: Dell Device [1028:04d7]

Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx-

Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-

Latency: 0

Interrupt: pin A routed to IRQ 11

Region 0: Memory at d1705000 (64-bit, non-prefetchable) [size=16]

Capabilities: <access denied>

00:1a.0 USB controller [0c03]: Intel Corporation 6 Series/C200 Series Chipset Family USB Enhanced Host Controller #2 [8086:1c2d] (rev 05) (prog-if 20 [EHCI])

Subsystem: Dell Device [1028:04d7]

Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx-

Status: Cap+ 66MHz- UDF- FastB2B+ ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-

Latency: 0

Interrupt: pin A routed to IRQ 16

Region 0: Memory at d170a000 (32-bit, non-prefetchable) [size=1K]

Capabilities: <access denied>

Kernel driver in use: ehci_hcd

00:1b.0 Audio device [0403]: Intel Corporation 6 Series/C200 Series Chipset Family High Definition Audio Controller [8086:1c20] (rev 05)

Subsystem: Dell Device [1028:04d7]

Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+

Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-

Latency: 0, Cache Line Size: 64 bytes

Interrupt: pin A routed to IRQ 47

Region 0: Memory at d1700000 (64-bit, non-prefetchable) [size=16K]

Capabilities: <access denied>

Kernel driver in use: snd_hda_intel

00:1c.0 PCI bridge [0604]: Intel Corporation 6 Series/C200 Series Chipset Family PCI Express Root Port 1 [8086:1c10] (rev b5) (prog-if 00 [Normal decode])

Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx-

Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-

Latency: 0, Cache Line Size: 64 bytes

Bus: primary=00, secondary=01, subordinate=01, sec-latency=0

Memory behind bridge: d1600000-d16fffff

Secondary status: 66MHz- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort+ <SERR- <PERR-

BridgeCtl: Parity- SERR- NoISA- VGA- MAbort- >Reset- FastB2B-

PriDiscTmr- SecDiscTmr- DiscTmrStat- DiscTmrSERREn-

Capabilities: <access denied>

Kernel driver in use: pcieport

00:1c.2 PCI bridge [0604]: Intel Corporation 6 Series/C200 Series Chipset Family PCI Express Root Port 3 [8086:1c14] (rev b5) (prog-if 00 [Normal decode])

Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx-

Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-

Latency: 0, Cache Line Size: 64 bytes

Bus: primary=00, secondary=02, subordinate=02, sec-latency=0

Memory behind bridge: d1500000-d15fffff

Secondary status: 66MHz- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort+ <SERR- <PERR-

BridgeCtl: Parity- SERR- NoISA- VGA- MAbort- >Reset- FastB2B-

PriDiscTmr- SecDiscTmr- DiscTmrStat- DiscTmrSERREn-

Capabilities: <access denied>

Kernel driver in use: pcieport

00:1c.4 PCI bridge [0604]: Intel Corporation 6 Series/C200 Series Chipset Family PCI Express Root Port 5 [8086:1c18] (rev b5) (prog-if 00 [Normal decode])

Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx-

Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-

Latency: 0, Cache Line Size: 64 bytes

Bus: primary=00, secondary=03, subordinate=03, sec-latency=0

I/O behind bridge: 00003000-00003fff

Prefetchable memory behind bridge: 00000000d0400000-00000000d04fffff

Secondary status: 66MHz- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- <SERR- <PERR-

BridgeCtl: Parity- SERR- NoISA- VGA- MAbort- >Reset- FastB2B-

PriDiscTmr- SecDiscTmr- DiscTmrStat- DiscTmrSERREn-

Capabilities: <access denied>

Kernel driver in use: pcieport

00:1c.5 PCI bridge [0604]: Intel Corporation 6 Series/C200 Series Chipset Family PCI Express Root Port 6 [8086:1c1a] (rev b5) (prog-if 00 [Normal decode])

Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx-

Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-

Latency: 0, Cache Line Size: 64 bytes

Bus: primary=00, secondary=04, subordinate=08, sec-latency=0

I/O behind bridge: 00002000-00002fff

Memory behind bridge: d0d00000-d14fffff

Prefetchable memory behind bridge: 00000000d0500000-00000000d0cfffff

Secondary status: 66MHz- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- <SERR- <PERR-

BridgeCtl: Parity- SERR- NoISA- VGA- MAbort- >Reset- FastB2B-

PriDiscTmr- SecDiscTmr- DiscTmrStat- DiscTmrSERREn-

Capabilities: <access denied>

Kernel driver in use: pcieport

00:1d.0 USB controller [0c03]: Intel Corporation 6 Series/C200 Series Chipset Family USB Enhanced Host Controller #1 [8086:1c26] (rev 05) (prog-if 20 [EHCI])

Subsystem: Dell Device [1028:04d7]

Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx-

Status: Cap+ 66MHz- UDF- FastB2B+ ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-

Latency: 0

Interrupt: pin A routed to IRQ 23

Region 0: Memory at d1709000 (32-bit, non-prefetchable) [size=1K]

Capabilities: <access denied>

Kernel driver in use: ehci_hcd

00:1f.0 ISA bridge [0601]: Intel Corporation HM67 Express Chipset Family LPC Controller [8086:1c4b] (rev 05)

Subsystem: Dell Device [1028:04d7]

Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx-

Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-

Latency: 0

Capabilities: <access denied>

00:1f.2 SATA controller [0106]: Intel Corporation 6 Series/C200 Series Chipset Family 6 port SATA AHCI Controller [8086:1c03] (rev 05) (prog-if 01 [AHCI 1.0])

Subsystem: Dell Device [1028:04d7]

Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+

Status: Cap+ 66MHz+ UDF- FastB2B+ ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-

Latency: 0

Interrupt: pin B routed to IRQ 46

Region 0: I/O ports at 4088 [size=8]

Region 1: I/O ports at 4094 [size=4]

Region 2: I/O ports at 4080 [size=8]

Region 3: I/O ports at 4090 [size=4]

Region 4: I/O ports at 4060 [size=32]

Region 5: Memory at d1708000 (32-bit, non-prefetchable) [size=2K]

Capabilities: <access denied>

Kernel driver in use: ahci

00:1f.3 SMBus [0c05]: Intel Corporation 6 Series/C200 Series Chipset Family SMBus Controller [8086:1c22] (rev 05)

Subsystem: Dell Device [1028:04d7]

Control: I/O+ Mem+ BusMaster- SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx-

Status: Cap- 66MHz- UDF- FastB2B+ ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-

Interrupt: pin C routed to IRQ 18

Region 0: Memory at d1704000 (64-bit, non-prefetchable) [size=256]

Region 4: I/O ports at efa0 [size=32]

01:00.0 Network controller [0280]: Intel Corporation Centrino Wireless-N 1030 [Rainbow Peak] [8086:008a] (rev 34)

Subsystem: Intel Corporation Centrino Wireless-N 1030 BGN [8086:5325]

Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+

Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-

Latency: 0, Cache Line Size: 64 bytes

Interrupt: pin A routed to IRQ 48

Region 0: Memory at d1600000 (64-bit, non-prefetchable) [size=8K]

Capabilities: <access denied>

Kernel driver in use: iwlwifi

02:00.0 USB controller [0c03]: NEC Corporation uPD720200 USB 3.0 Host Controller [1033:0194] (rev 04) (prog-if 30 [XHCI])

Subsystem: Dell Device [1028:04d7]

Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+

Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-

Latency: 0, Cache Line Size: 64 bytes

Interrupt: pin A routed to IRQ 18

Region 0: Memory at d1500000 (64-bit, non-prefetchable) [size=8K]

Capabilities: <access denied>

Kernel driver in use: xhci_hcd

03:00.0 Ethernet controller [0200]: Realtek Semiconductor Co., Ltd. RTL8101E/RTL8102E PCI Express Fast Ethernet controller [10ec:8136] (rev 05)

Subsystem: Dell Device [1028:04d7]

Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+

Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-

Latency: 0, Cache Line Size: 64 bytes

Interrupt: pin A routed to IRQ 40

Region 0: I/O ports at 3000 [size=256]

Region 2: Memory at d0404000 (64-bit, prefetchable) [size=4K]

Region 4: Memory at d0400000 (64-bit, prefetchable) [size=16K]

Capabilities: <access denied>

Kernel driver in use: r8169

** USB devices:

Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub

Bus 002 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub

Bus 003 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub

Bus 004 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub

Bus 001 Device 002: ID 8087:0024 Intel Corp. Integrated Rate Matching Hub

Bus 004 Device 002: ID 8087:0024 Intel Corp. Integrated Rate Matching Hub

Bus 001 Device 004: ID 1bcf:2881 Sunplus Innovation Technology Inc. 

Bus 004 Device 003: ID 8086:0189 Intel Corp. 

Bus 002 Device 004: ID 046d:c063 Logitech, Inc. DELL Laser Mouse

-- System Information:

Debian Release: 7.1

  APT prefers stable-updates

  APT policy: (500, 'stable-updates'), (500, 'stable')

Architecture: amd64 (x86_64)

Foreign Architectures: i386

Kernel: Linux 3.2.0-4-rt-amd64 (SMP w/4 CPU cores; PREEMPT)

Locale: LANG=C, LC_CTYPE=C (charmap=ANSI_X3.4-1968)

Shell: /bin/sh linked to /bin/dash

Versions of packages linux-image-3.2.0-4-rt-amd64 depends on:

ii  debconf [debconf-2.0]                   1.5.49

ii  initramfs-tools [linux-initramfs-tool]  0.109.1

ii  kmod                                    9-3

ii  linux-base                              3.5

ii  module-init-tools                       9-3

Versions of packages linux-image-3.2.0-4-rt-amd64 recommends:

ii  firmware-linux-free  3.2

Versions of packages linux-image-3.2.0-4-rt-amd64 suggests:

pn  debian-kernel-handbook  <none>

ii  grub-pc                 1.99-27+deb7u1

pn  linux-doc-3.2           <none>

Versions of packages linux-image-3.2.0-4-rt-amd64 is related to:

pn  firmware-atheros        <none>

pn  firmware-bnx2           <none>

pn  firmware-bnx2x          <none>

pn  firmware-brcm80211      <none>

pn  firmware-intelwimax     <none>

pn  firmware-ipw2x00        <none>

pn  firmware-ivtv           <none>

ii  firmware-iwlwifi        0.36+wheezy.1

pn  firmware-libertas       <none>

pn  firmware-linux          <none>

pn  firmware-linux-nonfree  <none>

pn  firmware-myricom        <none>

pn  firmware-netxen         <none>

pn  firmware-qlogic         <none>

pn  firmware-ralink         <none>

ii  firmware-realtek        0.36+wheezy.1

pn  xen-hypervisor          <none>

-- debconf information:

  linux-image-3.2.0-4-rt-amd64/postinst/depmod-error-initrd-3.2.0-4-rt-amd64: false

  linux-image-3.2.0-4-rt-amd64/prerm/removing-running-kernel-3.2.0-4-rt-amd64: true

  linux-image-3.2.0-4-rt-amd64/postinst/missing-firmware-3.2.0-4-rt-amd64:

  linux-image-3.2.0-4-rt-amd64/postinst/ignoring-ramdisk:

And here's the output from that same command in the VM:

-- Package-specific info:

** Model information

sys_vendor: Bochs

product_name: Bochs

product_version: 

chassis_vendor: Bochs

chassis_version: 

bios_vendor: Bochs

bios_version: Bochs

** PCI devices:

00:00.0 Host bridge [0600]: Intel Corporation 440FX - 82441FX PMC [Natoma] [8086:1237] (rev 02)

Subsystem: Red Hat, Inc Qemu virtual machine [1af4:1100]

Control: I/O+ Mem+ BusMaster- SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx-

Status: Cap- 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-

00:01.0 ISA bridge [0601]: Intel Corporation 82371SB PIIX3 ISA [Natoma/Triton II] [8086:7000]

Subsystem: Red Hat, Inc Qemu virtual machine [1af4:1100]

Control: I/O+ Mem+ BusMaster- SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx-

Status: Cap- 66MHz- UDF- FastB2B- ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-

00:01.1 IDE interface [0101]: Intel Corporation 82371SB PIIX3 IDE [Natoma/Triton II] [8086:7010] (prog-if 80 [Master])

Subsystem: Red Hat, Inc Qemu virtual machine [1af4:1100]

Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx-

Status: Cap- 66MHz- UDF- FastB2B+ ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-

Latency: 0

Region 0: [virtual] Memory at 000001f0 (32-bit, non-prefetchable) [size=8]

Region 1: [virtual] Memory at 000003f0 (type 3, non-prefetchable) [size=1]

Region 2: [virtual] Memory at 00000170 (32-bit, non-prefetchable) [size=8]

Region 3: [virtual] Memory at 00000370 (type 3, non-prefetchable) [size=1]

Region 4: I/O ports at c180 [size=16]

Kernel driver in use: ata_piix

00:01.3 Bridge [0680]: Intel Corporation 82371AB/EB/MB PIIX4 ACPI [8086:7113] (rev 03)

Subsystem: Red Hat, Inc Qemu virtual machine [1af4:1100]

Control: I/O+ Mem+ BusMaster- SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx-

Status: Cap- 66MHz- UDF- FastB2B+ ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-

Interrupt: pin A routed to IRQ 9

Kernel driver in use: piix4_smbus

00:02.0 VGA compatible controller [0300]: VMware SVGA II Adapter [15ad:0405] (prog-if 00 [VGA controller])

Subsystem: VMware SVGA II Adapter [15ad:0405]

Control: I/O+ Mem+ BusMaster- SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx-

Status: Cap- 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-

Region 0: I/O ports at c190 [size=16]

Region 1: Memory at fd000000 (32-bit, prefetchable) [size=16M]

Region 2: Memory at fe000000 (32-bit, prefetchable) [size=64K]

Expansion ROM at febd0000 [disabled] [size=64K]

00:03.0 Ethernet controller [0200]: Realtek Semiconductor Co., Ltd. RTL-8139/8139C/8139C+ [10ec:8139] (rev 20)

Subsystem: Red Hat, Inc Device [1af4:1100]

Physical Slot: 3

Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx-

Status: Cap- 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-

Latency: 0, Cache Line Size: 64 bytes

Interrupt: pin A routed to IRQ 11

Region 0: I/O ports at c000 [size=256]

Region 1: Memory at febf0000 (32-bit, non-prefetchable) [size=256]

Expansion ROM at febe0000 [disabled] [size=64K]

Kernel driver in use: 8139cp

00:04.0 Unclassified device [0002]: Red Hat, Inc Device [1af4:1009]

Subsystem: Red Hat, Inc Device [1af4:0009]

Physical Slot: 4

Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+

Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-

Latency: 0

Interrupt: pin A routed to IRQ 11

Region 0: I/O ports at c100 [size=64]

Region 1: Memory at febf1000 (32-bit, non-prefetchable) [size=4K]

Capabilities: <access denied>

Kernel driver in use: virtio-pci

00:05.0 SCSI storage controller [0100]: Red Hat, Inc Virtio block device [1af4:1001]

Subsystem: Red Hat, Inc Device [1af4:0002]

Physical Slot: 5

Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+

Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-

Latency: 0

Interrupt: pin A routed to IRQ 10

Region 0: I/O ports at c140 [size=64]

Region 1: Memory at febf2000 (32-bit, non-prefetchable) [size=4K]

Capabilities: <access denied>

Kernel driver in use: virtio-pci

** USB devices:

not available

-- System Information:

Debian Release: 7.1

  APT prefers stable-updates

  APT policy: (500, 'stable-updates'), (500, 'stable')

Architecture: amd64 (x86_64)

Foreign Architectures: i386

Kernel: Linux 3.2.0-4-amd64 (SMP w/4 CPU cores)

Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)

Shell: /bin/sh linked to /bin/dash

Versions of packages linux-image-3.2.0-4-rt-amd64 depends on:

ii  debconf [debconf-2.0]                   1.5.49

ii  initramfs-tools [linux-initramfs-tool]  0.109.1

ii  kmod                                    9-3

ii  linux-base                              3.5

ii  module-init-tools                       9-3

Versions of packages linux-image-3.2.0-4-rt-amd64 recommends:

ii  firmware-linux-free  3.2

Versions of packages linux-image-3.2.0-4-rt-amd64 suggests:

pn  debian-kernel-handbook  <none>

ii  grub-pc                 1.99-27+deb7u1

pn  linux-doc-3.2           <none>

Versions of packages linux-image-3.2.0-4-rt-amd64 is related to:

pn  firmware-atheros        <none>

pn  firmware-bnx2           <none>

pn  firmware-bnx2x          <none>

pn  firmware-brcm80211      <none>

pn  firmware-intelwimax     <none>

pn  firmware-ipw2x00        <none>

pn  firmware-ivtv           <none>

pn  firmware-iwlwifi        <none>

pn  firmware-libertas       <none>

pn  firmware-linux          <none>

pn  firmware-linux-nonfree  <none>

pn  firmware-myricom        <none>

pn  firmware-netxen         <none>

pn  firmware-qlogic         <none>

pn  firmware-ralink         <none>

pn  firmware-realtek        <none>

pn  xen-hypervisor          <none>

-- debconf information:

  linux-image-3.2.0-4-rt-amd64/postinst/depmod-error-initrd-3.2.0-4-rt-amd64: false

  linux-image-3.2.0-4-rt-amd64/prerm/removing-running-kernel-3.2.0-4-rt-amd64: true

  linux-image-3.2.0-4-rt-amd64/postinst/missing-firmware-3.2.0-4-rt-amd64:

  linux-image-3.2.0-4-rt-amd64/postinst/ignoring-ramdisk:

#include <unistd.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <assert.h>
#include <sys/mman.h>
#include <sys/syscall.h>
#include <inttypes.h>
#include <linux/futex.h>

typedef volatile uint32_t aos_futex __attribute__((aligned(sizeof(int))));

void mutex_lock(aos_futex *m) {
  assert(__sync_bool_compare_and_swap(m, 0, syscall(SYS_gettid)));
}
void mutex_unlock(aos_futex *m) {
  assert(__sync_bool_compare_and_swap(m, syscall(SYS_gettid), 0));
}

void condition_wait(aos_futex *c, aos_futex *m) {
  mutex_unlock(m);

  assert(syscall(SYS_futex, c, FUTEX_WAIT_REQUEUE_PI, *c,
                 NULL, m) == 0);
}

void condition_signal(aos_futex *c, aos_futex *m) {
  assert(syscall(SYS_futex, c, FUTEX_CMP_REQUEUE_PI, 1,
                 0, m, *c) != -1);
}

typedef struct {
  aos_futex mutex;
  aos_futex condition;
} Shared;

void RunTest(Shared *shared) {
  shared->mutex = shared->condition = 0;

  pid_t child = fork();
  if (child == 0) {
    mutex_lock(&shared->mutex);
    condition_wait(&shared->condition, &shared->mutex);
    mutex_unlock(&shared->mutex);
    _exit(0);
  } else {
    // This is where the race condition that tends to deadlock this test is.
    // This sleep has to be long enough for the child process to have started
    // waiting.
    usleep(20000);
    condition_signal(&shared->condition, &shared->mutex);
    waitpid(child, NULL, 0);
  }
}

int main() {
  int i;
  for (i = 0; i < 100; ++i) {
    if (fork() == 0) {
      Shared *shared = (Shared *)(mmap(NULL, sizeof(Shared),
                                       PROT_READ | PROT_WRITE,
                                       MAP_SHARED | MAP_ANONYMOUS,
                                       -1, 0));
      while (1) {
        RunTest(shared);
      }
    }
  }
}