Linux 内核模块 : Delayed workqueue make the kernel crashed

Question

我在内核模块中使用延迟工作队列。我的模块数据结构是这样的:

struct module_data {
   ...
   struct workqueue_struct *check_hook_wq;
   struct delayed_work  check_hook;
   ...
};

我初始化工作队列的函数是这样的:

void init_workqueue(struct module_data *wc)
{
   wc->check_hook_wq = create_workqueue("Check_Hook");
   INIT_DELAYED_WORK(&wc->check_hook, check_hook_handler);
}

进入“主要”功能，我做这样的事情(CHECK_HOOK_DELAY_MS = 5):

void main(void)
{
   ...
   init_workqueue(wc);
   queue_delayed_work(wc->check_hook_wq, &wc->kipbx_check_hook, msecs_to_jiffies(CHECK_HOOK_DELAY_MS));
   ...
}

在那之前一切正常，但是当工作队列计时器结束时，系统崩溃并出现以下错误，并且根本不要进入我的 check_hook_handler 函数:

[  330.206323] Unable to handle kernel paging request at virtual address 7f7f7f7e
[  330.213568] pgd = c0004000
[  330.216292] [7f7f7f7e] *pgd=00000000
root@solidrun-imx6:~# [  330.219895] Internal error: Oops: 80000005 [#1] SMP ARM
[  330.227035] Modules linked in: kipbx(O) dahdi(O)
[  330.231736] CPU: 1 PID: 116 Comm: mmcqd/0 Tainted: G           O 3.14.60+g4386797 #233
[  330.239670] task: dc1c9b80 ti: ddece000 task.ti: ddece000
[  330.245083] PC is at 0x7f7f7f7e
[  330.248254] LR is at call_timer_fn+0x24/0x84
[  330.252541] pc : [<7f7f7f7e>]    lr : [<c00349f8>]    psr: 200701b3
[  330.252541] sp : ddecfe18  ip : 00000000  fp : 00200200
[  330.264035] r10: 00000000  r9 : ddecfe48  r8 : 00000002
[  330.269273] r7 : 7f7f7f7f  r6 : 00000100  r5 : ddece000  r4 : ddece018
[  330.275812] r3 : ddecfe18  r2 : 7f7f7f7f  r1 : 7f7f7f7f  r0 : 7f7f7f7f
[  330.282355] Flags: nzCv  IRQs off  FIQs on  Mode SVC_32  ISA Thumb  Segment kernel
[  330.289937] Control: 10c53c7d  Table: 2854004a  DAC: 00000015
[  330.295697] Process mmcqd/0 (pid: 116, stack limit = 0xddece238)
[  330.301717] Stack: (0xddecfe18 to 0xdded0000)
[  330.306088] fe00:                                                       dc032000 7f7f7f7f
[  330.314285] fe20: 7f7f7f7f d8c2e308 dc032000 7f7f7f7f 7f7f7f7f c0035190 d8c2e32c 00000001
[  330.322483] fe40: c0a060c0 dc032814 ddecfe48 ddecfe48 ffffffff 00000020 c0a06084 ddece000
[  330.330679] fe60: 00000100 ddece038 00000001 c0a06080 40000001 c002f23c cb0aee0c 0000004c
[  330.338874] fe80: cb0aee0c 00000001 c0a06080 c0a00470 c0a60e00 0000000a c0754098 00007483
[  330.347071] fea0: c0a060c0 00208840 00000000 ddece010 0000001d 00000000 f4a00100 00000001
[  330.355266] fec0: dc37b410 00000000 00000000 c002f5b4 c0a00ee8 c000ec04 f4a0010c c0a0daa8
[  330.363463] fee0: ddecff00 c00084e0 c07519c8 20070013 ffffffff ddecff34 00000001 c00121c0
[  330.371658] ff00: dc37b410 60070013 dc37b410 000009c5 dc37b408 dc375240 ddece000 00000000
[  330.379854] ff20: 00000001 dc37b410 00000000 00000000 00000000 ddecff48 c0436474 c07519c8
[  330.388053] ff40: 20070013 ffffffff 00000000 dde95a00 dc37b408 c0436348 00000000 00000000
[  330.396249] ff60: 00000000 c0046bc8 c0a872a4 00000000 00002e31 dc37b408 00000000 00000000
[  330.404446] ff80: ddecff80 ddecff80 00000000 00000000 ddecff90 ddecff90 ddecffac dde95a00
[  330.412641] ffa0: c0046af8 00000000 00000000 c000e3c0 00000000 00000000 00000000 00000000
[  330.420836] ffc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[  330.429034] ffe0: 00000000 00000000 00000000 00000000 00000013 00000000 fffe6f9f effff8ef
[  330.437252] [<c00349f8>] (call_timer_fn) from [<c0035190>] (run_timer_softirq+0x134/0x260)
[  330.445546] [<c0035190>] (run_timer_softirq) from [<c002f23c>] (__do_softirq+0x138/0x23c)
[  330.453749] [<c002f23c>] (__do_softirq) from [<c002f5b4>] (irq_exit+0xac/0xf4)
[  330.461002] [<c002f5b4>] (irq_exit) from [<c000ec04>] (handle_IRQ+0x44/0x90)
[  330.468080] [<c000ec04>] (handle_IRQ) from [<c00084e0>] (gic_handle_irq+0x2c/0x5c)
[  330.475680] [<c00084e0>] (gic_handle_irq) from [<c00121c0>] (__irq_svc+0x40/0x50)
[  330.483175] Exception stack(0xddecff00 to 0xddecff48)
[  330.488247] ff00: dc37b410 60070013 dc37b410 000009c5 dc37b408 dc375240 ddece000 00000000
[  330.496442] ff20: 00000001 dc37b410 00000000 00000000 00000000 ddecff48 c0436474 c07519c8
[  330.504630] ff40: 20070013 ffffffff
[  330.508156] [<c00121c0>] (__irq_svc) from [<c07519c8>] (_raw_spin_unlock_irqrestore+0x1c/0x20)
[  330.516801] [<c07519c8>] (_raw_spin_unlock_irqrestore) from [<c0436474>] (mmc_queue_thread+0x12c/0x16c)
[  330.526225] [<c0436474>] (mmc_queue_thread) from [<c0046bc8>] (kthread+0xd0/0xe8)
[  330.533735] [<c0046bc8>] (kthread) from [<c000e3c0>] (ret_from_fork+0x14/0x34)
[  330.540975] Code: bad PC value
[  330.544053] ---[ end trace 5ea8c90639723bba ]---
[  330.548685] Kernel panic - not syncing: Fatal exception in interrupt
[  330.555059] CPU0: stopping
[  330.557796] CPU: 0 PID: 30 Comm: kworker/0:1 Tainted: G      D    O 3.14.60+g4386797 #233
[  330.566005] Workqueue: events od_dbs_timer
[  330.570166] [<c0014c6c>] (unwind_backtrace) from [<c00116a4>] (show_stack+0x10/0x14)
[  330.577949] [<c00116a4>] (show_stack) from [<c074c094>] (dump_stack+0x88/0x98)
[  330.585199] [<c074c094>] (dump_stack) from [<c0013744>] (handle_IPI+0x14c/0x16c)
[  330.592619] [<c0013744>] (handle_IPI) from [<c000850c>] (gic_handle_irq+0x58/0x5c)
[  330.600214] [<c000850c>] (gic_handle_irq) from [<c00121c0>] (__irq_svc+0x40/0x50)
[  330.607710] Exception stack(0xdc1fbcc0 to 0xdc1fbd08)
[  330.612784] bcc0: 00000004 00000004 c0a0daac 00000003 dc1fbd24 00000001 dc1fbdcc 00000000
[  330.620982] bce0: c075408c ffffffff 00000000 d83b0b40 00000002 dc1fbd08 c02abeec c00846ac
[  330.629171] bd00: 000d0113 ffffffff
[  330.632700] [<c00121c0>] (__irq_svc) from [<c00846ac>] (generic_exec_single+0x50/0xa0)
[  330.640646] [<c00846ac>] (generic_exec_single) from [<c0084808>] (smp_call_function_single+0x10c/0x19c)
[  330.650065] [<c0084808>] (smp_call_function_single) from [<c0084c8c>] (on_each_cpu+0x2c/0x48)
[  330.658617] [<c0084c8c>] (on_each_cpu) from [<c00141b4>] (twd_rate_change+0x28/0x30)
[  330.666392] [<c00141b4>] (twd_rate_change) from [<c004ad84>] (notifier_call_chain+0x44/0x84)
[  330.674863] [<c004ad84>] (notifier_call_chain) from [<c004b10c>] (__srcu_notifier_call_chain+0x44/0x60)
[  330.684285] [<c004b10c>] (__srcu_notifier_call_chain) from [<c004b140>] (srcu_notifier_call_chain+0x18/0x20)
[  330.694148] [<c004b140>] (srcu_notifier_call_chain) from [<c0474424>] (__clk_notify+0x70/0x78)
[  330.702790] [<c0474424>] (__clk_notify) from [<c04744c4>] (__clk_recalc_rates+0x98/0x9c)
[  330.710909] [<c04744c4>] (__clk_recalc_rates) from [<c0474498>] (__clk_recalc_rates+0x6c/0x9c)

你知道这个问题可能来自哪里吗？

Answer 1

有很多寄存器值为7f7f7f7f(0x7f其实是一个char)，好像是栈溢出或者其他内存区域造成的。