#12927 NORM 14.1.0: kernel oops, gckOS_Sprintf

[Zarro Boogs per Child]

#12927: kernel oops, gckOS_Sprintf
-------------------------------------+-------------------------------------
            Reporter:  Quozl         |          Owner:
                Type:  defect        |         Status:  new
            Priority:  normal        |      Milestone:  14.1.0
           Component:  kernel        |        Version:  Development build
          Resolution:                |  as of this date
          Blocked By:                |       Keywords:
Deployments affected:                |       Blocking:
            Verified:  0             |  Action Needed:  diagnose
-------------------------------------+-------------------------------------
Changes (by Quozl):

 * next_action:  reproduce => diagnose


Comment:

 * reproduced, [http://dev.laptop.org/~quozl/z/1aODpO.txt once], and
 [http://dev.laptop.org/~quozl/z/1aOE2y.txt twice], without the wireless
 driver kernel messages in the original report,
  * only occurs on fresh start of activity, not on resume from journal,
  * same code location, same text data 4e52454b "KERN" used as virtual
 address, and the pattern KERN is on stack next to VMEM,
  * the X process enters state Z,
  * attaching gdb to the X process before triggering the problem does not
 gain control, gdb is hung,
 {{{
 (gdb) cont
 Continuing.
 Detaching after fork from child process 867.
 [Thread 0xb68dd000 (LWP 430) exited]
 ^C^C
 }}}
  * stopping olpc-dm service does SIGKILL,
 {{{
 systemctl stop olpc-dm.service
 }}}
 {{{
 [Thread 0xacd502b0 (LWP 495) exited]

 Program terminated with signal SIGKILL, Killed.
 The program no longer exists.
 (gdb)
 }}}
  * restarting olpc-dm service does restore desktop,
  * an strace shows the X server hangs at the point of an ioctl(2), with a
 user space virtual address (0xbee8a8d4) that also appears several times in
 the corresponding [http://dev.laptop.org/~quozl/z/1aOEV1.txt kernel stack
 trace],
 {{{
 ioctl(5, _IOC(0, 0x75, 0x30, 0x00), 0xbee8a8d4) = 0
 ioctl(5, _IOC(0, 0x75, 0x30, 0x00), 0xbee8a8d4) = 0
 ioctl(5, _IOC(0, 0x75, 0x30, 0x00), 0xbee8a8d4) = 0
 ioctl(5, _IOC(0, 0x75, 0x30, 0x00)
 }}}

 Initial guess is that the Vivante graphics driver has sent an invalid
 command to the kernel galcore driver.

--
Ticket URL: <http://dev.laptop.org/ticket/12927#comment:1>
One Laptop per Child <http://one.laptop.org/>
One Laptop per Child bug tracking system