crash分析case2

Backgroud

crash> bt
PID: 39236 TASK: ffff881b61030000 CPU: 40 COMMAND: "systemd-random-"
#0 [ffff881929a2f230] machine_kexec at ffffffff8105554b
#1 [ffff881929a2f290] crash_kexec at ffffffff810fa132
#2 [ffff881929a2f360] oops_end at ffffffff81657aa8
#3 [ffff881929a2f388] no_context at ffffffff816452e8
#4 [ffff881929a2f3d8] __bad_area_nosemaphore at ffffffff8164537e
#5 [ffff881929a2f420] bad_area_nosemaphore at ffffffff816454e8
#6 [ffff881929a2f430] __do_page_fault at ffffffff8165a5a6
#7 [ffff881929a2f488] do_page_fault at ffffffff8165a6f3
#8 [ffff881929a2f4b0] page_fault at ffffffff81656868
[exception RIP: free_percpu+125]
RIP: ffffffff8119701d RSP: ffff881929a2f560 RFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff103b755e3028 RCX: ffffffff8196e000
RDX: ffff103b75fe3028 RSI: 0000000000000286 RDI: 0000000000000000
RBP: ffff881929a2f588 R8: 0000000000000287 R9: 0000000000000dd6
R10: 00000000000003ff R11: 0000000000000001 R12: ffff88207ff7e3c0
R13: 0000000000000287 R14: 0000000000000020 R15: ffff881b7cbe3140
ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018
#9 [ffff881929a2f590] percpu_counter_destroy at ffffffff8132b351
#10 [ffff881929a2f5b0] wb_init at ffffffff811951e4
#11 [ffff881929a2f5f0] wb_get_create at ffffffff811958ba
#12 [ffff881929a2f660] __inode_attach_wb at ffffffff8121cefc
#13 [ffff881929a2f690] __mark_inode_dirty at ffffffff8121d23f
#14 [ffff881929a2f6d0] ext4_mb_new_blocks at ffffffffa0434aed [ext4]
#15 [ffff881929a2f738] ext4_ext_map_blocks at ffffffffa0429bb9 [ext4]
#16 [ffff881929a2f820] ext4_map_blocks at ffffffffa03f7449 [ext4]
#17 [ffff881929a2f898] ext4_getblk at ffffffffa03f7e95 [ext4]
#18 [ffff881929a2f8f8] ext4_bread at ffffffffa03f8057 [ext4]
#19 [ffff881929a2f930] ext4_append at ffffffffa03ffd7a [ext4]
#20 [ffff881929a2f968] ext4_mkdir at ffffffffa04052f7 [ext4]
#21 [ffff881929a2f9f8] vfs_mkdir at ffffffff811faa87
#22 [ffff881929a2fa30] ovl_create_real at ffffffffa0387aaa [overlay]
#23 [ffff881929a2fa68] ovl_copy_up_one at ffffffffa038a7cb [overlay]
#24 [ffff881929a2fbc0] ovl_copy_up at ffffffffa038ad8c [overlay]
#25 [ffff881929a2fc78] ovl_dentry_open at ffffffffa0387170 [overlay]
#26 [ffff881929a2fcc0] vfs_open at ffffffff811ec860
#27 [ffff881929a2fcd0] do_last at ffffffff811fdc4d
#28 [ffff881929a2fd80] path_openat at ffffffff811fedd2
#29 [ffff881929a2fe18] do_filp_open at ffffffff8120059b
#30 [ffff881929a2fee8] do_sys_open at ffffffff811edd03
#31 [ffff881929a2ff40] sys_open at ffffffff811ede1e
#32 [ffff881929a2ff50] system_call_fastpath at ffffffff8165f0fd
RIP: 00007f7ec6577ed0 RSP: 00007ffc6b082e18 RFLAGS: 00010206
RAX: 0000000000000002 RBX: 00007ffc6b084f86 RCX: 0000000000000004
RDX: 0000000000000180 RSI: 0000000000080142 RDI: 00007f7ec6debd24
RBP: 00007f7ec7fe039a R8: 00007f7ec6debd24 R9: 000000000000000c
R10: 00000000fffffff0 R11: 0000000000000246 R12: 00007f7ec7fe0010
R13: 0000000000000000 R14: 0000000000000000 R15: 00007ffc6b082ec0
ORIG_RAX: 0000000000000002 CS: 0033 SS: 002b
crash>


crash> dis -l ffffffff8132b351
/usr/src/debug/kernel-3.10.0-327.ali2016/linux-3.10.0-327.ali2016.alios7.x86_64/lib/percpu_counter.c: 154
0xffffffff8132b351 : movq $0x0,0x20(%rbx)


找到代码： 第154行

crash> l *percpu_counter_destroy+65
0xffffffff8132b351 is in percpu_counter_destroy (lib/percpu_counter.c:154).
149 spin_lock_irqsave(&percpu_counters_lock, flags);
150 list_del(&fbc->list);
151 spin_unlock_irqrestore(&percpu_counters_lock, flags);
152 #endif
153 free_percpu(fbc->counters);
154 fbc->counters = NULL;
155 }
156 EXPORT_SYMBOL(percpu_counter_destroy);
157
158 int percpu_counter_batch __read_mostly = 32;