Unable to handle kernel NULL pointer dereference at virtual address 00000000

[wenping493]

死机打印：
18.126443: <6> send_afe_cal_type cal_block not found!!
18.151172: <6> le to handle kernel NULL pointer dereference at virtual address 00000000
18.158317: <6> pgd = c0004000
18.160998: <2> [00000000] *pgd=00000000
18.164561: <6> rnal error: Oops: 5 [#1] PREEMPT SMP ARM
18.169851: <2> les linked in:
18.172896: <6> CPU: 0 PID: 1051 Comm: mdss_fb0 Tainted: G W 3.10.49-g3567377-00268-g7f93885-dirty #1
18.182615: <6> task: d983d940 ti: d6628000 task.ti: d6628000
18.188002: <2> s at __wake_up_common+0x20/0x7c
18.192512: <2> LR is at complete_all+0x44/0x58
18.196680: <2> [<c0046df4>] lr : [<c004a808>] psr: 600f0193
sp : d6629d60 ip : c0d161fc fp : d6629d84
18.208132: <2> 00000002 r9 : 00000000 r8 : 00000003
18.213343: <2> 0000000e r6 : 00000000 r5 : de75b868 r4 : de75b870
18.219852: <2> 00000000 r2 : 00000000 r1 : 00000003 r0 : fffffff4
18.226364: <2> s: nZCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment kernel
18.233748: <2> rol: 10c5387d Table: 9481c06a DAC: 00000015
18.239476: <2>
PC: 0xc0046d74:
18.243726: <2> 6d74 f57ff05b e8bd8800 e92d4800 e3a00000 e28db004 e8bd8800 e59031e8 e5902024
18.251885: <2> 6d94 e3530005 e2422064 159f3028 03a03003 05803038 059f3020 17931102 10833102
18.260041: <2> 6db4 e92d4800 e28db004 159330a0 15801038 e580303c e8bd8800 c080cebc 55555555
18.268201: <2> 6dd4 e92d4ff8 e1a04000 e1a09003 e5b43004 e28db024 e1a08001 e243000c e1a06002
18.276362: <2> 6df4 e5935000 e59b7004 e245500c e280300c e1530004 0a00000f e590c008 e1a01008
18.284524: <2> 6e14 e1a02009 e1a03007 e590a000 e12fff3c e3500000 0a000003 e31a0001 0a000001
18.292683: <2> 6e34 e2566001 08bd8ff8 e595300c e1a00005 e243500c eaffffec e8bd8ff8 e92d4800
18.300841: <2> 6e54 e28db004 e24dd008 e3a03000 e58d3000 ebffffda e24bd004 e8bd8800 e92d4800
18.309004: <2>
LR: 0xc004a788:
18.313258: <2> a788 e5953000 e3a01003 e3a02001 e2833001 e5853000 e3a03000 e58d3000 e1a06000
18.321413: <2> a7a8 e1a00004 ebfff188 e1a00004 e1a01006 e24bd010 e8bd4870 ea1ee6df e92d4870
18.329575: <2> a7c8 e2804004 e28db010 e24dd00c e1a05000 e1a00004 eb1ee60a e5953000 e3a02000
18.337733: <2> a7e8 e3a01003 e2433106 e58d2000 e5853000 e1a03002 e1a06000 e1a00004 ebfff172
18.345894: <2> a808 e1a00004 e1a01006 e24bd010 e8bd4870 ea1ee6c9 e92d4830 e2805004 e1a04000
18.354054: <2> a828 e28db00c e1a00005 eb1ee5f5 e5943000 e3530000 12433001 15843000 01a04003
18.362216: <2> a848 13a04001 e1a01000 e1a00005 eb1ee6ba e2040001 e8bd8830 e92d4830 e2804004
18.370375: <2> a868 e28db00c e1a05000 e1a00004 eb1ee5e4 e5955000 e2955000 13a05001 e1a01000
18.378535: <2>

R5: 0xde75b7e8:
18.660913: <2> b7e8 00000000 00000000 00000000 ffffffe0 de75b7f8 de75b7f8 c0230220 c1319905
18.669075: <2> b808 c1315694 c1315694 c0230048 00000001 00000000 00000001 00000000 de75b824
18.677229: <2> b828 de75b824 00000000 00000000 00000000 00000101 00000001 00000000 00020002
18.685390: <2> b848 de75b848 de75b848 de75aa08 00000000 00000004 00000000 00000000 00000000
18.693551: <2> b868 7fffffff 00010000 00000000 00000000 c022ed24 00000000 00000000 00000000
18.701708: <2> b888 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
18.709868: <2> b8a8 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
18.718030: <2> b8c8 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
18.726195: <6> Process mdss_fb0 (pid: 1051, stack limit = 0xd6628238)
18.732361: <6> k: (0xd6629d60 to 0xd662a000)
18.736706: <6> 9d60: 00000000 de75b86c de75b868 400f0193 0000000e de75b000 c0d79f60 00000002
18.744865: <6> 9d80: d6629da4 c004a808 00000000 de75b000 c022e794 de7590cc c022e794 de7590dc
18.753024: <6> 9da0: c0d114ac c022d048 00000001 0000000e de759080 de759d50 02004100 c0228f50
18.761185: <6> 9dc0: de310c40 dec0af00 00000068 00000000 00000000 c00690d4 d6629e00 a00f0113
18.769346: <6> 9de0: 00000000 d6629e00 d6629e00 dec0af00 dec0af58 de310c40 d6629e8c ffffffff
18.777506: <6> 9e00: c0d79f60 00000002 de759bf0 c00692f4 dec0af00 dec0af58 00000000 c006c038
18.785665: <6> 9e20: c006bf78 00000068 c0c3fbf8 c00688d8 00000068 c000e004 e0802000 d6629e58
18.793825: <6> 9e40: c0c4b3a4 c0008660 c022df84 800f0113 ffffffff c0804d00 00000000 800f0113
18.801983: <6> 9e60: d6629e98 00000001 de7590cc d6628020 c0d12b04 00000001 ffffffff c0d79f60
18.810143: <6> 9e80: 00000002 de759bf0 c0d161fc d6629ea0 c080436c c022df84 800f0113 ffffffff
18.818304: <6> 9ea0: de75b848 de7590dc 00c20000 200f0113 de75b000 de75b000 de75a2c0 de0df838
18.826461: <6> 9ec0: 00000000 de0df838 00000000 de75b61c 00000000 c02308a4 00000000 00000001
18.834621: <6> 9ee0: 00000000 00000000 00000000 00000010 00000000 c0804024 00000000 c0804024
18.842783: <6> 9f00: de75a2c0 00000000 de75a8cc d6628020 de75aa30 d6629f38 c00408a8 c027263c
18.850942: <6> 9f20: 00000000 dae0fd34 00000010 00000000 d983d940 c00408a8 d6629f38 d6629f38
18.859102: <6> 9f40: d6629f64 dae0fd20 00000000 de75a2c0 c0272510 00000000 00000000 00000000
18.867259: <6> 9f60: 00000000 c003fd44 de00129c 00000000 00050005 de75a2c0 00000000 00000000
18.875424: <6> 9f80: d6629f80 d6629f80 00000000 00000000 d6629f90 d6629f90 d6629fac dae0fd20
18.883581: <6> 9fa0: c003fca4 00000000 00000000 c000d798 00000000 00000000 00000000 00000000
18.891740: <6> 9fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
18.899898: <6> 9fe0: 00000000 00000000 00000000 00000000 00000013 00000000 00000000 00000000
18.908073: <2> 046df4>] (__wake_up_common+0x20/0x7c) from [<c004a808>] (complete_all+0x44/0x58)
18.916837: <2> [<c004a808>] (complete_all+0x44/0x58) from [<c022d048>] (mdp3_dma_done_intr_handler+0x48/0x4c)
18.926471: <2> 22d048>] (mdp3_dma_done_intr_handler+0x48/0x4c) from [<c0228f50>] (mdp3_irq_handler+0x88/0xc4)
18.936455: <2> [<c0228f50>] (mdp3_irq_handler+0x88/0xc4) from [<c00690d4>] (handle_irq_event_percpu+0xbc/0x2a0)
18.946262: <2> [<c00690d4>] (handle_irq_event_percpu+0xbc/0x2a0) from [<c00692f4>] (handle_irq_event+0x3c/0x5c)
18.956071: <2> 0692f4>] (handle_irq_event+0x3c/0x5c) from [<c006c038>] (handle_fasteoi_irq+0xc0/0x108)
18.965442: <2> [<c006c038>] (handle_fasteoi_irq+0xc0/0x108) from [<c00688d8>] (generic_handle_irq+0x20/0x30)
18.974996: <2> 0688d8>] (generic_handle_irq+0x20/0x30) from [<c000e004>] (handle_IRQ+0x68/0x90)
18.983761: <2> [<c000e004>] (handle_IRQ+0x68/0x90) from [<c0008660>] (gic_handle_irq+0x3c/0x60)
18.992182: <2> [<c0008660>] (gic_handle_irq+0x3c/0x60) from [<c0804d00>] (__irq_svc+0x40/0x70)
19.000502: <2> ption stack(0xd6629e58 to 0xd6629ea0)
19.005536: <2> 9e40: 00000000 800f0113
19.013705: <2> 9e60: d6629e98 00000001 de7590cc d6628020 c0d12b04 00000001 ffffffff c0d79f60
19.021861: <2> 9e80: 00000002 de759bf0 c0d161fc d6629ea0 c080436c c022df84 800f0113 ffffffff
19.030033: <2> 804d00>] (__irq_svc+0x40/0x70) from [<c022df84>] (mdp3_dmap_update+0x53c/0x5f4)
19.038710: <2> 22df84>] (mdp3_dmap_update+0x53c/0x5f4) from [<c02308a4>] (mdp3_ctrl_display_commit_kickoff+0x254/0x520)
19.049569: <2> 2308a4>] (mdp3_ctrl_display_commit_kickoff+0x254/0x520) from [<c027263c>] (__mdss_fb_display_thread+0x12c/0x2fc)
19.061108: <2> 27263c>] (__mdss_fb_display_thread+0x12c/0x2fc) from [<c003fd44>] (kthread+0xa0/0xac)
19.070311: <2> 03fd44>] (kthread+0xa0/0xac) from [<c000d798>] (ret_from_fork+0x14/0x3c)
19.078373: <6> Code: e28db024 e1a08001 e243000c e1a06002 (e5935000)
19.084444: <6> end trace da227214a82491ba ]---
19.089052: <6> Kernel panic - not syncing: Fatal exception in interrupt

[wenping493]

反汇编的： c0046dd4 <__wake_up_common>: c0046dd4: e92d4ff8 push {r3, r4, r5, r6, r7, r8, r9, sl, fp, lr} c0046dd8: e1a04000 mov r4, r0 c0046ddc: e1a09003 mov r9, r3 c0046de0: e5b43004 ldr r3, [r4, #4]! c0046de4: e28db024 add fp, sp, #36 ; 0x24 c0046de8: e1a08001 mov r8, r1 c0046dec: e243000c sub r0, r3, #12 c0046df0: e1a06002 mov r6, r2 c0046df4: e5935000 ldr r5, [r3] c0046df8: e59b7004 ldr r7, [fp, #4] c0046dfc: e245500c sub r5, r5, #12 c0046e00: e280300c add r3, r0, #12 c0046e04: e1530004 cmp r3, r4 c0046e08: 0a00000f beq c0046e4c <__wake_up_common+0x78> c0046e0c: e590c008 ldr ip, [r0, #8] c0046e10: e1a01008 mov r1, r8 c0046e14: e1a02009 mov r2, r9 c0046e18: e1a03007 mov r3, r7 c0046e1c: e590a000 ldr sl, [r0] c0046e20: e12fff3c blx ip c0046e24: e3500000 cmp r0, #0 c0046e28: 0a000003 beq c0046e3c <__wake_up_common+0x68> c0046e2c: e31a0001 tst sl, #1 c0046e30: 0a000001 beq c0046e3c <__wake_up_common+0x68> c0046e34: e2566001 subs r6, r6, #1 c0046e38: 08bd8ff8 popeq {r3, r4, r5, r6, r7, r8, r9, sl, fp, pc} c0046e3c: e595300c ldr r3, [r5, #12] c0046e40: e1a00005 mov r0, r5 c0046e44: e243500c sub r5, r3, #12 c0046e48: eaffffec b c0046e00 <__wake_up_common+0x2c> c0046e4c: e8bd8ff8 pop {r3, r4, r5, r6, r7, r8, r9, sl, fp, pc}

[糊涂的小白]

通常是空指针

[wenping493]

引用 2 楼 糊涂的小白的回复:

通常是空指针

我知道呀，都反汇编出来了，定位不到问题

[wenping493]

引用 5 楼 糊涂的小白的回复:

编译成的时候带-g选项，不要strip，反汇编与C代码结合比较容易看出问题。 不过0x20/0x7c说明这个函数代码本身不长，可以估算一下在哪一段C代码，找一下是否引用了指针指向的东西但是没有检查指针是否为空。

这个是产线偶现的问题，我都没复现出来这个问题，如果用我自己编的内核，和这个对应不上，而且这块代码是高通的，我应该没问题的

[糊涂的小白]

c0046df4: e5935000 ldr r5, [r3] r3=0

[糊涂的小白]

编译成的时候带-g选项，不要strip，反汇编与C代码结合比较容易看出问题。 不过0x20/0x7c说明这个函数代码本身不长，可以估算一下在哪一段C代码，找一下是否引用了指针指向的东西但是没有检查指针是否为空。