Bug 874357

Summary: Kernel crash (NFS related?)
Product: [Fedora] Fedora Reporter: Braden McDaniel <braden>
Component: kernelAssignee: Jeff Layton <jlayton>
Status: CLOSED INSUFFICIENT_DATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: urgent Docs Contact:
Priority: unspecified    
Version: 17CC: gansalmon, itamar, jlayton, jonathan, kernel-maint, madhu.chinakonda, steved
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2013-03-11 12:25:29 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
Screen shot of kernel crash none

Description Braden McDaniel 2012-11-08 01:34:49 UTC
Created attachment 640513 [details]
Screen shot of kernel crash

Description of problem:
This bug has plagued recent kernel updates to Fedora 17 and has basically rendered my F17 box unusable with recent kernel updates.  It typically happens shortly after I log in and begin using an application like Evolution or GNOME Web (Epiphany).

I am using an NFS4-mounted home directory.

Version-Release number of selected component (if applicable):
3.6.5-1.fc17

Comment 1 Jeff Layton 2013-01-04 20:23:21 UTC
Not one I've seen before. I'll plan to poke at it as soon as I have some time.

Comment 2 Jeff Layton 2013-01-07 19:33:00 UTC
(gdb) list *(rb_erase+0x1fa)
0xffffffff812def3a is in rb_erase (include/linux/rbtree.h:125).
120	#define rb_set_red(r)  do { (r)->rb_parent_color &= ~1; } while (0)
121	#define rb_set_black(r)  do { (r)->rb_parent_color |= 1; } while (0)
122	
123	static inline void rb_set_parent(struct rb_node *rb, struct rb_node *p)
124	{
125		rb->rb_parent_color = (rb->rb_parent_color & 3) | (unsigned long)p;
126	}
127	static inline void rb_set_color(struct rb_node *rb, int color)
128	{
129		rb->rb_parent_color = (rb->rb_parent_color & ~1) | color;

Looks like the rb_node pointer is corrupt? But in this case, it fell down in rb_set_parent which implies that the rbtree was corrupt, not necessarily the actual rb_node being erased.

Any chance you could get a vmcore from one of these crashes? This one may be hard to track down from just an oops.

Comment 3 Jeff Layton 2013-01-23 19:29:28 UTC
...also, is this still reproducible on 3.7 kernels?

Comment 4 Jeff Layton 2013-03-11 12:25:29 UTC
No response in well over a month. Closing...