Bug 874357 - Kernel crash (NFS related?)
Summary: Kernel crash (NFS related?)
Keywords:
Status: CLOSED INSUFFICIENT_DATA
Alias: None
Product: Fedora
Classification: Fedora
Component: kernel
Version: 17
Hardware: Unspecified
OS: Unspecified
unspecified
urgent
Target Milestone: ---
Assignee: Jeff Layton
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2012-11-08 01:34 UTC by Braden McDaniel
Modified: 2014-06-18 07:42 UTC (History)
7 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2013-03-11 12:25:29 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)
Screen shot of kernel crash (1.36 MB, image/jpeg)
2012-11-08 01:34 UTC, Braden McDaniel
no flags Details

Description Braden McDaniel 2012-11-08 01:34:49 UTC
Created attachment 640513 [details]
Screen shot of kernel crash

Description of problem:
This bug has plagued recent kernel updates to Fedora 17 and has basically rendered my F17 box unusable with recent kernel updates.  It typically happens shortly after I log in and begin using an application like Evolution or GNOME Web (Epiphany).

I am using an NFS4-mounted home directory.

Version-Release number of selected component (if applicable):
3.6.5-1.fc17

Comment 1 Jeff Layton 2013-01-04 20:23:21 UTC
Not one I've seen before. I'll plan to poke at it as soon as I have some time.

Comment 2 Jeff Layton 2013-01-07 19:33:00 UTC
(gdb) list *(rb_erase+0x1fa)
0xffffffff812def3a is in rb_erase (include/linux/rbtree.h:125).
120	#define rb_set_red(r)  do { (r)->rb_parent_color &= ~1; } while (0)
121	#define rb_set_black(r)  do { (r)->rb_parent_color |= 1; } while (0)
122	
123	static inline void rb_set_parent(struct rb_node *rb, struct rb_node *p)
124	{
125		rb->rb_parent_color = (rb->rb_parent_color & 3) | (unsigned long)p;
126	}
127	static inline void rb_set_color(struct rb_node *rb, int color)
128	{
129		rb->rb_parent_color = (rb->rb_parent_color & ~1) | color;

Looks like the rb_node pointer is corrupt? But in this case, it fell down in rb_set_parent which implies that the rbtree was corrupt, not necessarily the actual rb_node being erased.

Any chance you could get a vmcore from one of these crashes? This one may be hard to track down from just an oops.

Comment 3 Jeff Layton 2013-01-23 19:29:28 UTC
...also, is this still reproducible on 3.7 kernels?

Comment 4 Jeff Layton 2013-03-11 12:25:29 UTC
No response in well over a month. Closing...


Note You need to log in before you can comment on or make changes to this bug.