989295 – ip addrlabel flush causes kernel segfault and reboot is required

Bug 989295 - ip addrlabel flush causes kernel segfault and reboot is required

Summary: ip addrlabel flush causes kernel segfault and reboot is required

Keywords:
Status:	CLOSED ERRATA
Alias:	None
Product:	Fedora
Classification:	Fedora
Component:	kernel
Sub Component:
Version:	19
Hardware:	i686
OS:	Linux
Priority:	unspecified
Severity:	low
Target Milestone:	---
Assignee:	Kernel Maintainer List
QA Contact:	Fedora Extras Quality Assurance
Docs Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+	depends on / blocked

Reported:	2013-07-29 02:53 UTC by Wendell Baker
Modified:	2013-12-25 18:10 UTC (History)
CC List:	12 users (show)
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed:	2013-12-25 18:10:27 UTC
Type:	Bug
Embargoed:
Dependent Products:

Attachments	(Terms of Use)
/etc/sysconfig/network-scripts/addrlabel as described in the ticket (1.02 KB, text/plain) 2013-08-25 16:31 UTC, Wendell Baker	no flags	Details
Patch to fix the ipv6 addrlabel oops (4.93 KB, patch) 2013-09-03 08:14 UTC, Michele Baldessari	no flags	Details \| Diff
View All

Description Wendell Baker 2013-07-29 02:53:54 UTC

Description of problem:

Use of 'ip addrlabel flush' causes a kernel segfault.
A reboot is required.

If such an invocation occurs in a startup script, then recovery methods are indicated.

Version-Release number of selected component (if applicable):

$ uname -a
Linux athletic 3.10.3-300.fc19.i686.PAE #1 SMP Fri Jul 26 00:12:34 UTC 2013 i686 i686 i386 GNU/Linux

$ rpm -q -f /sbin/ip
iproute-3.9.0-1.fc19.i686


How reproducible:

deterministic

Steps to Reproduce:

file=/etc/sysconfig/network-scripts/addrlabel 
ip addrlabel flush
{ cat "$file" ; echo ; } | sed 's/#.*//g' | grep -v '^[[:space:]]*$' | while read line; do
    ip addrlabel add $line || e=$?
done

Actual results:

kernel segfault included following.


Expected results:

Per ip-addrlabel(8), ip addrlabel flush is supposed to clear the table, presumably to allow one to reset the table to something else.

The workaround is "don't do that."

Additional info:


Jul 28 18:37:04 athletic kernel: [11168.825257] BUG: unable to handle kernel NULL pointer dereference at 00000024
Jul 28 18:37:04 athletic kernel: [11168.825299] IP: [<c093f4b3>] ip6addrlbl_add+0x183/0x2c0
Jul 28 18:37:04 athletic kernel: [11168.825328] *pdpt = 00000000255b9001 *pde = 0000000000000000 
Jul 28 18:37:04 athletic kernel: [11168.825349] Oops: 0000 [#1] SMP 
Jul 28 18:37:04 athletic kernel: [11168.825364] Modules linked in: rpcsec_gss_krb5 auth_rpcgss nfsv4 nfs lockd sunrpc dns_resolver fscache binfmt_misc ipt_MASQUERADE xt_nat iptable_nat nf_nat_ipv4 nf_nat xt_mark iptable_mangle xt_geoip(OF) nf_conntrack_ipv4 nf_defrag_ipv4 ip6t_REJECT xt_LOG xt_dccp xt_sctp xt_comment nf_conntrack_ipv6 nf_defrag_ipv6 xt_recent xt_multiport xt_conntrack nf_conntrack ip6table_filter ip6_tables bnep bluetooth rfkill snd_intel8x0m snd_intel8x0 snd_ac97_codec ac97_bus snd_seq snd_seq_device snd_pcm 8139too iTCO_wdt iTCO_vendor_support 8139cp snd_page_alloc apanel smsc_ircc2 input_polldev lpc_ich snd_timer snd i2c_i801 mii mfd_core irda soundcore crc_ccitt microcode fujitsu_tablet wacom_w8001 uinput i915 i2c_algo_bit drm_kms_helper drm firewire_ohci firewire_core crc_itu_t yenta_socket i2c_core video [last unloaded: iptable_mangle]
Jul 28 18:37:04 athletic kernel: [11168.825667] CPU: 0 PID: 12466 Comm: ip Tainted: GF          O 3.10.3-300.fc19.i686.PAE #1
Jul 28 18:37:04 athletic kernel: [11168.825687] Hardware name: FUJITSU STYLISTIC ST Series/FJPEN13, BIOS Version 1.19 Fujitsu Stylistic ST4000 04/05/2004
Jul 28 18:37:04 athletic kernel: [11168.825711] task: ed0d6380 ti: e5556000 task.ti: e5556000
Jul 28 18:37:04 athletic kernel: [11168.825770] EIP: 0060:[<c093f4b3>] EFLAGS: 00010246 CPU: 0
Jul 28 18:37:04 athletic kernel: [11168.825827] EIP is at ip6addrlbl_add+0x183/0x2c0
Jul 28 18:37:04 athletic kernel: [11168.825881] EAX: e539e540 EBX: 00000000 ECX: 00000000 EDX: 00000000
Jul 28 18:37:04 athletic kernel: [11168.825939] ESI: e539ed40 EDI: 00000000 EBP: e5557c30 ESP: e5557c14
Jul 28 18:37:04 athletic kernel: [11168.825997]  DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
Jul 28 18:37:04 athletic kernel: [11168.826022] CR0: 8005003b CR2: 00000024 CR3: 255b8000 CR4: 000007f0
Jul 28 18:37:04 athletic kernel: [11168.826022] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
Jul 28 18:37:04 athletic kernel: [11168.826022] DR6: ffff0ff0 DR7: 00000400
Jul 28 18:37:04 athletic kernel: [11168.826022] Stack:
Jul 28 18:37:04 athletic kernel: [11168.826022]  00000000 00000000 c0c4b700 e539ed40 ec684600 00000001 c0c4b700 e5557c84
Jul 28 18:37:04 athletic kernel: [11168.826022]  c093f83d 00000000 00000001 00000000 00000001 e5557c60 c0624e2c 00000001
Jul 28 18:37:04 athletic kernel: [11168.826022]  ec684628 00000000 ec684624 ec68461c c061f20c 00000001 ed0d6380 e5557c84
Jul 28 18:37:04 athletic kernel: [11168.826022] Call Trace:
Jul 28 18:37:04 athletic kernel: [11168.826022]  [<c093f83d>] ip6addrlbl_newdel+0x1ed/0x250
Jul 28 18:37:04 athletic kernel: [11168.826022]  [<c0624e2c>] ? selinux_capable+0x2c/0x40
Jul 28 18:37:04 athletic kernel: [11168.826022]  [<c061f20c>] ? security_capable+0x1c/0x30
Jul 28 18:37:04 athletic kernel: [11168.826022]  [<c08ad468>] rtnetlink_rcv_msg+0x88/0x1f0
Jul 28 18:37:04 athletic kernel: [11168.826022]  [<c08ad3e0>] ? rtnetlink_rcv+0x30/0x30
Jul 28 18:37:04 athletic kernel: [11168.826022]  [<c08c7056>] netlink_rcv_skb+0x86/0xa0
Jul 28 18:37:04 athletic kernel: [11168.826022]  [<c08ad3d1>] rtnetlink_rcv+0x21/0x30
Jul 28 18:37:04 athletic kernel: [11168.826022]  [<c08c67bf>] netlink_unicast+0xbf/0x150
Jul 28 18:37:04 athletic kernel: [11168.826022]  [<c08c6a8a>] netlink_sendmsg+0x23a/0x670
Jul 28 18:37:04 athletic kernel: [11168.826022]  [<c088d7fb>] sock_sendmsg+0x7b/0xb0
Jul 28 18:37:04 athletic kernel: [11168.826022]  [<c050a7c1>] ? get_page_from_freelist+0x361/0x5d0
Jul 28 18:37:04 athletic kernel: [11168.826022]  [<c088db01>] ___sys_sendmsg+0x291/0x2a0
Jul 28 18:37:04 athletic kernel: [11168.826022]  [<c0548620>] ? __mem_cgroup_commit_charge.constprop.52+0x90/0x2d0
Jul 28 18:37:04 athletic kernel: [11168.826022]  [<c050ebea>] ? lru_cache_add_lru+0x7a/0xa0
Jul 28 18:37:04 athletic kernel: [11168.826022]  [<c052e52d>] ? page_add_new_anon_rmap+0x7d/0x100
Jul 28 18:37:04 athletic kernel: [11168.826022]  [<c05258a5>] ? handle_pte_fault+0x515/0xae0
Jul 28 18:37:04 athletic kernel: [11168.826022]  [<c088d62b>] ? SYSC_getsockname+0xbb/0xd0
Jul 28 18:37:04 athletic kernel: [11168.826022]  [<c0526871>] ? handle_mm_fault+0x111/0x190
Jul 28 18:37:04 athletic kernel: [11168.826022]  [<c088e9a8>] __sys_sendmsg+0x38/0x70
Jul 28 18:37:04 athletic kernel: [11168.826022]  [<c088e9f6>] SyS_sendmsg+0x16/0x20
Jul 28 18:37:04 athletic kernel: [11168.826022]  [<c088f0db>] SyS_socketcall+0x29b/0x2f0
Jul 28 18:37:04 athletic kernel: [11168.826022]  [<c04ba146>] ? __audit_syscall_exit+0x1c6/0x260
Jul 28 18:37:04 athletic kernel: [11168.826022]  [<c04b9f34>] ? __audit_syscall_entry+0x94/0xe0
Jul 28 18:37:04 athletic kernel: [11168.826022]  [<c0997f8d>] sysenter_do_call+0x12/0x28
Jul 28 18:37:04 athletic kernel: [11168.826022] Code: 89 50 28 83 05 68 1a e2 c0 01 31 db 80 05 64 1a e2 c0 01 31 c0 85 db 0f 85 db 00 00 00 83 c4 10 5b 5e 5f 5d c3 8d 76 00 8b 75 f0 <a1> 24 00 00 00 8d 56 24 89 46 24 c7 46 28 24 00 00 00 89 15 24
Jul 28 18:37:04 athletic kernel: [11168.826022] EIP: [<c093f4b3>] ip6addrlbl_add+0x183/0x2c0 SS:ESP 0068:e5557c14
Jul 28 18:37:04 athletic kernel: [11168.826022] CR2: 0000000000000024
Jul 28 18:37:04 athletic kernel: [11168.833260] ---[ end trace 0706c5cba0b2df67 ]---

Comment 1 Michele Baldessari 2013-08-17 22:08:21 UTC

Hi Wendell,

I am unable to reproduce with some longer sequences of addrlabel commands. Could you upload here your /etc/sysconfig/network-scripts/addrlabel  file and also get me a list of your interfaces "ip a" and "ip l"

thanks,
Michele

Comment 2 Wendell Baker 2013-08-25 16:31:19 UTC

Created attachment 790109 [details]
/etc/sysconfig/network-scripts/addrlabel as described in the ticket

Repeated for clarity...  addrlabels file included nearby
(different kernel now)

The behavior of the kernel after the failure is that current connections "still work" but new connections don't succeed.   i.e. if I'm ssh+gnome-terminal into the box when I exhibit the bug, then those ssh+gnome-terminals continue to exist, however I can't ssh into the box.   The box still forwards packets, still runs IPv6 tunnels etc.

The failure occurs at a "standard" expression
namely: ip addrlabel add prefix 2002::/16 label 2

$ ps -ef | grep addrl
root     29651 29647  0 09:15 pts/2    00:00:00 ip addrlabel add prefix 2002::/16 label 2
wbaker   30363 30362  0 09:26 pts/5    00:00:00 ip -6 addrlabel show


process 29651 is the process that caused the failure; it is hung.
process 30363 occurred afterwards and is also hung.


$ uname -a
Linux athletic.emerson.baker.org 3.10.5-201.fc19.i686.PAE #1 SMP Wed Aug 7 17:30:03 UTC 2013 i686 i686 i386 GNU/Linux
$ cat t
#!/bin/sh

declare file=/etc/sysconfig/network-scripts/addrlabel 

ip addrlabel flush
{ cat "$file" ; echo ; } | sed 's/#.*//g' | grep -v '^[[:space:]]*$' | while read line; do
    ip addrlabel add $line || e=$?
done

$ rpm -q -f /sbin/ip
iproute-3.9.0-1.fc19.i686

$ cat t
#!/bin/sh

declare file=/etc/sysconfig/network-scripts/addrlabel 

ip addrlabel flush
{ cat "$file" ; echo ; } | sed 's/#.*//g' | grep -v '^[[:space:]]*$' | while read line; do
    ip addrlabel add $line || e=$?
done


$ sudo ./t
./t: line 9: 29650 Killed                  ip addrlabel add $line



From /var/log/messages

Aug 25 09:15:52 athletic kernel: [870806.559590] BUG: unable to handle kernel NULL pointer dereference at 00000024
Aug 25 09:15:52 athletic kernel: [870806.560029] IP: [<c0935e73>] ip6addrlbl_add+0x183/0x2c0
Aug 25 09:15:52 athletic kernel: [870806.560029] *pdpt = 000000002bc0e001 *pde = 0000000000000000 
Aug 25 09:15:52 athletic kernel: [870806.560029] Oops: 0000 [#1] SMP 
Aug 25 09:15:52 athletic kernel: [870806.560029] Modules linked in: ipt_MASQUERADE xt_nat iptable_nat nf_nat_ipv4 nf_nat xt_mark iptable_mangle nf_conntrack_ipv4 nf_defrag_ipv4 xt_geoip(OF) ip6t_REJECT xt_LOG xt_dccp xt_sctp xt_comment nf_conntrack_ipv6 nf_defrag_ipv6 xt_recent xt_multiport sit tunnel4 ip_tunnel tun bnep bluetooth rfkill ip6table_filter ip6_tables xt_conntrack nf_conntrack apanel input_polldev iTCO_wdt iTCO_vendor_support snd_intel8x0m snd_intel8x0 snd_ac97_codec ac97_bus snd_seq wacom_w8001 snd_seq_device snd_pcm microcode snd_page_alloc 8139too i2c_i801 snd_timer smsc_ircc2 snd lpc_ich 8139cp soundcore irda mfd_core crc_ccitt mii fujitsu_tablet uinput i915 i2c_algo_bit drm_kms_helper firewire_ohci drm firewire_core crc_itu_t yenta_socket video i2c_core
Aug 25 09:15:52 athletic kernel: [870806.560029] CPU: 0 PID: 29650 Comm: ip Tainted: GF          O 3.10.5-201.fc19.i686.PAE #1
Aug 25 09:15:52 athletic kernel: [870806.560029] Hardware name: FUJITSU STYLISTIC ST Series/FJPEN13, BIOS Version 1.19 Fujitsu Stylistic ST4000 04/05/2004
Aug 25 09:15:52 athletic kernel: [870806.560029] task: ed82f9b0 ti: da646000 task.ti: da646000
Aug 25 09:15:52 athletic kernel: [870806.560029] EIP: 0060:[<c0935e73>] EFLAGS: 00010246 CPU: 0
Aug 25 09:15:52 athletic kernel: [870806.560029] EIP is at ip6addrlbl_add+0x183/0x2c0
Aug 25 09:15:52 athletic kernel: [870806.560029] EAX: ecba9bc0 EBX: 00000000 ECX: 00000000 EDX: 00000000
Aug 25 09:15:52 athletic kernel: [870806.560029] ESI: ecba9b80 EDI: 00000000 EBP: da647c30 ESP: da647c14
Aug 25 09:15:52 athletic kernel: [870806.560029]  DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
Aug 25 09:15:52 athletic kernel: [870806.560029] CR0: 8005003b CR2: 00000024 CR3: 0e4fa000 CR4: 000007f0
Aug 25 09:15:52 athletic kernel: [870806.560029] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
Aug 25 09:15:52 athletic kernel: [870806.560029] DR6: ffff0ff0 DR7: 00000400
Aug 25 09:15:52 athletic kernel: [870806.560029] Stack:
Aug 25 09:15:52 athletic kernel: [870806.560029]  00000000 00000000 c0c3d540 ecba9b80 e6d24c00 00000001 c0c3d540 da647c84
Aug 25 09:15:52 athletic kernel: [870806.560029]  c09361fd 00000000 00000001 00000000 00000001 da647c60 c0624f9c 00000001
Aug 25 09:15:52 athletic kernel: [870806.560029]  e6d24c28 00000000 e6d24c24 e6d24c1c c061f37c 00000001 ed82f9b0 da647c84
Aug 25 09:15:52 athletic kernel: [870806.560029] Call Trace:
Aug 25 09:15:52 athletic kernel: [870806.560029]  [<c09361fd>] ip6addrlbl_newdel+0x1ed/0x250
Aug 25 09:15:52 athletic kernel: [870806.560029]  [<c0624f9c>] ? selinux_capable+0x2c/0x40
Aug 25 09:15:52 athletic kernel: [870806.560029]  [<c061f37c>] ? security_capable+0x1c/0x30
Aug 25 09:15:52 athletic kernel: [870806.560029]  [<c08a3e28>] rtnetlink_rcv_msg+0x88/0x1f0
Aug 25 09:15:52 athletic kernel: [870806.560029]  [<c08a3da0>] ? rtnetlink_rcv+0x30/0x30
Aug 25 09:15:52 athletic kernel: [870806.560029]  [<c08bda16>] netlink_rcv_skb+0x86/0xa0
Aug 25 09:15:52 athletic kernel: [870806.560029]  [<c08a3d91>] rtnetlink_rcv+0x21/0x30
Aug 25 09:15:52 athletic kernel: [870806.560029]  [<c08bd17f>] netlink_unicast+0xbf/0x150
Aug 25 09:15:52 athletic kernel: [870806.560029]  [<c08bd44a>] netlink_sendmsg+0x23a/0x670
Aug 25 09:15:52 athletic kernel: [870806.560029]  [<c08841bb>] sock_sendmsg+0x7b/0xb0
Aug 25 09:15:52 athletic kernel: [870806.560029]  [<c050a8d1>] ? get_page_from_freelist+0x361/0x5d0
Aug 25 09:15:52 athletic kernel: [870806.560029]  [<c08844c1>] ___sys_sendmsg+0x291/0x2a0
Aug 25 09:15:52 athletic kernel: [870806.560029]  [<c0548760>] ? __mem_cgroup_commit_charge.constprop.52+0x90/0x2d0
Aug 25 09:15:52 athletic kernel: [870806.560029]  [<c050ecfa>] ? lru_cache_add_lru+0x7a/0xa0
Aug 25 09:15:52 athletic kernel: [870806.560029]  [<c052e66d>] ? page_add_new_anon_rmap+0x7d/0x100
Aug 25 09:15:52 athletic kernel: [870806.560029]  [<c05259e5>] ? handle_pte_fault+0x515/0xae0
Aug 25 09:15:52 athletic kernel: [870806.560029]  [<c0883feb>] ? SYSC_getsockname+0xbb/0xd0
Aug 25 09:15:52 athletic kernel: [870806.560029]  [<c05269b1>] ? handle_mm_fault+0x111/0x190
Aug 25 09:15:52 athletic kernel: [870806.560029]  [<c0885368>] __sys_sendmsg+0x38/0x70
Aug 25 09:15:52 athletic kernel: [870806.560029]  [<c08853b6>] SyS_sendmsg+0x16/0x20
Aug 25 09:15:52 athletic kernel: [870806.560029]  [<c0885a9b>] SyS_socketcall+0x29b/0x2f0
Aug 25 09:15:52 athletic kernel: [870806.560029]  [<c04ba1b6>] ? __audit_syscall_exit+0x1c6/0x260
Aug 25 09:15:52 athletic kernel: [870806.560029]  [<c04b9fa4>] ? __audit_syscall_entry+0x94/0xe0
Aug 25 09:15:52 athletic kernel: [870806.560029]  [<c098e94d>] sysenter_do_call+0x12/0x28
Aug 25 09:15:52 athletic kernel: [870806.560029] Code: 89 50 28 83 05 28 2a e1 c0 01 31 db 80 05 24 2a e1 c0 01 31 c0 85 db 0f 85 db 00 00 00 83 c4 10 5b 5e 5f 5d c3 8d 76 00 8b 75 f0 <a1> 24 00 00 00 8d 56 24 89 46 24 c7 46 28 24 00 00 00 89 15 24
Aug 25 09:15:52 athletic kernel: [870806.560029] EIP: [<c0935e73>] ip6addrlbl_add+0x183/0x2c0 SS:ESP 0068:da647c14
Aug 25 09:15:52 athletic kernel: [870806.560029] CR2: 0000000000000024
Aug 25 09:15:52 athletic kernel: [870806.573463] ---[ end trace 1b56ace653eb6b52 ]---

Comment 3 Wendell Baker 2013-08-25 16:42:46 UTC

ip addr, ip link



$ uname -a
Linux athletic 3.10.9-200.fc19.i686.PAE #1 SMP Wed Aug 21 20:32:21 UTC 2013 i686 i686 i386 GNU/Linux

$ rpm -q -f /sbin/ip
iproute-3.9.0-1.fc19.i686

$ /sbin/ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: em1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 1000
    link/ether 00:0b:5d:48:62:c6 brd ff:ff:ff:ff:ff:ff
    inet 192.168.0.71/24 brd 192.168.0.255 scope global em1
       valid_lft forever preferred_lft forever
    inet 192.168.0.63/24 brd 192.168.0.255 scope global secondary deprecated em1
       valid_lft forever preferred_lft forever
    inet 192.168.0.50/24 brd 192.168.0.255 scope global secondary deprecated em1
       valid_lft forever preferred_lft forever
    inet6 2600:3c01:e001:d10:20b:5dff:fe48:62c6/64 scope global dynamic 
       valid_lft 86342sec preferred_lft 86342sec
    inet6 2001:5a8:4:9fa0:1:1:2:8008/128 scope global deprecated 
       valid_lft forever preferred_lft forever
    inet6 fdd3:34cd:f133:0:1:1:1:8/128 scope global deprecated 
       valid_lft forever preferred_lft forever
    inet6 fdd3:34cd:f133:0:1:1:2:8008/128 scope global deprecated 
       valid_lft forever preferred_lft forever
    inet6 2600:3c01:e001:d20:1:1:2:8008/128 scope global deprecated 
       valid_lft forever preferred_lft forever
    inet6 2600:3c01:e001:d10:1:1:2:8008/128 scope global deprecated 
       valid_lft forever preferred_lft forever
    inet6 2001:470:1f05:1ef6:1:1:2:8008/128 scope global deprecated 
       valid_lft forever preferred_lft forever
    inet6 2001:470:8370:0:1:1:2:8008/128 scope global deprecated 
       valid_lft forever preferred_lft forever
    inet6 2001:470:67:38d:1:1:2:8008/128 scope global deprecated 
       valid_lft forever preferred_lft forever
    inet6 fdd3:34cd:f133:673e:d36a:a53f:460c:100c/128 scope global deprecated 
       valid_lft forever preferred_lft forever
    inet6 fdd3:34cd:f133:673e:d36a:a53f:460c:200c/128 scope global deprecated 
       valid_lft forever preferred_lft forever
    inet6 fdd3:34cd:f133:673e:d36a:a53f:460c:300c/128 scope global deprecated 
       valid_lft forever preferred_lft forever
    inet6 2001:470:8370:0:20b:5dff:fe48:62c6/64 scope global dynamic 
       valid_lft 86370sec preferred_lft 86370sec
    inet6 2001:470:1f05:1ef6:20b:5dff:fe48:62c6/64 scope global dynamic 
       valid_lft 86370sec preferred_lft 86370sec
    inet6 2600:3c01:e001:d20:20b:5dff:fe48:62c6/64 scope global dynamic 
       valid_lft 86356sec preferred_lft 86356sec
    inet6 2001:5a8:4:9fa0:20b:5dff:fe48:62c6/64 scope global dynamic 
       valid_lft 86390sec preferred_lft 86390sec
    inet6 2001:470:67:38d:20b:5dff:fe48:62c6/64 scope global dynamic 
       valid_lft 86390sec preferred_lft 86390sec
    inet6 fdd3:34cd:f133:0:20b:5dff:fe48:62c6/64 scope global dynamic 
       valid_lft 86388sec preferred_lft 86388sec
    inet6 fe80::20b:5dff:fe48:62c6/64 scope link 
       valid_lft forever preferred_lft forever
3: em2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 1000
    link/ether 00:40:f4:d5:2f:5e brd ff:ff:ff:ff:ff:ff
    inet 76.21.113.204/21 brd 76.21.119.255 scope global em2
       valid_lft forever preferred_lft forever
    inet6 2001:558:6045:92:5845:e1cb:780c:62d6/128 scope global 
       valid_lft forever preferred_lft forever
    inet6 fe80::240:f4ff:fed5:2f5e/64 scope link 
       valid_lft forever preferred_lft forever
4: irda0: <NOARP> mtu 2048 qdisc noop state DOWN qlen 8
    link/irda 00:00:00:00 brd ff:ff:ff:ff
5: tun9: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 100
    link/none 
    inet 172.18.1.19 peer 172.18.0.1/32 scope global tun9
       valid_lft forever preferred_lft forever
6: sit0: <NOARP> mtu 1480 qdisc noop state DOWN 
    link/sit 0.0.0.0 brd 0.0.0.0
8: sit1: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1480 qdisc noqueue state UNKNOWN 
    link/sit 0.0.0.0 peer 192.155.80.72
    inet6 2600:3c01:e001:da1:faff:4c15:71cc:2/122 scope global deprecated 
       valid_lft forever preferred_lft forever
    inet6 fe80::ac12:113/64 scope link 
       valid_lft forever preferred_lft forever
    inet6 fe80::4c15:71cc/64 scope link 
       valid_lft forever preferred_lft forever
    inet6 fe80::c0a8:32/64 scope link 
       valid_lft forever preferred_lft forever
    inet6 fe80::c0a8:3f/64 scope link 
       valid_lft forever preferred_lft forever
    inet6 fe80::c0a8:47/64 scope link 
       valid_lft forever preferred_lft forever

$ /sbin/ip l
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: em1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN mode DEFAULT qlen 1000
    link/ether 00:0b:5d:48:62:c6 brd ff:ff:ff:ff:ff:ff
3: em2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN mode DEFAULT qlen 1000
    link/ether 00:40:f4:d5:2f:5e brd ff:ff:ff:ff:ff:ff
4: irda0: <NOARP> mtu 2048 qdisc noop state DOWN mode DEFAULT qlen 8
    link/irda 00:00:00:00 brd ff:ff:ff:ff
5: tun9: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN mode DEFAULT qlen 100
    link/none 
6: sit0: <NOARP> mtu 1480 qdisc noop state DOWN mode DEFAULT 
    link/sit 0.0.0.0 brd 0.0.0.0
8: sit1: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1480 qdisc noqueue state UNKNOWN mode DEFAULT 
    link/sit 0.0.0.0 peer 192.155.80.72

Comment 4 Michele Baldessari 2013-09-02 07:54:07 UTC

Thanks a lot Wendell, this helps. From a quick test this was introduced between 3.8 and 3.9. I'll bisect and then report to netdev. Watch this space.

cheers,
Michele

Comment 5 Michele Baldessari 2013-09-02 20:32:17 UTC

So I've bisected the issue to:
commit b67bfe0d42cac56c512dd5da4b1b347a23f4b70a
Author: Sasha Levin <sasha.levin>
Date:   Wed Feb 27 17:06:00 2013 -0800

    hlist: drop the node parameter from iterators


From a very cursory look I think this patch only brought the root cause to light and is not the cause itself. 

Patch introduced in 3.9 stable series

Comment 6 Michele Baldessari 2013-09-03 08:14:09 UTC

Created attachment 793049 [details]
Patch to fix the ipv6 addrlabel oops

Hi Wendell,

here is a patch from Hannes to fix the oops. I just tested and confirm it works. It will probably trickle down to stable once DaveM gets to it. 
I'll let the kernel-maintainers here decide if it is worth including it before that.

hth,
Michele

Comment 7 Michele Baldessari 2013-09-04 20:43:18 UTC

Hi Wendell,

a short update here. The patch will be pushed to linux-stable so it will hit either 3.10.11 or 3.10.12.

hth,
Michele

Comment 8 Josh Boyer 2013-09-18 20:46:15 UTC

*********** MASS BUG UPDATE **************

We apologize for the inconvenience.  There is a large number of bugs to go through and several of them have gone stale.  Due to this, we are doing a mass bug update across all of the Fedora 19 kernel bugs.

Fedora 19 has now been rebased to 3.11.1-200.fc19.  Please test this kernel update and let us know if you issue has been resolved or if it is still present with the newer kernel.

If you experience different issues, please open a new bug report for those.

Comment 9 Michele Baldessari 2013-09-20 07:51:36 UTC

Josh, fix is in 3.12-rc1 (639739b) but did not make it into 3.11.1 yet. I guess davem has not picked it up yet

Comment 10 Josh Boyer 2013-09-20 13:06:03 UTC

OK.  We'll look at grabbing it soon.  Thanks.

Comment 11 Michele Baldessari 2013-12-25 18:10:27 UTC

As 3.12 kernels have hit F19 updates as well (https://lists.fedoraproject.org/pipermail/package-announce/2013-December/124751.html)

I am closing this one.

Wendell, thanks again for your report.

regards,
Michele

Note You need to log in before you can comment on or make changes to this bug.