From: Linus Torvalds <torvalds@linux-foundation.org>
To: Simon Brewer <sbrunau@gmail.com>
Cc: Cong Wang <xiyou.wangcong@gmail.com>,
Al Viro <viro@zeniv.linux.org.uk>,
Andrew Morton <akpm@linux-foundation.org>,
linux-fsdevel <linux-fsdevel@vger.kernel.org>,
LKML <linux-kernel@vger.kernel.org>
Subject: Re: Kernel crash in free_pipe_info()
Date: Fri, 10 Nov 2017 11:47:43 -0800 [thread overview]
Message-ID: <CA+55aFzZKnEmqiYUjiNDvy470yau3XmitOnH5t0F5Upn9mrEAw@mail.gmail.com> (raw)
In-Reply-To: <CAEeGbKME2ngYXZOFbPxjCkwu-hsooZZ4J3iHapgAZrFm3+AsMA@mail.gmail.com>
On Thu, Nov 9, 2017 at 10:07 PM, Simon Brewer <sbrunau@gmail.com> wrote:
>
> This looks familiar...
>
> https://github.com/moby/moby/issues/34472
>
> From the bug report:
> "In particular, it looks like either docker-containerd or
> docker-containerd-shim (the log is cut off) has a pipe open that is
> causing a kernel BUG when attempting to kill the process. Fun times."
Interestingly, some of the "reproducers" show a totally different problem, with
kernel BUG at /build/linux-5EyXrQ/linux-4.4.0/mm/slub.c:1495!
which is this BUG():
1493 if (unlikely(flags & GFP_SLAB_BUG_MASK)) {
1494 pr_emerg("gfp: %u\n", flags & GFP_SLAB_BUG_MASK);
1495 BUG();
1496 }
which implies a completely invalid gfp mask.
The stack trace shows it's unix_stream_sendmsg -> sock_alloc_send_pskb
allocation, which uses "sk->sk_allocation".
Odd. af_unix just does
sk->sk_allocation = GFP_KERNEL_ACCOUNT;
That is new since v4.4, though - but before that it should have been
set by sock_init_data to just GFP_KERNEL.
So there it looks like a socket is entirely corrupted.
So that other backtrace looks entirely bogus too. More "that looks
like corrupted kernel data structures".
Enabling SLUB debugging would be really good here too.
But that is still quite an old kernel. I wish somebody could reproduce
this with something newer.
I added those wishes to the github thing.
Linus
next prev parent reply other threads:[~2017-11-10 19:47 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-10-30 20:58 Kernel crash in free_pipe_info() Cong Wang
2017-10-30 22:14 ` Linus Torvalds
2017-10-30 22:26 ` Linus Torvalds
2017-10-31 1:19 ` Cong Wang
2017-10-31 2:08 ` Linus Torvalds
2017-10-31 3:06 ` Linus Torvalds
2017-10-31 5:00 ` Al Viro
2017-10-31 4:44 ` Al Viro
2017-10-31 19:00 ` Linus Torvalds
2017-11-01 3:19 ` Cong Wang
2017-11-10 6:07 ` Simon Brewer
2017-11-10 19:16 ` Cong Wang
2017-11-10 19:47 ` Linus Torvalds [this message]
2017-10-31 1:28 ` Cong Wang
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CA+55aFzZKnEmqiYUjiNDvy470yau3XmitOnH5t0F5Upn9mrEAw@mail.gmail.com \
--to=torvalds@linux-foundation.org \
--cc=akpm@linux-foundation.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=sbrunau@gmail.com \
--cc=viro@zeniv.linux.org.uk \
--cc=xiyou.wangcong@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).