Re: Kernel crash in free_pipe_info()

2017-11-10 Thread Linus Torvalds
On Thu, Nov 9, 2017 at 10:07 PM, Simon Brewer wrote: > > This looks familiar... > > https://github.com/moby/moby/issues/34472 > > From the bug report: > "In particular, it looks like either docker-containerd or > docker-containerd-shim (the log is cut off) has a pipe open that is > causing a kerne

Re: Kernel crash in free_pipe_info()

2017-11-10 Thread Cong Wang
Hi, Simon On Thu, Nov 9, 2017 at 10:07 PM, Simon Brewer wrote: > This looks familiar... > > https://github.com/moby/moby/issues/34472 > > From the bug report: > "In particular, it looks like either docker-containerd or > docker-containerd-shim (the log is cut off) has a pipe open that is > causin

Re: Kernel crash in free_pipe_info()

2017-11-09 Thread Simon Brewer
On 1 November 2017 at 14:19, Cong Wang wrote: > On Mon, Oct 30, 2017 at 7:08 PM, Linus Torvalds > wrote: >> On Mon, Oct 30, 2017 at 6:19 PM, Cong Wang wrote: >>> >>> 1. The faulty addresses are all near 0001, with one exception >>> of null (which is the most recent one) >> >> Well, t

Re: Kernel crash in free_pipe_info()

2017-10-31 Thread Cong Wang
On Mon, Oct 30, 2017 at 7:08 PM, Linus Torvalds wrote: > On Mon, Oct 30, 2017 at 6:19 PM, Cong Wang wrote: >> >> 1. The faulty addresses are all near 0001, with one exception >> of null (which is the most recent one) > > Well, they're at 8(%rax), except for that last case. > > And in

Re: Kernel crash in free_pipe_info()

2017-10-31 Thread Linus Torvalds
On Mon, Oct 30, 2017 at 9:44 PM, Al Viro wrote: > On Mon, Oct 30, 2017 at 07:08:46PM -0700, Linus Torvalds wrote: >> >> Well, they're at 8(%rax), except for that last case. > > 0x10(%rax)? Duh, yes. >> Except the offset is that %r12*0x28+0x10, so we're talking a byte >> offset of 330 bytes into

Re: Kernel crash in free_pipe_info()

2017-10-30 Thread Al Viro
On Mon, Oct 30, 2017 at 08:06:23PM -0700, Linus Torvalds wrote: > We do that "free_pipe_info(inode->i_pipe);", but we never actually > clear inode->i_pipe, so now we have an inode that looks like a pipe > inode, and has a stale pointer to a pipe_inode_info. > > It all looks technically correct. I

Re: Kernel crash in free_pipe_info()

2017-10-30 Thread Al Viro
On Mon, Oct 30, 2017 at 07:08:46PM -0700, Linus Torvalds wrote: > On Mon, Oct 30, 2017 at 6:19 PM, Cong Wang wrote: > > > > 1. The faulty addresses are all near 0001, with one exception > > of null (which is the most recent one) > > Well, they're at 8(%rax), except for that last case.

Re: Kernel crash in free_pipe_info()

2017-10-30 Thread Linus Torvalds
On Mon, Oct 30, 2017 at 7:08 PM, Linus Torvalds wrote: > > I'm not seeing anything that makes sense. I'll have to think about this. Al, would you mind taking a look at the error handling in create_pipe_files(). In particular, look here: - we start out allocating the inode with "get_pipe_inode(

Re: Kernel crash in free_pipe_info()

2017-10-30 Thread Linus Torvalds
On Mon, Oct 30, 2017 at 6:19 PM, Cong Wang wrote: > > 1. The faulty addresses are all near 0001, with one exception > of null (which is the most recent one) Well, they're at 8(%rax), except for that last case. And in every case (_including_ that last case), %rax has a very interestin

Re: Kernel crash in free_pipe_info()

2017-10-30 Thread Cong Wang
On Mon, Oct 30, 2017 at 3:14 PM, Linus Torvalds wrote: > On Mon, Oct 30, 2017 at 1:58 PM, Cong Wang wrote: >> >> We got more than a dozen of kernel crashes at free_pipe_info() on our >> 4.1 kernel, they are all very similar to this one (with slightly >> different faulty addresses): > > Were it no

Re: Kernel crash in free_pipe_info()

2017-10-30 Thread Cong Wang
On Mon, Oct 30, 2017 at 3:26 PM, Linus Torvalds wrote: > On Mon, Oct 30, 2017 at 3:14 PM, Linus Torvalds > wrote: >> On Mon, Oct 30, 2017 at 1:58 PM, Cong Wang wrote: >>> >>> We got more than a dozen of kernel crashes at free_pipe_info() on our >>> 4.1 kernel, they are all very similar to this o

Re: Kernel crash in free_pipe_info()

2017-10-30 Thread Linus Torvalds
On Mon, Oct 30, 2017 at 3:14 PM, Linus Torvalds wrote: > On Mon, Oct 30, 2017 at 1:58 PM, Cong Wang wrote: >> >> We got more than a dozen of kernel crashes at free_pipe_info() on our >> 4.1 kernel, they are all very similar to this one (with slightly >> different faulty addresses): > > Were it no

Re: Kernel crash in free_pipe_info()

2017-10-30 Thread Linus Torvalds
On Mon, Oct 30, 2017 at 1:58 PM, Cong Wang wrote: > > We got more than a dozen of kernel crashes at free_pipe_info() on our > 4.1 kernel, they are all very similar to this one (with slightly > different faulty addresses): Were it not for the pointer to the much more recent powerpc version at

Kernel crash in free_pipe_info()

2017-10-30 Thread Cong Wang
Hi, Linus We got more than a dozen of kernel crashes at free_pipe_info() on our 4.1 kernel, they are all very similar to this one (with slightly different faulty addresses): [433948.755473] BUG: unable to handle kernel paging request at 0001000d [433948.762570] IP: [] free_pipe_info+0x5