Bug 153561

Summary:	Kernel panic while using wondershaper ( "tc" frontend ) in debian
Product:	Networking	Reporter:	vrishab (vrishab.in)
Component:	Other	Assignee:	Stephen Hemminger (stephen)
Status:	RESOLVED CODE_FIX
Severity:	high	CC:	ingvarthorvald, vrishab.in
Priority:	P1
Hardware:	All
OS:	Linux
Kernel Version:	4.6.0-1	Subsystem:
Regression:	No	Bisected commit-id:

Description vrishab 2016-08-22 23:23:59 UTC

! CAUTION !! CAUTION !!

System will hang and need to be rebooted. Please save your work before running
the below commands.

!! CAUTION !! CAUTION !!

Run the following commands as root:

root@unstable:~# wondershaper eth0 1024 1024
root@unstable:~# wondershaper eth0 1024 1024

The first command succeeds.
The second command causes entire system to hang.


-- System Information:
Debian Release: stretch/sid
  APT prefers unstable-debug
  APT policy: (500, 'unstable-debug'), (500, 'unstable')
Architecture: amd64 (x86_64)

Kernel: Linux 4.6.0-1-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_IN, LC_CTYPE=en_IN (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages wondershaper depends on:
ii  iproute2  4.6.0-4

wondershaper recommends no packages.

wondershaper suggests no packages.

-- no debconf information

Please refer to downstream bug: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=834814

Comment 1 vrishab 2016-08-22 23:26:03 UTC

wondershaper ( first command kernel output )

[  217.661284] u32 classifier
[  217.730428]     Performance counters on
[  217.731093]     input device check on
[  217.731736]     Actions configured

wondershaper ( second command kernel output )

[  223.670312] BUG: unable to handle kernel NULL pointer dereference at 00000008
[  223.750928] IP: [<c15729af>] _raw_spin_lock_bh+0x1f/0x40
[  223.751915] *pdpt = 0000000034360001 *pde = 0000000000000000 
[  223.753011] Oops: 0002 [#1] SMP 
[  223.753651] Modules linked in: act_police(E) sch_ingress(E) cls_u32(E) sch_sfq(E) sch_cbq(E) nls_utf8(E) isofs(E) udf(E) crc_itu_t(E) fuse(E) vboxsf(OE) vboxvideo(OE) vboxguest(OE) ppdev(E) joydev(E) crc32_pclmul(E) pcspkr(E) evdev(E) serio_raw(E) ttm(E) drm_kms_helper(E) i2c_piix4(E) drm(E) video(E) snd_intel8x0(E) snd_ac97_codec(E) parport_pc(E) sg(E) parport(E) snd_pcm(E) snd_timer(E) battery(E) snd(E) ac(E) soundcore(E) ac97_bus(E) 8250_fintek(E) acpi_cpufreq(E) tpm_tis(E) tpm(E) button(E) processor(E) sunrpc(E) autofs4(E) ext4(E) ecb(E) crc16(E) jbd2(E) crc32c_generic(E) mbcache(E) hid_generic(E) usbhid(E) hid(E) sd_mod(E) sr_mod(E) cdrom(E) ata_generic(E) ohci_pci(E) crc32c_intel(E) aesni_intel(E) xts(E) aes_i586(E) lrw(E) gf128mul(E) ablk_helper(E) cryptd(E) psmouse(E) ahci(E) libahci(E) ehci_pci(E) ohci_hcd(E) ehci_hcd(E) usbcore(E) usb_common(E) ata_piix(E) e1000(E) libata(E) scsi_mod(E)
[  224.052872] CPU: 0 PID: 3 Comm: ksoftirqd/0 Tainted: G           OE   4.6.0-1-686-pae #1 Debian 4.6.4-1
[  224.080942] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006
[  224.082432] task: f74b6000 ti: f74be000 task.ti: f74be000
[  224.083440] EIP: 0060:[<c15729af>] EFLAGS: 00010246 CPU: 0
[  224.084428] EIP is at _raw_spin_lock_bh+0x1f/0x40
[  224.085233] EAX: 00000000 EBX: 00000001 ECX: 00000008 EDX: 00000000
[  224.086292] ESI: 00000008 EDI: f3dce040 EBP: f74bfe74 ESP: f74bfe70
[  224.087330]  DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
[  224.088251] CR0: 80050033 CR2: 00000008 CR3: 377c5dc0 CR4: 000406f0
[  224.089354] Stack:
[  224.089722]  f40b7500 f74bfe84 c14a793e f41e7d80 f3dce050 f74bfea4 c14a8249 f41e7d90
[  224.091034]  00000001 c172c240 f41e7d8c f41e7d90 0000000a f74bfeb4 c14a647b f41e7d80
[  224.111515]  00000001 f74bfec4 f85ee1f6 00000004 f6f19d58 f74bff00 c10ce782 00001dc4
[  224.113132] Call Trace:
[  224.113601]  [<c14a793e>] ? __tcf_hash_release+0x5e/0xd0
[  224.114572]  [<c14a8249>] ? tcf_action_destroy+0x69/0x90
[  224.115544]  [<c14a647b>] ? tcf_exts_destroy+0x1b/0x30
[  224.116478]  [<f85ee1f6>] ? u32_destroy_key+0x16/0x50 [cls_u32]
[  224.117543]  [<c10ce782>] ? rcu_process_callbacks+0x1c2/0x560
[  224.140414]  [<c1574397>] ? __do_softirq+0xd7/0x254
[  224.170384]  [<c156ee67>] ? __schedule+0x247/0x910
[  224.171250]  [<c10722e5>] ? run_ksoftirqd+0x25/0x40
[  224.172142]  [<c108cbcb>] ? smpboot_thread_fn+0xfb/0x160
[  224.190472]  [<c108cad0>] ? sort_range+0x30/0x30
[  224.210449]  [<c10897b6>] ? kthread+0xa6/0xc0
[  224.211254]  [<c1572dc9>] ? ret_from_kernel_thread+0x21/0x38
[  224.212279]  [<c1089710>] ? kthread_create_on_node+0x130/0x130
[  224.213326] Code: 00 00 00 00 b8 01 00 00 00 5d c3 90 55 89 e5 53 66 66 66 66 90 64 81 05 40 a2 85 c1 00 02 00 00 89 c1 31 d2 bb 01 00 00 00 89 d0 <3e> 0f b1 19 85 c0 89 c2 75 07 5b 5d c3 8d 74 26 00 89 c8 e8 39
[  224.241089] EIP: [<c15729af>] _raw_spin_lock_bh+0x1f/0x40 SS:ESP 0068:f74bfe70
[  224.260466] CR2: 0000000000000008
[  224.270651] fbcon_switch: detected unhandled fb_set_par error, error code -16
[  224.273119] fbcon_switch: detected unhandled fb_set_par error, error code -16
[  224.302151] ---[ end trace fb76956f344f7f71 ]---
[  224.310916] Kernel panic - not syncing: Fatal exception in interrupt
[  224.312151] Kernel Offset: disabled
[  224.312754] ---[ end Kernel panic - not syncing: Fatal exception in interrupt

Comment 2 [account disabled by the administrator] 2016-08-23 15:40:59 UTC

Try a new kernel with the following commit id, a03e6fe569713fb3ff0714f8fd7c8785c0ca9e22 and see if it fixes your issue.

Comment 3 vrishab 2016-08-24 12:35:01 UTC

Crashes in Fedora 24 ( kernel version 4.6.6-300.fc24.x86_64 ).

[root@dhcppc1 ~]# [  164.677599] BUG: unable to handle kernel NULL pointer dereference at 000000000000000c
[  164.753969] IP: [<ffffffff817e0bd7>] _raw_spin_lock_bh+0x17/0x30
[  164.760600] PGD 4300e067 PUD 463ce067 PMD 0 
[  164.761589] Oops: 0002 [#1] SMP 
[  164.762325] Modules linked in: act_police cls_u32 sch_ingress nls_utf8 isofs fuse nf_conntrack_netbios_ns nf_conntrack_broadcast ip6t_rpfilter ip6t_REJECT nf_reject_ipv6 xt_conntrack ip_set nfnetlink ebtable_nat ebtable_broute bridge stp llc ip6table_mangle ip6table_nat nf_conntrack_ipv6 nf_defrag_ipv6 nf_nat_ipv6 ip6table_security ip6table_raw iptable_mangle iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack iptable_security iptable_raw ebtable_filter ebtables ip6table_filter ip6_tables vboxsf(OE) vboxvideo(OE) snd_intel8x0 snd_ac97_codec ac97_bus vboxguest(OE) snd_seq crct10dif_pclmul snd_seq_device snd_pcm ppdev ttm crc32_pclmul ghash_clmulni_intel joydev drm_kms_helper snd_timer snd soundcore i2c_piix4 drm parport_pc parport acpi_cpufreq tpm_tis tpm nfsd auth_rpcgss nfs_acl lockd grace sunrpc crc32c_intel serio_raw e1000 ata_generic pata_acpi fjes video
[  164.814277] CPU: 0 PID: 9 Comm: rcuos/0 Tainted: G           OE   4.6.6-300.fc24.x86_64 #1
[  164.815508] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006
[  164.816739] task: ffff88007c8e8000 ti: ffff88007c8f0000 task.ti: ffff88007c8f0000
[  164.817866] RIP: 0010:[<ffffffff817e0bd7>]  [<ffffffff817e0bd7>] _raw_spin_lock_bh+0x17/0x30
[  164.819148] RSP: 0018:ffff88007c8f3da0  EFLAGS: 00010246
[  164.819948] RAX: 0000000000000000 RBX: 000000000000000c RCX: ffff880034f57000
[  164.821023] RDX: 0000000000000001 RSI: 0000000000000001 RDI: 000000000000000c
[  164.822089] RBP: ffff88007c8f3db8 R08: ffff8800783e1600 R09: 000000018010000f
[  164.823162] R10: ffffea0001e33080 R11: 000000000001aa01 R12: ffff880034f57000
[  164.824231] R13: ffff880078dfd8c0 R14: 000000000000003c R15: 0000000000000001
[  164.825314] FS:  0000000000000000(0000) GS:ffff88007fc00000(0000) knlGS:0000000000000000
[  164.826526] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  164.827391] CR2: 000000000000000c CR3: 00000000463ba000 CR4: 00000000000406f0
[  164.828458] Stack:
[  164.828779]  ffffffff816f29e7 ffff88007adc6548 ffff880078dfd8d8 ffff88007c8f3df8
[  164.829948]  ffffffff816f3113 ffff88007adc6560 ffff88007adc6558 ffff88007adc6560
[  164.831119]  000000000000003c 000000000000003c ffff880078dfdee0 ffff88007c8f3e18
[  164.832286] Call Trace:
[  164.832673]  [<ffffffff816f29e7>] ? __tcf_hash_release+0x77/0xf0
[  164.833581]  [<ffffffff816f3113>] tcf_action_destroy+0x73/0xa0
[  164.834455]  [<ffffffff816f0ef0>] tcf_exts_destroy+0x20/0x30
[  164.835310]  [<ffffffffc04282bb>] u32_destroy_key.constprop.19+0x1b/0x50 [cls_u32]
[  164.836467]  [<ffffffffc0428327>] u32_delete_key_freepf_rcu+0x17/0x20 [cls_u32]
[  164.855705]  [<ffffffff8110d5dd>] rcu_nocb_kthread+0x2ad/0x490
[  164.884312]  [<ffffffff8110d330>] ? get_state_synchronize_rcu+0x20/0x20
[  164.885492]  [<ffffffff810c6f78>] kthread+0xd8/0xf0
[  164.886360]  [<ffffffff817e1182>] ret_from_fork+0x22/0x40
[  164.905159]  [<ffffffff810c6ea0>] ? kthread_worker_fn+0x180/0x180
[  164.913004] Code: 31 c0 5d c3 b8 01 00 00 00 5d c3 66 0f 1f 84 00 00 00 00 00 66 66 66 66 90 65 81 05 80 c6 82 7e 00 02 00 00 31 c0 ba 01 00 00 00 <f0> 0f b1 17 85 c0 75 01 c3 55 89 c6 48 89 e5 e8 05 1b 91 ff 5d 
[  164.918150] RIP  [<ffffffff817e0bd7>] _raw_spin_lock_bh+0x17/0x30
[  164.919264]  RSP <ffff88007c8f3da0>
[  164.919889] CR2: 000000000000000c
[  164.920509] fbcon_switch: detected unhandled fb_set_par error, error code -16
[  164.922741] fbcon_switch: detected unhandled fb_set_par error, error code -16
[  164.926039] ---[ end trace 95e8f5489ca9c678 ]---
[  164.943233] Kernel panic - not syncing: Fatal exception in interrupt
[  164.944512] Kernel Offset: disabled
[  164.945134] ---[ end Kernel panic - not syncing: Fatal exception in interrupt

Comment 4 vrishab 2016-08-24 12:37:18 UTC

(In reply to ingvarthorvald from comment #2)
> Try a new kernel with the following commit id,
> a03e6fe569713fb3ff0714f8fd7c8785c0ca9e22 and see if it fixes your issue.

This commit made into the 4.7 branch. I can test it ( may take a while ). 

In the meantime, if someone has a 4.7 kernel, they can confirm if this issue got fixed, as it is 100% reproducible.

Comment 5 vrishab 2016-08-24 15:51:27 UTC

Issue not seen in 4.7 kernel. Tested in debian / experimental branch.

root@sid-reportbug:~# uname -a
Linux sid-reportbug 4.7.0-rc7-686-pae #1 SMP Debian 4.7~rc7-1~exp1 (2016-07-14) i686 GNU/Linux

Please resolve this bug.

Comment 6 [account disabled by the administrator] 2016-08-25 03:19:20 UTC

Only the opener of the bug may close it just change the status to closed code fix.

Comment 7 vrishab 2016-08-25 06:39:39 UTC

Done. Thanks !