From: Jiri Olsa <jolsa@redhat.com>
To: Peter Zijlstra <peterz@infradead.org>, Ingo Molnar <mingo@redhat.com>
Cc: linux-kernel@vger.kernel.org, Rik van Riel <riel@redhat.com>
Subject: [BUG] crash in pick_next_task_fair
Date: Wed, 12 Aug 2015 15:33:23 +0200 [thread overview]
Message-ID: <20150812133323.GA16462@krava.brq.redhat.com> (raw)
hi,
we see crashes on older kernel (2.6.32 based) in pick_next_task_fair:
...
#8 [ffff8819335efa20] page_fault at ffffffff8152d375
[exception RIP: rb_next+1]
RIP: ffffffff81292ae1 RSP: ffff8819335efad8 RFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff8810b8a96928 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffff880ff7602ae0 RDI: 0000000000000010
RBP: ffff8819335efb28 R8: 0000000000000000 R9: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018
#9 [ffff8819335efae0] pick_next_task_fair at ffffffff8106c511
#10 [ffff8819335efb30] schedule at ffffffff81529746
#11 [ffff8819335efc00] futex_wait_queue_me at ffffffff810b226a
#12 [ffff8819335efc40] futex_wait at ffffffff810b33a0
#13 [ffff8819335efdb0] do_futex at ffffffff810b4c91
#14 [ffff8819335efef0] sys_futex at ffffffff810b56cb
#15 [ffff8819335eff80] system_call_fastpath at ffffffff8100b072
...
- pick_next_task_fair calls pick_next_entity
- pick_next_entity calls __pick_first_entity and gets NULL from cfs_rq->rb_leftmost
- cfs_rq->skip is NULL so it gets through (cfs_rq->skip == se) condition
and calls __pick_next_entity(se) which fails on rb_next(&se->run_node)
it seems that upstream could fail also via:
- pick_next_task_fair calls pick_next_entity with curr == NULL (simple case)
- __pick_first_entity calls __pick_first_entity and gets NULL from cfs_rq->rb_leftmost
- pick_next_entity returns NULL
- pick_next_task_fair calls set_next_entity with se = NULL
- set_next_entity fails on se->on_rq
would attached patch make sense or do I miss some rb_leftmost rules/behaviour?
thanks,
jirka
---
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index d113c3ba8bc4..72b4d386086e 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -538,7 +538,7 @@ static void __dequeue_entity(struct cfs_rq *cfs_rq, struct sched_entity *se)
struct sched_entity *__pick_first_entity(struct cfs_rq *cfs_rq)
{
- struct rb_node *left = cfs_rq->rb_leftmost;
+ struct rb_node *left = cfs_rq->rb_leftmost ? : rb_first(&cfs_rq->tasks_timeline);
if (!left)
return NULL;
next reply other threads:[~2015-08-12 13:33 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-08-12 13:33 Jiri Olsa [this message]
2015-08-13 21:07 ` Peter Zijlstra
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20150812133323.GA16462@krava.brq.redhat.com \
--to=jolsa@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=mingo@redhat.com \
--cc=peterz@infradead.org \
--cc=riel@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®