From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754815AbbHLNd2 (ORCPT ); Wed, 12 Aug 2015 09:33:28 -0400 Received: from mx1.redhat.com ([209.132.183.28]:34363 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754669AbbHLNdZ (ORCPT ); Wed, 12 Aug 2015 09:33:25 -0400 Date: Wed, 12 Aug 2015 15:33:23 +0200 From: Jiri Olsa To: Peter Zijlstra , Ingo Molnar Cc: linux-kernel@vger.kernel.org, Rik van Riel Subject: [BUG] crash in pick_next_task_fair Message-ID: <20150812133323.GA16462@krava.brq.redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.5.23 (2014-03-12) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org hi, we see crashes on older kernel (2.6.32 based) in pick_next_task_fair: ... #8 [ffff8819335efa20] page_fault at ffffffff8152d375 [exception RIP: rb_next+1] RIP: ffffffff81292ae1 RSP: ffff8819335efad8 RFLAGS: 00010046 RAX: 0000000000000000 RBX: ffff8810b8a96928 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffff880ff7602ae0 RDI: 0000000000000010 RBP: ffff8819335efb28 R8: 0000000000000000 R9: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 #9 [ffff8819335efae0] pick_next_task_fair at ffffffff8106c511 #10 [ffff8819335efb30] schedule at ffffffff81529746 #11 [ffff8819335efc00] futex_wait_queue_me at ffffffff810b226a #12 [ffff8819335efc40] futex_wait at ffffffff810b33a0 #13 [ffff8819335efdb0] do_futex at ffffffff810b4c91 #14 [ffff8819335efef0] sys_futex at ffffffff810b56cb #15 [ffff8819335eff80] system_call_fastpath at ffffffff8100b072 ... - pick_next_task_fair calls pick_next_entity - pick_next_entity calls __pick_first_entity and gets NULL from cfs_rq->rb_leftmost - cfs_rq->skip is NULL so it gets through (cfs_rq->skip == se) condition and calls __pick_next_entity(se) which fails on rb_next(&se->run_node) it seems that upstream could fail also via: - pick_next_task_fair calls pick_next_entity with curr == NULL (simple case) - __pick_first_entity calls __pick_first_entity and gets NULL from cfs_rq->rb_leftmost - pick_next_entity returns NULL - pick_next_task_fair calls set_next_entity with se = NULL - set_next_entity fails on se->on_rq would attached patch make sense or do I miss some rb_leftmost rules/behaviour? thanks, jirka --- diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index d113c3ba8bc4..72b4d386086e 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -538,7 +538,7 @@ static void __dequeue_entity(struct cfs_rq *cfs_rq, struct sched_entity *se) struct sched_entity *__pick_first_entity(struct cfs_rq *cfs_rq) { - struct rb_node *left = cfs_rq->rb_leftmost; + struct rb_node *left = cfs_rq->rb_leftmost ? : rb_first(&cfs_rq->tasks_timeline); if (!left) return NULL;