More braindump: One thing that seems sure is that the crash occurs in __run_timers after optionally cascading pending timers into higher level lists. This picks a list of timers from the root vector array (tv1) into a temporary location and then removes timers from that (and calls actions) until the temporary list is empty. Looking at the registers from the trace in comment #3 and comparing with the disassembly I would say r15 contains the pointer to the currently processed timer (with the list pointers right at the beginning). rax is the next pointer and rdx the pointer to the previous elements address. rdx seems to be an address on the stack, so I would guess this is the temporary lists head. Which makes sense given that the loop always takes the first element from the work list and then deletes it from the list. What should not happen is that this first element is already marked as deleted but still taken from the list. Because the poison value for the next pointer is only set after the element was unlinked from the list. One detail to note is that rdx still points to the previous elements address. If I looked correctly that would happen only from migrate_timers (which only happens if a cpu goes away, which is unlikely) or via __mod_timer() and that properly locks the base and would have taken the element out of list. Oh wait... just realize that even if the bad list element had pprev set to NULL, that would be "fixed up" by hlist_move_list(). So any thoughts trying to narrow down potential sources of modification are invalid. Only that it had to be somehow through detach_timer() at some point is true... *sigh*
-- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1534345 Title: Ubuntu 15.10 Crashing Frequently on EC2 Instances w/ Enhanced Networking To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1534345/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
