kernel BUG at [tty_ldisc_reinit] mm/slub.c!
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
linux (Ubuntu) |
In Progress
|
High
|
Kamal Mostafa | ||
Xenial |
Fix Released
|
High
|
Kamal Mostafa | ||
linux-lts-xenial (Ubuntu) |
In Progress
|
High
|
Kamal Mostafa | ||
Trusty |
Fix Released
|
High
|
Kamal Mostafa |
Bug Description
Reported in LP:#1707089:
Reported against v4.4 LTS kernel on 14.04; probably applicable to main v4.4 kernel on 16.04 also.
----------
The ubuntu 14.04 kernel panics on boot about 1% of the time.
[ 0.000000] Linux version 4.4.0-83-generic (buildd@lgw01-10) (gcc version 4.8.4 (Ubuntu 4.8.4-2ubuntu1~
[ 0.000000] Command line: BOOT_IMAGE=
.....
[ 8.510775] ------------[ cut here ]------------
[ 8.512172] kernel BUG at /build/
[ 8.514572] invalid opcode: 0000 [#1] SMP
[ 8.515937] Modules linked in: crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel aes_x86_64 lrw gf128mul glue_helper ablk_helper cryptd psmouse virtio_scsi
[ 8.521408] CPU: 3 PID: 1 Comm: init Not tainted 4.4.0-83-generic #106~14.04.1-Ubuntu
[ 8.523723] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 8.526418] task: ffff8803ee608000 ti: ffff8803ee604000 task.ti: ffff8803ee604000
[ 8.528521] RIP: 0010:[<
[ 8.530794] RSP: 0018:ffff8803ee
[ 8.532516] RAX: ffffea000bb817e0 RBX: ffff8802ee05fbe0 RCX: 000000018040001f
[ 8.534833] RDX: 000077ff80000000 RSI: 0000000000000282 RDI: ffff8802ee05fbe0
[ 8.536833] RBP: ffff8803ee607d10 R08: ffff8800bb80ae80 R09: 000000018040001f
[ 8.538830] R10: 00000000bb80ac01 R11: ffffea000bb817c0 R12: ffff8802ee05fbe0
[ 8.540956] R13: ffffffff814dd53d R14: ffff8803ee747990 R15: 0000000000000000
[ 8.543009] FS: 00007f7d1c62684
[ 8.545542] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 8.547433] CR2: 00007f9201dd07d0 CR3: 00000003e8455000 CR4: 00000000001406e0
[ 8.549688] Stack:
[ 8.550384] ffff880036697400 ffff8802ee05fbe0 0000000000000000 ffff8803ee607d40
[ 8.552627] ffffffff814dd53d ffff880036697400 ffff8802ee05fbe0 0000000000000002
[ 8.554791] 0000000000000000 ffff8803ee607d68 ffffffff814ddb24 0000000000000000
[ 8.556542] Call Trace:
[ 8.557249] [<ffffffff814dd
[ 8.558855] [<ffffffff814dd
[ 8.560500] [<ffffffff814d5
[ 8.562263] [<ffffffff814d5
[ 8.563748] [<ffffffff814e0
[ 8.565396] [<ffffffff814d5
[ 8.566995] [<ffffffff81202
[ 8.568528] [<ffffffff814dd
[ 8.570225] [<ffffffff81203
[ 8.571779] [<ffffffff8109b
[ 8.573355] [<ffffffff81079
[ 8.575236] [<ffffffff81003
[ 8.576499] [<ffffffff8180c
[ 8.578334] Code: 8b 03 31 f6 f6 c4 40 74 04 41 8b 73 6c 4c 89 df e8 cc cc fa ff e9 73 ff ff ff 4c 8d 58 ff e9 20 ff ff ff 49 8b 43 20 a8 01 75 d4 <0f> 0b 0f 1f 40 00 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 41 55
[ 8.586832] RIP [<ffffffff811e0
[ 8.588673] RSP <ffff8803ee607cf8>
[ 8.589869] ---[ end trace 87fcf5b5cdf6b7f0 ]---
[ 8.591565] Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b
[ 8.591565]
[ 8.594520] Kernel Offset: disabled
[ 8.595719] ---[ end Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b
[ 8.595719]
CVE References
no longer affects: | linux-lts-xenial (Ubuntu Xenial) |
no longer affects: | linux (Ubuntu Trusty) |
Changed in linux (Ubuntu Xenial): | |
assignee: | nobody → Kamal Mostafa (kamalmostafa) |
Changed in linux-lts-xenial (Ubuntu Trusty): | |
assignee: | nobody → Kamal Mostafa (kamalmostafa) |
Changed in linux-lts-xenial (Ubuntu): | |
importance: | Undecided → High |
assignee: | nobody → Kamal Mostafa (kamalmostafa) |
Changed in linux-lts-xenial (Ubuntu Trusty): | |
importance: | Undecided → High |
Changed in linux (Ubuntu Xenial): | |
importance: | Undecided → High |
Changed in linux-lts-xenial (Ubuntu): | |
status: | New → In Progress |
Changed in linux (Ubuntu Xenial): | |
status: | New → In Progress |
Changed in linux-lts-xenial (Ubuntu Trusty): | |
status: | New → In Progress |
Changed in linux (Ubuntu Xenial): | |
status: | In Progress → Fix Committed |
Changed in linux-lts-xenial (Ubuntu Trusty): | |
status: | In Progress → Fix Committed |
Mainline commit 892d1fa "tty: Destroy ldisc instance on hangup" (circa v4.6) appears to fix this issue, per positive test feedback in LP: #1707089. Additional prerequisite patches are required:
892d1fa tty: Destroy ldisc instance on hangup
7896f30 tty: Refactor tty_ldisc_reinit() for reuse
c12da96 tty: Use 'disc' for line discipline index name
6ffeb4b tty: Move tty_ldisc_kill()
a570a49 tty: Handle NULL tty->ldisc
ece5340 tty: Reset c_line from driver's init_termios
63d8cb3 tty: Simplify tty_set_ldisc() exit handling