0007770: Kernel crashes when updating cgroups cfs parameters of qemu-kvm process group

When running in parallel a loop that starts/stops several VMs using virsh and<br /> another loop that modifies cfs_period_us and cfs_quota_us of the machine cgroup,<br /> a kernel crash happens:<br /> <br /> [ 5427.286505] BUG: unable to handle kernel NULL pointer dereference at<br /> 0000000000000010<br /> [ 5427.286513] IP: [<ffffffff812be7d1>] rb_next+0x1/0x50<br /> [ 5427.286514] PGD 0<br /> [ 5427.286515] Oops: 0000 [<a href="http://bugs.centos.org/view.php?id=1">http://bugs.centos.org/view.php?id=1</a> [<a href="http://bugs.centos.org/view.php?id=1" target="_blank">^</a>]] SMP<br /> [ 5427.286545] Modules linked in: vhost_net macvtap macvlan tun ipt_MASQUERADE<br /> xt_CHECKSUM ip6t_rpfilter ip6t_REJECT ipt_REJECT xt_conntrack ebtable_nat<br /> ebtable_broute bridge stp llc ebtable_filter ebtables ip6table_nat<br /> nf_conntrack_ipv6 nf_defrag_ipv6 nf_nat_ipv6 ip6table_mangle ip6table_security<br /> ip6table_raw ip6table_filter ip6_tables iptable_nat nf_conntrack_ipv4<br /> nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack iptable_mangle iptable_security<br /> iptable_raw iptable_filter ip_tables sg dm_mirror dm_region_hash dm_log dm_mod<br /> iTCO_wdt iTCO_vendor_support mlx4_en coretemp kvm_intel kvm crct10dif_pclmul<br /> crc32_pclmul crc32c_intel igb ghash_clmulni_intel ptp mlx4_core aesni_intel<br /> pps_core lrw gf128mul glue_helper lpc_ich sb_edac ablk_helper mei_me ioatdma<br /> cryptd pcspkr edac_core i2c_i801 mfd_core mei shpchp<br /> [ 5427.286554] dca wmi mperf nfsd auth_rpcgss nfs_acl lockd sunrpc xfs<br /> libcrc32c sd_mod crc_t10dif crct10dif_common mgag200 syscopyarea isci<br /> sysfillrect sysimgblt i2c_algo_bit drm_kms_helper libsas ahci ttm libahci<br /> scsi_transport_sas drm libata i2c_core<br /> [ 5427.286557] CPU: 9 PID: 84162 Comm: qemu-kvm Not tainted<br /> 3.10.0-123.el7.x86_64 <a href="http://bugs.centos.org/view.php?id=1">http://bugs.centos.org/view.php?id=1</a> [<a href="http://bugs.centos.org/view.php?id=1" target="_blank">^</a>]<br /> [ 5427.286558] Hardware name: Intel Corporation S2600WP/S2600WP, BIOS<br /> SE5C600.86B.02.01.0002.082220131453 08/22/2013<br /> [ 5427.286559] task: ffff880fcafde660 ti: ffff880fc681c000 task.ti:<br /> ffff880fc681c000<br /> [ 5427.286561] RIP: 0010:[<ffffffff812be7d1>] [<ffffffff812be7d1>]<br /> rb_next+0x1/0x50<br /> [ 5427.286562] RSP: 0018:ffff880fc681d988 EFLAGS: 00010046<br /> [ 5427.286563] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000<br /> [ 5427.286564] RDX: 0000000000000001 RSI: ffff881ffe674628 RDI: 0000000000000010<br /> [ 5427.286564] RBP: ffff880fc681d9d0 R08: 0000000000000000 R09: 0000000000000001<br /> [ 5427.286565] R10: 0000000000000001 R11: 0000000000000001 R12: ffff881fd9d02200<br /> [ 5427.286565] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000<br /> [ 5427.286566] FS: 00007f6b27950a40(0000) GS:ffff881ffe660000(0000)<br /> knlGS:0000000000000000<br /> [ 5427.286567] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033<br /> [ 5427.286568] CR2: 0000000000000010 CR3: 0000000fd2649000 CR4: 00000000001427e0<br /> [ 5427.286568] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000<br /> [ 5427.286569] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400<br /> [ 5427.286570] Stack:<br /> [ 5427.286573] ffff880fc681d9d0 ffffffff8109cc29 00000001c681d9c0<br /> ffff881ffe674580<br /> [ 5427.286575] ffff880fcafdec40 ffff881ffe674580 0000000000000009<br /> 0000000000000000<br /> [ 5427.286577] ffff880fc681dbcc ffff880fc681da30 ffffffff815e6b22<br /> ffff880fc681dfd8<br /> [ 5427.286577] Call Trace:<br /> [ 5427.286586] [<ffffffff8109cc29>] ? pick_next_task_fair+0x129/0x1d0<br /> [ 5427.286592] [<ffffffff815e6b22>] __schedule+0x122/0x790<br /> [ 5427.286594] [<ffffffff815e71b9>] schedule+0x29/0x70<br /> [ 5427.286597] [<ffffffff815e64fc>] schedule_hrtimeout_range_clock+0x12c/0x170<br /> [ 5427.286601] [<ffffffff81089750>] ? hrtimer_get_res+0x50/0x50<br /> [ 5427.286604] [<ffffffff815e647c>] ? schedule_hrtimeout_range_clock+0xac/0x170<br /> [ 5427.286606] [<ffffffff815e6553>] schedule_hrtimeout_range+0x13/0x20<br /> [ 5427.286611] [<ffffffff811c3bf0>] poll_schedule_timeout+0x60/0xc0<br /> [ 5427.286613] [<ffffffff811c517d>] do_sys_poll+0x4cd/0x580<br /> [ 5427.286619] [<ffffffff814b807f>] ? sock_recvmsg+0xbf/0x100<br /> [ 5427.286623] [<ffffffff81090a7f>] ? __wake_up_sync_key+0x4f/0x60<br /> [ 5427.286625] [<ffffffff811c3b00>] ? poll_select_copy_remaining+0x150/0x150<br /> [ 5427.286626] [<ffffffff811c3b00>] ? poll_select_copy_remaining+0x150/0x150<br /> [ 5427.286628] [<ffffffff811c3b00>] ? poll_select_copy_remaining+0x150/0x150<br /> [ 5427.286630] [<ffffffff811c3b00>] ? poll_select_copy_remaining+0x150/0x150<br /> [ 5427.286631] [<ffffffff811c3b00>] ? poll_select_copy_remaining+0x150/0x150<br /> [ 5427.286633] [<ffffffff811c3b00>] ? poll_select_copy_remaining+0x150/0x150<br /> [ 5427.286638] [<ffffffff811fb517>] ? eventfd_ctx_read+0x67/0x260<br /> [ 5427.286643] [<ffffffff8101a0d9>] ? read_tsc+0x9/0x20<br /> [ 5427.286648] [<ffffffff810b68f8>] ? ktime_get_ts+0x48/0xe0<br /> [ 5427.286650] [<ffffffff811c5334>] SyS_poll+0x74/0x110<br /> [ 5427.286653] [<ffffffff815f2119>] system_call_fastpath+0x16/0x1b<br /> [ 5427.286666] Code: 89 06 48 8b 47 08 48 89 46 08 48 8b 47 10 48 89 46 10 c3 0f<br /> 1f 80 00 00 00 00 48 89 32 eb b2 0f 1f 00 48 89 70 10 eb a9 66 90 55 <48> 8b 17<br /> 48 89 e5 48 39 d7 74 3b 48 8b 47 08 48 85 c0 75 0e eb<br /> [ 5427.286667] RIP [<ffffffff812be7d1>] rb_next+0x1/0x50<br /> [ 5427.286668] RSP <ffff880fc681d988><br /> [ 5427.286668] CR2: 0000000000000010