[Bug 1736390] Re: openvswitch: kernel oops destroying interfaces on i386

[Joseph Salisbury]

I'm attempting to reproduce the bug.  However, I get a hang when I run the following:
$ autopkgtest-buildvm-ubuntu-cloud -a i386 -r artful -s 10G

Attached is a screen shot of the hang.  It seems to be trying to boot
the image.

** Attachment added: "hang.jpg"
   https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1736390/+attachment/5031209/+files/hang.jpg

-- 
You received this bug notification because you are a member of Ubuntu
OpenStack, which is subscribed to openvswitch in Ubuntu.
https://bugs.launchpad.net/bugs/1736390

Title:
  openvswitch: kernel oops destroying interfaces on i386

Status in linux package in Ubuntu:
  Fix Committed
Status in openvswitch package in Ubuntu:
  Confirmed
Status in linux source package in Artful:
  In Progress
Status in openvswitch source package in Artful:
  Confirmed
Status in linux source package in Bionic:
  Fix Committed
Status in openvswitch source package in Bionic:
  Confirmed

Bug description:
  Reproducable on bionic using the autopkgtest's from openvswitch on
  i386:

  [   41.420568] BUG: unable to handle kernel NULL pointer dereference at   (null)
  [   41.421000] IP: igmp_group_dropped+0x21/0x220
  [   41.421246] *pdpt = 000000001d62c001 *pde = 0000000000000000 

  [   41.421659] Oops: 0000 [#1] SMP
  [   41.421852] Modules linked in: veth openvswitch nf_conntrack_ipv6 nf_nat_ipv6 nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_defrag_ipv6 nf_nat nf_conntrack libcrc32c 9p fscache ppdev kvm_intel kvm 9pnet_virtio irqbypass input_leds joydev 9pnet parport_pc serio_raw parport i2c_piix4 qemu_fw_cfg mac_hid sch_fq_codel ip_tables x_tables autofs4 btrfs xor raid6_pq psmouse virtio_blk virtio_net pata_acpi floppy
  [   41.423855] CPU: 0 PID: 5 Comm: kworker/u2:0 Tainted: G        W       4.13.0-18-generic #21-Ubuntu
  [   41.424355] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014
  [   41.424849] Workqueue: netns cleanup_net
  [   41.425071] task: db8fba80 task.stack: dba10000
  [   41.425346] EIP: igmp_group_dropped+0x21/0x220
  [   41.425656] EFLAGS: 00010202 CPU: 0
  [   41.425864] EAX: 00000000 EBX: dd726360 ECX: dba11e6c EDX: 00000002
  [   41.426335] ESI: 00000000 EDI: dd4db500 EBP: dba11dcc ESP: dba11d94
  [   41.426687]  DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
  [   41.426990] CR0: 80050033 CR2: 00000000 CR3: 1e6d6d60 CR4: 000006f0
  [   41.427340] Call Trace:
  [   41.427485]  ? __wake_up+0x36/0x40
  [   41.427680]  ip_mc_down+0x27/0x90
  [   41.427869]  inetdev_event+0x398/0x4e0
  [   41.428082]  ? skb_dequeue+0x5b/0x70
  [   41.428286]  ? wireless_nlevent_flush+0x4c/0x90
  [   41.428541]  notifier_call_chain+0x4e/0x70
  [   41.428772]  raw_notifier_call_chain+0x11/0x20
  [   41.429023]  call_netdevice_notifiers_info+0x2a/0x60
  [   41.429301]  dev_close_many+0x9d/0xe0
  [   41.429509]  rollback_registered_many+0xd7/0x380
  [   41.429768]  unregister_netdevice_many.part.102+0x10/0x80
  [   41.430075]  default_device_exit_batch+0x134/0x160
  [   41.430344]  ? do_wait_intr_irq+0x80/0x80
  [   41.430650]  ops_exit_list.isra.8+0x4d/0x60
  [   41.430886]  cleanup_net+0x18e/0x260
  [   41.431090]  process_one_work+0x1a0/0x390
  [   41.431317]  worker_thread+0x37/0x450
  [   41.431525]  kthread+0xf3/0x110
  [   41.431714]  ? process_one_work+0x390/0x390
  [   41.431941]  ? kthread_create_on_node+0x20/0x20
  [   41.432187]  ret_from_fork+0x19/0x24
  [   41.432382] Code: 90 90 90 90 90 90 90 90 90 90 3e 8d 74 26 00 55 89 e5 57 56 53 89 c3 83 ec 2c 8b 33 65 a1 14 00 00 00 89 45 f0 31 c0 80 7b 4b 00 <8b> 06 8b b8 20 03 00 00 8b 43 04 0f 85 5e 01 00 00 3d e0 00 00
  [   41.433405] EIP: igmp_group_dropped+0x21/0x220 SS:ESP: 0068:dba11d94
  [   41.433750] CR2: 0000000000000000
  [   41.433961] ---[ end trace 595db54cab84070c ]---

  
  system then becomes unresponsive; no further interfaces can be created.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1736390/+subscriptions