Re: 2.5.46: kernel BUG at kernel/timer.c:333!

From: Andrew Morton (
Date: Sun Nov 10 2002 - 12:13:51 EST

Miquel van Smoorenburg wrote:
> According to Andrew Morton:
> > Miquel van Smoorenburg wrote:
> > > I can reliably crash 2.5.X on one of our newsservers (dual PIII/450, GigE,
> > > lots of disk- and network I/O).
> > >
> > > kernel BUG at kernel/timer.c:333!
> >
> > There are timer fixes in Linus's current tree. The problem which
> > they address could cause this BUG.
> I've booted 2.5.46bk5 on the machine, and it has been running for over
> 2 hours with extra heavy diskio. That reliably crashed the machine
> in about 45 minutes with 2.4.45 and 2.5.46, machine is still up now.

OK, thanks.

> I'm still seeing the buffer layer error at fs/buffer.c:1623,
> though. Happens when a blockdev is close()d. Is a fix for
> this in -mm2? Does -mm2 include -bk5 ? If so I'll put that
> on it and keep an eye on it tomorrow, see what happens.

This is a blockdev which was under mmap(), yes? No, I haven't looked at
that yet. It'll be a matter of just killing the warning.

mmapping a blockdev is a pretty dopey thing to do, btw. It doesn't
allow the use of highmem, the IO uses tiny BIOs (in fact I think
it uses 512-byte or 1k blocksize too) and there are buffer_heads
all over the place. You'll get better results from mmapping a
regular file.
> Debug messages I'm still seeing:
> (note that I compiled IPv6 into the kernel since we're slowly moving
> our network to IPv6 but that it is otherwise unused right now, and
> that the previous kernels that crashed on me didn't have IPv6 in it)
> Uninitialised timer!
> This is just a warning. Your computer is OK
> function=0xc0285748, data=0xf78a6680
> Call Trace:
> [<c0122610>] check_timer_failed+0x40/0x54
> [<c0285748>] igmp6_timer_handler+0x0/0x58
> [<c0122b12>] del_timer+0x16/0x84
> [<c02855d8>] igmp6_join_group+0x94/0x124

I missed one there.

--- 25/net/ipv6/mcast.c~ip6-mcast-timer Sun Nov 10 09:12:28 2002
+++ 25-akpm/net/ipv6/mcast.c Sun Nov 10 09:12:44 2002
@@ -296,6 +296,7 @@ int ipv6_dev_mc_inc(struct net_device *d
         memset(mc, 0, sizeof(struct ifmcaddr6));
+ init_timer(&mc->mca_timer);
         mc->mca_timer.function = igmp6_timer_handler;
         mc-> = (unsigned long) mc;

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
More majordomo info at
Please read the FAQ at

This archive was generated by hypermail 2b29 : Fri Nov 15 2002 - 22:00:20 EST