Re: crash in 3.12.51 (likely in 3.12.52 as well) in timer code

[Thomas Gleixner]

On Wed, 3 Feb 2016, Nikolay Borisov wrote:
> 
> It seems when the code tries to do prev->next = next in __list_del from 
> detach_timer, 
> rax has a value of dead000000200200 (LIST_POISON2).

> So in this case the prev/next entries do not look like corrupted, whereas
> when manipulating the list inside detach_timer they do. This is really
> odd, any ideas how to further debug this?

Please enable

CONFIG_DEBUG_OBJECTS
CONFIG_DEBUG_OBJECTS_TIMERS
CONFIG_DEBUG_OBJECTS_WORK

That should pinpoint the offending code.

Thanks,

        tglx