From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Eric Dumazet <edumazet@google.com>,
Yang Yingliang <yangyingliang@huawei.com>,
"David S. Miller" <davem@davemloft.net>
Subject: [PATCH 3.12 53/83] net: 8139cp: fix a BUG_ON triggered by wrong bytes_compl
Date: Fri, 6 Dec 2013 13:51:43 -0800 [thread overview]
Message-ID: <20131206214644.985720474@linuxfoundation.org> (raw)
In-Reply-To: <20131206214640.002320724@linuxfoundation.org>
3.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Yingliang <yangyingliang@huawei.com>
[ Upstream commit 7fe0ee099ad5e3dea88d4ee1b6f20246b1ca57c3 ]
Using iperf to send packets(GSO mode is on), a bug is triggered:
[ 212.672781] kernel BUG at lib/dynamic_queue_limits.c:26!
[ 212.673396] invalid opcode: 0000 [#1] SMP
[ 212.673882] Modules linked in: 8139cp(O) nls_utf8 edd fuse loop dm_mod ipv6 i2c_piix4 8139too i2c_core intel_agp joydev pcspkr hid_generic intel_gtt floppy sr_mod mii button sg cdrom ext3 jbd mbcache usbhid hid uhci_hcd ehci_hcd usbcore sd_mod usb_common crc_t10dif crct10dif_common processor thermal_sys hwmon scsi_dh_emc scsi_dh_rdac scsi_dh_hp_sw scsi_dh ata_generic ata_piix libata scsi_mod [last unloaded: 8139cp]
[ 212.676084] CPU: 0 PID: 4124 Comm: iperf Tainted: G O 3.12.0-0.7-default+ #16
[ 212.676084] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2007
[ 212.676084] task: ffff8800d83966c0 ti: ffff8800db4c8000 task.ti: ffff8800db4c8000
[ 212.676084] RIP: 0010:[<ffffffff8122e23f>] [<ffffffff8122e23f>] dql_completed+0x17f/0x190
[ 212.676084] RSP: 0018:ffff880116e03e30 EFLAGS: 00010083
[ 212.676084] RAX: 00000000000005ea RBX: 0000000000000f7c RCX: 0000000000000002
[ 212.676084] RDX: ffff880111dd0dc0 RSI: 0000000000000bd4 RDI: ffff8800db6ffcc0
[ 212.676084] RBP: ffff880116e03e48 R08: 0000000000000992 R09: 0000000000000000
[ 212.676084] R10: ffffffff8181e400 R11: 0000000000000004 R12: 000000000000000f
[ 212.676084] R13: ffff8800d94ec840 R14: ffff8800db440c80 R15: 000000000000000e
[ 212.676084] FS: 00007f6685a3c700(0000) GS:ffff880116e00000(0000) knlGS:0000000000000000
[ 212.676084] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 212.676084] CR2: 00007f6685ad6460 CR3: 00000000db714000 CR4: 00000000000006f0
[ 212.676084] Stack:
[ 212.676084] ffff8800db6ffc00 000000000000000f ffff8800d94ec840 ffff880116e03eb8
[ 212.676084] ffffffffa041509f ffff880116e03e88 0000000f16e03e88 ffff8800d94ec000
[ 212.676084] 00000bd400059858 000000050000000f ffffffff81094c36 ffff880116e03eb8
[ 212.676084] Call Trace:
[ 212.676084] <IRQ>
[ 212.676084] [<ffffffffa041509f>] cp_interrupt+0x4ef/0x590 [8139cp]
[ 212.676084] [<ffffffff81094c36>] ? ktime_get+0x56/0xd0
[ 212.676084] [<ffffffff8108cf73>] handle_irq_event_percpu+0x53/0x170
[ 212.676084] [<ffffffff8108d0cc>] handle_irq_event+0x3c/0x60
[ 212.676084] [<ffffffff8108fdb5>] handle_fasteoi_irq+0x55/0xf0
[ 212.676084] [<ffffffff810045df>] handle_irq+0x1f/0x30
[ 212.676084] [<ffffffff81003c8b>] do_IRQ+0x5b/0xe0
[ 212.676084] [<ffffffff8142beaa>] common_interrupt+0x6a/0x6a
[ 212.676084] <EOI>
[ 212.676084] [<ffffffffa0416a21>] ? cp_start_xmit+0x621/0x97c [8139cp]
[ 212.676084] [<ffffffffa0416a09>] ? cp_start_xmit+0x609/0x97c [8139cp]
[ 212.676084] [<ffffffff81378ed9>] dev_hard_start_xmit+0x2c9/0x550
[ 212.676084] [<ffffffff813960a9>] sch_direct_xmit+0x179/0x1d0
[ 212.676084] [<ffffffff813793f3>] dev_queue_xmit+0x293/0x440
[ 212.676084] [<ffffffff813b0e46>] ip_finish_output+0x236/0x450
[ 212.676084] [<ffffffff810e59e7>] ? __alloc_pages_nodemask+0x187/0xb10
[ 212.676084] [<ffffffff813b10e8>] ip_output+0x88/0x90
[ 212.676084] [<ffffffff813afa64>] ip_local_out+0x24/0x30
[ 212.676084] [<ffffffff813aff0d>] ip_queue_xmit+0x14d/0x3e0
[ 212.676084] [<ffffffff813c6fd1>] tcp_transmit_skb+0x501/0x840
[ 212.676084] [<ffffffff813c8323>] tcp_write_xmit+0x1e3/0xb20
[ 212.676084] [<ffffffff81363237>] ? skb_page_frag_refill+0x87/0xd0
[ 212.676084] [<ffffffff813c8c8b>] tcp_push_one+0x2b/0x40
[ 212.676084] [<ffffffff813bb7e6>] tcp_sendmsg+0x926/0xc90
[ 212.676084] [<ffffffff813e1d21>] inet_sendmsg+0x61/0xc0
[ 212.676084] [<ffffffff8135e861>] sock_aio_write+0x101/0x120
[ 212.676084] [<ffffffff81107cf1>] ? vma_adjust+0x2e1/0x5d0
[ 212.676084] [<ffffffff812163e0>] ? timerqueue_add+0x60/0xb0
[ 212.676084] [<ffffffff81130b60>] do_sync_write+0x60/0x90
[ 212.676084] [<ffffffff81130d44>] ? rw_verify_area+0x54/0xf0
[ 212.676084] [<ffffffff81130f66>] vfs_write+0x186/0x190
[ 212.676084] [<ffffffff811317fd>] SyS_write+0x5d/0xa0
[ 212.676084] [<ffffffff814321e2>] system_call_fastpath+0x16/0x1b
[ 212.676084] Code: ca 41 89 dc 41 29 cc 45 31 db 29 c2 41 89 c5 89 d0 45 29 c5 f7 d0 c1 e8 1f e9 43 ff ff ff 66 0f 1f 44 00 00 31 c0 e9 7b ff ff ff <0f> 0b eb fe 66 66 66 66 2e 0f 1f 84 00 00 00 00 00 c7 47 40 00
[ 212.676084] RIP [<ffffffff8122e23f>] dql_completed+0x17f/0x190
------------[ cut here ]------------
When a skb has frags, bytes_compl plus skb->len nr_frags times in cp_tx().
It's not the correct value(actually, it should plus skb->len once) and it
will trigger the BUG_ON(bytes_compl > num_queued - dql->num_completed).
So only increase bytes_compl when finish sending all frags. pkts_compl also
has a wrong value, fix it too.
It's introduced by commit 871f0d4c ("8139cp: enable bql").
Suggested-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/realtek/8139cp.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
--- a/drivers/net/ethernet/realtek/8139cp.c
+++ b/drivers/net/ethernet/realtek/8139cp.c
@@ -678,9 +678,6 @@ static void cp_tx (struct cp_private *cp
le32_to_cpu(txd->opts1) & 0xffff,
PCI_DMA_TODEVICE);
- bytes_compl += skb->len;
- pkts_compl++;
-
if (status & LastFrag) {
if (status & (TxError | TxFIFOUnder)) {
netif_dbg(cp, tx_err, cp->dev,
@@ -702,6 +699,8 @@ static void cp_tx (struct cp_private *cp
netif_dbg(cp, tx_done, cp->dev,
"tx done, slot %d\n", tx_tail);
}
+ bytes_compl += skb->len;
+ pkts_compl++;
dev_kfree_skb_irq(skb);
}
next prev parent reply other threads:[~2013-12-06 22:33 UTC|newest]
Thread overview: 91+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-12-06 21:50 [PATCH 3.12 00/83] 3.12.4-stable review Greg Kroah-Hartman
2013-12-06 21:50 ` [PATCH 3.12 01/83] net: mv643xx_eth: Add missing phy_addr_set in DT mode Greg Kroah-Hartman
2013-12-06 21:50 ` [PATCH 3.12 02/83] net: mv643xx_eth: potential NULL dereference in probe() Greg Kroah-Hartman
2013-12-06 21:50 ` [PATCH 3.12 03/83] ipv6: fix headroom calculation in udp6_ufo_fragment Greg Kroah-Hartman
2013-12-06 21:50 ` [PATCH 3.12 04/83] bonding: RCUify bond_set_rx_mode() Greg Kroah-Hartman
2013-12-06 21:50 ` [PATCH 3.12 05/83] net: x86: bpf: dont forget to free sk_filter (v2) Greg Kroah-Hartman
2013-12-06 21:50 ` [PATCH 3.12 06/83] net/mlx4_en: Fixed crash when port type is changed Greg Kroah-Hartman
2013-12-06 21:50 ` [PATCH 3.12 07/83] net: Fix "ip rule delete table 256" Greg Kroah-Hartman
2013-12-06 21:50 ` [PATCH 3.12 08/83] ipv6: use rt6_get_dflt_router to get default router in rt6_route_rcv Greg Kroah-Hartman
2013-12-06 21:50 ` [PATCH 3.12 09/83] ipv6: protect for_each_sk_fl_rcu in mem_check with rcu_read_lock_bh Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 10/83] random32: fix off-by-one in seeding requirement Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 11/83] bonding: dont permit to use ARP monitoring in 802.3ad mode Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 12/83] usbnet: fix status interrupt urb handling Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 13/83] core/dev: do not ignore dmac in dev_forward_skb() Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 14/83] 6lowpan: Uncompression of traffic class field was incorrect Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 15/83] tuntap: limit head length of skb allocated Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 16/83] macvtap: " Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 17/83] tcp: tsq: restore minimal amount of queueing Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 18/83] bonding: fix two race conditions in bond_store_updelay/downdelay Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 19/83] net-tcp: fix panic in tcp_fastopen_cache_set() Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 20/83] sit: fix use after free of fb_tunnel_dev Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 21/83] isdnloop: use strlcpy() instead of strcpy() Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 22/83] ip6tnl: fix use after free of fb_tnl_dev Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 23/83] pkt_sched: fq: change classification of control packets Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 24/83] connector: improved unaligned access error fix Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 25/83] ipv4: fix possible seqlock deadlock Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 26/83] pkt_sched: fq: warn users using defrate Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 27/83] pkt_sched: fq: fix pacing for small frames Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 28/83] inet: prevent leakage of uninitialized memory to user in recv syscalls Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 29/83] ping: prevent NULL pointer dereference on write to msg_name Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 30/83] net: rework recvmsg handler msg_name and msg_namelen logic Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 31/83] net: add BUG_ON if kernel advertises msg_namelen > sizeof(struct sockaddr_storage) Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 32/83] inet: fix addr_len/msg->msg_namelen assignment in recv_error and rxpmtu functions Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 33/83] net: clamp ->msg_namelen instead of returning an error Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 34/83] ipv6: fix leaking uninitialized port number of offender sockaddr Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 35/83] ipv6: Fix inet6_init() cleanup order Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 36/83] ip6_output: fragment outgoing reassembled skb properly Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 37/83] netfilter: push reasm skb through instead of original frag skbs Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 38/83] xfrm: Release dst if this dst is improper for vti tunnel Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 39/83] atm: idt77252: fix dev refcnt leak Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 40/83] tcp: dont update snd_nxt, when a socket is switched from repair mode Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 41/83] ipv4: fix race in concurrent ip_route_input_slow() Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 42/83] net: core: Always propagate flag changes to interfaces Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 43/83] bridge: flush brs address entry in fdb when remove the bridge dev Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 44/83] packet: fix use after free race in send path when dev is released Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 45/83] af_packet: block BH in prb_shutdown_retire_blk_timer() Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 46/83] gso: handle new frag_list of frags GRO packets Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 47/83] gro: Only verify TCP checksums for candidates Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 48/83] gro: Clean up tcpX_gro_receive checksum verification Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 49/83] sch_tbf: handle too small burst Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 50/83] xen-netback: include definition of csum_ipv6_magic Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 51/83] via-velocity: fix netif_receive_skb use in irq disabled section Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 52/83] r8169: check ALDPS bit and disable it if enabled for the 8168g Greg Kroah-Hartman
2013-12-06 21:51 ` Greg Kroah-Hartman [this message]
2013-12-06 21:51 ` [PATCH 3.12 54/83] net: smc91: fix crash regression on the versatile Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 55/83] net: update consumers of MSG_MORE to recognize MSG_SENDPAGE_NOTLAST Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 56/83] team: fix master carrier set when user linkup is enabled Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 57/83] inet: fix possible seqlock deadlocks Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 58/83] ipv6: fix possible seqlock deadlock in ip6_finish_output2 Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 59/83] {pktgen, xfrm} Update IPv4 header total len and checksum after tranformation Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 60/83] xfrm: Fix null pointer dereference when decoding sessions Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 61/83] xfs: add capability check to free eofblocks ioctl Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 62/83] mm: numa: return the number of base pages altered by protection changes Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 63/83] md/raid5: Use conf->device_lock protect changing of multi-thread resources Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 64/83] usb: musb: davinci: fix resources passed to MUSB driver for DM6467 Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 65/83] usb: wusbcore: change WA_SEGS_MAX to a legal value Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 66/83] video: kyro: fix incorrect sizes when copying to userspace Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 67/83] HID: lg: fix Report Descriptor for Logitech MOMO Force (Black) Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 68/83] HID: hid-elo: some systems cannot stomach work around Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 69/83] iommu/vt-d: Fixed interaction of VFIO_IOMMU_MAP_DMA with IOMMU address limits Greg Kroah-Hartman
2013-12-06 21:52 ` [PATCH 3.12 70/83] iommu: Remove stack trace from broken irq remapping warning Greg Kroah-Hartman
2013-12-06 21:52 ` [PATCH 3.12 71/83] rt2800: add support for radio chip RF3070 Greg Kroah-Hartman
2013-12-06 21:52 ` [PATCH 3.12 72/83] elevator: Fix a race in elevator switching and md device initialization Greg Kroah-Hartman
2013-12-06 21:52 ` [PATCH 3.12 73/83] elevator: acquire q->sysfs_lock in elevator_change() Greg Kroah-Hartman
2013-12-06 21:52 ` [PATCH 3.12 74/83] ntp: Make periodic RTC update more reliable Greg Kroah-Hartman
2013-12-06 21:52 ` [PATCH 3.12 75/83] aio: Fix a trinity splat Greg Kroah-Hartman
2013-12-06 21:52 ` [PATCH 3.12 76/83] take anon inode allocation to libfs.c Greg Kroah-Hartman
2013-12-06 21:52 ` [PATCH 3.12 77/83] rework aio migrate pages to use aio fs Greg Kroah-Hartman
2013-12-06 21:52 ` [PATCH 3.12 78/83] aio: checking for NULL instead of IS_ERR Greg Kroah-Hartman
2013-12-06 21:52 ` [PATCH 3.12 79/83] aio: prevent double free in ioctx_alloc Greg Kroah-Hartman
2013-12-06 21:52 ` [PATCH 3.12 80/83] aio: nullify aio->ring_pages after freeing it Greg Kroah-Hartman
2013-12-06 21:52 ` [PATCH 3.12 81/83] aio: clean up aio ring in the fail path Greg Kroah-Hartman
2013-12-06 21:52 ` [PATCH 3.12 82/83] drm/radeon/audio: improve ACR calculation Greg Kroah-Hartman
2013-12-06 21:52 ` [PATCH 3.12 83/83] drm/radeon/audio: correct ACR table Greg Kroah-Hartman
2013-12-06 22:52 ` [PATCH 3.12 00/83] 3.12.4-stable review Holger Hoffstätte
2013-12-07 17:01 ` Greg KH
2013-12-07 17:01 ` Greg KH
2013-12-07 6:44 ` Guenter Roeck
2013-12-07 17:00 ` Greg Kroah-Hartman
2013-12-07 22:15 ` Shuah Khan
2013-12-07 23:17 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20131206214644.985720474@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=yangyingliang@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.