[Xenomai-core] Ping causes Oops, appears to be a race condition

["Steven A. Falco" <sfalco@domain.hid>]

[-- Attachment #1: Type: text/plain, Size: 755 bytes --]

Some more info on the ping crash I reported last week (powerpc kernel 
2.6.23, Xenomai 2.4-rc4, ipipe 2.0-03).  Ping works correctly without 
Xenomai.  With Xenomai, I get an oops, attached below.

I added a printk in __raw_v4_lookup() since the NIP pointed there.  
Interestingly, once I did that, ping worked with Xenomai as shown here:

# ping 127.0.0.1
PING 127.0.0.1 (127.0.0.1): 56 data bytes
sock c06f4040
sock 00000000
sock c06f4040
sock 00000000
64 bytes from 127.0.0.1: seq=0 ttl=64 time=7.571 ms

Here is the printk that changed the behavior:

struct sock *__raw_v4_lookup(struct sock *sk, unsigned short num, __be32 
raddr, __be32 laddr, int dif)
{
    struct hlist_node *node;
    printk("sock %p\n", sk);
    sk_for_each_from(sk, node) {




[-- Attachment #2: log --]
[-- Type: text/plain, Size: 2008 bytes --]

# ping 127.0.0.1
PING 127.0.0.1 (127.0.0.1): 56 data bytes
Unable to handle kernel paging request for data at address 0x00000008
Faulting instruction address: 0xc01c6648
Oops: Kernel access of bad area, sig: 11 [#1]
Netdec
Modules linked in:
NIP: c01c6648 LR: c01c6d08 CTR: c018279c
REGS: c028b9d0 TRAP: 0300   Not tainted  (2.6.23)
MSR: 00029030 <EE,ME,IR,DR>  CR: 48000422  XER: 00000000
DEAR: 00000008, ESR: 00000000
TASK = c0f83810[660] 'ping' THREAD: c028a000
GPR00: 00000000 c028ba80 c0f83810 00000008 00000001 7f000001 7f000001 00000002
GPR08: c02c0000 c02b5680 c02d0360 c02c0000 c0f35e10 100d25f0 00ff9900 00000001
GPR16: 000000a0 c06e7f68 c02a0000 c02d0000 c028bb68 fffee529 c02fbd88 00000000
GPR24: 00000040 c02d0000 c02d0000 c02d0000 00000001 c06f4040 c06f6c60 c0f35e10
NIP [c01c6648] __raw_v4_lookup+0x10/0x84
LR [c01c6d08] raw_v4_input+0xcc/0x184
Call Trace:
[c028ba80] [c01c6cd4] raw_v4_input+0x98/0x184 (unreliable)
[c028baa0] [c01a5a34] ip_local_deliver+0xbc/0x188
[c028bac0] [c01a5d3c] ip_rcv+0x23c/0x4cc
[c028baf0] [c018b5cc] netif_receive_skb+0x22c/0x310
[c028bb20] [c018ded8] process_backlog+0xbc/0x19c
[c028bb60] [c018e06c] net_rx_action+0xb4/0x1b8
[c028bba0] [c0024f18] __do_softirq+0x84/0x108
[c028bbe0] [c0005178] do_softirq+0x94/0x98
[c028bbf0] [c0024c9c] local_bh_enable+0x7c/0xa4
[c028bc00] [c018e848] dev_queue_xmit+0xe4/0x31c
[c028bc20] [c01954c8] neigh_resolve_output+0xfc/0x2b4
[c028bc50] [c01aa494] ip_output+0x2c4/0x328
[c028bc70] [c01a997c] ip_push_pending_frames+0x280/0x40c
[c028bc90] [c01c74d8] raw_sendmsg+0x674/0x738
[c028bd10] [c01d0a30] inet_sendmsg+0x50/0x78
[c028bd30] [c017ed2c] sock_sendmsg+0xac/0xf4
[c028be20] [c017f0bc] sys_sendto+0xcc/0x108
[c028bf00] [c017faa4] sys_socketcall+0x138/0x1d8
[c028bf40] [c000e48c] ret_from_syscall+0x0/0x3c
Instruction dump:
5400e006 90010008 409effd4 80010024 bba10014 7c0803a6 38210020 4e800020
2c030000 4da20020 34630008 41820070 <81230000> 2f090000 419a0008 7c004a2c
Kernel panic - not syncing: Fatal exception in interrupt