From mboxrd@z Thu Jan 1 00:00:00 1970 From: Ding Tianhong Subject: Re: [PATCH net] net: neighbour: add neighbour dead check for neigh_timer_handler() Date: Wed, 18 Dec 2013 16:19:43 +0800 Message-ID: <52B15A9F.6030301@huawei.com> References: <529E9579.7090201@cn.fujitsu.com> <529EA9CF.2090008@huawei.com> <20131203.232122.852236751455974887.davem@davemloft.net> <529EC95A.5080908@huawei.com> <1386138457.30495.86.camel@edumazet-glaptop2.roam.corp.google.com> <529EF30A.4050609@huawei.com> <1386170645.30495.108.camel@edumazet-glaptop2.roam.corp.google.com> <529FC980.8020101@cn.fujitsu.com> <529FF066.1070307@huawei.com> <52B142AF.8070708@huawei.com> <20131218075131.GD27460@order.stressinduktion.org> Mime-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: 7bit To: Eric Dumazet , David Miller , , , , Return-path: Received: from szxga02-in.huawei.com ([119.145.14.65]:51937 "EHLO szxga02-in.huawei.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751072Ab3LRIe4 (ORCPT ); Wed, 18 Dec 2013 03:34:56 -0500 In-Reply-To: <20131218075131.GD27460@order.stressinduktion.org> Sender: netdev-owner@vger.kernel.org List-ID: On 2013/12/18 15:51, Hannes Frederic Sowa wrote: > Hi Ding! > > May I step in for short? > > On Wed, Dec 18, 2013 at 02:37:35PM +0800, Ding Tianhong wrote: >> On 2013/12/5 11:17, Ding Tianhong wrote: >>> On 2013/12/5 8:32, Gao feng wrote: >>>> On 12/04/2013 11:24 PM, Eric Dumazet wrote: >>>>> On Wed, 2013-12-04 at 17:16 +0800, Ding Tianhong wrote: >>>>>>>> base->running_timer = neigh->timer; >>>>>>>> neigh_timer_handler() => at this time, refcnt is 2; >>>>>>>> >>>>>>>> user-> neigh_changeaddr() >>>>>>>> neigh_flush_dev(); >>>>>>>> neigh_del_imer, refcnt dec to 1; >>>>>>> >>>>>>> Nope : del_timer() would return 0 here, so we do not decrement refcnt. >>>>>>> >>>>>> >>>>>> The first call for del_timer() will return 1, because the timer->entry.next is not NULL, >>>>>> then in the neigh_destroy, the del_timer() again will return 0 because timer->entry.next is NULL. >>>>> >>>>> Again no. You are very mistaken. >>>>> >>>>> del_timer() return code is not a hint. Its a precise meaning. >>>>> >>>>> It cannot return 1 if the timer function is running or is about to run. >>>>> >>>>> If you believe there is bug in del_timer(), fix it ;) >>>>> >>>>> >>>> >>>> Yes, you are right, __run_timers did this job. >>>> So We still don't know what's the root reason. >>>> >>> Yes, I miss it, the running timer is detached from the list, thanks for all above. >>> >>> Regards >>> Ding >>> >> >> >> Hi Eric: >> >> I was so doubt about the situation, can you give me some advise? >> >> CPU0 CPU1 CPU2 >> -------- -------- --------- >> neigh_timer_handler >> write_lock(n->lock); >> ... >> write_unlock(n->lock); >> n->ref_cnt = 2 or 3(if mode_time) >> ... neigh_flush_dev >> write_lock(n->lock); >> n->ref_cnt = 2; >> n->nud_state = NUD_NONE; >> write_unlock(n->lock); >> neigh_release() >> n->ref_cnt = 1; >> ... neigh_periodic_work >> write_lock(n->lock); >> write_unlock(n->lock); >> neigh_release(); >> kfree(n) >> n->ops->solicit() ... >> ... >> >> if that possible? or I was totally wrong? pls give me some advise if I miss something, thanks a lot. > > When you first posted the patch I had my doubts that there is such > race. E.g. n->dead was 0 in the neigh you posted. After all the neigh > timer has its own reference and does check ->dead before proceeding. I maybe > wrong because the memory could already be overwritten. > > (Maybe we should move the ->dead check inside the write_lock to use it as a > barrier.) > > Maybe there was another dereference which caused the bug. Could you check if > you have the code section from the panic? It should look something like > > Code: FF FF FF .. .. > > Sometimes using addr2line on vmlinux with the RIP could give another hint. > > Greetings, > > Hannes > Hi Hannes: Thanks for your attention. I hope it useful to you. 235 [64306.090258] Supported: Yes, External 236 [64306.090262] Pid: 58359, comm: socknal_cd04 Tainted: P N 2.6.32.59-0.7-default #1 T3500 G3 237 [64306.090266] RIP: 0010:[] [] neigh_timer_handler+0x116/0x3b0 238 [64306.090272] RSP: 0018:ffff880c273499d8 EFLAGS: 00010206 239 [64306.090275] RAX: 0000000000000000 RBX: ffff8801cddf1500 RCX: ffff8801cddf14f2 240 [64306.090278] RDX: 0000000000000000 RSI: ffff8805e40d3a28 RDI: ffff8801cddf1500 241 [64306.090281] RBP: ffff8805e40d3a28 R08: ffff8801cddf1530 R09: ffff880c27349b17 242 [64306.090284] R10: 000000000000000e R11: ffffffff812f8e22 R12: ffff880185c0e840 243 [64306.090287] R13: 0000000000000000 R14: ffff8805e40d3a60 R15: 0000000003484560 ffffffff812f8e36 (t) neigh_timer_handler+278 ../linux/net/core/neighbour.c: 876 crash> dis -l neigh_timer_handler /usr/src/linux/net/core/neighbour.c: 798 0xffffffff812f8d20 : sub $0x28,%rsp 0xffffffff812f8d24 : mov %r14,0x20(%rsp) /usr/src/linux/net/core/neighbour.c: 804 0xffffffff812f8d29 : lea 0x40(%rdi),%r14 /usr/src/linux/net/core/neighbour.c: 798 0xffffffff812f8d2d : mov %rbx,(%rsp) 0xffffffff812f8d31 : mov %rdi,%rbx 0xffffffff812f8d34 : mov %rbp,0x8(%rsp) 0xffffffff812f8d39 : mov %r12,0x10(%rsp) /usr/src/linux/net/core/neighbour.c: 804 0xffffffff812f8d3e : mov %r14,%rdi /usr/src/linux/net/core/neighbour.c: 798 0xffffffff812f8d41 : mov %r13,0x18(%rsp) /usr/src/linux/net/core/neighbour.c: 878 0xffffffff812f8d46 : xor %r13d,%r13d /usr/src/linux/net/core/neighbour.c: 804 0xffffffff812f8d49 : callq 0xffffffff81394bb0 <_write_lock> /usr/src/linux/net/core/neighbour.c: 806 0xffffffff812f8d4e : movzbl 0x39(%rbx),%edx /usr/src/linux/net/core/neighbour.c: 807 0xffffffff812f8d52 : mov 0x634ba7(%rip),%rdi # 0xffffffff8192d900 0xffffffff812f8d59 : lea 0x70(%rbx),%r12 /usr/src/linux/net/core/neighbour.c: 808 0xffffffff812f8d5d : lea 0xfa(%rdi),%rbp /usr/src/linux/net/core/neighbour.c: 806 0xffffffff812f8d64 : movzbl %dl,%eax /usr/src/linux/net/core/neighbour.c: 810 0xffffffff812f8d67 : test $0x1b,%al 0xffffffff812f8d69 : je 0xffffffff812f8e50 /usr/src/linux/net/core/neighbour.c: 817 0xffffffff812f8d6f : test $0x2,%al 0xffffffff812f8d71 : je 0xffffffff812f8e98 /usr/src/linux/net/core/neighbour.c: 818 0xffffffff812f8d77 : mov 0x10(%rbx),%r8 0xffffffff812f8d7b : movslq 0x5c(%r8),%rsi 0xffffffff812f8d7f : add 0x28(%rbx),%rsi 0xffffffff812f8d83 : cmp %rdi,%rsi 0xffffffff812f8d86 : js 0xffffffff812f8f58 0xffffffff812f8d8c : mov %rsi,%rbp /usr/src/linux/net/core/neighbour.c: 857 0xffffffff812f8d8f : movzbl %dl,%eax 0xffffffff812f8d92 : test $0x11,%al 0xffffffff812f8d94 : je 0xffffffff812f8db0 /usr/src/linux/net/core/neighbour.c: 768 0xffffffff812f8d96 : test $0x10,%al /usr/src/linux/include/asm/atomic_64.h: 23 0xffffffff812f8d98 : mov 0x3c(%rbx),%esi /usr/src/linux/net/core/neighbour.c: 767 0xffffffff812f8d9b : mov 0x10(%rbx),%rcx /usr/src/linux/net/core/neighbour.c: 768 0xffffffff812f8d9f : je 0xffffffff812f8fe8 0xffffffff812f8da5 : mov 0x68(%rcx),%edx /usr/src/linux/net/core/neighbour.c: 857 0xffffffff812f8da8 : cmp %edx,%esi 0xffffffff812f8daa : jge 0xffffffff812f9000 /usr/src/linux/net/core/neighbour.c: 864 0xffffffff812f8db0 : test $0x1b,%al 0xffffffff812f8db2 : lea 0x70(%rbx),%r12 0xffffffff812f8db6 : je 0xffffffff812f8df1 /usr/src/linux/net/core/neighbour.c: 865 0xffffffff812f8db8 : mov 0x634b41(%rip),%rax # 0xffffffff8192d900 0xffffffff812f8dbf : mov %rbp,%rdx 0xffffffff812f8dc2 : sub %rax,%rdx 0xffffffff812f8dc5 : mov %rdx,%rax 0xffffffff812f8dc8 : sub $0x7d,%rax 0xffffffff812f8dcc : js 0xffffffff812f9020 /usr/src/linux/net/core/neighbour.c: 867 0xffffffff812f8dd2 : lea 0x98(%rbx),%rdi 0xffffffff812f8dd9 : mov %rbp,%rsi 0xffffffff812f8ddc : callq 0xffffffff81057db0 0xffffffff812f8de1 : test %eax,%eax 0xffffffff812f8de3 : je 0xffffffff812f8fd0 0xffffffff812f8de9 : movzbl 0x39(%rbx),%eax 0xffffffff812f8ded : lea 0x70(%rbx),%r12 /usr/src/linux/net/core/neighbour.c: 870 0xffffffff812f8df1 : test $0x11,%al 0xffffffff812f8df3 : je 0xffffffff812f8e50 /usr/src/linux/include/linux/skbuff.h: 787 0xffffffff812f8df5 : mov 0x80(%rbx),%rbp 0xffffffff812f8dfc : lea 0x80(%rbx),%rax /usr/src/linux/include/linux/skbuff.h: 788 0xffffffff812f8e03 : cmp %rbp,%rax 0xffffffff812f8e06 : je 0xffffffff812f9060 /usr/src/linux/net/core/neighbour.c: 873 0xffffffff812f8e0c : test %rbp,%rbp 0xffffffff812f8e0f : je 0xffffffff812f8e21 /usr/src/linux/net/core/neighbour.c: 874 0xffffffff812f8e11 : mov %rbp,%rdi 0xffffffff812f8e14 : mov $0x20,%esi 0xffffffff812f8e19 : callq 0xffffffff812e83c0 0xffffffff812f8e1e : mov %rax,%rbp /usr/src/linux/include/asm/spinlock.h: 294 0xffffffff812f8e21 : lock addl $0x1000000,0x40(%rbx) /usr/src/linux/net/core/neighbour.c: 876 0xffffffff812f8e29 : mov 0xe8(%rbx),%rax 0xffffffff812f8e30 : mov %rbp,%rsi 0xffffffff812f8e33 : mov %rbx,%rdi 0xffffffff812f8e36 : callq *0x8(%rax) <-----crash /usr/src/linux/net/core/neighbour.c: 877 0xffffffff812f8e39 : lea 0x3c(%rbx),%rax /usr/src/linux/include/asm/atomic_64.h: 93 0xffffffff812f8e3d : lock incl 0x3c(%rbx) /usr/src/linux/net/core/neighbour.c: 878 0xffffffff812f8e41 : mov %rbp,%rdi 0xffffffff812f8e44 : callq 0xffffffff812e57c0 0xffffffff812f8e49 : jmp 0xffffffff812f8e58 0xffffffff812f8e4b : nopl 0x0(%rax,%rax,1) /usr/src/linux/include/asm/spinlock.h: 294 0xffffffff812f8e50 : lock addl $0x1000000,0x40(%rbx) /usr/src/linux/net/core/neighbour.c: 884 0xffffffff812f8e58 : test %r13d,%r13d 0xffffffff812f8e5b : je 0xffffffff812f8e65 /usr/src/linux/net/core/neighbour.c: 885 0xffffffff812f8e5d : mov %rbx,%rdi 0xffffffff812f8e60 : callq 0xffffffff812f8950 /usr/src/linux/include/asm/atomic_64.h: 123 0xffffffff812f8e65 : lock decl (%r12) 0xffffffff812f8e6a : sete %al /usr/src/linux/include/net/neighbour.h: 288 0xffffffff812f8e6d : test %al,%al 0xffffffff812f8e6f : jne 0xffffffff812f8f18 /usr/src/linux/net/core/neighbour.c: 888 0xffffffff812f8e75 : mov (%rsp),%rbx 0xffffffff812f8e79 : mov 0x8(%rsp),%rbp 0xffffffff812f8e7e : mov 0x10(%rsp),%r12 0xffffffff812f8e83 : mov 0x18(%rsp),%r13 0xffffffff812f8e88 : mov 0x20(%rsp),%r14 0xffffffff812f8e8d : add $0x28,%rsp 0xffffffff812f8e91 : retq 0xffffffff812f8e92 : nopw 0x0(%rax,%rax,1) /usr/src/linux/net/core/neighbour.c: 836 0xffffffff812f8e98 : test $0x8,%al 0xffffffff812f8e9a : je 0xffffffff812f8f40 /usr/src/linux/net/core/neighbour.c: 837 0xffffffff812f8ea0 : mov 0x10(%rbx),%r8 0xffffffff812f8ea4 : movslq 0x60(%r8),%rax 0xffffffff812f8ea8 : add 0x28(%rbx),%rax 0xffffffff812f8eac : cmp %rdi,%rax 0xffffffff812f8eaf : js 0xffffffff812f9030 /usr/src/linux/net/core/neighbour.c: 840 0xffffffff812f8eb5 : movb $0x2,0x39(%rbx) /usr/src/linux/net/core/neighbour.c: 689 0xffffffff812f8eb9 : mov 0xe8(%rbx),%rcx /usr/src/linux/net/core/neighbour.c: 841 0xffffffff812f8ec0 : mov 0x634a39(%rip),%rax # 0xffffffff8192d900 /usr/src/linux/net/core/neighbour.c: 691 0xffffffff812f8ec7 : mov 0x68(%rbx),%rdx /usr/src/linux/net/core/neighbour.c: 841 0xffffffff812f8ecb : mov %rax,0x30(%rbx) /usr/src/linux/net/core/neighbour.c: 689 0xffffffff812f8ecf : mov 0x20(%rcx),%rax /usr/src/linux/net/core/neighbour.c: 691 0xffffffff812f8ed3 : test %rdx,%rdx /usr/src/linux/net/core/neighbour.c: 689 0xffffffff812f8ed6 : mov %rax,0x78(%rbx) /usr/src/linux/net/core/neighbour.c: 691 0xffffffff812f8eda : jne 0xffffffff812f8ee7 0xffffffff812f8edc : jmp 0xffffffff812f8efe 0xffffffff812f8ede : xchg %ax,%ax 0xffffffff812f8ee0 : mov 0xe8(%rbx),%rcx /usr/src/linux/net/core/neighbour.c: 692 0xffffffff812f8ee7 : mov 0x28(%rcx),%rax 0xffffffff812f8eeb : mov %rax,0x88(%rdx) /usr/src/linux/net/core/neighbour.c: 691 0xffffffff812f8ef2 : mov (%rdx),%rdx 0xffffffff812f8ef5 : test %rdx,%rdx 0xffffffff812f8ef8 : jne 0xffffffff812f8ee0 0xffffffff812f8efa : mov 0x10(%rbx),%r8 /usr/src/linux/net/core/neighbour.c: 844 0xffffffff812f8efe : movslq 0x5c(%r8),%rbp 0xffffffff812f8f02 : add 0x28(%rbx),%rbp 0xffffffff812f8f06 : movzbl 0x39(%rbx),%edx 0xffffffff812f8f0a : mov $0x1,%r13d 0xffffffff812f8f10 : jmpq 0xffffffff812f8d8f 0xffffffff812f8f15 : nopl (%rax) /usr/src/linux/include/net/neighbour.h: 289 0xffffffff812f8f18 : mov %rbx,%rdi /usr/src/linux/net/core/neighbour.c: 888 0xffffffff812f8f1b : mov 0x8(%rsp),%rbp 0xffffffff812f8f20 : mov (%rsp),%rbx 0xffffffff812f8f24 : mov 0x10(%rsp),%r12 0xffffffff812f8f29 : mov 0x18(%rsp),%r13 0xffffffff812f8f2e : mov 0x20(%rsp),%r14 0xffffffff812f8f33 : add $0x28,%rsp /usr/src/linux/include/net/neighbour.h: 289 0xffffffff812f8f37 : jmpq 0xffffffff812f8ba0 0xffffffff812f8f3c : nopl 0x0(%rax) /usr/src/linux/net/core/neighbour.c: 854 0xffffffff812f8f40 : mov 0x10(%rbx),%rax 0xffffffff812f8f44 : movslq 0x54(%rax),%rax 0xffffffff812f8f48 : lea (%rax,%rdi,1),%rbp 0xffffffff812f8f4c : jmpq 0xffffffff812f8d8f 0xffffffff812f8f51 : nopl 0x0(%rax) /usr/src/linux/net/core/neighbour.c: 822 0xffffffff812f8f58 : movslq 0x60(%r8),%rax 0xffffffff812f8f5c : add 0x20(%rbx),%rax 0xffffffff812f8f60 : cmp %rdi,%rax 0xffffffff812f8f63 : js 0xffffffff812f9070 /usr/src/linux/net/core/neighbour.c: 825 0xffffffff812f8f69 : movb $0x8,0x39(%rbx) /usr/src/linux/net/core/neighbour.c: 672 0xffffffff812f8f6d : mov 0xe8(%rbx),%rcx /usr/src/linux/net/core/neighbour.c: 826 0xffffffff812f8f74 : mov 0x634985(%rip),%rax # 0xffffffff8192d900 /usr/src/linux/net/core/neighbour.c: 674 0xffffffff812f8f7b : mov 0x68(%rbx),%rdx /usr/src/linux/net/core/neighbour.c: 826 0xffffffff812f8f7f : mov %rax,0x30(%rbx) /usr/src/linux/net/core/neighbour.c: 672 0xffffffff812f8f83 : mov 0x18(%rcx),%rax /usr/src/linux/net/core/neighbour.c: 674 0xffffffff812f8f87 : test %rdx,%rdx /usr/src/linux/net/core/neighbour.c: 672 0xffffffff812f8f8a : mov %rax,0x78(%rbx) /usr/src/linux/net/core/neighbour.c: 674 0xffffffff812f8f8e : jne 0xffffffff812f8faf /usr/src/linux/net/core/neighbour.c: 828 0xffffffff812f8f90 : movslq 0x60(%r8),%rax 0xffffffff812f8f94 : movzbl 0x39(%rbx),%edx 0xffffffff812f8f98 : xor %r13d,%r13d 0xffffffff812f8f9b : lea (%rax,%rdi,1),%rbp 0xffffffff812f8f9f : jmpq 0xffffffff812f8d8f 0xffffffff812f8fa4 : nopl 0x0(%rax) 0xffffffff812f8fa8 : mov 0xe8(%rbx),%rcx /usr/src/linux/net/core/neighbour.c: 675 0xffffffff812f8faf : mov 0x18(%rcx),%rax 0xffffffff812f8fb3 : mov %rax,0x88(%rdx) /usr/src/linux/net/core/neighbour.c: 674 0xffffffff812f8fba : mov (%rdx),%rdx 0xffffffff812f8fbd : test %rdx,%rdx 0xffffffff812f8fc0 : jne 0xffffffff812f8fa8 0xffffffff812f8fc2 : mov 0x10(%rbx),%r8 0xffffffff812f8fc6 : jmp 0xffffffff812f8f90 0xffffffff812f8fc8 : nopl 0x0(%rax,%rax,1) /usr/src/linux/net/core/neighbour.c: 868 0xffffffff812f8fd0 : lea 0x70(%rbx),%r12 /usr/src/linux/include/asm/atomic_64.h: 93 0xffffffff812f8fd4 : lock incl 0x70(%rbx) 0xffffffff812f8fd8 : movzbl 0x39(%rbx),%eax 0xffffffff812f8fdc : jmpq 0xffffffff812f8df1 0xffffffff812f8fe1 : nopl 0x0(%rax) /usr/src/linux/net/core/neighbour.c: 768 0xffffffff812f8fe8 : mov 0x6c(%rcx),%edx 0xffffffff812f8feb : add 0x68(%rcx),%edx 0xffffffff812f8fee : add 0x70(%rcx),%edx 0xffffffff812f8ff1 : jmpq 0xffffffff812f8da8 0xffffffff812f8ff6 : nopw %cs:0x0(%rax,%rax,1) /usr/src/linux/net/core/neighbour.c: 859 0xffffffff812f9000 : movb $0x20,0x39(%rbx) /usr/src/linux/net/core/neighbour.c: 861 0xffffffff812f9004 : mov %rbx,%rdi 0xffffffff812f9007 : mov $0x1,%r13d 0xffffffff812f900d : callq 0xffffffff812f8880 0xffffffff812f9012 : movzbl 0x39(%rbx),%eax 0xffffffff812f9016 : jmpq 0xffffffff812f8db0 0xffffffff812f901b : nopl 0x0(%rax,%rax,1) /usr/src/linux/net/core/neighbour.c: 866 0xffffffff812f9020 : mov 0x6348d9(%rip),%rax # 0xffffffff8192d900 0xffffffff812f9027 : lea 0x7d(%rax),%rbp 0xffffffff812f902b : jmpq 0xffffffff812f8dd2 /usr/src/linux/net/core/neighbour.c: 847 0xffffffff812f9030 : movb $0x10,0x39(%rbx) /usr/src/linux/net/core/neighbour.c: 848 0xffffffff812f9034 : mov 0x6348c5(%rip),%rax # 0xffffffff8192d900 /usr/src/linux/net/core/neighbour.c: 850 0xffffffff812f903b : mov $0x10,%edx /usr/src/linux/include/asm/atomic_64.h: 35 0xffffffff812f9040 : movl $0x0,0x3c(%rbx) /usr/src/linux/net/core/neighbour.c: 848 0xffffffff812f9047 : mov %rax,0x30(%rbx) /usr/src/linux/net/core/neighbour.c: 850 0xffffffff812f904b : movslq 0x54(%r8),%rax 0xffffffff812f904f : lea (%rax,%rdi,1),%rbp 0xffffffff812f9053 : jmpq 0xffffffff812f8d8f 0xffffffff812f9058 : nopl 0x0(%rax,%rax,1) /usr/src/linux/include/linux/skbuff.h: 788 0xffffffff812f9060 : xor %ebp,%ebp 0xffffffff812f9062 : jmpq 0xffffffff812f8e21 0xffffffff812f9067 : nopw 0x0(%rax,%rax,1) /usr/src/linux/net/core/neighbour.c: 831 0xffffffff812f9070 : movb $0x4,0x39(%rbx) /usr/src/linux/net/core/neighbour.c: 672 0xffffffff812f9074 : mov 0xe8(%rbx),%rcx /usr/src/linux/net/core/neighbour.c: 674 0xffffffff812f907b : mov $0x4,%edx /usr/src/linux/net/core/neighbour.c: 832 0xffffffff812f9080 : mov 0x634879(%rip),%rax # 0xffffffff8192d900 /usr/src/linux/net/core/neighbour.c: 674 0xffffffff812f9087 : mov 0x68(%rbx),%rsi 0xffffffff812f908b : mov $0x1,%r13d /usr/src/linux/net/core/neighbour.c: 832 0xffffffff812f9091 : mov %rax,0x30(%rbx) /usr/src/linux/net/core/neighbour.c: 672 0xffffffff812f9095 : mov 0x18(%rcx),%rax /usr/src/linux/net/core/neighbour.c: 674 0xffffffff812f9099 : test %rsi,%rsi /usr/src/linux/net/core/neighbour.c: 672 0xffffffff812f909c : mov %rax,0x78(%rbx) /usr/src/linux/net/core/neighbour.c: 674 0xffffffff812f90a0 : jne 0xffffffff812f90b7 0xffffffff812f90a2 : jmpq 0xffffffff812f8d8f 0xffffffff812f90a7 : nopw 0x0(%rax,%rax,1) 0xffffffff812f90b0 : mov 0xe8(%rbx),%rcx /usr/src/linux/net/core/neighbour.c: 675 0xffffffff812f90b7 : mov 0x18(%rcx),%rax 0xffffffff812f90bb : mov %rax,0x88(%rsi) /usr/src/linux/net/core/neighbour.c: 674 0xffffffff812f90c2 : mov (%rsi),%rsi 0xffffffff812f90c5 : test %rsi,%rsi 0xffffffff812f90c8 : jne 0xffffffff812f90b0 0xffffffff812f90ca : jmpq 0xffffffff812f8f06 0xffffffff812f90cf : nop crash> neighbour ffff8801cddf1500 struct neighbour { next = 0x4037ad30000045, tbl = 0x2484560013d0640, parms = 0xdc03ff7f03484560, dev = 0x23351d86, used = 170277469553264, confirmed = 649366077121561602, updated = 0, flags = 0 '\000', nud_state = 0 '\000', type = 0 '\000', dead = 0 '\000', probes = { counter = 0 }, lock = { raw_lock = { lock = 16777216 } }, ha = "\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\0 00", hh = 0x0, refcnt = { counter = 0 }, output = 0, arp_queue = { next = 0x10002, prev = 0x0, qlen = 1, lock = { raw_lock = { slock = 0 } } }, timer = { entry = { next = 0x0, prev = 0x0 }, expires = 0, function = 0, data = 0, base = 0x0, start_site = 0x0, start_comm = "\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000", start_pid = 0 }, ops = 0x0, primary_key = 0xffff8801cddf15f0 "" } crash> struct -o neighbour struct neighbour { [0] struct neighbour *next; [8] struct neigh_table *tbl; [16] struct neigh_parms *parms; [24] struct net_device *dev; [32] long unsigned int used; [40] long unsigned int confirmed; [48] long unsigned int updated; [56] __u8 flags; [57] __u8 nud_state; [58] __u8 type; [59] __u8 dead; [60] atomic_t probes; [64] rwlock_t lock; [68] unsigned char ha[32]; [104] struct hh_cache *hh; [112] atomic_t refcnt; [120] int (*output)(struct sk_buff *); [128] struct sk_buff_head arp_queue; [152] struct timer_list timer; [232] const struct neigh_ops *ops; [240] u8 primary_key[0]; } SIZE: 240 > -- > To unsubscribe from this list: send the line "unsubscribe netdev" in > the body of a message to majordomo@vger.kernel.org > More majordomo info at http://vger.kernel.org/majordomo-info.html > > . >