* Re: veth crash (commit 751ae21c6cd1493e3d0a4935b08fb298b9d89773)
2006-10-12 8:22 veth crash (commit 751ae21c6cd1493e3d0a4935b08fb298b9d89773) David Gibson
@ 2006-10-13 4:20 ` David Gibson
2006-10-18 16:22 ` Santiago Leon
0 siblings, 1 reply; 3+ messages in thread
From: David Gibson @ 2006-10-13 4:20 UTC (permalink / raw)
To: Santiago Leon, Jeff Garzik; +Cc: Andrew Morton, linux-kernel
On Thu, Oct 12, 2006 at 06:22:14PM +1000, David Gibson wrote:
> Your recent ibmveth commit, 751ae21c6cd1493e3d0a4935b08fb298b9d89773
> ("fix int rollover panic"), causes a rapid oops on my test machine
> (POWER5 LPAR).
>
> I've bisected it down to that commit, but am still investigating the
> cause of the crash itself.
Found the problem, I believe: an object lesson in the need for great
caution using ++.
[...]
@@ -213,6 +213,7 @@ static void ibmveth_replenish_buffer_poo
}
free_index = pool->consumer_index++ % pool->size;
+ pool->consumer_index = free_index;
index = pool->free_map[free_index];
ibmveth_assert(index != IBM_VETH_INVALID_MAP);
Since the ++ is used as post-increment, the increment is not included
in free_index, and so the added line effectively reverts the
increment. The produced_index side has an analagous bug.
Jeff, Santiago, please apply the patch below to correct this:
ibmveth: Fix index increment calculation
The recent commit 751ae21c6cd1493e3d0a4935b08fb298b9d89773 introduced
a bug in the producer/consumer index calculation in the ibmveth driver
- incautious use of the post-increment ++ operator resulted in an
increment being immediately reverted. This patch corrects the logic.
Without this patch, the driver oopses almost immediately after
activation on at least some machines.
Signed-off-by: David Gibson <dwg@au1.ibm.com>
Index: working-2.6/drivers/net/ibmveth.c
===================================================================
--- working-2.6.orig/drivers/net/ibmveth.c 2006-10-13 14:12:49.000000000 +1000
+++ working-2.6/drivers/net/ibmveth.c 2006-10-13 14:14:24.000000000 +1000
@@ -212,8 +212,8 @@ static void ibmveth_replenish_buffer_poo
break;
}
- free_index = pool->consumer_index++ % pool->size;
- pool->consumer_index = free_index;
+ free_index = pool->consumer_index;
+ pool->consumer_index = (pool->consumer_index + 1) % pool->size;
index = pool->free_map[free_index];
ibmveth_assert(index != IBM_VETH_INVALID_MAP);
@@ -329,8 +329,10 @@ static void ibmveth_remove_buffer_from_p
adapter->rx_buff_pool[pool].buff_size,
DMA_FROM_DEVICE);
- free_index = adapter->rx_buff_pool[pool].producer_index++ % adapter->rx_buff_pool[pool].size;
- adapter->rx_buff_pool[pool].producer_index = free_index;
+ free_index = adapter->rx_buff_pool[pool].producer_index;
+ adapter->rx_buff_pool[pool].producer_index
+ = (adapter->rx_buff_pool[pool].producer_index + 1)
+ % adapter->rx_buff_pool[pool].size;
adapter->rx_buff_pool[pool].free_map[free_index] = index;
mb();
--
David Gibson | I'll have my music baroque, and my code
david AT gibson.dropbear.id.au | minimalist, thank you. NOT _the_ _other_
| _way_ _around_!
http://www.ozlabs.org/~dgibson
^ permalink raw reply [flat|nested] 3+ messages in thread