Re: Kernel oops during netfilter memory allocation

Thomas Jarosch
2007-08-22T15:09:26Z

Hello,

> > kernel BUG at arch/i386/mm/highmem.c:38
> >
> > Try this.

I just tried kernel 2.6.22.4 and 2.6.23-rc3. Using 2.6.23-rc3 vanilla,
the box survives only 3 seconds with ipt_CRASH. Here's the backtrace,
it's only slightly different:

------------[ cut here ]------------
kernel BUG at arch/i386/mm/highmem.c:38!
invalid opcode: 0000 [#1]
Modules linked in: ipt_CRASH iptable_filter ip_tables x_tables deflate
zlib_deflate twofish twofish_common serpent blowfish des cbc ecb blkcipher
aes xcbcd
CPU: 0
EIP: 0060:[<c011401f>] Not tainted VLI
EFLAGS: 00010286 (2.6.23-rc3 #1)
EIP is at kmap_atomic_prot+0x24/0x83
eax: 0000000c ebx: c16eba60 ecx: c0002edc edx: 00000003
esi: 00000163 edi: 00000001 ebp: c16eba60 esp: f75f1b9c
ds: 007b es: 007b fs: 0000 gs: 0000 ss: 0068
Process info_iponline (pid: 3469, ti=f75f0000 task=f7269ab0 task.ti=f75f0000)
Stack: c16eba60 00000000 c013c695 00000001 00000044 40000000 00000001 00000000
00028020 c0327a3c c0327648 00000000 00000001 00000000 00000001 00000000
00008020 00008020 00000000 c0327a38 c013c778 00000044 63d210ac 00000000
Call Trace:
[<c013c695>] get_page_from_freelist+0x1ed/0x284
[<c013c778>] __alloc_pages+0x4c/0x282
[<c013ca31>] get_zeroed_page+0x3c/0x4a
[<f894e000>] ipt_crash_target+0x0/0x48 [ipt_CRASH]
[<f894e012>] ipt_crash_target+0x12/0x48 [ipt_CRASH]
[<f8958331>] ipt_do_table+0x26d/0x2c8 [ip_tables]
[<c0258484>] nf_iterate+0x38/0x6a
[<c02585ed>] nf_hook_slow+0x4d/0xb5
[<c025d1b3>] ip_local_deliver_finish+0x0/0x16b
[<c025d85c>] ip_local_deliver+0x72/0x1ea
[<c025d1b3>] ip_local_deliver_finish+0x0/0x16b
[<c025d7bd>] ip_rcv+0x3fb/0x428
[<c01287c4>] getnstimeofday+0x2b/0xaf
[<c0127776>] ktime_get_real+0xf/0x2b
[<c024540c>] netif_receive_skb+0x219/0x269
[<f8998fa0>] e1000_clean_rx_irq+0x35a/0x42a [e1000]
[<f8998c46>] e1000_clean_rx_irq+0x0/0x42a [e1000]
[<f8997f88>] e1000_clean+0x304/0x4ae [e1000]
[<c014f745>] get_unused_fd_flags+0x42/0xaa
[<c0161327>] mntput_no_expire+0x11/0x47
[<c01580c1>] __link_path_walk+0x83f/0x9de
[<c01394cc>] do_generic_mapping_read+0x3cd/0x3d5
[<c02471ff>] net_rx_action+0x52/0xe9
[<c011b83c>] __do_softirq+0x35/0x75
[<c011b89e>] do_softirq+0x22/0x26
[<c0105e8c>] do_IRQ+0x58/0x6c
[<c0138e42>] find_lock_page+0x12/0x62
[<c0104573>] common_interrupt+0x23/0x28
[<c0141996>] __do_fault+0x136/0x2d1
[<c0142eac>] handle_mm_fault+0x2c5/0x571
[<c0145665>] vma_merge+0x120/0x178
[<c0113560>] do_page_fault+0x212/0x58a
[<c011334e>] do_page_fault+0x0/0x58a
[<c0292f2a>] error_code+0x6a/0x70
[<c0290000>] tpacket_rcv+0x142/0x38e
=======================
Code: 03 05 00 eb 38 c0 c3 56 89 ce 53 89 c3 89 e0 25 00 e0 ff ff ff 40 14 8b
0d f0 17 38 c0 8d 04 95 00 00 00 00 29 c1 83 39 00 74 04 <0f> 0b eb fe 8b 03
EIP: [<c011401f>] kmap_atomic_prot+0x24/0x83 SS:ESP 0068:f75f1b9c
Kernel panic - not syncing: Fatal exception in interrupt
------------------------------------

Disabling highmem support seems to work as a temporary solution.
Or does it only hide the symptoms of something really going wrong?

Any help is greatly appreciated.

Thomas