From: Stephen Hemminger <shemminger@vyatta.com>
To: David Miller <davem@davemloft.net>
Cc: gregkh@suse.de, linux-kernel@vger.kernel.org, stable@kernel.org,
akpm@linux-foundation.org, torvalds@linux-foundation.org,
roger.oksanen@cs.helsinki.fi
Subject: Re: [Stable-review] [19/39] e100: Use pci pool to work around GFP_ATOMIC order 5 memory allocation failure
Date: Mon, 15 Mar 2010 14:36:53 -0700 [thread overview]
Message-ID: <20100315143653.294c0650@nehalam> (raw)
In-Reply-To: <20100315.143225.212581877.davem@davemloft.net>
On Mon, 15 Mar 2010 14:32:25 -0700 (PDT)
David Miller <davem@davemloft.net> wrote:
> From: Stephen Hemminger <shemminger@vyatta.com>
> Date: Mon, 15 Mar 2010 14:29:53 -0700
>
> > On Tue, 05 Jan 2010 12:02:15 -0800
> > Greg KH <gregkh@suse.de> wrote:
> >
> >> 2.6.31-stable review patch. If anyone has any objections, please let us know.
> >>
> >> ------------------
> >>
> >> From: Roger Oksanen <roger.oksanen@cs.helsinki.fi>
> >>
> >> commit 98468efddb101f8a29af974101c17ba513b07be1 upstream.
> >>
> >> pci_alloc_consistent uses GFP_ATOMIC allocation that may fail on some systems
> >> with limited memory (Bug #14265). pci_pool_alloc allows waiting with
> >> GFP_KERNEL.
> >>
> >> Tested-by: Karol Lewandowski <karol.k.lewandowski@gmail.com>
> >> Signed-off-by: Roger Oksanen <roger.oksanen@cs.helsinki.fi>
> >> Signed-off-by: David S. Miller <davem@davemloft.net>
> >> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
> >
> >
> > These two e100 patches in 2.6.31.10 (and 2.6.32) caused kernel panic on one customer
> > system. I recommend they be reverted in next --stable update.
>
> There was a subsequent fix that explicitly zeros out the memory.
> The problem was that whilst pci_alloc_consistent() zeros out
> the memory it returns, the pci pool stuff does not.
>
> So please get that fix sent to -stable instead of the revert.
> For reference:
>
> commit 70abc8cb90e679d8519721e2761d8366a18212a6
> Author: Roger Oksanen <roger.oksanen@cs.helsinki.fi>
> Date: Fri Dec 18 20:18:21 2009 -0800
>
> e100: Fix broken cbs accounting due to missing memset.
>
> Alan Stern noticed that e100 caused slab corruption.
> commit 98468efddb101f8a29af974101c17ba513b07be1 changed
> the allocation of cbs to use dma pools that don't return zeroed memory,
> especially the cb->status field used to track which cb to clean, causing
> (the visible) double freeing of skbs and a wrong free cbs count.
>
> Now the cbs are explicitly zeroed at allocation time.
>
> Reported-by: Alan Stern <stern@rowland.harvard.edu>
> Tested-by: Alan Stern <stern@rowland.harvard.edu>
> Signed-off-by: Roger Oksanen <roger.oksanen@cs.helsinki.fi>
> Acked-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
> Signed-off-by: David S. Miller <davem@davemloft.net>
The kernel has both fixes in it. The customer reported that if both
were reverted, the kernel panic went away.
commit 1bfc1db036675e61af0ea34d3ac18206de566b64
Author: Roger Oksanen <roger.oksanen@cs.helsinki.fi>
Date: Fri Dec 18 20:18:21 2009 -0800
e100: Fix broken cbs accounting due to missing memset.
commit 70abc8cb90e679d8519721e2761d8366a18212a6 upstream.
Alan Stern noticed that e100 caused slab corruption.
commit 98468efddb101f8a29af974101c17ba513b07be1 changed
the allocation of cbs to use dma pools that don't return zeroed memory,
especially the cb->status field used to track which cb to clean, causing
(the visible) double freeing of skbs and a wrong free cbs count.
Now the cbs are explicitly zeroed at allocation time.
Reported-by: Alan Stern <stern@rowland.harvard.edu>
Tested-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Roger Oksanen <roger.oksanen@cs.helsinki.fi>
Acked-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
commit 550b1d3896894543cc13dafe6910119024177482
Author: Roger Oksanen <roger.oksanen@cs.helsinki.fi>
Date: Sun Nov 29 17:17:29 2009 -0800
e100: Use pci pool to work around GFP_ATOMIC order 5 memory allocation failu
commit 98468efddb101f8a29af974101c17ba513b07be1 upstream.
pci_alloc_consistent uses GFP_ATOMIC allocation that may fail on some system
with limited memory (Bug #14265). pci_pool_alloc allows waiting with
GFP_KERNEL.
Tested-by: Karol Lewandowski <karol.k.lewandowski@gmail.com>
Signed-off-by: Roger Oksanen <roger.oksanen@cs.helsinki.fi>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
next prev parent reply other threads:[~2010-03-15 21:37 UTC|newest]
Thread overview: 63+ messages / expand[flat|nested] mbox.gz Atom feed top
2010-01-05 19:50 [00/10] 2.6.27.43 stable review Greg KH
2010-01-05 19:47 ` [01/10] Libertas: fix buffer overflow in lbs_get_essid() Greg KH
2010-01-05 19:47 ` [02/10] pata_cmd64x: fix overclocking of UDMA0-2 modes Greg KH
2010-01-05 19:47 ` [03/10] sound: sgio2audio/pdaudiocf/usb-audio: initialize PCM buffer Greg KH
2010-01-05 19:47 ` [04/10] i2c/tsl2550: Fix lux value in extended mode Greg KH
2010-01-05 19:47 ` [05/10] ipv6: reassembly: use seperate reassembly queues for conntrack and local delivery Greg KH
2010-01-05 19:47 ` [06/10] S390: dasd: support DIAG access for read-only devices Greg KH
2010-01-05 19:47 ` [07/10] x86/ptrace: make genregs[32]_get/set more robust Greg KH
2010-01-05 19:47 ` [08/10] rt2x00: Disable powersaving for rt61pci and rt2800pci Greg KH
2010-01-05 20:58 ` Gertjan van Wingerde
2010-01-05 21:21 ` Greg KH
2010-01-05 19:48 ` [09/10] generic_permission: MAY_OPEN is not write access Greg KH
2010-01-05 19:48 ` [10/10] Revert: KVM: MMU: do not free active mmu pages in free_mmu_pages() Greg KH
2010-01-05 20:01 ` [01/39] acerhdf: limit modalias matching to supported Greg KH
2010-01-05 20:01 ` [02/39] ASoC: Do not write to invalid registers on the wm9712 Greg KH
2010-01-05 20:01 ` [03/39] cifs: NULL out tcon, pSesInfo, and srvTcp pointers when chasing DFS referrals Greg KH
2010-01-05 20:02 ` [04/39] clockevents: Prevent clockevent_devices list corruption on cpu hotplug Greg KH
2010-01-05 20:02 ` [05/39] dma: at_hdmac: correct incompatible type for argument 1 of spin_lock_bh Greg KH
2010-01-05 20:02 ` [06/39] drivers/net/usb: Correct code taking the size of a pointer Greg KH
2010-01-05 20:02 ` [07/39] iwmc3200wifi: fix array out-of-boundary access Greg KH
2010-01-06 2:52 ` Zhu Yi
2010-01-06 18:01 ` Greg KH
2010-01-06 18:27 ` [stable] " Greg KH
2010-01-05 20:02 ` [08/39] Libertas: fix buffer overflow in lbs_get_essid() Greg KH
2010-01-05 20:02 ` [09/39] md: Fix unfortunate interaction with evms Greg KH
2010-01-05 20:02 ` [10/39] pata_cmd64x: fix overclocking of UDMA0-2 modes Greg KH
2010-01-05 20:02 ` [11/39] pata_hpt3x2n: fix clock turnaround Greg KH
2010-01-05 20:02 ` [12/39] SCSI: fc class: fix fc_transport_init error handling Greg KH
2010-01-05 20:02 ` [13/39] sound: sgio2audio/pdaudiocf/usb-audio: initialize PCM buffer Greg KH
2010-01-05 20:02 ` [14/39] USB: emi62: fix crash when trying to load EMI 6|2 firmware Greg KH
2010-01-05 20:02 ` [15/39] USB: Fix a bug on appledisplay.c regarding signedness Greg KH
2010-01-05 20:02 ` [16/39] USB: musb: gadget_ep0: avoid SetupEnd interrupt Greg KH
2010-01-05 20:02 ` [17/39] USB: option: support hi speed for modem Haier CE100 Greg KH
2010-01-05 20:02 ` [18/39] x86, cpuid: Add "volatile" to asm in native_cpuid() Greg KH
2010-01-05 20:02 ` [19/39] e100: Use pci pool to work around GFP_ATOMIC order 5 memory allocation failure Greg KH
2010-03-15 21:29 ` [Stable-review] " Stephen Hemminger
2010-03-15 21:32 ` David Miller
2010-03-15 21:36 ` Stephen Hemminger [this message]
2010-03-15 21:39 ` David Miller
2010-03-15 22:20 ` David Miller
2010-03-15 22:25 ` Stephen Hemminger
2010-01-05 20:02 ` [20/39] e100: Fix broken cbs accounting due to missing memset Greg KH
2010-01-05 20:02 ` [21/39] hostap: Revert a toxic part of the conversion to net_device_ops Greg KH
2010-01-05 20:02 ` [22/39] hwmon: (fschmd) Fix check on unsigned in watchdog_write() Greg KH
2010-01-05 20:02 ` [23/39] hwmon: (sht15) Off-by-one error in array index + incorrect constants Greg KH
2010-01-05 20:02 ` [24/39] i2c/tsl2550: Fix lux value in extended mode Greg KH
2010-01-05 20:02 ` [25/39] ipv6: reassembly: use seperate reassembly queues for conntrack and local delivery Greg KH
2010-01-05 20:02 ` [26/39] S390: dasd: support DIAG access for read-only devices Greg KH
2010-01-05 20:02 ` [27/39] udf: Try harder when looking for VAT inode Greg KH
2010-01-05 20:02 ` [28/39] V4L/DVB (13596): ov511.c typo: lock => unlock Greg KH
2010-01-05 20:02 ` [29/39] x86/ptrace: make genregs[32]_get/set more robust Greg KH
2010-01-05 20:02 ` [30/39] XFS bug in log recover with quota (bugzilla id 855) Greg KH
2010-01-05 20:02 ` [31/39] generic_permission: MAY_OPEN is not write access Greg KH
2010-01-05 20:02 ` [32/39] rt2x00: Disable powersaving for rt61pci and rt2800pci Greg KH
2010-01-05 20:59 ` Gertjan van Wingerde
2010-01-05 21:21 ` Greg KH
2010-01-05 20:02 ` [33/39] memcg: avoid oom-killing innocent task in case of use_hierarchy Greg KH
2010-01-05 20:02 ` [34/39] Input: atkbd - add force relese key quirk for Samsung R59P/R60P/R61P Greg KH
2010-01-05 20:02 ` [35/39] Add unlocked version of inode_add_bytes() function Greg KH
2010-01-05 20:02 ` [36/39] quota: decouple fs reserved space from quota reservation Greg KH
2010-01-05 20:02 ` [37/39] ext4: Convert to generic reserved quotas space management Greg KH
2010-01-05 20:02 ` [38/39] ext4: Fix potential quota deadlock Greg KH
2010-01-05 20:02 ` [39/39] ext4: fix sleep inside spinlock issue with quota and dealloc (#14739) Greg KH
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20100315143653.294c0650@nehalam \
--to=shemminger@vyatta.com \
--cc=akpm@linux-foundation.org \
--cc=davem@davemloft.net \
--cc=gregkh@suse.de \
--cc=linux-kernel@vger.kernel.org \
--cc=roger.oksanen@cs.helsinki.fi \
--cc=stable@kernel.org \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox