Re: NULL deref in bnx2 / crashes ? ( was: netconsole leads to stalled CPU task )

[Eric Dumazet <eric.dumazet@gmail.com>]

On Wed, 2012-08-22 at 14:17 +0200, Sylvain Munaut wrote:
> Hi,
> 
> > Could be the infamous slave_dev_queue_mapping striking again.
> >
> > Could you please try :
> >
> > diff --git a/net/core/netpoll.c b/net/core/netpoll.c
> > index 346b1eb..df731a0 100644
> > --- a/net/core/netpoll.c
> > +++ b/net/core/netpoll.c
> > @@ -335,8 +335,11 @@ void netpoll_send_skb_on_dev(struct netpoll *np, struct sk_buff *skb,
> >         /* don't get messages out of order, and no recursion */
> >         if (skb_queue_len(&npinfo->txq) == 0 && !netpoll_owner_active(dev)) {
> >                 struct netdev_queue *txq;
> > +               int queue_index = skb_get_queue_mapping(skb);
> >
> > -               txq = netdev_get_tx_queue(dev, skb_get_queue_mapping(skb));
> > +               if (queue_index >= dev->real_num_tx_queues)
> > +                       queue_index = 0;
> > +               txq = netdev_get_tx_queue(dev, queue_index);
> >
> >                 /* try until next clock tick */
> >                 for (tries = jiffies_to_usecs(1)/USEC_PER_POLL;
> 
> 
> Well, it doesn't solve the problem :(
> 
> It does have an effect though. Now even on the machine with the
> broadcom card, it just freeze the machine ...
> On the machine with intel card, it actually does get a couple of
> netconsole packet out and then freeze as well.
> 

my patch was incomplete, sorry :

diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index 346b1eb..ddc453b 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -335,8 +335,13 @@ void netpoll_send_skb_on_dev(struct netpoll *np, struct sk_buff *skb,
 	/* don't get messages out of order, and no recursion */
 	if (skb_queue_len(&npinfo->txq) == 0 && !netpoll_owner_active(dev)) {
 		struct netdev_queue *txq;
+		int queue_index = skb_get_queue_mapping(skb);
 
-		txq = netdev_get_tx_queue(dev, skb_get_queue_mapping(skb));
+		if (queue_index >= dev->real_num_tx_queues) {
+			queue_index = 0;
+			skb_set_queue_mapping(skb, 0);
+		}
+		txq = netdev_get_tx_queue(dev, queue_index);
 
 		/* try until next clock tick */
 		for (tries = jiffies_to_usecs(1)/USEC_PER_POLL;