oops with hostap and 2.6.12-rc6-mm1: Kernel BUG at "net/ipv4/tcp_output.c":928

oops with hostap and 2.6.12-rc6-mm1: Kernel BUG at "net/ipv4/tcp_output.c":928

[belyshev]

Seems that this oops happens only if using hostap.

$ cat /dev/zero | nc host.com discard
^C
Segmentation fault

----------- [cut here ] --------- [please bite here ] ---------
Kernel BUG at "net/ipv4/tcp_output.c":928
invalid operand: 0000 [1] 
CPU 0 
Modules linked in: hostap_cs hostap
Pid: 3312, comm: nc Not tainted 2.6.12-rc6-mm1
RIP: 0010:[<ffffffff803ea297>] <ffffffff803ea297>{tcp_tso_should_defer+55}
RSP: 0018:ffff810015769c10  EFLAGS: 00010246
RAX: 0000000000000017 RBX: ffff81001e751340 RCX: 0000000005a80100
RDX: ffff81001e751340 RSI: ffff81001388aac0 RDI: 0000000000000002
RBP: ffff81001388aac0 R08: 0000000000000000 R09: ffff810015769d58
R10: 0000000000000000 R11: 0000000000000002 R12: 0000000000000000
R13: 0000000000000000 R14: ffff81001388aac0 R15: 0000000000000018
FS:  00002aaaaae00c80(0000) GS:ffffffff8082e840(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: 00000000005c5008 CR3: 0000000013eb4000 CR4: 00000000000006e0
Process nc (pid: 3312, threadinfo ffff810015768000, task ffff81001ed2b750)
Stack: ffffffff803ecaa4 ffff8100016c7bd8 000005a800000001 0000000000000001 
       ffff81001388aac0 ffff81001388aac0 0000000000000000 0000000000000000 
       ffff810019e4e888 ffff81001559f828 
Call Trace:<ffffffff803ecaa4>{tcp_write_xmit+196} <ffffffff803ece79>{__tcp_push_pending_frames+41}
       <ffffffff803e1361>{tcp_close+593} <ffffffff803fd9ec>{inet_release+92}
       <ffffffff80398b41>{sock_release+33} <ffffffff803993c5>{sock_close+53}
       <ffffffff80175ee2>{__fput+194} <ffffffff801733d8>{filp_close+104}
       <ffffffff80133fd4>{put_files_struct+116} <ffffffff80134f1a>{do_exit+522}
       <ffffffff80135931>{do_group_exit+177} <ffffffff8013f657>{get_signal_to_deliver+1255}
       <ffffffff8010e0fd>{do_signal+157} <ffffffff80146f90>{autoremove_wake_function+0}
       <ffffffff8019ac79>{inotify_inode_queue_event+41} <ffffffff8017551f>{vfs_write+303}
       <ffffffff8010ea33>{sysret_signal+28} <ffffffff8010ed1b>{ptregscall_common+103}
       

Code: 0f 0b de b7 4f 80 ff ff ff ff a0 03 44 8b 8e 14 03 00 00 44 
RIP <ffffffff803ea297>{tcp_tso_should_defer+55} RSP <ffff810015769c10>
 <1>Fixing recursive fault but reboot is needed!

Kernel BUG at "net/ipv4/tcp_output.c":928

[belyshev]

>Seems that this oops happens only if using hostap.

Apparently this has nothing to do with hostap, as I was able to reproduce this
without it:

----------- [cut here ] --------- [please bite here ] ---------
Kernel BUG at "net/ipv4/tcp_output.c":928
invalid operand: 0000 [1] 
CPU 0 
Modules linked in:
Pid: 2854, comm: nc Not tainted 2.6.12-rc6-mm1-gcc34
RIP: 0010:[<ffffffff803dad47>] <ffffffff803dad47>{tcp_tso_should_defer+55}
RSP: 0018:ffff810018b29c08  EFLAGS: 00010246
RAX: 000000000000002c RBX: ffff81001e0cdd40 RCX: 0000000005a80100
RDX: ffff81001e0cdd40 RSI: ffff81001ed44040 RDI: 0000000000000002
RBP: ffff81001ed44040 R08: 0000000000000000 R09: ffff810018b29d60
R10: 0000000000000002 R11: ffffffff8018c200 R12: ffff81001ed44040
R13: ffff81001ed44040 R14: 000000000000002d R15: 00000000000005a8
FS:  00002aaaaae00c80(0000) GS:ffffffff8081c840(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: 00000000007bd0d8 CR3: 0000000018b7d000 CR4: 00000000000006e0
Process nc (pid: 2854, threadinfo ffff810018b28000, task ffff81001f704f70)
Stack: ffff81001e0cdd40 ffffffff803daea4 ffff81001ed440d8 0000000000000296 
       0000000100000001 ffff81001ed44040 ffff81001ed44040 0000000000000000 
       0000000000000000 ffff81001a824088 
Call Trace:<ffffffff803daea4>{tcp_write_xmit+212} <ffffffff803db1b9>{__tcp_push_pending_frames+41}
       <ffffffff803d2153>{tcp_close+595} <ffffffff803ed8b8>{inet_release+88}
       <ffffffff8038ac01>{sock_release+33} <ffffffff8038b8e5>{sock_close+53}
       <ffffffff80173972>{__fput+194} <ffffffff8017222e>{filp_close+110}
       <ffffffff801334f3>{put_files_struct+115} <ffffffff80133da4>{do_exit+484}
       <ffffffff8013b745>{__dequeue_signal+501} <ffffffff8013477f>{do_group_exit+159}
       <ffffffff8013d267>{get_signal_to_deliver+1239} <ffffffff8010dd52>{do_signal+162}
       <ffffffff8017e3a7>{pipe_readv+823} <ffffffff80486968>{cond_resched+56}
       <ffffffff801978a1>{inotify_inode_queue_event+49} <ffffffff80145b00>{autoremove_wake_function+0}
       <ffffffff80172bcd>{vfs_write+317} <ffffffff8010e95b>{sysret_signal+28}
       <ffffffff8010ec43>{ptregscall_common+103} 

Code: 0f 0b 56 a9 4e 80 ff ff ff ff a0 03 44 8b 86 14 03 00 00 44 
RIP <ffffffff803dad47>{tcp_tso_should_defer+55} RSP <ffff810018b29c08>
 <1>Fixing recursive fault but reboot is needed!

Re: oops with hostap and 2.6.12-rc6-mm1: Kernel BUG at "net/ipv4/tcp_output.c":928

[David S. Miller]

Just remove the BUG_ON() assertion in tcp_tso_should_defer(),
it's simply not a correct check when FIN is set in the packet.