BNX2X driver: kernel panic when running netperf

BNX2X driver: kernel panic when running netperf

[Max Asbock]

I tested the bnx2x driver (0001-BNX2X-0.40.10a-net-2.6.24.patch) with
netdev-2.6.24 git tree and found that I can reproducibly panic the
system when running netperf with the TCP_STREAM test.
I copied the following information from the panic message:
RIP: 0xc02fff32
net_rx_action +0x142/0x190
...
do_softirq
...
Kernel panic - not syncing
Fatal exception in interrupt.

Please let me what additional information is useful. 

Max


  

Re: BNX2X driver: kernel panic when running netperf

[David Miller]

From: Max Asbock <masbock@us.ibm.com>
Date: Tue, 16 Oct 2007 16:34:40 -0700

> I tested the bnx2x driver (0001-BNX2X-0.40.10a-net-2.6.24.patch) with
> netdev-2.6.24 git tree and found that I can reproducibly panic the
> system when running netperf with the TCP_STREAM test.
> I copied the following information from the panic message:
> RIP: 0xc02fff32
> net_rx_action +0x142/0x190

The driver is doing netif_rx_complete() yet returning a value from
->poll() which is >= budget, which is illegal.

We had to fix a similar bug in the tg3 and bnx2 drivers, the same
logic probably just propagated itself into bnx2x.

Re: BNX2X driver: kernel panic when running netperf

[Eliezer Tamir]

On Tue, 2007-10-16 at 16:49 -0700, David Miller wrote:
> From: Max Asbock <masbock@us.ibm.com>
> Date: Tue, 16 Oct 2007 16:34:40 -0700
> 
> > I tested the bnx2x driver (0001-BNX2X-0.40.10a-net-2.6.24.patch)
> with
> > netdev-2.6.24 git tree and found that I can reproducibly panic the
> > system when running netperf with the TCP_STREAM test.
> > I copied the following information from the panic message:
> > RIP: 0xc02fff32
> > net_rx_action +0x142/0x190
> 
> The driver is doing netif_rx_complete() yet returning a value from
> ->poll() which is >= budget, which is illegal.
> 
> We had to fix a similar bug in the tg3 and bnx2 drivers, the same
> logic probably just propagated itself into bnx2x.

I think that this will fix the bug.

This is a diff against 0.40.10a.
I hope to get a new version out soon, once we finish working on Dave's
comments.

Eliezer


---
 drivers/net/bnx2x.c |    5 +++--
 1 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/net/bnx2x.c b/drivers/net/bnx2x.c
index f462c74..9220bd3 100644
--- a/drivers/net/bnx2x.c
+++ b/drivers/net/bnx2x.c
@@ -8085,9 +8085,10 @@ #endif
 		work_done = bnx2x_rx_int(fp, budget);
 	}
 
-	rmb(); /* TBD check */
+	rmb(); /* bnx2x_has_work() reads the status block */
 
-	if (!bnx2x_has_work(fp)) {
+	/* must not complete if we consumed full budget */
+	if ((work_done < budget) && !bnx2x_has_work(fp)) {
 		netif_rx_complete(bp->dev, napi);
 
 		bnx2x_ack_sb(bp, fp->index, USTORM_ID, fp->fp_u_idx,
-- 
1.4.2