* [BUG] latest net-next-2.6 doesnt fly
@ 2010-04-02 9:33 Eric Dumazet
2010-04-02 9:40 ` Eric Dumazet
0 siblings, 1 reply; 7+ messages in thread
From: Eric Dumazet @ 2010-04-02 9:33 UTC (permalink / raw)
To: netdev; +Cc: FUJITA Tomonori
On my 32bit dev machine (bnx2 + tg3)
Suspects :
commit 5acbbd428db47b12f137a8a2aa96b3c0a96b744e
(net: change illegal_highdma to use dma_mask)
[ 1946.979911] BUG: unable to handle kernel NULL pointer dereference at
000000b4
[ 1946.980046] IP: [<c12dd30a>] dev_queue_xmit+0x47a/0x6a0
[ 1946.980145] *pde = 00000000
[ 1946.980228] Oops: 0000 [#61] PREEMPT SMP DEBUG_PAGEALLOC
[ 1946.980409] last sysfs
file: /sys/devices/system/cpu/cpu3/cpufreq/stats/time_in_state
[ 1946.982172] Modules linked in: xt_hashlimit ipmi_si ipmi_msghandler
hpilo bonding
[ 1946.982442]
[ 1946.982493] Pid: 9887, comm: emonitor Tainted: G D W
2.6.34-rc1-01558-gba0ad27-dirty #598 /ProLiant BL460c G1
[ 1946.982574] EIP: 0060:[<c12dd30a>] EFLAGS: 00010202 CPU: 4
[ 1946.982632] EIP is at dev_queue_xmit+0x47a/0x6a0
[ 1946.982687] EAX: d4cb8cb0 EBX: d4d0cf30 ECX: c1d69003 EDX: c233a240
[ 1946.982746] ESI: 00000000 EDI: eeba8800 EBP: d4f69ba8 ESP: d4f69b6c
[ 1946.982804] DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
[ 1946.982862] Process emonitor (pid: 9887, ti=d4f69000 task=d5ac65e0
task.ti=d4f69000)
[ 1946.982937] Stack:
[ 1946.982987] d5ac65e0 c1046b27 eebeff24 d4f69b88 c1073810 c12e43d5
eebeff00 d4f69b90
[ 1946.983274] <0> c1d69003 00000000 00000000 00000001 d4d0cf30 eebeff00
eebeff24 d4f69bec
[ 1946.983639] <0> c12e43eb eebeff48 00000000 00000b84 0000000e 00000246
00000002 d4f69bf0
[ 1946.983857] Call Trace:
[ 1946.983857] [<c1046b27>] ? local_bh_enable_ip+0x67/0xd0
[ 1946.983857] [<c1073810>] ? trace_hardirqs_on_caller+0x20/0x190
[ 1946.983857] [<c12e43d5>] ? neigh_resolve_output+0xd5/0x350
[ 1946.983857] [<c12e43eb>] ? neigh_resolve_output+0xeb/0x350
[ 1946.983857] [<c12f0008>] ? qdisc_create+0x98/0x340
[ 1946.983857] [<c12eda50>] ? eth_header+0x0/0xb0
[ 1946.983857] [<c130ddc4>] ? ip_finish_output2+0xc4/0x280
[ 1946.983857] [<c12fe618>] ? nf_hook_slow+0x108/0x140
[ 1946.983857] [<c130df80>] ? ip_finish_output+0x0/0x70
[ 1946.983857] [<c130dfcc>] ? ip_finish_output+0x4c/0x70
[ 1946.983857] [<c130e0a2>] ? ip_output+0xb2/0xd0
[ 1946.983857] [<c130df80>] ? ip_finish_output+0x0/0x70
[ 1946.983857] [<c130d47d>] ? ip_local_out+0x1d/0x30
[ 1946.983857] [<c130d92d>] ? ip_queue_xmit+0x13d/0x380
[ 1946.983857] [<c10b5434>] ? get_page_from_freelist+0x254/0x510
[ 1946.983857] [<c12d0517>] ? __skb_clone+0x27/0xe0
[ 1946.983857] [<c132136d>] ? tcp_transmit_skb+0x35d/0x7a0
[ 1946.983857] [<c1323341>] ? tcp_write_xmit+0x1e1/0x980
[ 1946.983857] [<c10c6de2>] ? might_fault+0x62/0xb0
[ 1946.983857] [<c1323b15>] ? tcp_push_one+0x35/0x40
[ 1946.983857] [<c1317e28>] ? tcp_sendmsg+0x898/0x910
[ 1946.983857] [<c12ca08b>] ? sock_aio_write+0xfb/0x110
[ 1946.983857] [<c10e370d>] ? do_sync_readv_writev+0x9d/0xe0
[ 1946.983857] [<c10e35b0>] ? rw_copy_check_uvector+0x80/0xf0
[ 1946.983857] [<c10e4431>] ? do_readv_writev+0xa1/0x1b0
[ 1946.983857] [<c12c9f90>] ? sock_aio_write+0x0/0x110
[ 1946.983857] [<c10e4950>] ? rcu_read_unlock+0x0/0x50
[ 1946.983857] [<c10e4976>] ? rcu_read_unlock+0x26/0x50
[ 1946.983857] [<c10e4a6b>] ? fget_light+0xcb/0xe0
[ 1946.983857] [<c10e4585>] ? vfs_writev+0x45/0x60
[ 1946.983857] [<c10e4676>] ? sys_writev+0x46/0x70
[ 1946.983857] [<c1002e50>] ? sysenter_do_call+0x12/0x36
[ 1946.983857] Code: 84 1b fd ff ff 0f b7 c9 8b b7 34 03 00 00 85 c9 89
4d f0 0f 8e 07 fd ff ff 8b 50 2c 8b 0a c1 e9 1a 8b 0c cd c0 04 cb c1 89
4d e4 <8b> 8e b4 00 00 00 85 c9 0f 84 d5 fc ff ff 8b 31 89 75 e8 8b 49
[ 1946.983857] EIP: [<c12dd30a>] dev_queue_xmit+0x47a/0x6a0 SS:ESP
0068:d4f69b6c
[ 1946.983857] CR2: 00000000000000b4
[ 1946.988377] ---[ end trace a6e77232ba4a3a41 ]---
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [BUG] latest net-next-2.6 doesnt fly
2010-04-02 9:33 [BUG] latest net-next-2.6 doesnt fly Eric Dumazet
@ 2010-04-02 9:40 ` Eric Dumazet
2010-04-02 9:58 ` Eric Dumazet
0 siblings, 1 reply; 7+ messages in thread
From: Eric Dumazet @ 2010-04-02 9:40 UTC (permalink / raw)
To: netdev; +Cc: FUJITA Tomonori
Le vendredi 02 avril 2010 à 11:33 +0200, Eric Dumazet a écrit :
> On my 32bit dev machine (bnx2 + tg3)
>
> Suspects :
>
> commit 5acbbd428db47b12f137a8a2aa96b3c0a96b744e
> (net: change illegal_highdma to use dma_mask)
>
> [ 1946.979911] BUG: unable to handle kernel NULL pointer dereference at
> 000000b4
> [ 1946.980046] IP: [<c12dd30a>] dev_queue_xmit+0x47a/0x6a0
> [ 1946.980145] *pde = 00000000
> [ 1946.980228] Oops: 0000 [#61] PREEMPT SMP DEBUG_PAGEALLOC
> [ 1946.980409] last sysfs
> file: /sys/devices/system/cpu/cpu3/cpufreq/stats/time_in_state
> [ 1946.982172] Modules linked in: xt_hashlimit ipmi_si ipmi_msghandler
> hpilo bonding
> [ 1946.982442]
> [ 1946.982493] Pid: 9887, comm: emonitor Tainted: G D W
> 2.6.34-rc1-01558-gba0ad27-dirty #598 /ProLiant BL460c G1
> [ 1946.982574] EIP: 0060:[<c12dd30a>] EFLAGS: 00010202 CPU: 4
> [ 1946.982632] EIP is at dev_queue_xmit+0x47a/0x6a0
> [ 1946.982687] EAX: d4cb8cb0 EBX: d4d0cf30 ECX: c1d69003 EDX: c233a240
> [ 1946.982746] ESI: 00000000 EDI: eeba8800 EBP: d4f69ba8 ESP: d4f69b6c
> [ 1946.982804] DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
> [ 1946.982862] Process emonitor (pid: 9887, ti=d4f69000 task=d5ac65e0
> task.ti=d4f69000)
> [ 1946.982937] Stack:
> [ 1946.982987] d5ac65e0 c1046b27 eebeff24 d4f69b88 c1073810 c12e43d5
> eebeff00 d4f69b90
> [ 1946.983274] <0> c1d69003 00000000 00000000 00000001 d4d0cf30 eebeff00
> eebeff24 d4f69bec
> [ 1946.983639] <0> c12e43eb eebeff48 00000000 00000b84 0000000e 00000246
> 00000002 d4f69bf0
> [ 1946.983857] Call Trace:
> [ 1946.983857] [<c1046b27>] ? local_bh_enable_ip+0x67/0xd0
> [ 1946.983857] [<c1073810>] ? trace_hardirqs_on_caller+0x20/0x190
> [ 1946.983857] [<c12e43d5>] ? neigh_resolve_output+0xd5/0x350
> [ 1946.983857] [<c12e43eb>] ? neigh_resolve_output+0xeb/0x350
> [ 1946.983857] [<c12f0008>] ? qdisc_create+0x98/0x340
> [ 1946.983857] [<c12eda50>] ? eth_header+0x0/0xb0
> [ 1946.983857] [<c130ddc4>] ? ip_finish_output2+0xc4/0x280
> [ 1946.983857] [<c12fe618>] ? nf_hook_slow+0x108/0x140
> [ 1946.983857] [<c130df80>] ? ip_finish_output+0x0/0x70
> [ 1946.983857] [<c130dfcc>] ? ip_finish_output+0x4c/0x70
> [ 1946.983857] [<c130e0a2>] ? ip_output+0xb2/0xd0
> [ 1946.983857] [<c130df80>] ? ip_finish_output+0x0/0x70
> [ 1946.983857] [<c130d47d>] ? ip_local_out+0x1d/0x30
> [ 1946.983857] [<c130d92d>] ? ip_queue_xmit+0x13d/0x380
> [ 1946.983857] [<c10b5434>] ? get_page_from_freelist+0x254/0x510
> [ 1946.983857] [<c12d0517>] ? __skb_clone+0x27/0xe0
> [ 1946.983857] [<c132136d>] ? tcp_transmit_skb+0x35d/0x7a0
> [ 1946.983857] [<c1323341>] ? tcp_write_xmit+0x1e1/0x980
> [ 1946.983857] [<c10c6de2>] ? might_fault+0x62/0xb0
> [ 1946.983857] [<c1323b15>] ? tcp_push_one+0x35/0x40
> [ 1946.983857] [<c1317e28>] ? tcp_sendmsg+0x898/0x910
> [ 1946.983857] [<c12ca08b>] ? sock_aio_write+0xfb/0x110
> [ 1946.983857] [<c10e370d>] ? do_sync_readv_writev+0x9d/0xe0
> [ 1946.983857] [<c10e35b0>] ? rw_copy_check_uvector+0x80/0xf0
> [ 1946.983857] [<c10e4431>] ? do_readv_writev+0xa1/0x1b0
> [ 1946.983857] [<c12c9f90>] ? sock_aio_write+0x0/0x110
> [ 1946.983857] [<c10e4950>] ? rcu_read_unlock+0x0/0x50
> [ 1946.983857] [<c10e4976>] ? rcu_read_unlock+0x26/0x50
> [ 1946.983857] [<c10e4a6b>] ? fget_light+0xcb/0xe0
> [ 1946.983857] [<c10e4585>] ? vfs_writev+0x45/0x60
> [ 1946.983857] [<c10e4676>] ? sys_writev+0x46/0x70
> [ 1946.983857] [<c1002e50>] ? sysenter_do_call+0x12/0x36
> [ 1946.983857] Code: 84 1b fd ff ff 0f b7 c9 8b b7 34 03 00 00 85 c9 89
> 4d f0 0f 8e 07 fd ff ff 8b 50 2c 8b 0a c1 e9 1a 8b 0c cd c0 04 cb c1 89
> 4d e4 <8b> 8e b4 00 00 00 85 c9 0f 84 d5 fc ff ff 8b 31 89 75 e8 8b 49
> [ 1946.983857] EIP: [<c12dd30a>] dev_queue_xmit+0x47a/0x6a0 SS:ESP
> 0068:d4f69b6c
> [ 1946.983857] CR2: 00000000000000b4
> [ 1946.988377] ---[ end trace a6e77232ba4a3a41 ]---
>
So after applying following patch :
diff --git a/net/core/dev.c b/net/core/dev.c
index e19cdae..a93092c 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1801,7 +1801,7 @@ EXPORT_SYMBOL(netdev_rx_csum_fault);
* 2. No high memory really exists on this machine.
*/
-static inline int illegal_highdma(struct net_device *dev, struct sk_buff *skb)
+static noinline int illegal_highdma(struct net_device *dev, struct sk_buff *skb)
{
#ifdef CONFIG_HIGHMEM
int i;
I can confirm the problem :
[ 206.020316] BUG: unable to handle kernel NULL pointer dereference at 000000b4
[ 206.020451] IP: [<c12d76b4>] illegal_highdma+0x44/0x170
[ 206.020543] *pde = 00000000
[ 206.020627] Oops: 0000 [#2] PREEMPT SMP DEBUG_PAGEALLOC
[ 206.020808] last sysfs file: /sys/devices/system/cpu/cpu3/cpufreq/stats/time_in_state
[ 206.020882] Modules linked in: xt_hashlimit ipmi_si ipmi_msghandler hpilo bonding
[ 206.021148]
[ 206.021198] Pid: 4632, comm: emonitor Tainted: G D W 2.6.34-rc1-01558-gba0ad27-dirty #599 /ProLiant BL460c G1
[ 206.021276] EIP: 0060:[<c12d76b4>] EFLAGS: 00010202 CPU: 4
[ 206.021332] EIP is at illegal_highdma+0x44/0x170
[ 206.021386] EAX: c23a7e80 EBX: 00000000 ECX: f1f75cb0 EDX: f292af30
[ 206.021443] ESI: 00000001 EDI: 00000001 EBP: ee83ab68 ESP: ee83ab58
[ 206.021500] DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
[ 206.021556] Process emonitor (pid: 4632, ti=ee83a000 task=ee9726e0 task.ti=ee83a000)
[ 206.021629] Stack:
[ 206.021678] 00000000 f292af30 00010000 f2bdc800 ee83aba8 c12dcfb9 c1046b27 f2976f24
[ 206.021958] <0> ee83ab88 c1073810 c12e4275 f2976f00 ee83ab90 c107398b ee83ab9c c1046b27
[ 206.022316] <0> f2976f24 f292af30 f2976f00 f2976f24 ee83abec c12e428b f2976f48 00000000
[ 206.022717] Call Trace:
[ 206.022770] [<c12dcfb9>] ? dev_queue_xmit+0x229/0x550
[ 206.022828] [<c1046b27>] ? local_bh_enable_ip+0x67/0xd0
[ 206.022885] [<c1073810>] ? trace_hardirqs_on_caller+0x20/0x190
[ 206.022943] [<c12e4275>] ? neigh_resolve_output+0xd5/0x350
[ 206.023000] [<c107398b>] ? trace_hardirqs_on+0xb/0x10
[ 206.023055] [<c1046b27>] ? local_bh_enable_ip+0x67/0xd0
[ 206.023111] [<c12e428b>] ? neigh_resolve_output+0xeb/0x350
[ 206.023169] [<c12f0008>] ? qdisc_create+0x1f8/0x340
[ 206.023225] [<c12ed8f0>] ? eth_header+0x0/0xb0
[ 206.023282] [<c130dc64>] ? ip_finish_output2+0xc4/0x280
[ 206.023339] [<c12fe4b8>] ? nf_hook_slow+0x108/0x140
[ 206.023394] [<c130de20>] ? ip_finish_output+0x0/0x70
[ 206.023450] [<c130de6c>] ? ip_finish_output+0x4c/0x70
[ 206.023506] [<c130df42>] ? ip_output+0xb2/0xd0
[ 206.023560] [<c130de20>] ? ip_finish_output+0x0/0x70
[ 206.023616] [<c130d31d>] ? ip_local_out+0x1d/0x30
[ 206.023671] [<c130d7cd>] ? ip_queue_xmit+0x13d/0x380
[ 206.023728] [<c10b5434>] ? get_page_from_freelist+0x254/0x510
[ 206.023785] [<c12d0517>] ? __skb_clone+0x27/0xe0
[ 206.023841] [<c132120d>] ? tcp_transmit_skb+0x35d/0x7a0
[ 206.023898] [<c13231e1>] ? tcp_write_xmit+0x1e1/0x980
[ 206.023955] [<c10c6de2>] ? might_fault+0x62/0xb0
[ 206.024010] [<c13239b5>] ? tcp_push_one+0x35/0x40
[ 206.024066] [<c1317cc8>] ? tcp_sendmsg+0x898/0x910
[ 206.024123] [<c12ca08b>] ? sock_aio_write+0xfb/0x110
[ 206.024180] [<c10e370d>] ? do_sync_readv_writev+0x9d/0xe0
[ 206.024237] [<c10e35b0>] ? rw_copy_check_uvector+0x80/0xf0
[ 206.024257] [<c10e4431>] ? do_readv_writev+0xa1/0x1b0
[ 206.024257] [<c12c9f90>] ? sock_aio_write+0x0/0x110
[ 206.024257] [<c10e4950>] ? rcu_read_unlock+0x0/0x50
[ 206.024257] [<c10e4976>] ? rcu_read_unlock+0x26/0x50
[ 206.024257] [<c10e4a6b>] ? fget_light+0xcb/0xe0
[ 206.024257] [<c10e4585>] ? vfs_writev+0x45/0x60
[ 206.024257] [<c10e4676>] ? sys_writev+0x46/0x70
[ 206.024257] [<c1002e50>] ? sysenter_do_call+0x12/0x36
[ 206.024257] Code: 0d 80 34 53 c1 8b 49 3c 85 c9 0f 84 37 01 00 00 8b 8a a0 00 00 00 8b 98 34 03 00 00 0f b7 71 04 85 f6 0f 84 1f 01 00 00 8b 41 2c <8b> 9b b4 00 00 00 8b 10 c1 ea 1a 85 db 8b 14 d5 c0 04 cb c1 74
[ 206.024257] EIP: [<c12d76b4>] illegal_highdma+0x44/0x170 SS:ESP 0068:ee83ab58
[ 206.024257] CR2: 00000000000000b4
[ 206.027098] ---[ end trace 2b194fa03b7756a0 ]---
c12d7670 <illegal_highdma>:
c12d7670: 55 push %ebp
c12d7671: 89 e5 mov %esp,%ebp
c12d7673: 57 push %edi
c12d7674: 56 push %esi
c12d7675: 53 push %ebx
c12d7676: 83 ec 04 sub $0x4,%esp
c12d7679: e8 06 bd d2 ff call c1003384 <mcount>
c12d767e: f6 40 4c 20 testb $0x20,0x4c(%eax)
c12d7682: 0f 84 b0 00 00 00 je c12d7738 <illegal_highdma+0xc8>
c12d7688: 8b 0d 80 34 53 c1 mov 0xc1533480,%ecx
c12d768e: 8b 49 3c mov 0x3c(%ecx),%ecx
c12d7691: 85 c9 test %ecx,%ecx
c12d7693: 0f 84 37 01 00 00 je c12d77d0 <illegal_highdma+0x160>
c12d7699: 8b 8a a0 00 00 00 mov 0xa0(%edx),%ecx
c12d769f: 8b 98 34 03 00 00 mov 0x334(%eax),%ebx
c12d76a5: 0f b7 71 04 movzwl 0x4(%ecx),%esi
c12d76a9: 85 f6 test %esi,%esi
c12d76ab: 0f 84 1f 01 00 00 je c12d77d0 <illegal_highdma+0x160>
c12d76b1: 8b 41 2c mov 0x2c(%ecx),%eax
c12d76b4: 8b 9b b4 00 00 00 mov 0xb4(%ebx),%ebx << NULL POINTER >>
c12d76ba: 8b 10 mov (%eax),%edx
c12d76bc: c1 ea 1a shr $0x1a,%edx
c12d76bf: 85 db test %ebx,%ebx
c12d76c1: 8b 14 d5 c0 04 cb c1 mov -0x3e34fb40(,%edx,8),%edx
c12d76c8: 74 5d je c12d7727 <illegal_highdma+0xb7>
c12d76ca: 8b 3b mov (%ebx),%edi
c12d76cc: 83 e2 fc and $0xfffffffc,%edx
c12d76cf: 89 7d f0 mov %edi,-0x10(%ebp)
c12d76d2: 29 d0 sub %edx,%eax
c12d76d4: 8b 7b 04 mov 0x4(%ebx),%edi
c12d76d7: c1 f8 05 sar $0x5,%eax
c12d76da: c1 e0 0c shl $0xc,%eax
c12d76dd: 05 ff 0f 00 00 add $0xfff,%eax
c12d76e2: 85 ff test %edi,%edi
c12d76e4: 75 05 jne c12d76eb <illegal_highdma+0x7b>
c12d76e6: 3b 45 f0 cmp -0x10(%ebp),%eax
c12d76e9: 77 3c ja c12d7727 <illegal_highdma+0xb7>
c12d76eb: 31 d2 xor %edx,%edx
c12d76ed: 8d 76 00 lea 0x0(%esi),%esi
c12d76f0: 42 inc %edx
c12d76f1: 39 d6 cmp %edx,%esi
c12d76f3: 0f 8e d7 00 00 00 jle c12d77d0 <illegal_highdma+0x160>
c12d76f9: 8b 59 38 mov 0x38(%ecx),%ebx
c12d76fc: 83 c1 0c add $0xc,%ecx
c12d76ff: 8b 03 mov (%ebx),%eax
c12d7701: c1 e8 1a shr $0x1a,%eax
c12d7704: 8b 04 c5 c0 04 cb c1 mov -0x3e34fb40(,%eax,8),%eax
c12d770b: 83 e0 fc and $0xfffffffc,%eax
c12d770e: 29 c3 sub %eax,%ebx
c12d7710: 31 c0 xor %eax,%eax
c12d7712: c1 fb 05 sar $0x5,%ebx
c12d7715: c1 e3 0c shl $0xc,%ebx
c12d7718: 81 c3 ff 0f 00 00 add $0xfff,%ebx
c12d771e: 39 f8 cmp %edi,%eax
c12d7720: 72 ce jb c12d76f0 <illegal_highdma+0x80>
c12d7722: 3b 5d f0 cmp -0x10(%ebp),%ebx
c12d7725: 76 c9 jbe c12d76f0 <illegal_highdma+0x80>
c12d7727: 83 c4 04 add $0x4,%esp
c12d772a: b8 01 00 00 00 mov $0x1,%eax
c12d772f: 5b pop %ebx
c12d7730: 5e pop %esi
c12d7731: 5f pop %edi
c12d7732: c9 leave
c12d7733: c3 ret
c12d7734: 8d 74 26 00 lea 0x0(%esi,%eiz,1),%esi
c12d7738: 8b b2 a0 00 00 00 mov 0xa0(%edx),%esi
c12d773e: 0f b7 7e 04 movzwl 0x4(%esi),%edi
c12d7742: 85 ff test %edi,%edi
c12d7744: 0f 84 3e ff ff ff je c12d7688 <illegal_highdma+0x18>
c12d774a: 8b 4e 2c mov 0x2c(%esi),%ecx
c12d774d: 8b 09 mov (%ecx),%ecx
c12d774f: c1 e9 18 shr $0x18,%ecx
c12d7752: 83 e1 03 and $0x3,%ecx
c12d7755: 69 c9 80 03 00 00 imul $0x380,%ecx,%ecx
c12d775b: 81 c1 c0 bb 56 c1 add $0xc156bbc0,%ecx
c12d7761: 2b 89 4c 03 00 00 sub 0x34c(%ecx),%ecx
c12d7767: 81 f9 00 07 00 00 cmp $0x700,%ecx
c12d776d: 74 b8 je c12d7727 <illegal_highdma+0xb7>
c12d776f: 8b 1d f4 8d ca c1 mov 0xc1ca8df4,%ebx
c12d7775: 89 5d f0 mov %ebx,-0x10(%ebp)
c12d7778: 31 db xor %ebx,%ebx
c12d777a: 81 f9 80 0a 00 00 cmp $0xa80,%ecx
c12d7780: 74 3d je c12d77bf <illegal_highdma+0x14f>
c12d7782: 43 inc %ebx
c12d7783: 39 fb cmp %edi,%ebx
c12d7785: 0f 8d fd fe ff ff jge c12d7688 <illegal_highdma+0x18>
c12d778b: 8b 4e 38 mov 0x38(%esi),%ecx
c12d778e: 83 c6 0c add $0xc,%esi
c12d7791: 8b 09 mov (%ecx),%ecx
c12d7793: c1 e9 18 shr $0x18,%ecx
c12d7796: 83 e1 03 and $0x3,%ecx
c12d7799: 69 c9 80 03 00 00 imul $0x380,%ecx,%ecx
c12d779f: 81 c1 c0 bb 56 c1 add $0xc156bbc0,%ecx
c12d77a5: 2b 89 4c 03 00 00 sub 0x34c(%ecx),%ecx
c12d77ab: 81 f9 00 07 00 00 cmp $0x700,%ecx
c12d77b1: 0f 84 70 ff ff ff je c12d7727 <illegal_highdma+0xb7>
c12d77b7: 81 f9 80 0a 00 00 cmp $0xa80,%ecx
c12d77bd: 75 c3 jne c12d7782 <illegal_highdma+0x112>
c12d77bf: 83 7d f0 02 cmpl $0x2,-0x10(%ebp)
c12d77c3: 75 bd jne c12d7782 <illegal_highdma+0x112>
c12d77c5: 8d 76 00 lea 0x0(%esi),%esi
c12d77c8: e9 5a ff ff ff jmp c12d7727 <illegal_highdma+0xb7>
c12d77cd: 8d 76 00 lea 0x0(%esi),%esi
c12d77d0: 83 c4 04 add $0x4,%esp
c12d77d3: 31 c0 xor %eax,%eax
c12d77d5: 5b pop %ebx
c12d77d6: 5e pop %esi
c12d77d7: 5f pop %edi
c12d77d8: c9 leave
c12d77d9: c3 ret
^ permalink raw reply related [flat|nested] 7+ messages in thread
* Re: [BUG] latest net-next-2.6 doesnt fly
2010-04-02 9:40 ` Eric Dumazet
@ 2010-04-02 9:58 ` Eric Dumazet
2010-04-02 20:35 ` David Miller
2010-04-04 9:16 ` FUJITA Tomonori
0 siblings, 2 replies; 7+ messages in thread
From: Eric Dumazet @ 2010-04-02 9:58 UTC (permalink / raw)
To: netdev, David Miller; +Cc: FUJITA Tomonori
Le vendredi 02 avril 2010 à 11:40 +0200, Eric Dumazet a écrit :
>
> [ 206.020316] BUG: unable to handle kernel NULL pointer dereference at 000000b4
> [ 206.020451] IP: [<c12d76b4>] illegal_highdma+0x44/0x170
> [ 206.020543] *pde = 00000000
> [ 206.020627] Oops: 0000 [#2] PREEMPT SMP DEBUG_PAGEALLOC
> [ 206.020808] last sysfs file: /sys/devices/system/cpu/cpu3/cpufreq/stats/time_in_state
> [ 206.020882] Modules linked in: xt_hashlimit ipmi_si ipmi_msghandler hpilo bonding
> [ 206.021148]
> [ 206.021198] Pid: 4632, comm: emonitor Tainted: G D W 2.6.34-rc1-01558-gba0ad27-dirty #599 /ProLiant BL460c G1
> [ 206.021276] EIP: 0060:[<c12d76b4>] EFLAGS: 00010202 CPU: 4
> [ 206.021332] EIP is at illegal_highdma+0x44/0x170
> [ 206.021386] EAX: c23a7e80 EBX: 00000000 ECX: f1f75cb0 EDX: f292af30
> [ 206.021443] ESI: 00000001 EDI: 00000001 EBP: ee83ab68 ESP: ee83ab58
> [ 206.021500] DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
> [ 206.021556] Process emonitor (pid: 4632, ti=ee83a000 task=ee9726e0 task.ti=ee83a000)
> [ 206.021629] Stack:
> [ 206.021678] 00000000 f292af30 00010000 f2bdc800 ee83aba8 c12dcfb9 c1046b27 f2976f24
> [ 206.021958] <0> ee83ab88 c1073810 c12e4275 f2976f00 ee83ab90 c107398b ee83ab9c c1046b27
> [ 206.022316] <0> f2976f24 f292af30 f2976f00 f2976f24 ee83abec c12e428b f2976f48 00000000
> [ 206.022717] Call Trace:
> [ 206.022770] [<c12dcfb9>] ? dev_queue_xmit+0x229/0x550
> [ 206.022828] [<c1046b27>] ? local_bh_enable_ip+0x67/0xd0
> [ 206.022885] [<c1073810>] ? trace_hardirqs_on_caller+0x20/0x190
> [ 206.022943] [<c12e4275>] ? neigh_resolve_output+0xd5/0x350
> [ 206.023000] [<c107398b>] ? trace_hardirqs_on+0xb/0x10
> [ 206.023055] [<c1046b27>] ? local_bh_enable_ip+0x67/0xd0
> [ 206.023111] [<c12e428b>] ? neigh_resolve_output+0xeb/0x350
> [ 206.023169] [<c12f0008>] ? qdisc_create+0x1f8/0x340
> [ 206.023225] [<c12ed8f0>] ? eth_header+0x0/0xb0
> [ 206.023282] [<c130dc64>] ? ip_finish_output2+0xc4/0x280
> [ 206.023339] [<c12fe4b8>] ? nf_hook_slow+0x108/0x140
> [ 206.023394] [<c130de20>] ? ip_finish_output+0x0/0x70
> [ 206.023450] [<c130de6c>] ? ip_finish_output+0x4c/0x70
> [ 206.023506] [<c130df42>] ? ip_output+0xb2/0xd0
> [ 206.023560] [<c130de20>] ? ip_finish_output+0x0/0x70
> [ 206.023616] [<c130d31d>] ? ip_local_out+0x1d/0x30
> [ 206.023671] [<c130d7cd>] ? ip_queue_xmit+0x13d/0x380
> [ 206.023728] [<c10b5434>] ? get_page_from_freelist+0x254/0x510
> [ 206.023785] [<c12d0517>] ? __skb_clone+0x27/0xe0
> [ 206.023841] [<c132120d>] ? tcp_transmit_skb+0x35d/0x7a0
> [ 206.023898] [<c13231e1>] ? tcp_write_xmit+0x1e1/0x980
> [ 206.023955] [<c10c6de2>] ? might_fault+0x62/0xb0
> [ 206.024010] [<c13239b5>] ? tcp_push_one+0x35/0x40
> [ 206.024066] [<c1317cc8>] ? tcp_sendmsg+0x898/0x910
> [ 206.024123] [<c12ca08b>] ? sock_aio_write+0xfb/0x110
> [ 206.024180] [<c10e370d>] ? do_sync_readv_writev+0x9d/0xe0
> [ 206.024237] [<c10e35b0>] ? rw_copy_check_uvector+0x80/0xf0
> [ 206.024257] [<c10e4431>] ? do_readv_writev+0xa1/0x1b0
> [ 206.024257] [<c12c9f90>] ? sock_aio_write+0x0/0x110
> [ 206.024257] [<c10e4950>] ? rcu_read_unlock+0x0/0x50
> [ 206.024257] [<c10e4976>] ? rcu_read_unlock+0x26/0x50
> [ 206.024257] [<c10e4a6b>] ? fget_light+0xcb/0xe0
> [ 206.024257] [<c10e4585>] ? vfs_writev+0x45/0x60
> [ 206.024257] [<c10e4676>] ? sys_writev+0x46/0x70
> [ 206.024257] [<c1002e50>] ? sysenter_do_call+0x12/0x36
> [ 206.024257] Code: 0d 80 34 53 c1 8b 49 3c 85 c9 0f 84 37 01 00 00 8b 8a a0 00 00 00 8b 98 34 03 00 00 0f b7 71 04 85 f6 0f 84 1f 01 00 00 8b 41 2c <8b> 9b b4 00 00 00 8b 10 c1 ea 1a 85 db 8b 14 d5 c0 04 cb c1 74
> [ 206.024257] EIP: [<c12d76b4>] illegal_highdma+0x44/0x170 SS:ESP 0068:ee83ab58
> [ 206.024257] CR2: 00000000000000b4
> [ 206.027098] ---[ end trace 2b194fa03b7756a0 ]---
Here is the patch I did to solve this problem
[PATCH net-next-2.6] net: illegal_highdma() fix
Followup to commit 5acbbd428db47b12f137a8a2aa96b3c0a96b744e
(net: change illegal_highdma to use dma_mask)
If dev->dev.parent is NULL, we should not try to dereference it.
Dont force inline illegal_highdma() as its pretty big now.
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
---
net/core/dev.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/net/core/dev.c b/net/core/dev.c
index e19cdae..c6b5206 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1801,7 +1801,7 @@ EXPORT_SYMBOL(netdev_rx_csum_fault);
* 2. No high memory really exists on this machine.
*/
-static inline int illegal_highdma(struct net_device *dev, struct sk_buff *skb)
+static int illegal_highdma(struct net_device *dev, struct sk_buff *skb)
{
#ifdef CONFIG_HIGHMEM
int i;
@@ -1814,6 +1814,8 @@ static inline int illegal_highdma(struct net_device *dev, struct sk_buff *skb)
if (PCI_DMA_BUS_IS_PHYS) {
struct device *pdev = dev->dev.parent;
+ if (!pdev)
+ return 0;
for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
dma_addr_t addr = page_to_phys(skb_shinfo(skb)->frags[i].page);
if (!pdev->dma_mask || addr + PAGE_SIZE - 1 > *pdev->dma_mask)
^ permalink raw reply related [flat|nested] 7+ messages in thread
* Re: [BUG] latest net-next-2.6 doesnt fly
2010-04-02 9:58 ` Eric Dumazet
@ 2010-04-02 20:35 ` David Miller
2010-04-04 9:16 ` FUJITA Tomonori
1 sibling, 0 replies; 7+ messages in thread
From: David Miller @ 2010-04-02 20:35 UTC (permalink / raw)
To: eric.dumazet; +Cc: netdev, fujita.tomonori
From: Eric Dumazet <eric.dumazet@gmail.com>
Date: Fri, 02 Apr 2010 11:58:24 +0200
> [PATCH net-next-2.6] net: illegal_highdma() fix
>
> Followup to commit 5acbbd428db47b12f137a8a2aa96b3c0a96b744e
> (net: change illegal_highdma to use dma_mask)
>
> If dev->dev.parent is NULL, we should not try to dereference it.
>
> Dont force inline illegal_highdma() as its pretty big now.
>
> Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Applied, thanks for tracking this down.
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [BUG] latest net-next-2.6 doesnt fly
2010-04-02 9:58 ` Eric Dumazet
2010-04-02 20:35 ` David Miller
@ 2010-04-04 9:16 ` FUJITA Tomonori
2010-04-04 9:29 ` Eric Dumazet
1 sibling, 1 reply; 7+ messages in thread
From: FUJITA Tomonori @ 2010-04-04 9:16 UTC (permalink / raw)
To: eric.dumazet; +Cc: netdev, davem, fujita.tomonori
On Fri, 02 Apr 2010 11:58:24 +0200
Eric Dumazet <eric.dumazet@gmail.com> wrote:
> diff --git a/net/core/dev.c b/net/core/dev.c
> index e19cdae..c6b5206 100644
> --- a/net/core/dev.c
> +++ b/net/core/dev.c
> @@ -1801,7 +1801,7 @@ EXPORT_SYMBOL(netdev_rx_csum_fault);
> * 2. No high memory really exists on this machine.
> */
>
> -static inline int illegal_highdma(struct net_device *dev, struct sk_buff *skb)
> +static int illegal_highdma(struct net_device *dev, struct sk_buff *skb)
> {
> #ifdef CONFIG_HIGHMEM
> int i;
> @@ -1814,6 +1814,8 @@ static inline int illegal_highdma(struct net_device *dev, struct sk_buff *skb)
> if (PCI_DMA_BUS_IS_PHYS) {
> struct device *pdev = dev->dev.parent;
>
> + if (!pdev)
> + return 0;
Sorry about that and thanks for the fix.
I think, if pdev is null, returning 1 here is safer since the device
doesn't set up dma info properly.
Do you know what device hits this bug? You said that you use bnx2 and
tg3. Both call SET_NETDEV_DEV with pdev->dev. I tested bnx2 and seems
that netdev->dev.parent is set up correctly.
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [BUG] latest net-next-2.6 doesnt fly
2010-04-04 9:16 ` FUJITA Tomonori
@ 2010-04-04 9:29 ` Eric Dumazet
2010-04-04 10:19 ` FUJITA Tomonori
0 siblings, 1 reply; 7+ messages in thread
From: Eric Dumazet @ 2010-04-04 9:29 UTC (permalink / raw)
To: FUJITA Tomonori; +Cc: netdev, davem
Le dimanche 04 avril 2010 à 18:16 +0900, FUJITA Tomonori a écrit :
> > + return 0;
>
> Sorry about that and thanks for the fix.
>
> I think, if pdev is null, returning 1 here is safer since the device
> doesn't set up dma info properly.
>
> Do you know what device hits this bug? You said that you use bnx2 and
> tg3. Both call SET_NETDEV_DEV with pdev->dev. I tested bnx2 and seems
> that netdev->dev.parent is set up correctly.
> --
Might be because of my setup, I suspect I had two reasons to hit the
bug :
A bonding of eth2 (bnx2) and eth3 (tg3)
Then vlans on top of this bond0
When first dev_queue_xmit() was called, it was for a virtual device :)
# ip link
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP
qlen 1000
link/ether 00:1e:0b:ec:d3:dc brd ff:ff:ff:ff:ff:ff
3: eth1: <BROADCAST,MULTICAST,SLAVE,UP,LOWER_UP> mtu 1500 qdisc mq
master bond0 state UP qlen 1000
link/ether 00:1e:0b:ec:d3:d2 brd ff:ff:ff:ff:ff:ff
4: eth2: <BROADCAST,MULTICAST,SLAVE,UP,LOWER_UP> mtu 1500 qdisc hfsc
master bond0 state UP qlen 1000
link/ether 00:1e:0b:ec:d3:d2 brd ff:ff:ff:ff:ff:ff
5: eth3: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN qlen 1000
link/ether 00:1e:0b:92:78:51 brd ff:ff:ff:ff:ff:ff
6: bond0: <BROADCAST,MULTICAST,MASTER,UP,LOWER_UP> mtu 1500 qdisc
noqueue state UP
link/ether 00:1e:0b:ec:d3:d2 brd ff:ff:ff:ff:ff:ff
7: vlan.103@bond0: <BROADCAST,MULTICAST,MASTER,UP,LOWER_UP> mtu 1500
qdisc pfifo_fast state UP qlen 100
link/ether 00:1e:0b:ec:d3:d2 brd ff:ff:ff:ff:ff:ff
8: vlan.825@bond0: <BROADCAST,MULTICAST,MASTER,UP,LOWER_UP> mtu 1500
qdisc pfifo_fast state UP qlen 1000
link/ether 00:1e:0b:ec:d3:d2 brd ff:ff:ff:ff:ff:ff
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [BUG] latest net-next-2.6 doesnt fly
2010-04-04 9:29 ` Eric Dumazet
@ 2010-04-04 10:19 ` FUJITA Tomonori
0 siblings, 0 replies; 7+ messages in thread
From: FUJITA Tomonori @ 2010-04-04 10:19 UTC (permalink / raw)
To: eric.dumazet; +Cc: fujita.tomonori, netdev, davem
On Sun, 04 Apr 2010 11:29:55 +0200
Eric Dumazet <eric.dumazet@gmail.com> wrote:
> > I think, if pdev is null, returning 1 here is safer since the device
> > doesn't set up dma info properly.
> >
> > Do you know what device hits this bug? You said that you use bnx2 and
> > tg3. Both call SET_NETDEV_DEV with pdev->dev. I tested bnx2 and seems
> > that netdev->dev.parent is set up correctly.
> > --
>
> Might be because of my setup, I suspect I had two reasons to hit the
> bug :
>
> A bonding of eth2 (bnx2) and eth3 (tg3)
>
> Then vlans on top of this bond0
>
> When first dev_queue_xmit() was called, it was for a virtual device :)
Thanks! So it's due to bond or vlan (or both).
I guess that returning zero here with a null pdev is fine. If we
return 1, probably some people would complain about performance
regression. Like the block layer does, coping the dma restriction info
from the lower devices can solve this problem but I guess that it's
over engineering. My original patch doesn't loosen the DMA restriction
checking so returning zero shouldn't break anything. If when we fix
the usage of NETIF_F_HIGHDMA in each driver and also check the usage
of netdev->dev.parent, everything should be fine.
^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2010-04-04 10:19 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2010-04-02 9:33 [BUG] latest net-next-2.6 doesnt fly Eric Dumazet
2010-04-02 9:40 ` Eric Dumazet
2010-04-02 9:58 ` Eric Dumazet
2010-04-02 20:35 ` David Miller
2010-04-04 9:16 ` FUJITA Tomonori
2010-04-04 9:29 ` Eric Dumazet
2010-04-04 10:19 ` FUJITA Tomonori
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).