From mboxrd@z Thu Jan 1 00:00:00 1970 From: David Miller Subject: Re: 3.5rc6 sctp panic Date: Sat, 14 Jul 2012 13:02:01 -0700 (PDT) Message-ID: <20120714.130201.1562818146578811700.davem@davemloft.net> References: <20120711000831.GA10518@redhat.com> Mime-Version: 1.0 Content-Type: Text/Plain; charset=us-ascii Content-Transfer-Encoding: 7bit Cc: netdev@vger.kernel.org, vyasevich@gmail.com, sri@us.ibm.com, nhorman@tuxdriver.com To: davej@redhat.com Return-path: Received: from shards.monkeyblade.net ([149.20.54.216]:52405 "EHLO shards.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751686Ab2GNUCE (ORCPT ); Sat, 14 Jul 2012 16:02:04 -0400 In-Reply-To: <20120711000831.GA10518@redhat.com> Sender: netdev-owner@vger.kernel.org List-ID: From: Dave Jones Date: Tue, 10 Jul 2012 20:08:32 -0400 > I just hit this while fuzz testing, and the box locked up immediately afterwards. > The serial log was a little mangled, I did my best to clean it up.. Guys can we fix crashes like this one reported by Dave instead of working on new features and cleanups? Thanks. > [22766.294255] general protection fault: 0000 [#1] PREEMPT SMP > [22766.295376] CPU 0 > [22766.295384] Modules linked in: > [22766.387137] ffffffffa169f292 6b6b6b6b6b6b6b6b ffff880147c03a90 ffff880147c03a74 > [22766.387135] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 00000000000 > [22766.387136] Process trinity-watchdo (pid: 10896, threadinfo ffff88013e7d2000, > [22766.387137] Stack: > [22766.387140] ffff880147c03a10 > [22766.387140] ffffffffa169f2b6 > [22766.387140] ffff88013ed95728 > [22766.387143] 0000000000000002 > [22766.387143] 0000000000000000 > [22766.387143] ffff880003fad062 > [22766.387144] ffff88013c120000 > [22766.387144] > [22766.387145] Call Trace: > [22766.387145] > [22766.387150] [] ? __sctp_lookup_association+0x62/0xd0 [sctp] > [22766.387154] [] __sctp_lookup_association+0x86/0xd0 [sctp] > [22766.387157] [] sctp_rcv+0x207/0xbb0 [sctp] > [22766.387161] [] ? trace_hardirqs_off_caller+0x28/0xd0 > [22766.387163] [] ? nf_hook_slow+0x133/0x210 > [22766.387166] [] ? ip_local_deliver_finish+0x4c/0x4c0 > [22766.387168] [] ip_local_deliver_finish+0x18d/0x4c0 > [22766.387169] [] ? ip_local_deliver_finish+0x4c/0x4c0 > [22766.387171] [] ip_local_deliver+0x47/0x80 > [22766.387172] [] ip_rcv_finish+0x150/0x680 > [22766.387174] [] ip_rcv+0x214/0x320 > [22766.387176] [] __netif_receive_skb+0x7b7/0x910 > [22766.387178] [] ? __netif_receive_skb+0x11c/0x910 > [22766.387180] [] ? put_lock_stats.isra.25+0xe/0x40 > [22766.387182] [] netif_receive_skb+0x23/0x1f0 > [22766.387183] [] ? dev_gro_receive+0x139/0x440 > [22766.387185] [] napi_skb_finish+0x70/0xa0 > [22766.387187] [] napi_gro_receive+0xf5/0x130 > [22766.387218] [] e1000_receive_skb+0x59/0x70 [e1000e] > [22766.387242] [] e1000_clean_rx_irq+0x28b/0x460 [e1000e] > [22766.387266] [] e1000e_poll+0x78/0x430 [e1000e] > [22766.387268] [] net_rx_action+0x1aa/0x3d0 > [22766.387270] [] ? account_system_vtime+0x10f/0x130 > [22766.387273] [] __do_softirq+0xe0/0x420 > [22766.387275] [] call_softirq+0x1c/0x30 > [22766.387278] [] do_softirq+0xd5/0x110 > [22766.387279] [] irq_exit+0xd5/0xe0 > [22766.387281] [] do_IRQ+0x63/0xd0 > [22766.387283] [] common_interrupt+0x6f/0x6f > [22766.387283] > [22766.387284] > [22766.387285] [] ? retint_swapgs+0x13/0x1b > [22766.387285] Code: c0 90 5d c3 66 0f 1f 44 00 00 4c 89 c8 5d c3 0f 1f 00 55 48 89 e5 48 83 > ec 20 48 89 5d e8 4c 89 65 f0 4c 89 6d f8 66 66 66 66 90 <0f> b7 87 98 00 00 00 48 89 fb > 49 89 f5 66 c1 c0 08 66 39 46 02 > [22766.387307] > [22766.387307] RIP > [22766.387311] [] sctp_assoc_is_match+0x19/0x90 [sctp] > [22766.387311] RSP > [22766.387142] ffffffffa16ab120 > [22766.599537] ---[ end trace 3f6dae82e37b17f5 ]--- > [22766.601221] Kernel panic - not syncing: Fatal exception in interrupt > > > > Disassembly of the function shows that we oopsed here.. > > /* Is this the association we are looking for? */ > struct sctp_transport *sctp_assoc_is_match(struct sctp_association *asoc, > const union sctp_addr *laddr, > const union sctp_addr *paddr) > { > 1070: 55 push %rbp > 1071: 48 89 e5 mov %rsp,%rbp > 1074: 48 83 ec 20 sub $0x20,%rsp > 1078: 48 89 5d e8 mov %rbx,-0x18(%rbp) > 107c: 4c 89 65 f0 mov %r12,-0x10(%rbp) > 1080: 4c 89 6d f8 mov %r13,-0x8(%rbp) > 1084: e8 00 00 00 00 callq 1089 > struct sctp_transport *transport; > > if ((htons(asoc->base.bind_addr.port) == laddr->v4.sin_port) && > 1089: 0f b7 87 98 00 00 00 movzwl 0x98(%rdi),%eax > > > -- > To unsubscribe from this list: send the line "unsubscribe netdev" in > the body of a message to majordomo@vger.kernel.org > More majordomo info at http://vger.kernel.org/majordomo-info.html >