From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Eric Dumazet <edumazet@google.com>,
Yang Yingliang <yangyingliang@huawei.com>,
"David S. Miller" <davem@davemloft.net>
Subject: [PATCH 3.12 53/83] net: 8139cp: fix a BUG_ON triggered by wrong bytes_compl
Date: Fri, 6 Dec 2013 13:51:43 -0800 [thread overview]
Message-ID: <20131206214644.985720474@linuxfoundation.org> (raw)
In-Reply-To: <20131206214640.002320724@linuxfoundation.org>
3.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Yingliang <yangyingliang@huawei.com>
[ Upstream commit 7fe0ee099ad5e3dea88d4ee1b6f20246b1ca57c3 ]
Using iperf to send packets(GSO mode is on), a bug is triggered:
[ 212.672781] kernel BUG at lib/dynamic_queue_limits.c:26!
[ 212.673396] invalid opcode: 0000 [#1] SMP
[ 212.673882] Modules linked in: 8139cp(O) nls_utf8 edd fuse loop dm_mod ipv6 i2c_piix4 8139too i2c_core intel_agp joydev pcspkr hid_generic intel_gtt floppy sr_mod mii button sg cdrom ext3 jbd mbcache usbhid hid uhci_hcd ehci_hcd usbcore sd_mod usb_common crc_t10dif crct10dif_common processor thermal_sys hwmon scsi_dh_emc scsi_dh_rdac scsi_dh_hp_sw scsi_dh ata_generic ata_piix libata scsi_mod [last unloaded: 8139cp]
[ 212.676084] CPU: 0 PID: 4124 Comm: iperf Tainted: G O 3.12.0-0.7-default+ #16
[ 212.676084] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2007
[ 212.676084] task: ffff8800d83966c0 ti: ffff8800db4c8000 task.ti: ffff8800db4c8000
[ 212.676084] RIP: 0010:[<ffffffff8122e23f>] [<ffffffff8122e23f>] dql_completed+0x17f/0x190
[ 212.676084] RSP: 0018:ffff880116e03e30 EFLAGS: 00010083
[ 212.676084] RAX: 00000000000005ea RBX: 0000000000000f7c RCX: 0000000000000002
[ 212.676084] RDX: ffff880111dd0dc0 RSI: 0000000000000bd4 RDI: ffff8800db6ffcc0
[ 212.676084] RBP: ffff880116e03e48 R08: 0000000000000992 R09: 0000000000000000
[ 212.676084] R10: ffffffff8181e400 R11: 0000000000000004 R12: 000000000000000f
[ 212.676084] R13: ffff8800d94ec840 R14: ffff8800db440c80 R15: 000000000000000e
[ 212.676084] FS: 00007f6685a3c700(0000) GS:ffff880116e00000(0000) knlGS:0000000000000000
[ 212.676084] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 212.676084] CR2: 00007f6685ad6460 CR3: 00000000db714000 CR4: 00000000000006f0
[ 212.676084] Stack:
[ 212.676084] ffff8800db6ffc00 000000000000000f ffff8800d94ec840 ffff880116e03eb8
[ 212.676084] ffffffffa041509f ffff880116e03e88 0000000f16e03e88 ffff8800d94ec000
[ 212.676084] 00000bd400059858 000000050000000f ffffffff81094c36 ffff880116e03eb8
[ 212.676084] Call Trace:
[ 212.676084] <IRQ>
[ 212.676084] [<ffffffffa041509f>] cp_interrupt+0x4ef/0x590 [8139cp]
[ 212.676084] [<ffffffff81094c36>] ? ktime_get+0x56/0xd0
[ 212.676084] [<ffffffff8108cf73>] handle_irq_event_percpu+0x53/0x170
[ 212.676084] [<ffffffff8108d0cc>] handle_irq_event+0x3c/0x60
[ 212.676084] [<ffffffff8108fdb5>] handle_fasteoi_irq+0x55/0xf0
[ 212.676084] [<ffffffff810045df>] handle_irq+0x1f/0x30
[ 212.676084] [<ffffffff81003c8b>] do_IRQ+0x5b/0xe0
[ 212.676084] [<ffffffff8142beaa>] common_interrupt+0x6a/0x6a
[ 212.676084] <EOI>
[ 212.676084] [<ffffffffa0416a21>] ? cp_start_xmit+0x621/0x97c [8139cp]
[ 212.676084] [<ffffffffa0416a09>] ? cp_start_xmit+0x609/0x97c [8139cp]
[ 212.676084] [<ffffffff81378ed9>] dev_hard_start_xmit+0x2c9/0x550
[ 212.676084] [<ffffffff813960a9>] sch_direct_xmit+0x179/0x1d0
[ 212.676084] [<ffffffff813793f3>] dev_queue_xmit+0x293/0x440
[ 212.676084] [<ffffffff813b0e46>] ip_finish_output+0x236/0x450
[ 212.676084] [<ffffffff810e59e7>] ? __alloc_pages_nodemask+0x187/0xb10
[ 212.676084] [<ffffffff813b10e8>] ip_output+0x88/0x90
[ 212.676084] [<ffffffff813afa64>] ip_local_out+0x24/0x30
[ 212.676084] [<ffffffff813aff0d>] ip_queue_xmit+0x14d/0x3e0
[ 212.676084] [<ffffffff813c6fd1>] tcp_transmit_skb+0x501/0x840
[ 212.676084] [<ffffffff813c8323>] tcp_write_xmit+0x1e3/0xb20
[ 212.676084] [<ffffffff81363237>] ? skb_page_frag_refill+0x87/0xd0
[ 212.676084] [<ffffffff813c8c8b>] tcp_push_one+0x2b/0x40
[ 212.676084] [<ffffffff813bb7e6>] tcp_sendmsg+0x926/0xc90
[ 212.676084] [<ffffffff813e1d21>] inet_sendmsg+0x61/0xc0
[ 212.676084] [<ffffffff8135e861>] sock_aio_write+0x101/0x120
[ 212.676084] [<ffffffff81107cf1>] ? vma_adjust+0x2e1/0x5d0
[ 212.676084] [<ffffffff812163e0>] ? timerqueue_add+0x60/0xb0
[ 212.676084] [<ffffffff81130b60>] do_sync_write+0x60/0x90
[ 212.676084] [<ffffffff81130d44>] ? rw_verify_area+0x54/0xf0
[ 212.676084] [<ffffffff81130f66>] vfs_write+0x186/0x190
[ 212.676084] [<ffffffff811317fd>] SyS_write+0x5d/0xa0
[ 212.676084] [<ffffffff814321e2>] system_call_fastpath+0x16/0x1b
[ 212.676084] Code: ca 41 89 dc 41 29 cc 45 31 db 29 c2 41 89 c5 89 d0 45 29 c5 f7 d0 c1 e8 1f e9 43 ff ff ff 66 0f 1f 44 00 00 31 c0 e9 7b ff ff ff <0f> 0b eb fe 66 66 66 66 2e 0f 1f 84 00 00 00 00 00 c7 47 40 00
[ 212.676084] RIP [<ffffffff8122e23f>] dql_completed+0x17f/0x190
------------[ cut here ]------------
When a skb has frags, bytes_compl plus skb->len nr_frags times in cp_tx().
It's not the correct value(actually, it should plus skb->len once) and it
will trigger the BUG_ON(bytes_compl > num_queued - dql->num_completed).
So only increase bytes_compl when finish sending all frags. pkts_compl also
has a wrong value, fix it too.
It's introduced by commit 871f0d4c ("8139cp: enable bql").
Suggested-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/realtek/8139cp.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
--- a/drivers/net/ethernet/realtek/8139cp.c
+++ b/drivers/net/ethernet/realtek/8139cp.c
@@ -678,9 +678,6 @@ static void cp_tx (struct cp_private *cp
le32_to_cpu(txd->opts1) & 0xffff,
PCI_DMA_TODEVICE);
- bytes_compl += skb->len;
- pkts_compl++;
-
if (status & LastFrag) {
if (status & (TxError | TxFIFOUnder)) {
netif_dbg(cp, tx_err, cp->dev,
@@ -702,6 +699,8 @@ static void cp_tx (struct cp_private *cp
netif_dbg(cp, tx_done, cp->dev,
"tx done, slot %d\n", tx_tail);
}
+ bytes_compl += skb->len;
+ pkts_compl++;
dev_kfree_skb_irq(skb);
}
next prev parent reply other threads:[~2013-12-06 21:51 UTC|newest]
Thread overview: 90+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-12-06 21:50 [PATCH 3.12 00/83] 3.12.4-stable review Greg Kroah-Hartman
2013-12-06 21:50 ` [PATCH 3.12 01/83] net: mv643xx_eth: Add missing phy_addr_set in DT mode Greg Kroah-Hartman
2013-12-06 21:50 ` [PATCH 3.12 02/83] net: mv643xx_eth: potential NULL dereference in probe() Greg Kroah-Hartman
2013-12-06 21:50 ` [PATCH 3.12 03/83] ipv6: fix headroom calculation in udp6_ufo_fragment Greg Kroah-Hartman
2013-12-06 21:50 ` [PATCH 3.12 04/83] bonding: RCUify bond_set_rx_mode() Greg Kroah-Hartman
2013-12-06 21:50 ` [PATCH 3.12 05/83] net: x86: bpf: dont forget to free sk_filter (v2) Greg Kroah-Hartman
2013-12-06 21:50 ` [PATCH 3.12 06/83] net/mlx4_en: Fixed crash when port type is changed Greg Kroah-Hartman
2013-12-06 21:50 ` [PATCH 3.12 07/83] net: Fix "ip rule delete table 256" Greg Kroah-Hartman
2013-12-06 21:50 ` [PATCH 3.12 08/83] ipv6: use rt6_get_dflt_router to get default router in rt6_route_rcv Greg Kroah-Hartman
2013-12-06 21:50 ` [PATCH 3.12 09/83] ipv6: protect for_each_sk_fl_rcu in mem_check with rcu_read_lock_bh Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 10/83] random32: fix off-by-one in seeding requirement Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 11/83] bonding: dont permit to use ARP monitoring in 802.3ad mode Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 12/83] usbnet: fix status interrupt urb handling Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 13/83] core/dev: do not ignore dmac in dev_forward_skb() Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 14/83] 6lowpan: Uncompression of traffic class field was incorrect Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 15/83] tuntap: limit head length of skb allocated Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 16/83] macvtap: " Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 17/83] tcp: tsq: restore minimal amount of queueing Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 18/83] bonding: fix two race conditions in bond_store_updelay/downdelay Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 19/83] net-tcp: fix panic in tcp_fastopen_cache_set() Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 20/83] sit: fix use after free of fb_tunnel_dev Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 21/83] isdnloop: use strlcpy() instead of strcpy() Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 22/83] ip6tnl: fix use after free of fb_tnl_dev Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 23/83] pkt_sched: fq: change classification of control packets Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 24/83] connector: improved unaligned access error fix Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 25/83] ipv4: fix possible seqlock deadlock Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 26/83] pkt_sched: fq: warn users using defrate Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 27/83] pkt_sched: fq: fix pacing for small frames Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 28/83] inet: prevent leakage of uninitialized memory to user in recv syscalls Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 29/83] ping: prevent NULL pointer dereference on write to msg_name Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 30/83] net: rework recvmsg handler msg_name and msg_namelen logic Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 31/83] net: add BUG_ON if kernel advertises msg_namelen > sizeof(struct sockaddr_storage) Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 32/83] inet: fix addr_len/msg->msg_namelen assignment in recv_error and rxpmtu functions Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 33/83] net: clamp ->msg_namelen instead of returning an error Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 34/83] ipv6: fix leaking uninitialized port number of offender sockaddr Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 35/83] ipv6: Fix inet6_init() cleanup order Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 36/83] ip6_output: fragment outgoing reassembled skb properly Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 37/83] netfilter: push reasm skb through instead of original frag skbs Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 38/83] xfrm: Release dst if this dst is improper for vti tunnel Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 39/83] atm: idt77252: fix dev refcnt leak Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 40/83] tcp: dont update snd_nxt, when a socket is switched from repair mode Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 41/83] ipv4: fix race in concurrent ip_route_input_slow() Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 42/83] net: core: Always propagate flag changes to interfaces Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 43/83] bridge: flush brs address entry in fdb when remove the bridge dev Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 44/83] packet: fix use after free race in send path when dev is released Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 45/83] af_packet: block BH in prb_shutdown_retire_blk_timer() Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 46/83] gso: handle new frag_list of frags GRO packets Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 47/83] gro: Only verify TCP checksums for candidates Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 48/83] gro: Clean up tcpX_gro_receive checksum verification Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 49/83] sch_tbf: handle too small burst Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 50/83] xen-netback: include definition of csum_ipv6_magic Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 51/83] via-velocity: fix netif_receive_skb use in irq disabled section Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 52/83] r8169: check ALDPS bit and disable it if enabled for the 8168g Greg Kroah-Hartman
2013-12-06 21:51 ` Greg Kroah-Hartman [this message]
2013-12-06 21:51 ` [PATCH 3.12 54/83] net: smc91: fix crash regression on the versatile Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 55/83] net: update consumers of MSG_MORE to recognize MSG_SENDPAGE_NOTLAST Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 56/83] team: fix master carrier set when user linkup is enabled Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 57/83] inet: fix possible seqlock deadlocks Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 58/83] ipv6: fix possible seqlock deadlock in ip6_finish_output2 Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 59/83] {pktgen, xfrm} Update IPv4 header total len and checksum after tranformation Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 60/83] xfrm: Fix null pointer dereference when decoding sessions Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 61/83] xfs: add capability check to free eofblocks ioctl Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 62/83] mm: numa: return the number of base pages altered by protection changes Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 63/83] md/raid5: Use conf->device_lock protect changing of multi-thread resources Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 64/83] usb: musb: davinci: fix resources passed to MUSB driver for DM6467 Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 65/83] usb: wusbcore: change WA_SEGS_MAX to a legal value Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 66/83] video: kyro: fix incorrect sizes when copying to userspace Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 67/83] HID: lg: fix Report Descriptor for Logitech MOMO Force (Black) Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 68/83] HID: hid-elo: some systems cannot stomach work around Greg Kroah-Hartman
2013-12-06 21:51 ` [PATCH 3.12 69/83] iommu/vt-d: Fixed interaction of VFIO_IOMMU_MAP_DMA with IOMMU address limits Greg Kroah-Hartman
2013-12-06 21:52 ` [PATCH 3.12 70/83] iommu: Remove stack trace from broken irq remapping warning Greg Kroah-Hartman
2013-12-06 21:52 ` [PATCH 3.12 71/83] rt2800: add support for radio chip RF3070 Greg Kroah-Hartman
2013-12-06 21:52 ` [PATCH 3.12 72/83] elevator: Fix a race in elevator switching and md device initialization Greg Kroah-Hartman
2013-12-06 21:52 ` [PATCH 3.12 73/83] elevator: acquire q->sysfs_lock in elevator_change() Greg Kroah-Hartman
2013-12-06 21:52 ` [PATCH 3.12 74/83] ntp: Make periodic RTC update more reliable Greg Kroah-Hartman
2013-12-06 21:52 ` [PATCH 3.12 75/83] aio: Fix a trinity splat Greg Kroah-Hartman
2013-12-06 21:52 ` [PATCH 3.12 76/83] take anon inode allocation to libfs.c Greg Kroah-Hartman
2013-12-06 21:52 ` [PATCH 3.12 77/83] rework aio migrate pages to use aio fs Greg Kroah-Hartman
2013-12-06 21:52 ` [PATCH 3.12 78/83] aio: checking for NULL instead of IS_ERR Greg Kroah-Hartman
2013-12-06 21:52 ` [PATCH 3.12 79/83] aio: prevent double free in ioctx_alloc Greg Kroah-Hartman
2013-12-06 21:52 ` [PATCH 3.12 80/83] aio: nullify aio->ring_pages after freeing it Greg Kroah-Hartman
2013-12-06 21:52 ` [PATCH 3.12 81/83] aio: clean up aio ring in the fail path Greg Kroah-Hartman
2013-12-06 21:52 ` [PATCH 3.12 82/83] drm/radeon/audio: improve ACR calculation Greg Kroah-Hartman
2013-12-06 21:52 ` [PATCH 3.12 83/83] drm/radeon/audio: correct ACR table Greg Kroah-Hartman
2013-12-06 22:52 ` [PATCH 3.12 00/83] 3.12.4-stable review Holger Hoffstätte
2013-12-07 17:01 ` Greg KH
2013-12-07 6:44 ` Guenter Roeck
2013-12-07 17:00 ` Greg Kroah-Hartman
2013-12-07 22:15 ` Shuah Khan
2013-12-07 23:17 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20131206214644.985720474@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=yangyingliang@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).