Re: RT patches expose netdev race [was Re: [RFC] [patch 2/2] powerpc 2.6.21-rt1: fix kernel hang and/or panic
From: Linas Vepstas <hidden>
Date: 2007-05-17 23:53:04
Also in:
netdev
On Wed, May 16, 2007 at 05:41:01PM -0700, David Miller wrote:
From: linas@austin.ibm.com (Linas Vepstas) Date: Wed, 16 May 2007 19:18:02 -0500quoted
Since this is a long email; let me put a summary up front: I think the RT/premption patches are exposing some sort of race in the ip header handling code. The rest of the note is forensics pointing to this.skb->head should never ever be NULL.
The stack trace from Owa-san showed a null pointer deref at ip_hdr(skb)->protocol for an skb passed in via hard_start_xmit() I dunno, memory corruption? Tsutomu, can you reproduce this with something similr to the following patch? --linas drivers/net/spider_net.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) Index: linux-2.6.22-rc1/drivers/net/spider_net.c ===================================================================
--- linux-2.6.22-rc1.orig/drivers/net/spider_net.c 2007-05-17 18:31:40.000000000 -0500
+++ linux-2.6.22-rc1/drivers/net/spider_net.c 2007-05-17 18:51:49.000000000 -0500@@ -720,7 +720,19 @@ spider_net_prepare_tx_descr(struct spide SPIDER_NET_DESCR_CARDOWNED | SPIDER_NET_DMAC_NOCS; spin_unlock_irqrestore(&chain->lock, flags); - if (skb->protocol == htons(ETH_P_IP) && skb->ip_summed == CHECKSUM_PARTIAL) + if (skb->protocol == htons(ETH_P_IP) && skb->ip_summed == CHECKSUM_PARTIAL) { + struct iphdr *hp=ip_hdr(skb); + if (((unsigned long) hp < 0x100000) || + ((unsigned long)hp > 0xffff000000000000UL)) { + printk(KERN_ERROR "spidernet: bad ip header! " + "skb=%p ip_hdr=%p head=%p data=%p net=%x\n", skb, hp, + skb->head, skb->data, skb->network_header); + int i; + unsinged long *s=(unsigned long*) skb; + for (i=0; i<20; i++) { + printk("%d %lx %lx\n", i, s[2*i],s[2*i+1]); + } + } else { switch (ip_hdr(skb)->protocol) { case IPPROTO_TCP: hwdescr->dmac_cmd_status |= SPIDER_NET_DMAC_TCP;
@@ -728,6 +740,8 @@ spider_net_prepare_tx_descr(struct spide case IPPROTO_UDP: hwdescr->dmac_cmd_status |= SPIDER_NET_DMAC_UDP; break; + } + } } /* Chain the bus address, so that the DMA engine finds this descr. */