Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752155AbXLKJOj (ORCPT ); Tue, 11 Dec 2007 04:14:39 -0500 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1751248AbXLKJOZ (ORCPT ); Tue, 11 Dec 2007 04:14:25 -0500 Received: from rv-out-0910.google.com ([209.85.198.185]:14198 "EHLO rv-out-0910.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750953AbXLKJOX (ORCPT ); Tue, 11 Dec 2007 04:14:23 -0500 DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=from:to:subject:date:message-id:mime-version:content-type:content-transfer-encoding:x-mailer:x-mimeole:thread-index; b=K16lQmCwg5iOUn/lUztwdlf0VrxflEHElifVgvARQmPMr06VAnXK2//PhMWUqL19ozo/IfJTMieikcOi8vCeziwD7VOgF2Fy8Fe4tkELErGNgEDP+XidS+HVQ7EWPHxnsKCylATFZ3aWEbMWjryj19knWZvtNs3/WqvUrsHTBV4= From: "Joonwoo Park" To: , Subject: [PATCH] [NET]: Fix Ooops of napi net_rx_action. Date: Tue, 11 Dec 2007 18:13:34 +0900 Message-ID: <001801c83bd6$2001d410$9c94fea9@jason> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Office Outlook 11 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3198 Thread-Index: Acg71hh4ItVaWze8SVudSycOTeg0Fw== Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 3919 Lines: 109 [NET]: Fix Ooops of napi net_rx_action. Before doing list_move_tail napi poll_list, it should be ensured Signed-off-by: Joonwoo Park --- diff --git a/net/core/dev.c b/net/core/dev.c index 86d6261..74bd5ab 100644 --- a/net/core/dev.c +++ b/net/core/dev.c @@ -2207,7 +2207,8 @@ static void net_rx_action(struct softirq_action *h) * still "owns" the NAPI instance and therefore can * move the instance around on the list at-will. */ - if (unlikely(work == weight)) + if (unlikely((test_bit(NAPI_STATE_SCHED, &n->state)) + && (work == weight))) list_move_tail(&n->poll_list, list); netpoll_poll_unlock(have); --- I was able to make it real oops on 2.6.24-rc4 + e1000 napi + smp. eth0 of my laptop is connected directly to a packet generator. The packet generator is making unicast udp packets to laptop (approximately 70000pps). At that time, if the interface is went down, Ooops occurred. Thanks. Joonwoo root@joonwpark-laptop:~# ifconfig eth0 down BUG: unable to handle kernel paging request at virtual address 00100104 printing eip: c42ecc35 *pdpt = 000000001fc89001 *pde = 0000000000000000 Ooops: 0002 [#1] SMP Modules linked in: Pid: 4, comm:ksoftirqd/0 Not tainted (2.6.24-rc4 #27) EIP: 0060:[] EFLAGS: 00010046 CPU: 0 EIP is at net_rx_action+0x1d5/0x1f0 EAX: 00100100 EBX: f77c965c ECX: 00000000 EDX: 00200200 ESI: 00000040 EDI: f77c965c EBP: f7c6df94 ESP: f7c6df64 DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068 Process ksoftirqd/0 (pid: 4, ti=f7c6c000 task=f7c68ab0 task.ti=f7c6c000) Stack: 00000002 00000001 c42ecabe c4598f40 c1d0f5cc 0000c7da 000000ac f77c965c 00000040 00000001 c4543b18 c4598f40 f7c6dfb0 c4032a07 00000004 00000000 00000246 00000000 c4032f60 f7c6dfbc c4032ad7 c459ba80 f6c6dfcc c4032fb9 Call Trace: [] show_trace_log_lvl+0x1a/0x30 [] show_stack_log_lvl+0xa9/0xd0 [] show_registers+0xca/0x1c0 [] die+0x115/0x230 [] do_page_fault+0x34c/0x7f0 [] error_code+0x72/0x78 [] __do_softirq+0x87/0x60 [] do_softirq+0x57/0xe0 [] kthread+0x42/0x70 [] kernel_thread_helper+0x7/0x14 gdb outputs (gdb) info line *net_rx_action+0x1d5 Line 157 of "include/linux/list.h" starts at address 0xc42ecc35 and ends at 0xc42ecc38 . (gdb) l include/linux/list.h:157 152 * This is only for internal list manipulation where we know 153 * the prev/next entries already! 154 */ 155 static inline void __list_del(struct list_head * prev, struct list_head * next) 156 { 157 next->prev = prev; 158 prev->next = next; 159 } 160 161 /** (gdb) info line *__do_softirq+0x87 Line 130 of "include/linux/rcupdate.h" starts at address 0xc4032a07 <__do_softirq+135> and ends at 0xc4032a0a <__do_softirq+138>. (gdb) l include/linux/rcupdate.h:130 125 struct rcu_data *rdp = &per_cpu(rcu_data, cpu); 126 rdp->passed_quiesc = 1; 127 } 128 static inline void rcu_bh_qsctr_inc(int cpu) 129 { 130 struct rcu_data *rdp = &per_cpu(rcu_bh_data, cpu); 131 rdp->passed_quiesc = 1; 132 } 133 134 extern int rcu_pending(int cpu); (gdb) info line *do_softirq+0x57 Line 269 of "kernel/softirq.c" starts at address 0xc4032ad2 and ends at 0xc4032ae0 . (gdb) l kernel/softirq.c:269 264 local_irq_save(flags); 265 266 pending = local_softirq_pending(); 267 268 if (pending) 269 __do_softirq(); 270 271 local_irq_restore(flags); 272 } 273 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/