* Fw: [Bugme-new] [Bug 7962] New: oops in port_carrier_check
@ 2007-02-07 20:52 Andrew Morton
2007-02-07 22:09 ` Stephen Hemminger
0 siblings, 1 reply; 12+ messages in thread
From: Andrew Morton @ 2007-02-07 20:52 UTC (permalink / raw)
To: netdev; +Cc: Stephen Hemminger, bugme-daemon@kernel-bugs.osdl.org, pterjan
Begin forwarded message:
Date: Wed, 7 Feb 2007 12:41:07 -0800
From: bugme-daemon@bugzilla.kernel.org
To: bugme-new@lists.osdl.org
Subject: [Bugme-new] [Bug 7962] New: oops in port_carrier_check
http://bugzilla.kernel.org/show_bug.cgi?id=7962
Summary: oops in port_carrier_check
Kernel Version: 2.6.20-rc7
Status: NEW
Severity: normal
Owner: acme@conectiva.com.br
Submitter: pterjan@gmail.com
While playing with qemu, I got a oops in bridge (and lost keyboard) :
Feb 7 21:20:18 plop kernel: BUG: unable to handle kernel paging request at
virtual address 6b6b6b6b
Feb 7 21:20:18 plop kernel: printing eip:
Feb 7 21:20:18 plop kernel: *pde = 00000000
Feb 7 21:20:18 plop kernel: Oops: 0000 [#1]
Feb 7 21:20:18 plop kernel: CPU: 0
Feb 7 21:20:19 plop kernel: EIP: 0060:[pg0+814360305/1067136000] Not
tainted VLI
Feb 7 21:20:19 plop kernel: EIP: 0060:[<f0eed6f1>] Not tainted VLI
Feb 7 21:20:19 plop kernel: EFLAGS: 00010202 (2.6.20.0.rc7-1mdv #1)
Feb 7 21:20:19 plop kernel: EIP is at port_carrier_check+0x22/0x75 [bridge]
Feb 7 21:20:19 plop kernel: eax: 6b6b6b6b ebx: 6b6b6b6b ecx: 00000000
edx: 00000001
Feb 7 21:20:19 plop kernel: esi: eb99b120 edi: 00000296 ebp: eff0bf58
esp: eff0bf4c
Feb 7 21:20:19 plop kernel: ds: 007b es: 007b ss: 0068
Feb 7 21:20:19 plop kernel: Process events/0 (pid: 4, ti=eff0a000 task=eff09530
task.ti=eff0a000)
Feb 7 21:20:19 plop kernel: Stack: cd566744 eff4e86c 00000296 eff0bf84 c012534a
eff0bf70 00000296 eff0bfa0
Feb 7 21:20:19 plop kernel: eff0bfac cd566740 f0eed6cf eff4e86c eff03ec8
eff0bfb4 eff0bfc4 c012590d
Feb 7 21:20:19 plop kernel: 00000001 00000000 00000001 00010000 00000000
00000000 eff09530 c0114770
Feb 7 21:20:19 plop kernel: Call Trace:
Feb 7 21:20:19 plop kernel: [show_trace_log_lvl+26/47]
show_trace_log_lvl+0x1a/0x2f
Feb 7 21:20:19 plop kernel: [<c010422c>] show_trace_log_lvl+0x1a/0x2f
Feb 7 21:20:19 plop kernel: [show_stack_log_lvl+155/163]
show_stack_log_lvl+0x9b/0xa3
Feb 7 21:20:19 plop kernel: [<c01042dc>] show_stack_log_lvl+0x9b/0xa3
Feb 7 21:20:19 plop kernel: [show_registers+402/616] show_registers+0x192/0x268
Feb 7 21:20:19 plop kernel: [<c0104476>] show_registers+0x192/0x268
Feb 7 21:20:19 plop kernel: [die+234/511] die+0xea/0x1ff
Feb 7 21:20:19 plop kernel: [<c0104636>] die+0xea/0x1ff
Feb 7 21:20:19 plop kernel: [do_page_fault+1111/1334] do_page_fault+0x457/0x536
Feb 7 21:20:19 plop kernel: [<c02c0c73>] do_page_fault+0x457/0x536
Feb 7 21:20:19 plop kernel: [error_code+116/128] error_code+0x74/0x80
Feb 7 21:20:19 plop kernel: [<c02bf624>] error_code+0x74/0x80
Feb 7 21:20:19 plop kernel: [run_workqueue+142/333] run_workqueue+0x8e/0x14d
Feb 7 21:20:19 plop kernel: [<c012534a>] run_workqueue+0x8e/0x14d
Feb 7 21:20:19 plop kernel: [worker_thread+260/302] worker_thread+0x104/0x12e
Feb 7 21:20:19 plop kernel: [<c012590d>] worker_thread+0x104/0x12e
Feb 7 21:20:19 plop kernel: [kthread+163/206] kthread+0xa3/0xce
Feb 7 21:20:19 plop kernel: [<c0127e55>] kthread+0xa3/0xce
Feb 7 21:20:19 plop kernel: [kernel_thread_helper+7/16]
kernel_thread_helper+0x7/0x10
Feb 7 21:20:19 plop kernel: [<c0103ed7>] kernel_thread_helper+0x7/0x10
Feb 7 21:20:19 plop kernel: =======================
Feb 7 21:20:19 plop kernel: Code: 38 cf 89 d8 5b 5e 5f 5d c3 55 89 e5 57 56 53
8b b0 24 ff ff ff 0f ba 30 00 e8 d3 20 38 cf 8b 9e 40 02 00 00 85 db 74 4c 8b 46
2c <8b> 3b a8 10 75 0a 89 f0 e8 e2 f9 ff ff 89 43 2c 8b 47 30 f6 40
Feb 7 21:20:19 plop kernel: EIP: [pg0+814360305/1067136000]
port_carrier_check+0x22/0x75 [bridge] SS:ESP 0068:eff0bf4c
Feb 7 21:20:19 plop kernel: EIP: [<f0eed6f1>] port_carrier_check+0x22/0x75
[bridge] SS:ESP 0068:eff0bf4c
------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [Bugme-new] [Bug 7962] New: oops in port_carrier_check
2007-02-07 20:52 Fw: [Bugme-new] [Bug 7962] New: oops in port_carrier_check Andrew Morton
@ 2007-02-07 22:09 ` Stephen Hemminger
2007-02-09 7:42 ` Jarek Poplawski
0 siblings, 1 reply; 12+ messages in thread
From: Stephen Hemminger @ 2007-02-07 22:09 UTC (permalink / raw)
To: Andrew Morton; +Cc: netdev, bugme-daemon@kernel-bugs.osdl.org, pterjan
On Wed, 7 Feb 2007 12:52:16 -0800
Andrew Morton <akpm@linux-foundation.org> wrote:
>
>
> Begin forwarded message:
>
> Date: Wed, 7 Feb 2007 12:41:07 -0800
> From: bugme-daemon@bugzilla.kernel.org
> To: bugme-new@lists.osdl.org
> Subject: [Bugme-new] [Bug 7962] New: oops in port_carrier_check
>
>
> http://bugzilla.kernel.org/show_bug.cgi?id=7962
>
> Summary: oops in port_carrier_check
> Kernel Version: 2.6.20-rc7
> Status: NEW
> Severity: normal
> Owner: acme@conectiva.com.br
> Submitter: pterjan@gmail.com
>
>
> While playing with qemu, I got a oops in bridge (and lost keyboard) :
>
> Feb 7 21:20:18 plop kernel: BUG: unable to handle kernel paging request at
> virtual address 6b6b6b6b
> Feb 7 21:20:18 plop kernel: printing eip:
> Feb 7 21:20:18 plop kernel: *pde = 00000000
> Feb 7 21:20:18 plop kernel: Oops: 0000 [#1]
> Feb 7 21:20:18 plop kernel: CPU: 0
> Feb 7 21:20:19 plop kernel: EIP: 0060:[pg0+814360305/1067136000] Not
> tainted VLI
> Feb 7 21:20:19 plop kernel: EIP: 0060:[<f0eed6f1>] Not tainted VLI
> Feb 7 21:20:19 plop kernel: EFLAGS: 00010202 (2.6.20.0.rc7-1mdv #1)
> Feb 7 21:20:19 plop kernel: EIP is at port_carrier_check+0x22/0x75 [bridge]
> Feb 7 21:20:19 plop kernel: eax: 6b6b6b6b ebx: 6b6b6b6b ecx: 00000000
> edx: 00000001
> Feb 7 21:20:19 plop kernel: esi: eb99b120 edi: 00000296 ebp: eff0bf58
> esp: eff0bf4c
> Feb 7 21:20:19 plop kernel: ds: 007b es: 007b ss: 0068
> Feb 7 21:20:19 plop kernel: Process events/0 (pid: 4, ti=eff0a000 task=eff09530
> task.ti=eff0a000)
> Feb 7 21:20:19 plop kernel: Stack: cd566744 eff4e86c 00000296 eff0bf84 c012534a
> eff0bf70 00000296 eff0bfa0
> Feb 7 21:20:19 plop kernel: eff0bfac cd566740 f0eed6cf eff4e86c eff03ec8
> eff0bfb4 eff0bfc4 c012590d
> Feb 7 21:20:19 plop kernel: 00000001 00000000 00000001 00010000 00000000
> 00000000 eff09530 c0114770
> Feb 7 21:20:19 plop kernel: Call Trace:
> Feb 7 21:20:19 plop kernel: [show_trace_log_lvl+26/47]
> show_trace_log_lvl+0x1a/0x2f
> Feb 7 21:20:19 plop kernel: [<c010422c>] show_trace_log_lvl+0x1a/0x2f
> Feb 7 21:20:19 plop kernel: [show_stack_log_lvl+155/163]
> show_stack_log_lvl+0x9b/0xa3
> Feb 7 21:20:19 plop kernel: [<c01042dc>] show_stack_log_lvl+0x9b/0xa3
> Feb 7 21:20:19 plop kernel: [show_registers+402/616] show_registers+0x192/0x268
> Feb 7 21:20:19 plop kernel: [<c0104476>] show_registers+0x192/0x268
> Feb 7 21:20:19 plop kernel: [die+234/511] die+0xea/0x1ff
> Feb 7 21:20:19 plop kernel: [<c0104636>] die+0xea/0x1ff
> Feb 7 21:20:19 plop kernel: [do_page_fault+1111/1334] do_page_fault+0x457/0x536
> Feb 7 21:20:19 plop kernel: [<c02c0c73>] do_page_fault+0x457/0x536
> Feb 7 21:20:19 plop kernel: [error_code+116/128] error_code+0x74/0x80
> Feb 7 21:20:19 plop kernel: [<c02bf624>] error_code+0x74/0x80
> Feb 7 21:20:19 plop kernel: [run_workqueue+142/333] run_workqueue+0x8e/0x14d
> Feb 7 21:20:19 plop kernel: [<c012534a>] run_workqueue+0x8e/0x14d
> Feb 7 21:20:19 plop kernel: [worker_thread+260/302] worker_thread+0x104/0x12e
> Feb 7 21:20:19 plop kernel: [<c012590d>] worker_thread+0x104/0x12e
> Feb 7 21:20:19 plop kernel: [kthread+163/206] kthread+0xa3/0xce
> Feb 7 21:20:19 plop kernel: [<c0127e55>] kthread+0xa3/0xce
> Feb 7 21:20:19 plop kernel: [kernel_thread_helper+7/16]
> kernel_thread_helper+0x7/0x10
> Feb 7 21:20:19 plop kernel: [<c0103ed7>] kernel_thread_helper+0x7/0x10
> Feb 7 21:20:19 plop kernel: =======================
> Feb 7 21:20:19 plop kernel: Code: 38 cf 89 d8 5b 5e 5f 5d c3 55 89 e5 57 56 53
> 8b b0 24 ff ff ff 0f ba 30 00 e8 d3 20 38 cf 8b 9e 40 02 00 00 85 db 74 4c 8b 46
> 2c <8b> 3b a8 10 75 0a 89 f0 e8 e2 f9 ff ff 89 43 2c 8b 47 30 f6 40
> Feb 7 21:20:19 plop kernel: EIP: [pg0+814360305/1067136000]
> port_carrier_check+0x22/0x75 [bridge] SS:ESP 0068:eff0bf4c
> Feb 7 21:20:19 plop kernel: EIP: [<f0eed6f1>] port_carrier_check+0x22/0x75
> [bridge] SS:ESP 0068:eff0bf4c
>
> ------- You are receiving this mail because: -------
> You are on the CC list for the bug, or are watching someone who is.
I wonder if this is work_queue API change fallout.
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [Bugme-new] [Bug 7962] New: oops in port_carrier_check
2007-02-07 22:09 ` Stephen Hemminger
@ 2007-02-09 7:42 ` Jarek Poplawski
2007-02-09 17:52 ` Stephen Hemminger
0 siblings, 1 reply; 12+ messages in thread
From: Jarek Poplawski @ 2007-02-09 7:42 UTC (permalink / raw)
To: Stephen Hemminger
Cc: Andrew Morton, netdev, bugme-daemon@kernel-bugs.osdl.org, pterjan
On 07-02-2007 23:09, Stephen Hemminger wrote:
> On Wed, 7 Feb 2007 12:52:16 -0800
> Andrew Morton <akpm@linux-foundation.org> wrote:
...
>> Feb 7 21:20:18 plop kernel: BUG: unable to handle kernel paging request at
>> virtual address 6b6b6b6b
>> Feb 7 21:20:18 plop kernel: printing eip:
>> Feb 7 21:20:18 plop kernel: *pde = 00000000
>> Feb 7 21:20:18 plop kernel: Oops: 0000 [#1]
>> Feb 7 21:20:18 plop kernel: CPU: 0
>> Feb 7 21:20:19 plop kernel: EIP: 0060:[pg0+814360305/1067136000] Not
>> tainted VLI
>> Feb 7 21:20:19 plop kernel: EIP: 0060:[<f0eed6f1>] Not tainted VLI
>> Feb 7 21:20:19 plop kernel: EFLAGS: 00010202 (2.6.20.0.rc7-1mdv #1)
>> Feb 7 21:20:19 plop kernel: EIP is at port_carrier_check+0x22/0x75 [bridge]
>> Feb 7 21:20:19 plop kernel: eax: 6b6b6b6b ebx: 6b6b6b6b ecx: 00000000
I think it's caused by pending delayed workqueue
trying to use dev after kfree (POISON_FREE in eax, ebx).
> static void port_carrier_check(struct work_struct *work)
> {
> struct net_bridge_port *p;
> struct net_device *dev;
> struct net_bridge *br;
>
> dev = container_of(work, struct net_bridge_port,
> carrier_check.work)->dev;
> work_release(work);
>
> rtnl_lock();
> p = dev->br_port;
> if (!p)
> goto done;
> br = p->br;
>
> if (netif_carrier_ok(dev))
> p->path_cost = port_cost(dev);
>
> if (br->dev->flags & IFF_UP) {
My investigation seems to point at this line (p == ebx
but not NULL because of mem debugging on, probably).
Regards,
Jarek P.
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [Bugme-new] [Bug 7962] New: oops in port_carrier_check
2007-02-09 7:42 ` Jarek Poplawski
@ 2007-02-09 17:52 ` Stephen Hemminger
2007-02-09 18:50 ` Pascal Terjan
2007-02-12 6:44 ` Jarek Poplawski
0 siblings, 2 replies; 12+ messages in thread
From: Stephen Hemminger @ 2007-02-09 17:52 UTC (permalink / raw)
To: Jarek Poplawski
Cc: Andrew Morton, netdev, bugme-daemon@kernel-bugs.osdl.org, pterjan
On Fri, 9 Feb 2007 08:42:11 +0100
Jarek Poplawski <jarkao2@o2.pl> wrote:
> On 07-02-2007 23:09, Stephen Hemminger wrote:
> > On Wed, 7 Feb 2007 12:52:16 -0800
> > Andrew Morton <akpm@linux-foundation.org> wrote:
> ...
> >> Feb 7 21:20:18 plop kernel: BUG: unable to handle kernel paging request at
> >> virtual address 6b6b6b6b
> >> Feb 7 21:20:18 plop kernel: printing eip:
> >> Feb 7 21:20:18 plop kernel: *pde = 00000000
> >> Feb 7 21:20:18 plop kernel: Oops: 0000 [#1]
> >> Feb 7 21:20:18 plop kernel: CPU: 0
> >> Feb 7 21:20:19 plop kernel: EIP: 0060:[pg0+814360305/1067136000] Not
> >> tainted VLI
> >> Feb 7 21:20:19 plop kernel: EIP: 0060:[<f0eed6f1>] Not tainted VLI
> >> Feb 7 21:20:19 plop kernel: EFLAGS: 00010202 (2.6.20.0.rc7-1mdv #1)
> >> Feb 7 21:20:19 plop kernel: EIP is at port_carrier_check+0x22/0x75 [bridge]
> >> Feb 7 21:20:19 plop kernel: eax: 6b6b6b6b ebx: 6b6b6b6b ecx: 00000000
>
> I think it's caused by pending delayed workqueue
> trying to use dev after kfree (POISON_FREE in eax, ebx).
>
> > static void port_carrier_check(struct work_struct *work)
> > {
> > struct net_bridge_port *p;
> > struct net_device *dev;
> > struct net_bridge *br;
> >
> > dev = container_of(work, struct net_bridge_port,
> > carrier_check.work)->dev;
> > work_release(work);
> >
> > rtnl_lock();
> > p = dev->br_port;
> > if (!p)
> > goto done;
> > br = p->br;
> >
> > if (netif_carrier_ok(dev))
> > p->path_cost = port_cost(dev);
> >
> > if (br->dev->flags & IFF_UP) {
>
> My investigation seems to point at this line (p == ebx
> but not NULL because of mem debugging on, probably).
>
The carrier_check is canceled by removal of port from bridge.
Perhaps there is something broken in rcu assumptions under Qemu
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [Bugme-new] [Bug 7962] New: oops in port_carrier_check
2007-02-09 17:52 ` Stephen Hemminger
@ 2007-02-09 18:50 ` Pascal Terjan
2007-02-12 6:44 ` Jarek Poplawski
1 sibling, 0 replies; 12+ messages in thread
From: Pascal Terjan @ 2007-02-09 18:50 UTC (permalink / raw)
To: Stephen Hemminger
Cc: Jarek Poplawski, Andrew Morton, netdev,
bugme-daemon@kernel-bugs.osdl.org
2007/2/9, Stephen Hemminger <shemminger@linux-foundation.org>:
> The carrier_check is canceled by removal of port from bridge.
> Perhaps there is something broken in rcu assumptions under Qemu
If that can help:
I started /stopped qemu several times. Maybe I started /stopped qemu
several times as I was testing new PXE support in qemu with different
virtual nic. Each time, a tun device was created by qemu at startup
and added to the bridge, and destroyed on exit.
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [Bugme-new] [Bug 7962] New: oops in port_carrier_check
2007-02-09 17:52 ` Stephen Hemminger
2007-02-09 18:50 ` Pascal Terjan
@ 2007-02-12 6:44 ` Jarek Poplawski
2007-02-12 10:28 ` [PATCH][NET][BRIDGE] br_if: " Jarek Poplawski
1 sibling, 1 reply; 12+ messages in thread
From: Jarek Poplawski @ 2007-02-12 6:44 UTC (permalink / raw)
To: Stephen Hemminger
Cc: Andrew Morton, netdev, bugme-daemon@kernel-bugs.osdl.org, pterjan
On Fri, Feb 09, 2007 at 09:52:04AM -0800, Stephen Hemminger wrote:
> On Fri, 9 Feb 2007 08:42:11 +0100
> Jarek Poplawski <jarkao2@o2.pl> wrote:
>
> > On 07-02-2007 23:09, Stephen Hemminger wrote:
> > > On Wed, 7 Feb 2007 12:52:16 -0800
> > > Andrew Morton <akpm@linux-foundation.org> wrote:
> > ...
> > >> Feb 7 21:20:18 plop kernel: BUG: unable to handle kernel paging request at
> > >> virtual address 6b6b6b6b
> > >> Feb 7 21:20:18 plop kernel: printing eip:
> > >> Feb 7 21:20:18 plop kernel: *pde = 00000000
> > >> Feb 7 21:20:18 plop kernel: Oops: 0000 [#1]
> > >> Feb 7 21:20:18 plop kernel: CPU: 0
> > >> Feb 7 21:20:19 plop kernel: EIP: 0060:[pg0+814360305/1067136000] Not
> > >> tainted VLI
> > >> Feb 7 21:20:19 plop kernel: EIP: 0060:[<f0eed6f1>] Not tainted VLI
> > >> Feb 7 21:20:19 plop kernel: EFLAGS: 00010202 (2.6.20.0.rc7-1mdv #1)
> > >> Feb 7 21:20:19 plop kernel: EIP is at port_carrier_check+0x22/0x75 [bridge]
> > >> Feb 7 21:20:19 plop kernel: eax: 6b6b6b6b ebx: 6b6b6b6b ecx: 00000000
> >
> > I think it's caused by pending delayed workqueue
> > trying to use dev after kfree (POISON_FREE in eax, ebx).
> >
> > > static void port_carrier_check(struct work_struct *work)
> > > {
> > > struct net_bridge_port *p;
> > > struct net_device *dev;
> > > struct net_bridge *br;
> > >
> > > dev = container_of(work, struct net_bridge_port,
> > > carrier_check.work)->dev;
> > > work_release(work);
> > >
> > > rtnl_lock();
> > > p = dev->br_port;
> > > if (!p)
> > > goto done;
> > > br = p->br;
> > >
> > > if (netif_carrier_ok(dev))
> > > p->path_cost = port_cost(dev);
> > >
> > > if (br->dev->flags & IFF_UP) {
> >
> > My investigation seems to point at this line (p == ebx
> > but not NULL because of mem debugging on, probably).
Sorry, I overpasted. This is the line:
--> br = p->br;
> The carrier_check is canceled by removal of port from bridge.
> Perhaps there is something broken in rcu assumptions under Qemu
If you mean this:
> static void del_nbp(struct net_bridge_port *p)
> {
> ...
> cancel_delayed_work(&p->carrier_check);
it's not sufficient. According to workqueue.h:
> /*
> * Kill off a pending schedule_delayed_work(). Note that the work callback
> * function may still be running on return from cancel_delayed_work(). Run
> * flush_scheduled_work() to wait on it.
> */
> static inline int cancel_delayed_work(struct delayed_work *work)
I can't see how rcu could help here with this pointer
to dev passed on to delayed_work (out of any rcu block).
IMHO dev_hold/dev_put (or something alike) is needed here.
Regards,
Jarek P.
^ permalink raw reply [flat|nested] 12+ messages in thread
* [PATCH][NET][BRIDGE] br_if: oops in port_carrier_check
2007-02-12 6:44 ` Jarek Poplawski
@ 2007-02-12 10:28 ` Jarek Poplawski
2007-02-12 17:47 ` Stephen Hemminger
0 siblings, 1 reply; 12+ messages in thread
From: Jarek Poplawski @ 2007-02-12 10:28 UTC (permalink / raw)
To: Stephen Hemminger
Cc: Andrew Morton, netdev, bugme-daemon@kernel-bugs.osdl.org, pterjan
Here is my patch proposal for testing.
If it doesn't work - forget about it.
(Prepared with 2.6.20-git6 but could
be applied to 2.6.20 also.)
Jarek P.
dev_hold/dev_put added to prevent dev kfree
during port_carrier_check runnig, while dev
and port are removed.
Submitted and tested by: Pascal Terjan <pterjan@gmail.com>
Signed-off-by: Jarek Poplawski <jarkao2@o2.pl>
---
diff -Nurp linux-2.6.20-git6-/net/bridge/br_if.c linux-2.6.20-git6/net/bridge/br_if.c
--- linux-2.6.20-git6-/net/bridge/br_if.c 2007-02-12 10:20:14.000000000 +0100
+++ linux-2.6.20-git6/net/bridge/br_if.c 2007-02-12 10:36:58.000000000 +0100
@@ -108,6 +108,7 @@ static void port_carrier_check(struct wo
spin_unlock_bh(&br->lock);
}
done:
+ dev_put(dev);
rtnl_unlock();
}
@@ -161,7 +162,8 @@ static void del_nbp(struct net_bridge_po
dev_set_promiscuity(dev, -1);
- cancel_delayed_work(&p->carrier_check);
+ if (cancel_delayed_work(&p->carrier_check))
+ dev_put(dev);
spin_lock_bh(&br->lock);
br_stp_disable_port(p);
@@ -444,7 +446,9 @@ int br_add_if(struct net_bridge *br, str
spin_lock_bh(&br->lock);
br_stp_recalculate_bridge_id(br);
br_features_recompute(br);
- schedule_delayed_work(&p->carrier_check, BR_PORT_DEBOUNCE);
+ if (schedule_delayed_work(&p->carrier_check, BR_PORT_DEBOUNCE))
+ dev_hold(dev);
+
spin_unlock_bh(&br->lock);
dev_set_mtu(br->dev, br_min_mtu(br));
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [PATCH][NET][BRIDGE] br_if: oops in port_carrier_check
2007-02-12 10:28 ` [PATCH][NET][BRIDGE] br_if: " Jarek Poplawski
@ 2007-02-12 17:47 ` Stephen Hemminger
2007-02-13 6:26 ` Jarek Poplawski
0 siblings, 1 reply; 12+ messages in thread
From: Stephen Hemminger @ 2007-02-12 17:47 UTC (permalink / raw)
To: Jarek Poplawski
Cc: Andrew Morton, netdev, bugme-daemon@kernel-bugs.osdl.org, pterjan
On Mon, 12 Feb 2007 11:28:48 +0100
Jarek Poplawski <jarkao2@o2.pl> wrote:
> Here is my patch proposal for testing.
> If it doesn't work - forget about it.
> (Prepared with 2.6.20-git6 but could
> be applied to 2.6.20 also.)
>
> Jarek P.
>
>
> dev_hold/dev_put added to prevent dev kfree
> during port_carrier_check runnig, while dev
> and port are removed.
No, holding the reference just stops the kfree, it doesn't
stop the device from being removed from the port.
^ permalink raw reply [flat|nested] 12+ messages in thread
* [PATCH][NET][BRIDGE] br_if: oops in port_carrier_check
2007-02-12 17:47 ` Stephen Hemminger
@ 2007-02-13 6:26 ` Jarek Poplawski
2007-02-13 19:55 ` Stephen Hemminger
0 siblings, 1 reply; 12+ messages in thread
From: Jarek Poplawski @ 2007-02-13 6:26 UTC (permalink / raw)
To: Stephen Hemminger
Cc: Andrew Morton, netdev, bugme-daemon@kernel-bugs.osdl.org, pterjan
On Mon, Feb 12, 2007 at 09:47:38AM -0800, Stephen Hemminger wrote:
> On Mon, 12 Feb 2007 11:28:48 +0100
> Jarek Poplawski <jarkao2@o2.pl> wrote:
>
> > Here is my patch proposal for testing.
> > If it doesn't work - forget about it.
> > (Prepared with 2.6.20-git6 but could
> > be applied to 2.6.20 also.)
> >
> > Jarek P.
> >
> >
> > dev_hold/dev_put added to prevent dev kfree
> > during port_carrier_check runnig, while dev
> > and port are removed.
>
> No, holding the reference just stops the kfree, it doesn't
> stop the device from being removed from the port.
But I wrote above it is only to prevent the kfree.
> p = dev->br_port;
> if (!p)
> goto done;
> br = p->br;
Then p is NULL here and we goto done.
Sorry, but the first version was wrong (incomplete).
Below I attach a new proposal.
Signed-off-by: Jarek Poplawski <jarkao2@o2.pl>
---
diff -Nurp linux-2.6.20-git7-/net/bridge/br_if.c linux-2.6.20-git7/net/bridge/br_if.c
--- linux-2.6.20-git7-/net/bridge/br_if.c 2007-02-12 20:27:49.000000000 +0100
+++ linux-2.6.20-git7/net/bridge/br_if.c 2007-02-12 20:53:27.000000000 +0100
@@ -108,6 +108,7 @@ static void port_carrier_check(struct wo
spin_unlock_bh(&br->lock);
}
done:
+ dev_put(dev);
rtnl_unlock();
}
@@ -161,7 +162,8 @@ static void del_nbp(struct net_bridge_po
dev_set_promiscuity(dev, -1);
- cancel_delayed_work(&p->carrier_check);
+ if (cancel_delayed_work(&p->carrier_check))
+ dev_put(dev);
spin_lock_bh(&br->lock);
br_stp_disable_port(p);
@@ -444,7 +446,9 @@ int br_add_if(struct net_bridge *br, str
spin_lock_bh(&br->lock);
br_stp_recalculate_bridge_id(br);
br_features_recompute(br);
- schedule_delayed_work(&p->carrier_check, BR_PORT_DEBOUNCE);
+ if (schedule_delayed_work(&p->carrier_check, BR_PORT_DEBOUNCE))
+ dev_hold(dev);
+
spin_unlock_bh(&br->lock);
dev_set_mtu(br->dev, br_min_mtu(br));
diff -Nurp linux-2.6.20-git7-/net/bridge/br_notify.c linux-2.6.20-git7/net/bridge/br_notify.c
--- linux-2.6.20-git7-/net/bridge/br_notify.c 2007-02-12 20:27:49.000000000 +0100
+++ linux-2.6.20-git7/net/bridge/br_notify.c 2007-02-12 20:50:50.000000000 +0100
@@ -56,7 +56,9 @@ static int br_device_event(struct notifi
case NETDEV_CHANGE:
if (br->dev->flags & IFF_UP)
- schedule_delayed_work(&p->carrier_check, BR_PORT_DEBOUNCE);
+ if (schedule_delayed_work(&p->carrier_check,
+ BR_PORT_DEBOUNCE))
+ dev_hold(dev);
break;
case NETDEV_FEAT_CHANGE:
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [PATCH][NET][BRIDGE] br_if: oops in port_carrier_check
2007-02-13 6:26 ` Jarek Poplawski
@ 2007-02-13 19:55 ` Stephen Hemminger
2007-02-13 20:35 ` David Miller
0 siblings, 1 reply; 12+ messages in thread
From: Stephen Hemminger @ 2007-02-13 19:55 UTC (permalink / raw)
To: Jarek Poplawski
Cc: Andrew Morton, netdev, bugme-daemon@kernel-bugs.osdl.org, pterjan
On Tue, 13 Feb 2007 07:26:51 +0100
Jarek Poplawski <jarkao2@o2.pl> wrote:
> On Mon, Feb 12, 2007 at 09:47:38AM -0800, Stephen Hemminger wrote:
> > On Mon, 12 Feb 2007 11:28:48 +0100
> > Jarek Poplawski <jarkao2@o2.pl> wrote:
> >
> > > Here is my patch proposal for testing.
> > > If it doesn't work - forget about it.
> > > (Prepared with 2.6.20-git6 but could
> > > be applied to 2.6.20 also.)
> > >
> > > Jarek P.
> > >
> > >
> > > dev_hold/dev_put added to prevent dev kfree
> > > during port_carrier_check runnig, while dev
> > > and port are removed.
> >
> > No, holding the reference just stops the kfree, it doesn't
> > stop the device from being removed from the port.
>
> But I wrote above it is only to prevent the kfree.
>
> > p = dev->br_port;
> > if (!p)
> > goto done;
> > br = p->br;
>
> Then p is NULL here and we goto done.
>
> Sorry, but the first version was wrong (incomplete).
> Below I attach a new proposal.
>
>
> Signed-off-by: Jarek Poplawski <jarkao2@o2.pl>
Yes, this looks correct. If carrier_check is pending the ref count
gets cleared by cancel. If carrier work is waiting for rtnl, then
it cleans itself up.
--
Stephen Hemminger <shemminger@linux-foundation.org>
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [PATCH][NET][BRIDGE] br_if: oops in port_carrier_check
2007-02-13 19:55 ` Stephen Hemminger
@ 2007-02-13 20:35 ` David Miller
2007-02-14 8:07 ` Jarek Poplawski
0 siblings, 1 reply; 12+ messages in thread
From: David Miller @ 2007-02-13 20:35 UTC (permalink / raw)
To: shemminger; +Cc: jarkao2, akpm, netdev, bugme-daemon, pterjan
From: Stephen Hemminger <shemminger@linux-foundation.org>
Date: Tue, 13 Feb 2007 11:55:29 -0800
> On Tue, 13 Feb 2007 07:26:51 +0100
> Jarek Poplawski <jarkao2@o2.pl> wrote:
>
> > On Mon, Feb 12, 2007 at 09:47:38AM -0800, Stephen Hemminger wrote:
> > > On Mon, 12 Feb 2007 11:28:48 +0100
> > > Jarek Poplawski <jarkao2@o2.pl> wrote:
> > >
> > > > Here is my patch proposal for testing.
> > > > If it doesn't work - forget about it.
> > > > (Prepared with 2.6.20-git6 but could
> > > > be applied to 2.6.20 also.)
> > > >
> > > > Jarek P.
> > > >
> > > >
> > > > dev_hold/dev_put added to prevent dev kfree
> > > > during port_carrier_check runnig, while dev
> > > > and port are removed.
> > >
> > > No, holding the reference just stops the kfree, it doesn't
> > > stop the device from being removed from the port.
> >
> > But I wrote above it is only to prevent the kfree.
> >
> > > p = dev->br_port;
> > > if (!p)
> > > goto done;
> > > br = p->br;
> >
> > Then p is NULL here and we goto done.
> >
> > Sorry, but the first version was wrong (incomplete).
> > Below I attach a new proposal.
> >
> >
> > Signed-off-by: Jarek Poplawski <jarkao2@o2.pl>
>
> Yes, this looks correct. If carrier_check is pending the ref count
> gets cleared by cancel. If carrier work is waiting for rtnl, then
> it cleans itself up.
I've applied this patch, thanks everyone.
Stephen, do we want this in -stable?
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [PATCH][NET][BRIDGE] br_if: oops in port_carrier_check
2007-02-13 20:35 ` David Miller
@ 2007-02-14 8:07 ` Jarek Poplawski
0 siblings, 0 replies; 12+ messages in thread
From: Jarek Poplawski @ 2007-02-14 8:07 UTC (permalink / raw)
To: David Miller; +Cc: shemminger, akpm, netdev, bugme-daemon, pterjan
On Tue, Feb 13, 2007 at 12:35:53PM -0800, David Miller wrote:
...
> I've applied this patch, thanks everyone.
>
> Stephen, do we want this in -stable?
I got this info it went trough -mm too:
...
> From: akpm@linux-foundation.org
> Subject: - br_if-oops-in-port_carrier_check.patch removed from -mm tree
> To: jarkao2@o2.pl, mm-commits@vger.kernel.org
...
> The patch titled
> br_if: oops in port_carrier_check
> has been removed from the -mm tree. Its filename was
> br_if-oops-in-port_carrier_check.patch
>
> This patch was dropped because it was merged into mainline or a subsystem tree
Regards,
Jarek P.
^ permalink raw reply [flat|nested] 12+ messages in thread
end of thread, other threads:[~2007-02-14 8:04 UTC | newest]
Thread overview: 12+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2007-02-07 20:52 Fw: [Bugme-new] [Bug 7962] New: oops in port_carrier_check Andrew Morton
2007-02-07 22:09 ` Stephen Hemminger
2007-02-09 7:42 ` Jarek Poplawski
2007-02-09 17:52 ` Stephen Hemminger
2007-02-09 18:50 ` Pascal Terjan
2007-02-12 6:44 ` Jarek Poplawski
2007-02-12 10:28 ` [PATCH][NET][BRIDGE] br_if: " Jarek Poplawski
2007-02-12 17:47 ` Stephen Hemminger
2007-02-13 6:26 ` Jarek Poplawski
2007-02-13 19:55 ` Stephen Hemminger
2007-02-13 20:35 ` David Miller
2007-02-14 8:07 ` Jarek Poplawski
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.