| Message ID | 1319268338.6180.20.camel@edumazet-laptop |
|---|---|
| State | Accepted, archived |
| Delegated to: | David Miller |
| Headers | show |
From: Eric Dumazet <eric.dumazet@gmail.com> Date: Sat, 22 Oct 2011 09:25:38 +0200 > Ari got kernel panics using tg3 NIC, and bisected to 2669069aacc9 "tg3: > enable transmit time stamping." > > This is because tigon3_dma_hwbug_workaround() might alloc a new skb and > free the original. We panic when skb_tx_timestamp() is called on freed > skb. > > Reported-by: Ari Savolainen <ari.m.savolainen@gmail.com> > Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Applied, thanks Eric. -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
I tried a similar patch earlier and got another panic with that. I was quite tired at that time and may have made a mistake. I'll test Eric's patch either later today or tomorrow. Ari 2011/10/22 Eric Dumazet <eric.dumazet@gmail.com>: > Ari got kernel panics using tg3 NIC, and bisected to 2669069aacc9 "tg3: > enable transmit time stamping." > > This is because tigon3_dma_hwbug_workaround() might alloc a new skb and > free the original. We panic when skb_tx_timestamp() is called on freed > skb. > > Reported-by: Ari Savolainen <ari.m.savolainen@gmail.com> > Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> > --- > drivers/net/tg3.c | 8 ++++---- > 1 file changed, 4 insertions(+), 4 deletions(-) > > diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c > index 4a1374d..6149dc5 100644 > --- a/drivers/net/tg3.c > +++ b/drivers/net/tg3.c > @@ -6029,12 +6029,12 @@ static void tg3_tx_skb_unmap(struct tg3_napi *tnapi, u32 entry, int last) > > /* Workaround 4GB and 40-bit hardware DMA bugs. */ > static int tigon3_dma_hwbug_workaround(struct tg3_napi *tnapi, > - struct sk_buff *skb, > + struct sk_buff **pskb, > u32 *entry, u32 *budget, > u32 base_flags, u32 mss, u32 vlan) > { > struct tg3 *tp = tnapi->tp; > - struct sk_buff *new_skb; > + struct sk_buff *new_skb, *skb = *pskb; > dma_addr_t new_addr = 0; > int ret = 0; > > @@ -6076,7 +6076,7 @@ static int tigon3_dma_hwbug_workaround(struct tg3_napi *tnapi, > } > > dev_kfree_skb(skb); > - > + *pskb = new_skb; > return ret; > } > > @@ -6305,7 +6305,7 @@ static netdev_tx_t tg3_start_xmit(struct sk_buff *skb, struct net_device *dev) > */ > entry = tnapi->tx_prod; > budget = tg3_tx_avail(tnapi); > - if (tigon3_dma_hwbug_workaround(tnapi, skb, &entry, &budget, > + if (tigon3_dma_hwbug_workaround(tnapi, &skb, &entry, &budget, > base_flags, mss, vlan)) > goto out_unlock; > } > > > -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
I tested the patch. It works. The panics are gone. Thanks, Ari 2011/10/22 Ari Savolainen <ari.m.savolainen@gmail.com>: > I tried a similar patch earlier and got another panic with that. I was > quite tired at that time and may have made a mistake. I'll test Eric's > patch either later today or tomorrow. > > Ari > > 2011/10/22 Eric Dumazet <eric.dumazet@gmail.com>: >> Ari got kernel panics using tg3 NIC, and bisected to 2669069aacc9 "tg3: >> enable transmit time stamping." >> >> This is because tigon3_dma_hwbug_workaround() might alloc a new skb and >> free the original. We panic when skb_tx_timestamp() is called on freed >> skb. >> >> Reported-by: Ari Savolainen <ari.m.savolainen@gmail.com> >> Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> >> --- >> drivers/net/tg3.c | 8 ++++---- >> 1 file changed, 4 insertions(+), 4 deletions(-) >> >> diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c >> index 4a1374d..6149dc5 100644 >> --- a/drivers/net/tg3.c >> +++ b/drivers/net/tg3.c >> @@ -6029,12 +6029,12 @@ static void tg3_tx_skb_unmap(struct tg3_napi *tnapi, u32 entry, int last) >> >> /* Workaround 4GB and 40-bit hardware DMA bugs. */ >> static int tigon3_dma_hwbug_workaround(struct tg3_napi *tnapi, >> - struct sk_buff *skb, >> + struct sk_buff **pskb, >> u32 *entry, u32 *budget, >> u32 base_flags, u32 mss, u32 vlan) >> { >> struct tg3 *tp = tnapi->tp; >> - struct sk_buff *new_skb; >> + struct sk_buff *new_skb, *skb = *pskb; >> dma_addr_t new_addr = 0; >> int ret = 0; >> >> @@ -6076,7 +6076,7 @@ static int tigon3_dma_hwbug_workaround(struct tg3_napi *tnapi, >> } >> >> dev_kfree_skb(skb); >> - >> + *pskb = new_skb; >> return ret; >> } >> >> @@ -6305,7 +6305,7 @@ static netdev_tx_t tg3_start_xmit(struct sk_buff *skb, struct net_device *dev) >> */ >> entry = tnapi->tx_prod; >> budget = tg3_tx_avail(tnapi); >> - if (tigon3_dma_hwbug_workaround(tnapi, skb, &entry, &budget, >> + if (tigon3_dma_hwbug_workaround(tnapi, &skb, &entry, &budget, >> base_flags, mss, vlan)) >> goto out_unlock; >> } >> >> >> > -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c index 4a1374d..6149dc5 100644 --- a/drivers/net/tg3.c +++ b/drivers/net/tg3.c @@ -6029,12 +6029,12 @@ static void tg3_tx_skb_unmap(struct tg3_napi *tnapi, u32 entry, int last) /* Workaround 4GB and 40-bit hardware DMA bugs. */ static int tigon3_dma_hwbug_workaround(struct tg3_napi *tnapi, - struct sk_buff *skb, + struct sk_buff **pskb, u32 *entry, u32 *budget, u32 base_flags, u32 mss, u32 vlan) { struct tg3 *tp = tnapi->tp; - struct sk_buff *new_skb; + struct sk_buff *new_skb, *skb = *pskb; dma_addr_t new_addr = 0; int ret = 0; @@ -6076,7 +6076,7 @@ static int tigon3_dma_hwbug_workaround(struct tg3_napi *tnapi, } dev_kfree_skb(skb); - + *pskb = new_skb; return ret; } @@ -6305,7 +6305,7 @@ static netdev_tx_t tg3_start_xmit(struct sk_buff *skb, struct net_device *dev) */ entry = tnapi->tx_prod; budget = tg3_tx_avail(tnapi); - if (tigon3_dma_hwbug_workaround(tnapi, skb, &entry, &budget, + if (tigon3_dma_hwbug_workaround(tnapi, &skb, &entry, &budget, base_flags, mss, vlan)) goto out_unlock; }
Ari got kernel panics using tg3 NIC, and bisected to 2669069aacc9 "tg3: enable transmit time stamping." This is because tigon3_dma_hwbug_workaround() might alloc a new skb and free the original. We panic when skb_tx_timestamp() is called on freed skb. Reported-by: Ari Savolainen <ari.m.savolainen@gmail.com> Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> --- drivers/net/tg3.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html