Recently had this bug halt reported to me: kernel BUG at net/rds/send.c:329! Oops: Exception in kernel mode, sig: 5 [#1] SMP NR_CPUS=1024 NUMA pSeries Modules linked in: rds sunrpc ipv6 dm_mirror dm_region_hash dm_log ibmveth sg ext4 jbd2 mbcache sd_mod crc_t10dif ibmvscsic scsi_transport_srp scsi_tgt dm_mod [last unloaded: scsi_wait_scan] NIP: d000000003ca68f4 LR: d000000003ca67fc CTR: d000000003ca8770 REGS: c000000175cab980 TRAP: 0700 Not tainted (2.6.32-118.el6.ppc64) MSR: 8000000000029032 <EE,ME,CE,IR,DR> CR: 44000022 XER: 00000000 TASK = c00000017586ec90[1896] 'krdsd' THREAD: c000000175ca8000 CPU: 0 GPR00: 0000000000000150 c000000175cabc00 d000000003cb7340 0000000000002030 GPR04: ffffffffffffffff 0000000000000030 0000000000000000 0000000000000030 GPR08: 0000000000000001 0000000000000001 c0000001756b1e30 0000000000010000 GPR12: d000000003caac90 c000000000fa2500 c0000001742b2858 c0000001742b2a00 GPR16: c0000001742b2a08 c0000001742b2820 0000000000000001 0000000000000001 GPR20: 0000000000000040 c0000001742b2814 c000000175cabc70 0800000000000000 GPR24: 0000000000000004 0200000000000000 0000000000000000 c0000001742b2860 GPR28: 0000000000000000 c0000001756b1c80 d000000003cb68e8 c0000001742b27b8 NIP [d000000003ca68f4] .rds_send_xmit+0x4c4/0x8a0 [rds] LR [d000000003ca67fc] .rds_send_xmit+0x3cc/0x8a0 [rds] Call Trace: [c000000175cabc00] [d000000003ca67fc] .rds_send_xmit+0x3cc/0x8a0 [rds] (unreliable) [c000000175cabd30] [d000000003ca7e64] .rds_send_worker+0x54/0x100 [rds] [c000000175cabdb0] [c0000000000b475c] .worker_thread+0x1dc/0x3c0 [c000000175cabed0] [c0000000000baa9c] .kthread+0xbc/0xd0 [c000000175cabf90] [c000000000032114] .kernel_thread+0x54/0x70 Instruction dump: 4bfffd50 60000000 60000000 39080001 935f004c f91f0040 41820024 813d017c 7d094a78 7d290074 7929d182 394a0020 <0b090000> 40e2ff68 4bffffa4 39200000 Kernel panic - not syncing: Fatal exception Call Trace: [c000000175cab560] [c000000000012e04] .show_stack+0x74/0x1c0 (unreliable) [c000000175cab610] [c0000000005a365c] .panic+0x80/0x1b4 [c000000175cab6a0] [c00000000002fbcc] .die+0x21c/0x2a0 [c000000175cab750] [c000000000030000] ._exception+0x110/0x220 [c000000175cab910] [c000000000004b9c] program_check_common+0x11c/0x180 Signed-off-by: David S. Miller <davem@davemloft.net>
		
			
				
	
	
		
			194 lines
		
	
	
	
		
			5.8 KiB
			
		
	
	
	
		
			C
		
	
	
	
	
	
			
		
		
	
	
			194 lines
		
	
	
	
		
			5.8 KiB
			
		
	
	
	
		
			C
		
	
	
	
	
	
/*
 | 
						|
 * Copyright (c) 2006 Oracle.  All rights reserved.
 | 
						|
 *
 | 
						|
 * This software is available to you under a choice of one of two
 | 
						|
 * licenses.  You may choose to be licensed under the terms of the GNU
 | 
						|
 * General Public License (GPL) Version 2, available from the file
 | 
						|
 * COPYING in the main directory of this source tree, or the
 | 
						|
 * OpenIB.org BSD license below:
 | 
						|
 *
 | 
						|
 *     Redistribution and use in source and binary forms, with or
 | 
						|
 *     without modification, are permitted provided that the following
 | 
						|
 *     conditions are met:
 | 
						|
 *
 | 
						|
 *      - Redistributions of source code must retain the above
 | 
						|
 *        copyright notice, this list of conditions and the following
 | 
						|
 *        disclaimer.
 | 
						|
 *
 | 
						|
 *      - Redistributions in binary form must reproduce the above
 | 
						|
 *        copyright notice, this list of conditions and the following
 | 
						|
 *        disclaimer in the documentation and/or other materials
 | 
						|
 *        provided with the distribution.
 | 
						|
 *
 | 
						|
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
 | 
						|
 * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
 | 
						|
 * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
 | 
						|
 * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
 | 
						|
 * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
 | 
						|
 * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
 | 
						|
 * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 | 
						|
 * SOFTWARE.
 | 
						|
 *
 | 
						|
 */
 | 
						|
#include <linux/kernel.h>
 | 
						|
#include <linux/slab.h>
 | 
						|
#include <linux/in.h>
 | 
						|
 | 
						|
#include "rds.h"
 | 
						|
#include "loop.h"
 | 
						|
 | 
						|
static DEFINE_SPINLOCK(loop_conns_lock);
 | 
						|
static LIST_HEAD(loop_conns);
 | 
						|
 | 
						|
/*
 | 
						|
 * This 'loopback' transport is a special case for flows that originate
 | 
						|
 * and terminate on the same machine.
 | 
						|
 *
 | 
						|
 * Connection build-up notices if the destination address is thought of
 | 
						|
 * as a local address by a transport.  At that time it decides to use the
 | 
						|
 * loopback transport instead of the bound transport of the sending socket.
 | 
						|
 *
 | 
						|
 * The loopback transport's sending path just hands the sent rds_message
 | 
						|
 * straight to the receiving path via an embedded rds_incoming.
 | 
						|
 */
 | 
						|
 | 
						|
/*
 | 
						|
 * Usually a message transits both the sender and receiver's conns as it
 | 
						|
 * flows to the receiver.  In the loopback case, though, the receive path
 | 
						|
 * is handed the sending conn so the sense of the addresses is reversed.
 | 
						|
 */
 | 
						|
static int rds_loop_xmit(struct rds_connection *conn, struct rds_message *rm,
 | 
						|
			 unsigned int hdr_off, unsigned int sg,
 | 
						|
			 unsigned int off)
 | 
						|
{
 | 
						|
	struct scatterlist *sgp = &rm->data.op_sg[sg];
 | 
						|
	int ret = sizeof(struct rds_header) +
 | 
						|
			be32_to_cpu(rm->m_inc.i_hdr.h_len);
 | 
						|
 | 
						|
	/* Do not send cong updates to loopback */
 | 
						|
	if (rm->m_inc.i_hdr.h_flags & RDS_FLAG_CONG_BITMAP) {
 | 
						|
		rds_cong_map_updated(conn->c_fcong, ~(u64) 0);
 | 
						|
		ret = min_t(int, ret, sgp->length - conn->c_xmit_data_off);
 | 
						|
		goto out;
 | 
						|
	}
 | 
						|
 | 
						|
	BUG_ON(hdr_off || sg || off);
 | 
						|
 | 
						|
	rds_inc_init(&rm->m_inc, conn, conn->c_laddr);
 | 
						|
	/* For the embedded inc. Matching put is in loop_inc_free() */
 | 
						|
	rds_message_addref(rm);
 | 
						|
 | 
						|
	rds_recv_incoming(conn, conn->c_laddr, conn->c_faddr, &rm->m_inc,
 | 
						|
			  GFP_KERNEL, KM_USER0);
 | 
						|
 | 
						|
	rds_send_drop_acked(conn, be64_to_cpu(rm->m_inc.i_hdr.h_sequence),
 | 
						|
			    NULL);
 | 
						|
 | 
						|
	rds_inc_put(&rm->m_inc);
 | 
						|
out:
 | 
						|
	return ret;
 | 
						|
}
 | 
						|
 | 
						|
/*
 | 
						|
 * See rds_loop_xmit(). Since our inc is embedded in the rm, we
 | 
						|
 * make sure the rm lives at least until the inc is done.
 | 
						|
 */
 | 
						|
static void rds_loop_inc_free(struct rds_incoming *inc)
 | 
						|
{
 | 
						|
        struct rds_message *rm = container_of(inc, struct rds_message, m_inc);
 | 
						|
        rds_message_put(rm);
 | 
						|
}
 | 
						|
 | 
						|
/* we need to at least give the thread something to succeed */
 | 
						|
static int rds_loop_recv(struct rds_connection *conn)
 | 
						|
{
 | 
						|
	return 0;
 | 
						|
}
 | 
						|
 | 
						|
struct rds_loop_connection {
 | 
						|
	struct list_head loop_node;
 | 
						|
	struct rds_connection *conn;
 | 
						|
};
 | 
						|
 | 
						|
/*
 | 
						|
 * Even the loopback transport needs to keep track of its connections,
 | 
						|
 * so it can call rds_conn_destroy() on them on exit. N.B. there are
 | 
						|
 * 1+ loopback addresses (127.*.*.*) so it's not a bug to have
 | 
						|
 * multiple loopback conns allocated, although rather useless.
 | 
						|
 */
 | 
						|
static int rds_loop_conn_alloc(struct rds_connection *conn, gfp_t gfp)
 | 
						|
{
 | 
						|
	struct rds_loop_connection *lc;
 | 
						|
	unsigned long flags;
 | 
						|
 | 
						|
	lc = kzalloc(sizeof(struct rds_loop_connection), GFP_KERNEL);
 | 
						|
	if (!lc)
 | 
						|
		return -ENOMEM;
 | 
						|
 | 
						|
	INIT_LIST_HEAD(&lc->loop_node);
 | 
						|
	lc->conn = conn;
 | 
						|
	conn->c_transport_data = lc;
 | 
						|
 | 
						|
	spin_lock_irqsave(&loop_conns_lock, flags);
 | 
						|
	list_add_tail(&lc->loop_node, &loop_conns);
 | 
						|
	spin_unlock_irqrestore(&loop_conns_lock, flags);
 | 
						|
 | 
						|
	return 0;
 | 
						|
}
 | 
						|
 | 
						|
static void rds_loop_conn_free(void *arg)
 | 
						|
{
 | 
						|
	struct rds_loop_connection *lc = arg;
 | 
						|
	unsigned long flags;
 | 
						|
 | 
						|
	rdsdebug("lc %p\n", lc);
 | 
						|
	spin_lock_irqsave(&loop_conns_lock, flags);
 | 
						|
	list_del(&lc->loop_node);
 | 
						|
	spin_unlock_irqrestore(&loop_conns_lock, flags);
 | 
						|
	kfree(lc);
 | 
						|
}
 | 
						|
 | 
						|
static int rds_loop_conn_connect(struct rds_connection *conn)
 | 
						|
{
 | 
						|
	rds_connect_complete(conn);
 | 
						|
	return 0;
 | 
						|
}
 | 
						|
 | 
						|
static void rds_loop_conn_shutdown(struct rds_connection *conn)
 | 
						|
{
 | 
						|
}
 | 
						|
 | 
						|
void rds_loop_exit(void)
 | 
						|
{
 | 
						|
	struct rds_loop_connection *lc, *_lc;
 | 
						|
	LIST_HEAD(tmp_list);
 | 
						|
 | 
						|
	/* avoid calling conn_destroy with irqs off */
 | 
						|
	spin_lock_irq(&loop_conns_lock);
 | 
						|
	list_splice(&loop_conns, &tmp_list);
 | 
						|
	INIT_LIST_HEAD(&loop_conns);
 | 
						|
	spin_unlock_irq(&loop_conns_lock);
 | 
						|
 | 
						|
	list_for_each_entry_safe(lc, _lc, &tmp_list, loop_node) {
 | 
						|
		WARN_ON(lc->conn->c_passive);
 | 
						|
		rds_conn_destroy(lc->conn);
 | 
						|
	}
 | 
						|
}
 | 
						|
 | 
						|
/*
 | 
						|
 * This is missing .xmit_* because loop doesn't go through generic
 | 
						|
 * rds_send_xmit() and doesn't call rds_recv_incoming().  .listen_stop and
 | 
						|
 * .laddr_check are missing because transport.c doesn't iterate over
 | 
						|
 * rds_loop_transport.
 | 
						|
 */
 | 
						|
struct rds_transport rds_loop_transport = {
 | 
						|
	.xmit			= rds_loop_xmit,
 | 
						|
	.recv			= rds_loop_recv,
 | 
						|
	.conn_alloc		= rds_loop_conn_alloc,
 | 
						|
	.conn_free		= rds_loop_conn_free,
 | 
						|
	.conn_connect		= rds_loop_conn_connect,
 | 
						|
	.conn_shutdown		= rds_loop_conn_shutdown,
 | 
						|
	.inc_copy_to_user	= rds_message_inc_copy_to_user,
 | 
						|
	.inc_free		= rds_loop_inc_free,
 | 
						|
	.t_name			= "loopback",
 | 
						|
};
 |