forge/linux-uconsole
1
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions
linux-uconsole/drivers
History
Yang Yingliang ac3e7d9bc4 net: 8139cp: fix a BUG_ON triggered by wrong bytes_compl 
[ Upstream commit 7fe0ee099a ]

Using iperf to send packets(GSO mode is on), a bug is triggered:

[  212.672781] kernel BUG at lib/dynamic_queue_limits.c:26!
[  212.673396] invalid opcode: 0000 [#1] SMP
[  212.673882] Modules linked in: 8139cp(O) nls_utf8 edd fuse loop dm_mod ipv6 i2c_piix4 8139too i2c_core intel_agp joydev pcspkr hid_generic intel_gtt floppy sr_mod mii button sg cdrom ext3 jbd mbcache usbhid hid uhci_hcd ehci_hcd usbcore sd_mod usb_common crc_t10dif crct10dif_common processor thermal_sys hwmon scsi_dh_emc scsi_dh_rdac scsi_dh_hp_sw scsi_dh ata_generic ata_piix libata scsi_mod [last unloaded: 8139cp]
[  212.676084] CPU: 0 PID: 4124 Comm: iperf Tainted: G           O 3.12.0-0.7-default+ #16
[  212.676084] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2007
[  212.676084] task: ffff8800d83966c0 ti: ffff8800db4c8000 task.ti: ffff8800db4c8000
[  212.676084] RIP: 0010:[<ffffffff8122e23f>]  [<ffffffff8122e23f>] dql_completed+0x17f/0x190
[  212.676084] RSP: 0018:ffff880116e03e30  EFLAGS: 00010083
[  212.676084] RAX: 00000000000005ea RBX: 0000000000000f7c RCX: 0000000000000002
[  212.676084] RDX: ffff880111dd0dc0 RSI: 0000000000000bd4 RDI: ffff8800db6ffcc0
[  212.676084] RBP: ffff880116e03e48 R08: 0000000000000992 R09: 0000000000000000
[  212.676084] R10: ffffffff8181e400 R11: 0000000000000004 R12: 000000000000000f
[  212.676084] R13: ffff8800d94ec840 R14: ffff8800db440c80 R15: 000000000000000e
[  212.676084] FS:  00007f6685a3c700(0000) GS:ffff880116e00000(0000) knlGS:0000000000000000
[  212.676084] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  212.676084] CR2: 00007f6685ad6460 CR3: 00000000db714000 CR4: 00000000000006f0
[  212.676084] Stack:
[  212.676084]  ffff8800db6ffc00 000000000000000f ffff8800d94ec840 ffff880116e03eb8
[  212.676084]  ffffffffa041509f ffff880116e03e88 0000000f16e03e88 ffff8800d94ec000
[  212.676084]  00000bd400059858 000000050000000f ffffffff81094c36 ffff880116e03eb8
[  212.676084] Call Trace:
[  212.676084]  <IRQ>
[  212.676084]  [<ffffffffa041509f>] cp_interrupt+0x4ef/0x590 [8139cp]
[  212.676084]  [<ffffffff81094c36>] ? ktime_get+0x56/0xd0
[  212.676084]  [<ffffffff8108cf73>] handle_irq_event_percpu+0x53/0x170
[  212.676084]  [<ffffffff8108d0cc>] handle_irq_event+0x3c/0x60
[  212.676084]  [<ffffffff8108fdb5>] handle_fasteoi_irq+0x55/0xf0
[  212.676084]  [<ffffffff810045df>] handle_irq+0x1f/0x30
[  212.676084]  [<ffffffff81003c8b>] do_IRQ+0x5b/0xe0
[  212.676084]  [<ffffffff8142beaa>] common_interrupt+0x6a/0x6a
[  212.676084]  <EOI>
[  212.676084]  [<ffffffffa0416a21>] ? cp_start_xmit+0x621/0x97c [8139cp]
[  212.676084]  [<ffffffffa0416a09>] ? cp_start_xmit+0x609/0x97c [8139cp]
[  212.676084]  [<ffffffff81378ed9>] dev_hard_start_xmit+0x2c9/0x550
[  212.676084]  [<ffffffff813960a9>] sch_direct_xmit+0x179/0x1d0
[  212.676084]  [<ffffffff813793f3>] dev_queue_xmit+0x293/0x440
[  212.676084]  [<ffffffff813b0e46>] ip_finish_output+0x236/0x450
[  212.676084]  [<ffffffff810e59e7>] ? __alloc_pages_nodemask+0x187/0xb10
[  212.676084]  [<ffffffff813b10e8>] ip_output+0x88/0x90
[  212.676084]  [<ffffffff813afa64>] ip_local_out+0x24/0x30
[  212.676084]  [<ffffffff813aff0d>] ip_queue_xmit+0x14d/0x3e0
[  212.676084]  [<ffffffff813c6fd1>] tcp_transmit_skb+0x501/0x840
[  212.676084]  [<ffffffff813c8323>] tcp_write_xmit+0x1e3/0xb20
[  212.676084]  [<ffffffff81363237>] ? skb_page_frag_refill+0x87/0xd0
[  212.676084]  [<ffffffff813c8c8b>] tcp_push_one+0x2b/0x40
[  212.676084]  [<ffffffff813bb7e6>] tcp_sendmsg+0x926/0xc90
[  212.676084]  [<ffffffff813e1d21>] inet_sendmsg+0x61/0xc0
[  212.676084]  [<ffffffff8135e861>] sock_aio_write+0x101/0x120
[  212.676084]  [<ffffffff81107cf1>] ? vma_adjust+0x2e1/0x5d0
[  212.676084]  [<ffffffff812163e0>] ? timerqueue_add+0x60/0xb0
[  212.676084]  [<ffffffff81130b60>] do_sync_write+0x60/0x90
[  212.676084]  [<ffffffff81130d44>] ? rw_verify_area+0x54/0xf0
[  212.676084]  [<ffffffff81130f66>] vfs_write+0x186/0x190
[  212.676084]  [<ffffffff811317fd>] SyS_write+0x5d/0xa0
[  212.676084]  [<ffffffff814321e2>] system_call_fastpath+0x16/0x1b
[  212.676084] Code: ca 41 89 dc 41 29 cc 45 31 db 29 c2 41 89 c5 89 d0 45 29 c5 f7 d0 c1 e8 1f e9 43 ff ff ff 66 0f 1f 44 00 00 31 c0 e9 7b ff ff ff <0f> 0b eb fe 66 66 66 66 2e 0f 1f 84 00 00 00 00 00 c7 47 40 00
[  212.676084] RIP  [<ffffffff8122e23f>] dql_completed+0x17f/0x190
------------[ cut here ]------------

When a skb has frags, bytes_compl plus skb->len nr_frags times in cp_tx().
It's not the correct value(actually, it should plus skb->len once) and it
will trigger the BUG_ON(bytes_compl > num_queued - dql->num_completed).
So only increase bytes_compl when finish sending all frags. pkts_compl also
has a wrong value, fix it too.

It's introduced by commit 871f0d4c ("8139cp: enable bql").

Suggested-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-12-08 07:29:26 -08:00
..
accessibility
acpi ACPI / hotplug: Fix conflicted PCI bridge notify handlers 2013-12-04 10:57:04 -08:00
amba
ata ahci: add Marvell 9230 to the AHCI PCI device list 2013-12-04 10:56:13 -08:00
atm atm: idt77252: fix dev refcnt leak 2013-12-08 07:29:25 -08:00
auxdisplay
base PM / runtime: Use pm_runtime_put_sync() in __device_release_driver() 2013-12-04 10:56:59 -08:00
bcma bcma: add more core IDs 2013-05-17 14:31:05 -04:00
block xen/blkback: fix reference counting 2013-12-04 10:56:25 -08:00
bluetooth Bluetooth: Add support for BCM20702A0 [0b05, 17cb] 2013-10-13 16:08:32 -07:00
bus
cdrom drivers/cdrom/cdrom.c: use kzalloc() for failing hardware 2013-07-13 11:42:26 -07:00
char random: run random_int_secret_init() run after all late_initcalls 2013-10-18 07:45:44 -07:00
clk clk: armada-370: fix tclk frequencies 2013-12-04 10:57:19 -08:00
clocksource clocksource: dw_apb: Fix error check 2013-07-25 14:07:29 -07:00
connector connector: improved unaligned access error fix 2013-12-08 07:29:25 -08:00
cpufreq cpufreq: highbank-cpufreq: Enable Midway/ECX-2000 2013-12-04 10:57:18 -08:00
cpuidle cpuidle: coupled: fix race condition between pokes and safe state 2013-09-26 17:18:02 -07:00
crypto crypto: caam - Fixed the memory out of bound overwrite issue 2013-08-04 16:50:57 +08:00
dca
devfreq
dio
dma ioatdma: fix selection of 16 vs 8 source path 2013-12-04 10:56:45 -08:00
edac edac, highbank: Fix interrupt setup of mem and l2 controller 2013-12-04 10:57:15 -08:00
eisa
extcon Removal of GENERIC_GPIO for v3.10 2013-05-09 09:59:16 -07:00
firewire firewire: fix libdc1394/FlyCap2 iso event regression 2013-08-04 16:50:38 +08:00
firmware dmi: add support for exact DMI matches in addition to substring matching 2013-11-29 11:11:53 -08:00
gpio gpio: pl061: move irqdomain initialization 2013-12-04 10:57:20 -08:00
gpu drm/radeon: re-enable sw ACR support on pre-DCE4 2013-12-04 10:57:35 -08:00
hid HID: apple: option to swap the 'Option' ("Alt") and 'Command' ("Flag") keys. 2013-12-04 10:57:34 -08:00
hsi
hv Drivers: hv: balloon: Do not post pressure status if interrupted 2013-08-04 16:50:58 +08:00
hwmon hwmon: (lm90) Fix max6696 alarm handling 2013-11-29 11:11:50 -08:00
hwspinlock
i2c i2c: mux: gpio: use gpio_set_value_cansleep() 2013-12-04 10:55:50 -08:00
ide
idle sched, idle: Fix the idle polling state logic 2013-11-29 11:11:42 -08:00
iio iio:accel:kxsd9 fix missing mutex unlock 2013-12-04 10:57:16 -08:00
infiniband IB/srp: Report receive errors correctly 2013-12-04 10:56:17 -08:00
input Input: usbtouchscreen: ignore eGalax/D-Wav/EETI HIDs 2013-12-04 10:57:18 -08:00
iommu intel-iommu: Fix leaks in pagetable freeing 2013-09-26 17:18:27 -07:00
ipack
irqchip ARM: SoC fixes for 3.10-rc 2013-06-22 09:44:45 -10:00
isdn net: rework recvmsg handler msg_name and msg_namelen logic 2013-12-08 07:29:25 -08:00
leds leds: wm831x-status: Request a REG resource 2013-09-26 17:18:27 -07:00
lguest
macintosh powerpc/windfarm: Fix noisy slots-fan on Xserve (rm31) 2013-08-11 18:35:20 -07:00
mailbox
md md: fix calculation of stacking limits on level change. 2013-12-04 10:57:15 -08:00
media media: cx23885: Fix TeVii S471 regression since introduction of ts2020 2013-12-04 10:57:35 -08:00
memory drivers/memory: don't check resource with devm_ioremap_resource 2013-05-18 11:55:52 +02:00
memstick
message
mfd mfd: tps6586x: correct device name of the regulator cell 2013-06-24 12:37:47 +01:00
misc mei: nfc: fix memory leak in error path 2013-11-29 11:11:52 -08:00
mmc mmc: atmel-mci: fix oops in atmci_tasklet_func 2013-12-04 10:56:40 -08:00
mtd mtd: gpmi: fix kernel BUG due to racing DMA operations 2013-12-04 10:56:23 -08:00
net net: 8139cp: fix a BUG_ON triggered by wrong bytes_compl 2013-12-08 07:29:26 -08:00
nfc NFC: mei: Do not disable MEI devices from their remove routine 2013-05-21 10:48:41 +02:00
ntb NTB: Correct debugfs to work with more than 1 NTB Device 2013-11-13 12:05:35 +09:00
nubus
of of: Fix missing memory initialization on FDT unflattening 2013-09-26 17:18:29 -07:00
oprofile
parisc parisc: Fix interrupt routing for C8000 serial ports 2013-08-11 18:35:21 -07:00
parport parisc: parport0: fix this legacy no-device port driver! 2013-06-01 14:46:42 +02:00
pci PCI: Remove duplicate pci_disable_device() from pcie_portdrv_remove() 2013-12-04 10:57:04 -08:00
pcmcia pcmcia: at91_cf: fix gpio_get_value in at91_cf_get_status 2013-07-21 18:21:25 -07:00
pinctrl pinctrl: dove: unset twsi option3 for gconfig as well 2013-12-04 10:55:49 -08:00
platform drivers/platform/olpc/olpc-ec.c: initialise earlier 2013-08-29 09:47:38 -07:00
pnp
power charger-manager: Ensure event is not used as format string 2013-07-13 11:42:26 -07:00
pps
ps3
ptp ptp_pch: fix error handling in pch_probe() 2013-05-25 21:24:15 -07:00
pwm drivers/pwm: don't check resource with devm_ioremap_resource 2013-05-18 11:55:58 +02:00
rapidio RAPIDIO: IDT_GEN2: Fix build error. 2013-07-28 16:30:07 -07:00
regulator mfd: tps6586x: correct device name of the regulator cell 2013-06-24 12:37:47 +01:00
remoteproc
reset
rpmsg
rtc drivers/rtc/rtc-max77686.c: Fix wrong register 2013-09-14 06:54:57 -07:00
s390 qeth: avoid buffer overflow in snmp ioctl 2013-12-04 10:56:37 -08:00
sbus
scsi aacraid: prevent invalid pointer dereference 2013-11-29 11:11:40 -08:00
sfi
sh
sn
spi spi: spi-davinci: Fix direction in dma_map_single() 2013-08-11 18:35:25 -07:00
ssb - Lots of cleanups from Artem, including deletion of some obsolete drivers 2013-05-09 10:15:46 -07:00
ssbi
staging media: lirc_zilog: Don't use dynamic static allocation 2013-12-04 10:57:32 -08:00
target iscsi-target: chap auth shouldn't match username with trailing garbage 2013-12-04 10:56:15 -08:00
tc
thermal drivers/thermal: don't check resource with devm_ioremap_resource 2013-05-18 11:57:30 +02:00
tty serial: vt8500: add missing braces 2013-11-04 04:31:06 -08:00
uio Fix a few incorrectly checked [io_]remap_pfn_range() calls 2013-11-13 12:05:33 +09:00
usb usb: hub: Clear Port Reset Change during init/resume 2013-11-29 11:11:52 -08:00
uwb
vfio vfio: fix crash on rmmod 2013-06-05 08:54:16 -06:00
vhost vhost/scsi: Fix incorrect usage of get_user_pages_fast write parameter 2013-11-13 12:05:32 +09:00
video backlight: atmel-pwm-bl: fix reported brightness 2013-12-04 10:55:47 -08:00
virt
virtio virtio: support unlocked queue poll 2013-07-28 16:29:55 -07:00
vlynq
vme
w1 drivers/w1/masters: don't check resource with devm_ioremap_resource 2013-05-18 11:58:03 +02:00
watchdog watchdog: ts72xx_wdt: locking bug in ioctl 2013-10-18 07:45:45 -07:00
xen xen-gnt: prevent adding duplicate gnt callbacks 2013-09-26 17:18:02 -07:00
zorro
Kconfig
Makefile