netdev - Re: bisect results of MSI-X related panic (help!)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 14 Oct 2009 15:30:38 -0700 (Pacific Daylight Time)
From:	"Brandeburg, Jesse" <jesse.brandeburg@...el.com>
To:	Tejun Heo <tj@...nel.org>
cc:	Jesse Brandeburg <jesse.brandeburg@...il.com>,
	Frans Pop <elendil@...net.nl>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"netdev@...r.kernel.org" <netdev@...r.kernel.org>,
	Ingo Molnar <mingo@...e.hu>, "hpa@...or.com" <hpa@...or.com>
Subject: Re: bisect results of MSI-X related panic (help!)

On Mon, 12 Oct 2009, Tejun Heo wrote:
> Can you please apply the following patch and try to retrigger the
> panic?
> 
> diff --git a/kernel/irq/chip.c b/kernel/irq/chip.c
> index c166019..f5a1482 100644
> --- a/kernel/irq/chip.c
> +++ b/kernel/irq/chip.c
> @@ -63,6 +63,9 @@ void dynamic_irq_cleanup(unsigned int irq)
>  	struct irq_desc *desc = irq_to_desc(irq);
>  	unsigned long flags;
> 
> +	printk("XXX dynamic_irq_cleanup() called on %u\n", irq);
> +	dump_stack();
> +
>  	if (!desc) {
>  		WARN(1, KERN_ERR "Trying to cleanup invalid IRQ%d\n", irq);
>  		return;

I'm working on it, but now that I've added a bunch of debug including the 
above printk, my system panics (with a stack protector canary overwrite) 
when loading the first network adapter with 30+ MSI-X vectors.  I can boot 
single user mode and bring up netconsole, but then as soon as I brought up 
the first port with lots of MSI-X vectors, the system hard locks, no panic 
message.

I have a bit of a theory that the node = -1 (numa_node) stuff might be 
playing some havoc with the code in numa_migrate.c.  I'm not sure if that 
is contributing, but the code in there doesn't seem written to handle node 
= - 1 very well.  As in I never see it do an smp_processor_id at the 
bottom before accessing the node value.

Not sure if that is relevant, but I wanted to mention it before I went 
home.

What next?  I made it worse so I guess that is something.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html