netdev - Re: NIU driver: Sun x8 Express Quad Gigabit Ethernet Adapter

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 13 Nov 2008 14:08:24 -0800 (PST)
From:	David Miller <davem@...emloft.net>
To:	jdb@...x.dk
Cc:	netdev@...r.kernel.org
Subject: Re: NIU driver: Sun x8 Express Quad Gigabit Ethernet Adapter

From: Jesper Dangaard Brouer <jdb@...x.dk>
Date: Thu, 13 Nov 2008 09:50:22 +0100

> Another bug... while unloading the niu module.
> 
> During my testing I'm unloading/loading the niu module, I usually take
> down the interfaces _before_ unloading the module, but I forgot one
> time, and got the following BUG in the kern log.
> 
> niu: niu_put_parent: port[3]
> niu 0000:0b:00.3: PCI INT D disabled
> niu: niu_put_parent: port[2]
> niu 0000:0b:00.2: PCI INT C disabled
> niu: niu_put_parent: port[1]
> niu 0000:0b:00.1: PCI INT B disabled
> ------------[ cut here ]------------
> kernel BUG at drivers/pci/msi.c:630!

Weird.  When the module is unloaded, unregister_netdev() will
do a dev_close() which will invoke dev->stop() which is
niu_close().

And niu_close() will call free_irq() on every MSI interrupt
registered in niu_open().

So I can't see how this can happen but obviously it is happening.

I suspect that something might be changing np->num_ldg, but
anyways the following debugging patch should provide some
clues.  Please reproduce this and send the logs it generates.

Thanks.

diff --git a/drivers/net/niu.c b/drivers/net/niu.c
index d8463b1..c0eedd3 100644
--- a/drivers/net/niu.c
+++ b/drivers/net/niu.c
@@ -5600,12 +5600,20 @@ static int niu_request_irq(struct niu *np)
 	int i, j, err;
 
 	err = 0;
+#if 1
+	dev_err(np->device, PFX "%s: niu_request_irq() num_ldg[%d]\n",
+		np->dev->name, np->num_ldg);
+#endif
 	for (i = 0; i < np->num_ldg; i++) {
 		struct niu_ldg *lp = &np->ldg[i];
 
 		err = request_irq(lp->irq, niu_interrupt,
 				  IRQF_SHARED | IRQF_SAMPLE_RANDOM,
 				  np->dev->name, lp);
+#if 1
+		dev_err(np->device, PFX "%s: Request IRQ %u, lp(%p), err=%d\n",
+			np->dev->name, lp->irq, lp, err);
+#endif
 		if (err)
 			goto out_free_irqs;
 
@@ -5617,6 +5625,11 @@ out_free_irqs:
 	for (j = 0; j < i; j++) {
 		struct niu_ldg *lp = &np->ldg[j];
 
+#if 1
+		dev_err(np->device, PFX "%s: out_free_irqs, "
+			"free IRQ %u, lp(%p)\n",
+			np->dev->name, lp->irq, lp);
+#endif
 		free_irq(lp->irq, lp);
 	}
 	return err;
@@ -5626,9 +5639,17 @@ static void niu_free_irq(struct niu *np)
 {
 	int i;
 
+#if 1
+	dev_err(np->device, PFX "%s: niu_free_irq() num_ldg[%d]\n",
+		np->dev->name, np->num_ldg);
+#endif
 	for (i = 0; i < np->num_ldg; i++) {
 		struct niu_ldg *lp = &np->ldg[i];
 
+#if 1
+		dev_err(np->device, PFX "%s: free IRQ %u, lp(%p)\n",
+			np->dev->name, lp->irq, lp);
+#endif
 		free_irq(lp->irq, lp);
 	}
 }
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html