lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:	Sat,  3 Dec 2011 03:44:27 -0800
From:	Jeff Kirsher <>
Cc:	Bruce Allan <>,,,,
	Mike McElroy <>,
	Jeff Kirsher <>
Subject: [net-next 2/6] e1000e: hitting BUG_ON() from napi_enable

From: Bruce Allan <>

Based on a patch from Mike McElroy created against the out-of-tree e1000e

Hitting the BUG_ON in napi_enable(). Code inspection shows that this can
only be triggered by calling napi_enable() twice without an intervening

I saw the following sequence of events in the stack trace:

1) We simulated a cable pull using an Extreme switch.
2) e1000_tx_timeout() was entered.
3) e1000_reset_task() was called. Saw the message from e_err() in the
console log.
4) e1000_reinit_locked was called. This function calls e1000_down() and
e1000_up(). These functions call napi_disable() and napi_enable()
5) Then on another thread, a monitor task saw carrier was down and executed
'ip set link down' and 'ip set link up' commands.
6) Saw the '_E1000_RESETTING'warning fron the e1000_close function.
7) Either the e1000_open() executed between the e1000_down() and e1000_up()
calls in step 4 or the e1000_open() call executed after the e1000_up()
call.  In either case, napi_enable() is called twice which triggers the

Signed-off-by: Bruce Allan <>
Cc: Mike McElroy <>
Tested-by: Aaron Brown <>
Signed-off-by: Jeff Kirsher <>
 drivers/net/ethernet/intel/e1000e/netdev.c |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
index 3c12e6a..ef6546f 100644
--- a/drivers/net/ethernet/intel/e1000e/netdev.c
+++ b/drivers/net/ethernet/intel/e1000e/netdev.c
@@ -3516,7 +3516,6 @@ int e1000e_up(struct e1000_adapter *adapter)
 	clear_bit(__E1000_DOWN, &adapter->state);
-	napi_enable(&adapter->napi);
 	if (adapter->msix_entries)
@@ -3578,7 +3577,6 @@ void e1000e_down(struct e1000_adapter *adapter)
 	usleep_range(10000, 20000);
-	napi_disable(&adapter->napi);
@@ -3901,6 +3899,8 @@ static int e1000_close(struct net_device *netdev)
+	napi_disable(&adapter->napi);
 	if (!test_bit(__E1000_DOWN, &adapter->state)) {

To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to
More majordomo info at

Powered by blists - more mailing lists