iocellnetworks
commented
11 years ago According to the functions exported in this bug, and what they use as the parameter,
ndas_core_main.c (153-183)
static ndas_error_t register_network(void) {
int c = 0;
ndas_error_t err;
struct net_device *dev;
read_lock(&dev_base_lock);
FOR_EACH_NETDEV(dev)
{
if ( strcmp(dev->name, "lo") == 0 )
continue;
if ( ndas_dev != NULL && ndas_dev[0]!=0 && strcmp(dev->name, ndas_dev) != 0 )
continue;
printk("ndas: registering network interface %s\n", dev->name);
---> err = ndas_register_network_interface(dev->name); <--- maybe passing null pointer
if ( err == NDAS_ERROR_OUT_OF_MEMORY) {
goto out;
} if ( !NDAS_SUCCESS(err) ) {
printk("ndas: fail to register network interface %s (%d): ignored\n", dev->name, err);
}
c++;
}
read_unlock(&dev_base_lock);
if ( c == 0 ) {
return NDAS_ERROR_NO_DEVICE;
}
return NDAS_OK;
out:
unregister_network();
return err;
}ndasuser.c gets the device (106-110)
NDASUSER_API ndas_error_t
ndas_register_network_interface(const char* devname)
{
return lpx_register_dev(devname);
}lpxproto.c takes the infomration and tries to create the device (6257-6260)
ndas_error_t lpx_register_dev(const char* devname)
{
return lpxitf_create(devname);
}This is the function that creates the device lpxproto.c (476-530)
LOCAL ndas_error_t lpxitf_create(const char *dev_name)
{
lpx_interface *itf;
sal_netdev_desc nd;
int ret;
debug_lpx(3, "ing dev_name=%s", dev_name);
if(lpxitf_find_using_devname(dev_name) != NULL)
return NDAS_ERROR_EXIST;
---> nd = sal_netdev_open(dev_name); <--- Last call listed in the bug trace
if (nd == SAL_INVALID_NET_DESC) {
/* sal_debug_print("Failed open device %s\r\n", dev_name); */
return NDAS_ERROR_NO_DEVICE;
}
itf = (lpx_interface *)sal_malloc(sizeof(lpx_interface));
if(itf == NULL) {
ret = NDAS_ERROR_OUT_OF_MEMORY;
goto out1;
}
itf->nd = nd;
itf->itf_sklist = NULL;
ret = sal_spinlock_create("itf-sk-lock", &itf->itf_sklock);
if (!ret) {
ret = NDAS_ERROR_OUT_OF_MEMORY;
goto out2;
}
sal_strcpy(itf->dev, dev_name);
sal_netdev_get_address(nd, itf->itf_node);
itf->mss = sal_netdev_get_mtu(nd) - sizeof(struct lpxhdr);
sal_assert(itf->mss + sizeof(struct lpxhdr)>= MIN_MTU_SIZE); /* We assume MTU is large enough to hold two disk sector */
itf->hard_header_len = SAL_ETHER_HEADER_SIZE;
lpxitf_insert(itf);
ret = sal_netdev_register_proto(nd, g_htons(ETH_P_LPX), lpx_net_rx_handler);
if (ret != 0) {
sal_debug_print("sal_netdev_register_proto failed");
ret = NDAS_ERROR_PROTO_REGISTRATION_FAIL;
goto out3;
}
return NDAS_OK;
out3:
lpxitf_remove(itf);
out2:
sal_free(itf);
out1:
sal_netdev_close(nd);
return ret;
}So the device open happens in sal_net.c (589 - 660 )
I loaded this function with printk statements to see what I can know more about the crash.
/**
* sal_netdev_open - open the network device by the given name
* @devname - the name of the network device to open
*/
NDAS_SAL_API sal_netdev_desc sal_netdev_open(const char* devname)
{
unsigned long flags;
int ret;
_network_device_t* psn = NULL;
struct net_device *dev = NULL;
struct list_head* i;
printk("sal_netdev_open devname=%s", devname);
// dbgl_salnet(1, "ing name=%s", devname);
if ( strcmp(devname, "lo") == 0 ) {
goto errout;
}
/* Check device is exists */
printk("sal_netdev_open DEV_GET_BY_NAME(devname)");
dev = DEV_GET_BY_NAME(devname);
if (unlikely(dev == NULL)) {
dbgl_salnet(1, "no such device %s:",devname);
goto errout;
}
printk("sal_netdev_open spin_lock_irqsave");
spin_lock_irqsave(&v_sal_net_global.lock, flags);
printk("sal_netdev_open list_for_each");
list_for_each(i, &v_sal_net_global.net_dev_list)
{
printk("sal_netdev_open list_entry");
psn = list_entry(i, _network_device_t, link);
printk("sal_netdev_open sal_assert(psn ...");
sal_assert(psn != NULL);
printk("sal_netdev_open if !strncomp(psn->devname ");
if ( !strncmp(psn->devname,devname,IFNAMSIZ) )
{
/* Already opened device */
printk("sal_netdev_open Already opened device");
spin_unlock_irqrestore(&v_sal_net_global.lock, flags);
psn = NULL;
goto errout;
}
}
printk("sal_netdev_open spin_unlock_irqrestore");
spin_unlock_irqrestore(&v_sal_net_global.lock, flags);
/* Now everything OK,
create place holder for new net interface */
printk("sal_netdev_open create place holder for new net interface");
psn = (_network_device_t*) sal_malloc(sizeof(_network_device_t));
if ( !psn ) {
goto errout;
}
printk("sal_netdev_open memset size of network device");
memset(psn, 0, sizeof(_network_device_t));
printk("sal_netdev_open strncpy devname ... ");
strncpy(psn->devname, devname, IFNAMSIZ); // TODO: strncpy
printk("sal_netdev_open psn->if_dev");
psn->if_dev = dev;
printk("sal_netdev_open ret = sal_netdev_get_addresss");
ret = sal_netdev_get_address((sal_netdev_desc)psn, psn->mac);
if (ret!=0) {
printk("sal_netdev_open go to errout (1)");
goto errout;
}
/* Link to net list */
printk("sal_netdev_open spin_lock_irqsave");
spin_lock_irqsave(&v_sal_net_global.lock, flags);
printk("sal_netdev_open list_add ");
list_add(&psn->link, &v_sal_net_global.net_dev_list);
printk("sal_netdev_open unlock_irqrestore ");
spin_unlock_irqrestore(&v_sal_net_global.lock, flags);
printk("sal_netdev_open dev_put");
dev_put(dev);
printk("sal_netdev_open sal_netdev_opened : %s", devname);
dbgl_salnet(5, "sal_netdev_opened : %s", devname);
printk("sal_netdev_open return sal_netdev_desc)psn");
return (sal_netdev_desc)psn;
errout:
printk("sal_netdev_open errout: ");
dbgl_salnet(1, "sal_netdev_open : can\'t open %s", devname);
printk("sal_netdev_open ");
if (dev) {
printk("sal_netdev_open if(Dev) dev_put");
dev_put(dev);
}
if (psn) {
printk("sal_netdev_open if(psn) sal_free");
sal_free(psn); // psn is not NULL
}
printk("sal_netdev_open return SAL invalid net desc");
return SAL_INVALID_NET_DESC;
}
EXPORT_SYMBOL(sal_netdev_open);and I get the following oops.
Feb 16 09:20:16 rawhide kernel: [41881.740523] ndas: sal_thread_create: sal_thread
Feb 16 09:20:16 rawhide kernel: [41881.740822] ndas: sal_thread_create: set tid; tsk=-131939323490912
Feb 16 09:20:16 rawhide kernel: [41881.740825] ndas: sal_thread_created: tid=-1605139104
Feb 16 09:20:16 rawhide kernel: [41881.741385] ndas: sal_thread_create: sal_thread
Feb 16 09:20:16 rawhide kernel: [41881.746951] ndas: sal_thread_create: set tid; tsk=-131939194175488
Feb 16 09:20:16 rawhide kernel: [41881.746955] ndas: sal_thread_created: tid=-1605139328
Feb 16 09:20:16 rawhide kernel: [41881.749033] ndas: registering network interface enp6s1
Feb 16 09:20:16 rawhide kernel: [41881.749038] sal_netdev_open devname=enp6s1
Feb 16 09:20:16 rawhide kernel: [41881.749038] sal_netdev_open DEV_GET_BY_NAME(devname)
Feb 16 09:20:16 rawhide kernel: [41881.749038] sal_netdev_open spin_lock_irqsave
Feb 16 09:20:16 rawhide kernel: [41881.749038] sal_netdev_open list_for_each
Feb 16 09:20:16 rawhide kernel: [41881.749038] sal_netdev_open list_entry
Feb 16 09:20:16 rawhide kernel: [41881.749038] sal_netdev_open sal_assert(psn ...
Feb 16 09:20:16 rawhide kernel: [41881.749038] sal_netdev_open if !strncomp(psn->devname
Feb 16 09:20:16 rawhide kernel: [41881.749060] BUG: unable to handle kernel NULL pointer dereference at 0000000000000024
Feb 16 09:20:16 rawhide kernel: [41881.749124] IP: [<ffffffff8135b119>] strncmp+0x9/0x60
Feb 16 09:20:16 rawhide kernel: [41881.749161] PGD 973eb067 PUD 627d5067 PMD 0
Feb 16 09:20:16 rawhide kernel: [41881.749198] Oops: 0000 [#1] SMP
Feb 16 09:20:16 rawhide kernel: [41881.749227] Modules linked in: ndas_core(OF+) ndas_block(OF) ndas_sal(OF) rfcomm ipt_MASQUERADE nf_conntrack_netbios_ns nf_conntrack_broadcast ip6table_mangle ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 iptable_nat nf_nat_ipv4 nf_nat iptable_mangle nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack ebtable_filter ebtables bnep bluetooth rfkill ip6table_filter ip6_tables ppdev iTCO_wdt iTCO_vendor_support coretemp kvm_intel kvm microcode snd_hda_codec_idt snd_hda_intel usblp snd_hda_codec snd_hwdep snd_seq parport_pc snd_seq_device parport snd_pcm snd_page_alloc snd_timer snd soundcore serio_raw lpc_ich mei mfd_core i2c_i801 uinput ata_generic pata_acpi firewire_ohci r8169 firewire_core crc_itu_t mii i915 sata_sil24 pata_marvell video i2c_algo_bit drm_kms_helper drm e1000e i2c_core sunrpc
Feb 16 09:20:16 rawhiderawhide kernel: [41881.749841] CPU 0
Feb 16 09:20:16 rawhide kernel: [41881.749859] Pid: 3472, comm: insmod Tainted: GF O 3.8.0-0.rc7.git2.1.fc19.x86_64 #1 /DG965OT
Feb 16 09:20:16 rawhide kernel: [41881.749921] RIP: 0010:[<ffffffff8135b119>] [<ffffffff8135b119>] strncmp+0x9/0x60
Feb 16 09:20:16 rawhide kernel: [41881.749968] RSP: 0018:ffff880093c77d70 EFLAGS: 00010002
Feb 16 09:20:16 rawhide kernel: [41881.750004] RAX: 000000000000002b RBX: 0000000000000000 RCX: 0000000000000001
Feb 16 09:20:16 rawhide kernel: [41881.750012] RDX: 0000000000000010 RSI: ffff880035c62160 RDI: 0000000000000024
Feb 16 09:20:16 rawhide kernel: [41881.750012] RBP: ffff880093c77d70 R08: 0000000000000002 R09: 0000000000000000
Feb 16 09:20:16 rawhide kernel: [41881.750012] R10: 0000000000000001 R11: 0000000000000000 R12: ffff880035c62160
Feb 16 09:20:16 rawhide kernel: [41881.750012] R13: ffff880035c62160 R14: 0000000000000286 R15: ffffffffa0537ac0
Feb 16 09:20:16 rawhide kernel: [41881.750012] FS: 00007f6ce8d85740(0000) GS:ffff8800bdc00000(0000) knlGS:0000000000000000
Feb 16 09:20:16 rawhide kernel: [41881.750012] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
Feb 16 09:20:16 rawhide kernel: [41881.750012] CR2: 0000000000000024 CR3: 000000007b679000 CR4: 00000000000007f0
Feb 16 09:20:16 rawhide kernel: [41881.750012] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
Feb 16 09:20:16 rawhide kernel: [41881.750012] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Feb 16 09:20:16 rawhide kernel: [41881.750012] Process insmod (pid: 3472, threadinfo ffff880093c76000, task ffff880035d24da0)
Feb 16 09:20:16 rawhide kernel: [41881.750012] Stack:
Feb 16 09:20:16 rawhide kernel: [41881.750012] ffff880093c77da0 ffffffffa04bfc6b ffff880035c62160 0000000000000003
Feb 16 09:20:16 rawhide kernel: [41881.750012] ffffffffa0532e39 0000000000000000 ffff880093c77dc8 ffffffffa051948a
Feb 16 09:20:16 rawhide kernel: [41881.750012] ffff880035c62160 0000000000000003 ffffffffa0532e39 ffff880093c77dd8
Feb 16 09:20:16 rawhide kernel: [41881.750012] Call Trace:
Feb 16 09:20:16 rawhide kernel: [41881.750012] [<ffffffffa04bfc6b>] sal_netdev_open+0xdb/0x3e0 [ndas_sal]
Feb 16 09:20:16 rawhide kernel: [41881.750012] [<ffffffffa051948a>] lpx_register_dev+0xda/0x260 [ndas_core]
Feb 16 09:20:16 rawhide kernel: [41881.750012] [<ffffffffa050f0fe>] ndas_register_network_interface+0xe/0x10 [ndas_core]
Feb 16 09:20:16 rawhide kernel: [41881.750012] [<ffffffffa052fc85>] init_module+0x105/0x150 [ndas_core]
Feb 16 09:20:16 rawhide kernel: [41881.750012] [<ffffffffa052fb80>] ? ndas_change_handler_func+0x70/0x70 [ndas_core]
Feb 16 09:20:16 rawhide kernel: [41881.750012] [<ffffffff8100210a>] do_one_initcall+0x10a/0x160
Feb 16 09:20:16 rawhide kernel: [41881.750012] [<ffffffff810e9e8e>] load_module+0x1a4e/0x2310
Feb 16 09:20:16 rawhide kernel: [41881.750012] [<ffffffff81374f30>] ? ddebug_proc_write+0xf0/0xf0
Feb 16 09:20:16 rawhide kernel: [41881.750012] [<ffffffff810ea811>] sys_init_module+0xc1/0x110
Feb 16 09:20:16 rawhide kernel: [41881.750012] [<ffffffff8170eb19>] system_call_fastpath+0x16/0x1b
Feb 16 09:20:16 rawhide kernel: [41881.750012] Code: c6 01 3a 46 ff 74 eb 19 c0 83 c8 01 5d c3 0f 1f 40 00 31 c0 5d c3 66 66 66 2e 0f 1f 84 00 00 00 00 00 55 48 85 d2 48 89 e5 74 3c <0f> b6 0f 44 0f b6 06 44 38 c1 75 3b 84 c9 74 2c 48 83 ea 01 31
Feb 16 09:20:16 rawhide kernel: [41881.750012] RIP [<ffffffff8135b119>] strncmp+0x9/0x60
Feb 16 09:20:16 rawhide kernel: [41881.750012] RSP <ffff880093c77d70>
Feb 16 09:20:16 rawhide kernel: [41881.750012] CR2: 0000000000000024
Feb 16 09:20:16 rawhide kernel: [41881.852936] ---[ end trace 0027d2d008b9dc49 ]---
Feb 16 09:20:16 rawhide kernel: [41881.852943] BUG: sleeping function called from invalid context at kernel/rwsem.c:20
Feb 16 09:20:16 rawhide kernel: [41881.852946] in_atomic(): 1, irqs_disabled(): 1, pid: 3472, name: insmod
Feb 16 09:20:16 rawhide kernel: [41881.852948] INFO: lockdep is turned off.
Feb 16 09:20:16 rawhide kernel: [41881.852950] irq event stamp: 0
Feb 16 09:20:16 rawhide kernel: [41881.852952] hardirqs last enabled at (0): [< (null)>] (null)
Feb 16 09:20:16 rawhide kernel: [41881.852957] hardirqs last disabled at (0): [<ffffffff81066548>] copy_process.part.21+0x5d8/0x1650
Feb 16 09:20:16 rawhide kernel: [41881.852965] softirqs last enabled at (0): [<ffffffff81066548>] copy_process.part.21+0x5d8/0x1650
Feb 16 09:20:16 rawhide kernel: [41881.852969] softirqs last disabled at (0): [< (null)>] (null)So. oops appears in here: (sal_net.c)
printk("ndas: sal_netdev_open list_for_each\n");
list_for_each(i, &v_sal_net_global.net_dev_list) <-- this net_dev_list is referenced.
{
printk("ndas: sal_netdev_open list_entry\n");
psn = list_entry(i, _network_device_t, link); <--- psn is possibly a null reference.
printk("ndas: sal_netdev_open sal_assert(psn ...\n");
sal_assert(psn != NULL);
printk("ndas: sal_netdev_open if !strncomp(psn->devname \n");
if ( !strncmp(psn->devname,devname,IFNAMSIZ) ) <-- it fails to compare devname with psn
{Next I turned up the printk just a bit for finer detail and oopsed again:
9707:Feb 16 10:10:20 rawhide kernel: [ 2882.471733] ndas: registering network interface enp6s1
9708:Feb 16 10:10:20 rawhide kernel: [ 2882.471737] ndas: sal_netdev_open devname=enp6s1
9709:Feb 16 10:10:20 rawhide kernel: [ 2882.471740] ndas: sal_netdev_open DEV_GET_BY_NAME(devname)ndas: sal_netdev_open spin_lock_irqsave
9710:Feb 16 10:10:20 rawhide kernel: [ 2882.471744] ndas: sal_netdev_open list_for_each
9711:Feb 16 10:10:20 rawhide kernel: [ 2882.471746] ndas: sal_netdev_open list_entry
9712:Feb 16 10:10:20 rawhide kernel: [ 2882.471748] ndas: sal_netdev_open sal_assert(psn ...
9713:Feb 16 10:10:20 rawhide kernel: [ 2882.471750] ndas: sal_netdev_open if !strncomp(psn->devname,devname
-->>9714:Feb 16 10:10:20 rawhide kernel: [ 2882.471752] ndas: sal_netdev_open actual if !strncomp((null),enp6s1,IFNAMISIZ)
>> line above show the values tested at this point.
>> the &v_sal_net_global.net_dev_list entry has some problem)
9715:Feb 16 10:10:20 rawhide kernel: [ 2882.471767] BUG: unable to handle kernel NULL pointer dereference at 0000000000000024
9716:Feb 16 10:10:20 rawhide kernel: [ 2882.471829] IP: [<ffffffff8135b119>] strncmp+0x9/0x60So, I guess one thing to do is see how the net_dev_list is created. because after comparing, the function uses "psn" to create the actual device.
gregkh
This proto version is surely oopsing when ndas_core connects.
Seems like as the network card is registered it makes a null pointer. The only thing close that I saw in the past was this bug. http://ndas4linux.iocellnetworks.com/trac/index.cgi/ticket/1
But I un - did the commented line in that bug, to test it. And there was still the same crash.
I will try to understand a little better tomorrow. Thanks again.
Here is a basic oops.