From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1763999AbYEITjU (ORCPT ); Fri, 9 May 2008 15:39:20 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1753678AbYEITjA (ORCPT ); Fri, 9 May 2008 15:39:00 -0400 Received: from fmailhost04.isp.att.net ([204.127.217.104]:49704 "EHLO fmailhost01.isp.att.net" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1752125AbYEITi6 convert rfc822-to-8bit (ORCPT ); Fri, 9 May 2008 15:38:58 -0400 X-Originating-IP: [74.251.48.254] Date: Fri, 9 May 2008 14:38:54 -0500 From: Jay Cliburn To: Alexey Dobriyan Cc: Chris Snook , Luca Tettamanti , Jeff Garzik , Andrew Morton , linux-kernel@vger.kernel.org, netdev@vger.kernel.org Subject: Re: atl1 64-bit => 32-bit DMA borkage (reproducible, bisected) Message-ID: <20080509143854.7bc39ab7@osprey.hogchain.net> In-Reply-To: <20080509200715.GA5040@martell.zuzino.mipt.ru> References: <20080420060607.2b1be48b@osprey.hogchain.net> <20080420122631.GA4761@martell.zuzino.mipt.ru> <20080420133704.63f5cc10@osprey.hogchain.net> <20080420205500.GA4762@martell.zuzino.mipt.ru> <20080421210821.28053a92@osprey.hogchain.net> <20080425195743.2bfe66ee@osprey.hogchain.net> <20080504211507.GC1040@martell.zuzino.mipt.ru> <20080506110225.31fd61a4@osprey.hogchain.net> <20080509195149.GA4985@martell.zuzino.mipt.ru> <48249E55.1020300@redhat.com> <20080509200715.GA5040@martell.zuzino.mipt.ru> X-Mailer: Claws Mail 3.3.1 (GTK+ 2.12.5; i386-redhat-linux-gnu) Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8BIT Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org [trimmed cc list slightly] On Sat, 10 May 2008 00:07:15 +0400 Alexey Dobriyan wrote: > On Fri, May 09, 2008 at 02:56:21PM -0400, Chris Snook wrote: > > Alexey Dobriyan wrote: > >> Hmmm, there was a wonderful oops on interface stop here when the > >> other end of atl1 cable was physically unplugged (but there was > >> traffic before): atl1_down > >> atl1_clean_rx_ring > >> swiotlb_unmap_single > >> swiotlb_unmap_single_attrs > >> memcpy_c > > > > Intel chip, or AMD? > > Intel(R) Core(TM)2 CPU 6400 @ 2.13GHz > Asus P5B-E motherboard. > I see the same thing with a Socked AM2-based board (Asus M2V) with 4GB RAM installed. The problem occurs only when SWIOTLB is active, which happens automatically at boot (in arch/x86/kernel/pci-swiotlb.c) when the page frame number exceeds 1048576 (corresponding to 2^32 bytes). I thought for awhile that the problem went away with iommu=allowed, but I was wrong. The bug appears to be a "simple" skb write-after-free that happens only when bounce buffers are in use, but I'll be damned if I can find the cause of it. ============================================================================= BUG kmalloc-2048: Poison overwritten ----------------------------------------------------------------------------- INFO: 0xffff81010004297a-0xffff810100042f71. First byte 0x0 instead of 0x6b INFO: Allocated in dev_alloc_skb+0x16/0x2c age=5813 cpu=0 pid=3029 INFO: Freed in skb_release_data+0xa8/0xad age=201 cpu=0 pid=0 INFO: Slab 0xffffe20005801600 objects=15 used=0 fp=0xffff810100045b18 flags=0x8000000000002082 INFO: Object 0xffff810100042968 @offset=10600 fp=0xffff8101000418d8 Bytes b4 0xffff810100042958: aa 91 fd ff 00 00 00 00 5a 5a 5a 5a 5a 5a 5a 5a �.��....ZZZZZZZZ Object 0xffff810100042968: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk Object 0xffff810100042978: 6b 6b 00 17 31 4e 9d 41 00 0f db bc af 14 08 00 kk..1N.A..ۼ�... Object 0xffff810100042988: 45 00 00 4e 87 5e 00 00 40 11 6e 82 c0 a8 01 fe E..N.^..@.n.�������.� Object 0xffff810100042998: c0 a8 01 70 00 89 00 89 00 3a 3b 67 00 09 00 00 ��.p.....:;g.... Object 0xffff8101000429a8: 00 01 00 00 00 00 00 00 20 43 4b 41 41 41 41 41 .........CKAAAAA Object 0xffff8101000429b8: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA Object 0xffff8101000429c8: 41 41 41 41 41 41 41 41 41 00 00 21 00 01 f0 53 AAAAAAAAA..!.. Object 0xffff8101000429d8: 56 17 df 3e 3b 9f b7 1f 2d 29 f0 68 cf 4d 61 97 V.�>;.�.-)�h�Ma. Redzone 0xffff810100043168: bb bb bb bb bb bb bb bb �𰻻������ Padding 0xffff8101000431a8: 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZ Pid: 3030, comm: ifconfig Not tainted 2.6.26-rc1 #3 Call Trace: [] print_trailer+0x123/0x12c [] check_bytes_and_report+0xa4/0xcb [] check_object+0xca/0x212 [] __free_slab+0x85/0xfd [] ? skb_release_data+0xa8/0xad [] discard_slab+0x38/0x3a [] __slab_free+0xdb/0x2ac [] kfree+0xbc/0xcb [] ? skb_release_data+0xa8/0xad [] skb_release_data+0xa8/0xad [] skb_release_all+0xc9/0xce [] __kfree_skb+0x11/0x78 [] kfree_skb+0x27/0x29 [] :atl1:atl1_clean_rx_ring+0x7e/0xe2 [] :atl1:atl1_down+0xc9/0xce [] :atl1:atl1_close+0x18/0x27 [] dev_close+0x57/0x72 [] dev_change_flags+0xa8/0x164 [] devinet_ioctl+0x26a/0x5f6 [] inet_ioctl+0x92/0xaa [] sock_ioctl+0x1da/0x202 [] vfs_ioctl+0x2a/0x77 [] do_vfs_ioctl+0x262/0x27f [] sys_ioctl+0x57/0x7a [] tracesys+0xd5/0xda FIX kmalloc-2048: Restoring 0xffff81010004297a-0xffff810100042f71=0x6b