Bug 168736

Summary:	oops in bridge code trying to delif
Product:	[Fedora] Fedora	Reporter:	Aaron Richton <richton>
Component:	kernel	Assignee:	David Miller <davem>
Status:	CLOSED INSUFFICIENT_DATA	QA Contact:	Brian Brock <bbrock>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	4	CC:	davej, wtogami
Target Milestone:	---
Target Release:	---
Hardware:	i686
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2006-05-05 13:09:53 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Aaron Richton 2005-09-19 21:44:47 UTC

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.11) Gecko/20050815

Description of problem:
Shell script ran "brctl delif br24 tap9." Kernel didn't like it:

kernel: kernel BUG at include/linux/dcache.h:306!
kernel: invalid operand: 0000 [#1]
kernel: Modules linked in: tun 8021q bridge
dm_mod video button battery ac ohci_hcd i2c_piix4 i2c_core 3c59x mii
e1000 floppy ext3 jbd
kernel: CPU:    0
kernel: EIP:    0060:[<c01c7986>]    Not tainted VLI
kernel: EFLAGS: 00010246   (2.6.12-1.1372_FC3)
kernel: EIP is at sysfs_remove_dir+0xf3/0x100
kernel: eax: 00000000   ebx: dd2e96d0   ecx:
c027dc2c edx: dd2e96d0
kernel: esi: dce58280   edi: dd9dde60   ebp:
ddc30f10 esp: ddc30e98
kernel: ds: 007b   es: 007b   ss: 0068
kernel: Process brctl (pid: 17140,
threadinfo=ddc30000 task=dc605550)
local0: write active-config 172.18.147.194
kernel: Stack: dd1103b0 dd2e96d0 dce58280
dce58280 ddc30f10 c0204ca1 dd2e9600 e09b3ff0
kernel:        00000246 00000282 00008933
00008933 00000000 00000020 bf9598bc ddc30ef0
kernel:        df577000 00000000 e09b4611
dce58000 000089a3 e09b53e2 c02fa08d ddc30f10
kernel: Call Trace:
kernel:  [<c0204ca1>] kobject_del+0x8/0x10
kernel:  [<e09b3ff0>] br_del_if+0x27/0x166 [bridge]
kernel:  [<e09b4611>] add_del_if+0x3b/0x54 [bridge]
kernel:  [<e09b53e2>] br_dev_ioctl+0x0/0x4e [bridge]
kernel:  [<c02fa08d>] dev_ifsioc+0x109/0x368
kernel:  [<c02fa4f9>] dev_ioctl+0x20d/0x26e
kernel:  [<c031e8c0>] tcp_ioctl+0x0/0x121
kernel:  [<c033f874>] inet_ioctl+0x47/0x84
kernel:  [<c02ee863>] sock_ioctl+0x192/0x221
kernel:  [<c02ee6d1>] sock_ioctl+0x0/0x221
kernel:  [<c018deb4>] do_ioctl+0x44/0x52
kernel:  [<c018dfb7>] vfs_ioctl+0x55/0x193
kernel:  [<c018e154>] sys_ioctl+0x5f/0x6f
kernel:  [<c010392d>] syscall_call+0x7/0xb
kernel: Code: 5e 5f 5d e9 52 ac fc ff 83 c4 04
5b 5e 5f 5d c3 8b 5e 14 8b 03 e8 3c 1f f9 ff 8b 43 04 e8 cd d3 03 00 89
d8 e8 2d 1f f9 ff eb ab <0f> 0b 32 01 f1 43 37 c0 e9 1c ff ff ff 55 89
d5 57 89 d7 56 53


Version-Release number of selected component (if applicable):
kernel-2.6.12-1.1372_FC3

How reproducible:
Couldn't Reproduce

Steps to Reproduce:
Can't reproduce. This machine runs brctl very, very frequently.


Actual Results:  Kernel stopped bridging properly. Not very good.


Expected Results:  Kernel removes interface and keeps bridging properly.


Additional info:

Comment 1 David Miller 2005-10-06 01:17:00 UTC

The dput() on the sysfs directory entry for the bridge device
sees the refcount as zero, during sysfs_remove_dir().

Not good.

I think the issue is that nothing protects us from parallel
bridge interface deletes.  Let me ask Stephen Hemminger.

Comment 2 Dave Jones 2006-01-16 22:22:40 UTC

This is a mass-update to all currently open Fedora Core 3 kernel bugs.

Fedora Core 3 support has transitioned to the Fedora Legacy project.
Due to the limited resources of this project, typically only
updates for new security issues are released.

As this bug isn't security related, it has been migrated to a
Fedora Core 4 bug.  Please upgrade to this newer release, and
test if this bug is still present there.

This bug has been placed in NEEDINFO_REPORTER state.
Due to the large volume of inactive bugs in bugzilla, if this bug is
still in this state in two weeks time, it will be closed.

Should this bug still be relevant after this period, the reporter
can reopen the bug at any time. Any other users on the Cc: list
of this bug can request that the bug be reopened by adding a
comment to the bug.

Thank you.

Comment 3 Aaron Richton 2006-01-17 14:30:09 UTC

> I think the issue is that nothing protects us from parallel
> bridge interface deletes.  Let me ask Stephen Hemminger.

If thiis asking hasn't been completed, I assume the sysfs bug is still present,
so this should be bumped to an OPEN FC4(+) bug?

Comment 4 Dave Jones 2006-02-03 07:19:11 UTC

This is a mass-update to all currently open kernel bugs.

A new kernel update has been released (Version: 2.6.15-1.1830_FC4)
based upon a new upstream kernel release.

Please retest against this new kernel, as a large number of patches
go into each upstream release, possibly including changes that
may address this problem.

This bug has been placed in NEEDINFO_REPORTER state.
Due to the large volume of inactive bugs in bugzilla, if this bug is
still in this state in two weeks time, it will be closed.

Should this bug still be relevant after this period, the reporter
can reopen the bug at any time. Any other users on the Cc: list
of this bug can request that the bug be reopened by adding a
comment to the bug.

If this bug is a problem preventing you from installing the
release this version is filed against, please see bug 169613.

Thank you.

Comment 5 John Thacker 2006-05-05 13:09:53 UTC

Closing per previous comment.