Bug 219488

Summary: kernel panic removing devices from a teql queuing discipline
Product: [Fedora] Fedora Reporter: Tom Hughes <thh>
Component: kernelAssignee: Kernel Maintainer List <kernel-maint>
Status: CLOSED ERRATA QA Contact: Brian Brock <bbrock>
Severity: medium Docs Contact:
Priority: medium    
Version: 6CC: dwmw2, jonstanley, wtogami
Target Milestone: ---   
Target Release: ---   
Hardware: i386   
OS: Linux   
Whiteboard:
Fixed In Version: 2.6.23.8-34.fc7 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2008-01-08 08:48:23 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 427887    
Attachments:
Description Flags
Kernel panic none

Description Tom Hughes 2006-12-13 15:23:25 UTC 
Description of problem:

Removing devices from a teql queuing discipline being used to equalise traffic
over a group of interfaces can cause the kernel to panic if there is traffic
going through the interface at the time.

Version-Release number of selected component (if applicable):

2.6.18-1.2849.fc6

How reproducible:

Very.

Steps to Reproduce:

1. Setup a teql0 interface with one or more underlying interfaces:

   modprobe sch-teql
   tc qdisc add dev eth0 root teql0
   tc qdisc add dev eth1 root teql1
   ifconfig teql0 inet ...

2. Send traffic through the teql0 interface (I use a flood ping):

   ping -s 1200 -f ...

3. Drop the underlying interface(s) from the equaliser:

   tc qdisc del dev eth0 root && tc qdisc del dev eth1 root
  
Actual results:

Kernel panics - the panic is attached.

Expected results:

Kernel doesn't panic.

Additional info:
Comment 1 Tom Hughes 2006-12-13 15:23:29 UTC 
Created attachment 143525 [details]
Kernel panic
Comment 2 Tom Hughes 2006-12-13 15:29:35 UTC 
The panic is in __teql_resolve (which has been inlined into teql_master_xmit) in
net/sched/sch_teql.c at this line:

	if (n && n->tbl == mn->tbl &&

Specifically the dereference of n->tbl is faulting as n is not valid.
Comment 3 Tom Hughes 2007-05-10 09:00:38 UTC 
Any news on this?
Comment 4 Tom Hughes 2007-10-29 08:50:03 UTC 
Still happening in F7 with kernel 2.6.22.9-91.fc7...
Comment 5 Chuck Ebbert 2007-10-29 18:00:26 UTC 
Reported to netdev.
Comment 6 Jon Stanley 2008-01-08 01:55:11 UTC 
(This is a mass-update to all current FC6 kernel bugs in NEW state)

Hello,

I'm reviewing this bug list as part of the kernel bug triage project, an attempt
to isolate current bugs in the Fedora kernel.

http://fedoraproject.org/wiki/KernelBugTriage

I am CC'ing myself to this bug, however this version of Fedora is no longer
maintained.

Please attempt to reproduce this bug with a current version of Fedora (presently
Fedora 8). If the bug no longer exists, please close the bug or I'll do so in a
few days if there is no further information lodged.

Thanks for using Fedora!
Comment 7 Tom Hughes 2008-01-08 08:48:23 UTC 
This was fixed by the netdev guys and the fix made it into 2.6.23.4 and we have
been running 2.6.23.8-34.fc7 on the system in question since 13th December
without any problems.

In fact our ISP had some problems last night which meant this got throughly
exercised as my monitoring code took interfaces in and out of the bond on
several occasions without any panic.