Bug 508608

Summary: Crash in tcp_v4_do_rcv+0x5a/0x367
Product: [Fedora] Fedora Reporter: Pete Zaitcev <zaitcev>
Component: kernelAssignee: Kernel Maintainer List <kernel-maint>
Status: CLOSED RAWHIDE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: low    
Version: rawhideCC: itamar, kernel-maint, quintela
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2009-07-07 23:38:04 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
netconsole log none

Description Pete Zaitcev 2009-06-29 04:42:42 UTC
Created attachment 349725 [details]
netconsole log

Description of problem:

System crashed, keyboard LEDs blinking.

Version-Release number of selected component (if applicable):

2.6.31-0.33.rc1.git2.fc12.x86_64

How reproducible:

Unknown

Steps to Reproduce:

Unknown
  
Actual results:

Crash

Expected results:

No crash

Additional info:

Something in tun maybe. People (Herbert?) were playing with tun for
Xen and maybe screwed it up.

Same userland works dandy with self-built 2.6.30.

One-glance oops stack:

general protection fault: 0000 [#1] SMP 
last sysfs file: /sys/devices/LNXSYSTM:00/device:00/PNP0C0A:00/power_supply/BAT1/present
CPU 0 
Modules linked in: tun netconsole configfs fuse ipt_MASQUERADE iptable_nat nf_nat sco bridge stp llc bnep l2cap bluetooth ip6t_REJECT ip6t_ipv6header nf_conntrack_ipv6 ip6table_filter ip6_tables ipv6 cpufreq_ondemand powernow_k8 freq_table uinput arc4 ecb b43 mac80211 cfg80211 snd_hda_codec_idt dell_laptop rfkill dcdbas snd_hda_intel snd_hda_codec snd_hwdep snd_pcm snd_timer sdhci_pci amd64_edac_mod snd sdhci b44 ata_generic k8temp pata_acpi radeon joydev edac_core soundcore mmc_core mii hwmon snd_page_alloc ricoh_mmc pata_atiixp ttm i2c_piix4 drm i2c_algo_bit ssb i2c_core shpchp wmi video output [last unloaded: scsi_wait_scan]
Pid: 2684, comm: vpnc Not tainted 2.6.31-0.33.rc1.git2.fc12.x86_64 #1 Inspiron 1501 
RIP: 0010:[<ffffffff8148b2da>]  [<ffffffff8148b2da>] tcp_v4_do_rcv+0x5a/0x367
RSP: 0018:ffff880002673bd8  EFLAGS: 00010202
RAX: ffff88005b483bf0 RBX: ffff880065d00640 RCX: ffffffff8148c88a
RDX: 6b6b6b6b6b6b6b6b RSI: 000000003305050a RDI: ffff88005e61b9f8
RBP: ffff880002673c58 R08: 0000000000000002 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff88005e61b9f8
R13: ffff88005e61ba48 R14: ffff88005b483bf0 R15: ffff88005b483c04
FS:  00007fd0598706f0(0000) GS:ffff880002670000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: 00007f4cfc890000 CR3: 000000005a9f4000 CR4: 00000000000006f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process vpnc (pid: 2684, threadinfo ffff88005a9a6000, task ffff88005a59a4a0)
Stack:
 ffff880002673bf8 00000000526e2e1e ffff88005e61b9f8 ffff88005b483bf0
<0> ffff88005e61ba60 ffff88005e61ba48 ffff88005b483bf0 ffffffff826388a0
<0> ffff880002673c58 00000000526e2e1e ffffffff8148c88a ffff880065d00640
Call Trace:
 <IRQ> 
 [<ffffffff8148c88a>] ? tcp_v4_rcv+0x2c7/0x70d
 [<ffffffff8148ca7f>] tcp_v4_rcv+0x4bc/0x70d
 [<ffffffff8146d71e>] ? ip_local_deliver_finish+0x58/0x25f
 [<ffffffff8146d71e>] ? ip_local_deliver_finish+0x58/0x25f
 [<ffffffff8146d84e>] ip_local_deliver_finish+0x188/0x25f
 [<ffffffff8146d71e>] ? ip_local_deliver_finish+0x58/0x25f
 [<ffffffff8146d9ab>] ip_local_deliver+0x86/0xa3
 [<ffffffff8146d207>] ip_rcv_finish+0x3e1/0x425
 [<ffffffff8146d4bb>] ip_rcv+0x270/0x2c4
 [<ffffffff81433d0b>] ? __rcu_read_lock+0x0/0x58
 [<ffffffff81436b3e>] netif_receive_skb+0x417/0x455
 [<ffffffff81436c27>] process_backlog+0xab/0xfb
 [<ffffffff81434517>] net_rx_action+0xc4/0x201
 [<ffffffff8106a6c5>] __do_softirq+0xf6/0x1f0
 [<ffffffff8101422c>] call_softirq+0x1c/0x30
 <EOI> 
 [<ffffffff81015d77>] do_softirq+0x5f/0xd7
 [<ffffffff81437415>] netif_rx_ni+0x35/0x4e
 [<ffffffffa03e61fd>] tun_chr_aio_write+0x3c7/0x438 [tun]
 [<ffffffff8113e0f1>] do_sync_write+0xfa/0x14b
 [<ffffffff8107f56f>] ? autoremove_wake_function+0x0/0x5f
 [<ffffffff81076975>] ? do_sys_times+0x52/0xd3
 [<ffffffff81076975>] ? do_sys_times+0x52/0xd3
 [<ffffffff81093b12>] ? trace_hardirqs_on_caller+0x32/0x175
 [<ffffffff8121eff8>] ? security_file_permission+0x29/0x3f
 [<ffffffff8113e7a5>] vfs_write+0xbd/0x12e
 [<ffffffff8113e908>] sys_write+0x59/0x91
 [<ffffffff81012f42>] system_call_fastpath+0x16/0x1b
Code: 00 00 00 48 89 f3 49 89 fc 48 8d 14 10 48 89 55 98 44 8b be c8 00 00 00 8b 72 0c 48 8b 97 98 09 00 00 48 85 d2 4e 8d 3c 38 74 21 <8b> 4a 18 31 c0 85 c9 75 14 eb 16 4c 63 f0 4d 6b f6 18 4c 03 32 
RIP  [<ffffffff8148b2da>] tcp_v4_do_rcv+0x5a/0x367
 RSP <ffff880002673bd8>

Comment 1 Pete Zaitcev 2009-07-01 18:14:30 UTC
This may be fixed in 2.6.31-0.35.rc1.git5.fc12. I'll close when I'm sure.