Bug 140405 (IT#50093) - panic: e100_free_tcb_pool() called when no pool allocated
Summary: panic: e100_free_tcb_pool() called when no pool allocated
Alias: IT#50093
Product: Red Hat Enterprise Linux 3
Classification: Red Hat
Component: kernel (Show other bugs)
(Show other bugs)
Version: 3.0
Hardware: All Linux
Target Milestone: ---
Assignee: John W. Linville
QA Contact: Brian Brock
Depends On:
TreeView+ depends on / blocked
Reported: 2004-11-22 19:37 UTC by Steve Conklin
Modified: 2007-11-30 22:07 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2004-12-20 20:56:59 UTC
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
Patch supplied with Issue (9.55 KB, patch)
2004-11-22 19:39 UTC, Steve Conklin
no flags Details | Diff
The patch (really!) (2.52 KB, patch)
2004-11-22 21:56 UTC, Steve Conklin
no flags Details | Diff

External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2004:550 normal SHIPPED_LIVE Updated kernel packages available for Red Hat Enterprise Linux 3 Update 4 2004-12-20 05:00:00 UTC

Description Steve Conklin 2004-11-22 19:37:16 UTC
Description of problem:
From IT#50093:

I've reproduced this locally.  The crash is ultimately
due to an assumption in e100_free_tcb_pool() that the
pool is, indeed, allocated upon entry to the function.
 Or, it could be said that the calling function is at
fault for calling to free the pool when none is
allocated.  Either way, e100 tries to dereference a
NULL pointer, then Bad things happen.
The ethtool implementation in this generation of
e100 has some problems dealing with failures.  The
e100_open() function can fail if one of its memory
allocations fails, and most ethtool commands that
change parameters will do a "down up" cycle to free
and reallocate the ethtool-modifiable parameters, in
this case, the tx ring.

I've generated a patch that eliminates the panic, and
adds some error returns for a few ethtool commands
(-G tx being one).  This is still not quite right,
though, as an "ethtool -g eth0" after such a failure
will claim that there are however many tx buffers
allocated as was requested in the previous (failing)
-G request.  The device also will not function,
even though it's nominally up and running.

This driver is outdated; the current driver from Intel is a complete
rewrite, so
I'm not sure how much effort we want to put into fixing this one.

The patch is for the RH 2.4.21-18.EL kernel.

(see the IT issue for a discussion of whether the current
Intel driver can be used to replace this older version.

Version-Release number of selected component (if applicable):
RH 2.4.21-18.EL

How reproducible:

Steps to Reproduce:
1.run "ethtool -G eth* tx 1024" on an e100 card

Actual Results:  Sometimes the kernel panics

Expected Results:  Should never panic

Additional info:

Comment 1 Steve Conklin 2004-11-22 19:38:44 UTC
Note - I didn't recreate this - the person who filed the issue did.

Patch coming.

Comment 2 Steve Conklin 2004-11-22 19:39:35 UTC
Created attachment 107227 [details]
Patch supplied with Issue

Comment 3 John W. Linville 2004-11-22 21:45:34 UTC
I think the attachment is busted -- it looks like nothing but HTML to

Comment 4 Steve Conklin 2004-11-22 21:56:32 UTC
Created attachment 107250 [details]
The patch (really!)

Try this. Operator error.

Comment 5 John W. Linville 2004-11-22 22:07:23 UTC
As you say, the current version (U4) of the driver is quite different
-- e100_free_tcb_pool() doesn't even exist anymore.  The attached
patch won't apply to the current sources.

While I appreciate the patch, I'm going to have to close this as

Comment 6 Ernie Petrides 2004-11-22 23:17:11 UTC
Since U4 is not the next release (RHEL4 is), and since U4 is not
actually released yet (it's still in beta), I'm reverting this
bug to MODIFIED state.  The upgrade of the e100 driver (committed
in kernel version 2.4.21-20.11.EL) has presumably resolved this bug,
which will be set to CLOSED/ERRATA automatically when U4 is released.

Comment 7 John W. Linville 2004-11-29 20:39:21 UTC
Re-opening due to likely back-rev of e100 driver in RHEL3...

Comment 8 Ernie Petrides 2004-12-02 03:03:05 UTC
A fix for this problem has just been committed to the RHEL3 U4
patch pool this evening (in kernel version 2.4.21-27.EL).

The fix was applied to the back-rev'ed (to 2.3.43-k1) e100 driver.

Comment 9 John Flanagan 2004-12-20 20:56:59 UTC
An errata has been issued which should help the problem 
described in this bug report. This report is therefore being 
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files, 
please follow the link below. You may reopen this bug report 
if the solution does not work for you.


Note You need to log in before you can comment on or make changes to this bug.