[3583] in linux-net channel archive

home help back first fref pref prev next nref lref last post

Re: Linux 2.0.0 bugs (was Mrouted and multicast tools on ONE LINUX

daemon@ATHENA.MIT.EDU (Malcolm Beattie)
Fri Jul 5 12:30:31 1996

From: Malcolm Beattie <malcolm.beattie@computing-services.oxford.ac.uk>
To: alan@lxorguk.ukuu.org.uk (Alan Cox)
Date: 	Fri, 5 Jul 1996 10:18:49 +0100 (BST)
Cc: linux-net@vger.rutgers.edu
In-Reply-To: <m0ubY6e-0005FbC@lightning.swansea.linux.org.uk> from "Alan Cox" at Jul 3, 96 09:01:00 pm

With 2.0 + Alan's patch-kit + the skb_reserve() fix (effectively
2.0.1 for the purposes of this posting), I'm getting a new
"kernel aiee" in ip_forward() with mrouted routing.

The slightly good news is that, modulo this, I have an mrouted tunnel
partially working but I'll post about that separately.

The oopses are as follows:
Jul  4 18:44:35 plutonium kernel: Unable to handle kernel paging request at virtual address c18361a8
Jul  4 18:44:35 plutonium kernel: current->tss.cr3 = 00101000, Hr3 = 00101000
Jul  4 18:44:35 plutonium kernel: *pde = 00001067
Jul  4 18:44:35 plutonium kernel: *pte = 00000000
Jul  4 18:44:35 plutonium kernel: Oops: 0000
Jul  4 18:44:35 plutonium kernel: CPU:    0
Jul  4 18:44:35 plutonium kernel: EIP:    0010:[<00146492>]
Jul  4 18:44:35 plutonium kernel: EFLAGS: 00010202
Jul  4 18:44:35 plutonium kernel: eax: 00000001   ebx: 0a303d76   ecx: 01836170   edx: 00000000
Jul  4 18:44:35 plutonium kernel: esi: 00b00364   edi: 00000018   ebp: 001b28d8   esp: 001a62b0
Jul  4 18:44:35 plutonium kernel: ds: 0018   es: 0018   fs: 002b   gs: 0018   ss: 0018
Jul  4 18:44:35 plutonium kernel: Process swapper (pid: 0, process nr: 0, stackpage=001a4448)
Jul  4 18:44:35 plutonium kernel: Stack: 00b00364 00000010 00000118 001b28d8 00000014 0000014c 00000000 00b003b4 
Jul  4 18:44:35 plutonium kernel:        00000000 00b00364 00b0025c 01836170 001573f0 00b00364 001b28d8 00000018 
Jul  4 18:44:35 plutonium kernel:        0e0201a3 00000007 00000002 00431958 00355498 001574d8 00b00364 001babc8 
Jul  4 18:44:35 plutonium kernel: Call Trace: [<01836170>] [<001573f0>] [<001574d8>] [<0014558e>] [<0013d66c>] [<0011706b>] [<0010a56b>] 
Jul  4 18:44:35 plutonium kernel:        [<01b2d00f>] [<001096bc>] [<0010a5e2>] [<001093d0>] [<00109243>] [<00116760>] [<01ae975c>] [<0011049c>] 
Jul  4 18:44:35 plutonium kernel:        [<01b2d011>] 
Jul  4 18:44:35 plutonium kernel: Code: f6 41 38 01 0f 84 94 04 00 00 8b 54 24 10 8b 74 24 34 03 56 
Jul  4 18:44:35 plutonium kernel: Aiee, killing interrupt handler
Jul  4 18:44:35 plutonium kernel: kfree of non-kmalloced memory: 001a6490, next= fe2001a3, order=14485504
Jul  4 18:44:35 plutonium kernel: kfree of non-kmalloced memory: 001a6480, next= fe2001a3, order=14485504
Jul  4 18:44:35 plutonium kernel: kfree of non-kmalloced memory: 001a68b4, next= fe2001a3, order=14485504
Jul  4 18:44:35 plutonium kernel: idle task may not sleep
Jul  4 18:44:35 plutonium last message repeated 4 times
Jul  4 18:47:12 plutonium kernel: Unable to handle kernel paging request at virtual address c18361a8
Jul  4 18:47:12 plutonium kernel: current->tss.cr3 = 00101000, Hr3 = 00101000
Jul  4 18:47:12 plutonium kernel: *pde = 00001067
Jul  4 18:47:12 plutonium kernel: *pte = 00000000
Jul  4 18:47:12 plutonium kernel: Oops: 0000
Jul  4 18:47:12 plutonium kernel: CPU:    0
Jul  4 18:47:12 plutonium kernel: EIP:    0010:[<00146492>]
Jul  4 18:47:12 plutonium kernel: EFLAGS: 00010202
Jul  4 18:47:12 plutonium kernel: eax: 00000001   ebx: 0a303d76   ecx: 01836170   edx: 00000000
Jul  4 18:47:12 plutonium kernel: esi: 00b00d50   edi: 00000018   ebp: 001b28d8   esp: 001a60d4
Jul  4 18:47:12 plutonium kernel: ds: 0018   es: 0018   fs: 002b   gs: 0000   ss: 0018
Jul  4 18:47:12 plutonium kernel: Process swapper (pid: 0, process nr: 0, stackpage=001a4448)
Jul  4 18:47:12 plutonium kernel: Stack: 00b00d50 00000010 00000118 001b28d8 00000014 0000014c 00000000 00b00da0 
Jul  4 18:47:12 plutonium kernel:        00000000 00b00d50 00b00c48 01836170 001573f0 00b00d50 001b28d8 00000018 
Jul  4 18:47:12 plutonium kernel:        0e0201a3 00000007 00000002 00431f4c 00355498 001574d8 00b00d50 001babc8 
Jul  4 18:47:12 plutonium kernel: Call Trace: [<01836170>] [<001573f0>] [<001574d8>] [<0014558e>] [<0013d66c>] [<0011706b>] [<0010a56b>] 
Jul  4 18:47:12 plutonium kernel:        [<00115a2d>] [<00115d7a>] [<0010ab92>] [<02000000>] [<01800000>] [<0011012f>] [<0010fe70>] [<0010a77b>] 
Jul  4 18:47:12 plutonium kernel:        [<01836170>] [<00146492>] [<01836170>] [<001573f0>] [<001574d8>] [<0014558e>] [<0013d66c>] [<0011706b>] 
Jul  4 18:47:12 plutonium kernel:        [<0010a56b>] [<01b2d00f>] [<001096bc>] [<0010a5e2>] [<001093d0>] [<00109243>] [<00116760>] [<01aed420>] 
Jul  4 18:47:12 plutonium kernel:        [<0011049c>] [<01b30d9d>] 
Jul  4 18:47:12 plutonium kernel: Code: f6 41 38 01 0f 84 94 04 00 00 8b 54 24 10 8b 74 24 34 03 56 
Jul  4 18:47:12 plutonium kernel: Aiee, killing interrupt handler

ksymoops shows the stack trace to be:

>>EIP: 146492 <ip_forward+202/700>
Trace: 1836170
Trace: 1573f0 <ipmr_queue_xmit+50/70>
Trace: 1574d8 <ipmr_forward+c8/100>
Trace: 14558e <ip_rcv+45e/590>
Trace: 13d66c <net_bh+ec/120>
Trace: 11706b <do_bottom_half+3b/70>
Trace: 10a56b <handle_bottom_half+b/20>
Trace: 1b2d00f
Trace: 1096bc <sys_idle+6c/80>
Trace: 10a5e2 <system_call+52/80>
Trace: 1093d0 <init>
Trace: 109243 <start_kernel+163/170>
Trace: 116760 <it_real_fn>
Trace: 1ae975c
Trace: 11049c <schedule+24c/2b0>
Trace: 1b2d011

Disassembling ip_forward and matching it up with the assembler, the
code path is:

        if(!(is_frag&IPFWD_MULTICASTING))
        ...
        else
        {
                /*
                 *      Multicast route forward. Routing is already done
                 */
                dev2=skb->dev;
                raddr=skb->raddr;
                if(is_frag&IPFWD_MULTITUNNEL)   /* VIFF_TUNNEL mode */
                        encap=20;
                rt=NULL;
        }
        [CONFIG_FIREWALL is *not* set so no code in here]
        /*
         * We now may allocate a new buffer, and copy the datagram into it.
         * If the indicated interface is up and running, kick it.
         */

        if (dev2->flags & IFF_UP)
        {
0x14648e <ip_forward+510>:      movl   0x2c(%esp,1),%ecx
0x146492 <ip_forward+514>:      testb  $0x1,0x38(%ecx)

and trying to dereference dev2->flags bombs out. So presumably the
   dev2=skb->dev;
a little way back didn't produce a valid device after all so maybe the
comment
                 *      Multicast route forward. Routing is already done
is wrong.

--Malcolm

-- 
Malcolm Beattie <mbeattie@sable.ox.ac.uk>
Unix Systems Programmer
Oxford University Computing Services


home help back first fref pref prev next nref lref last post