[openib-general] ipoib oops (again)

[Michael S. Tsirkin]

Hi, Roland!
The following crash was triggered by ifconfig down.

The crash site is at db7:

drivers/infiniband/ulp/ipoib/ipoib_multicast.c:225
     db3:       49 8b 45 70             mov    0x70(%r13),%rax
include/linux/byteorder/swab.h:147
     db7:       8b 40 20                mov    0x20(%rax),%eax

which is this line:

ipoib_multicast.c:225  priv->qkey = be32_to_cpu(priv->broadcast->mcmember.qkey);

priv->broadcast appears to be NULL.

MST

Unable to handle kernel NULL pointer dereference at 0000000000000020 RIP:
<ffffffff88039267>{:ib_ipoib:ipoib_mcast_join_finish+119}
PGD 6a2d9067 PUD 6a7fd067 PMD 0
Oops: 0000 [1] SMP
CPU 1
Modules linked in: ib_sdp ib_cm ib_ipoib ib_sa ib_umad ib_mthca ib_mad ib_core
Pid: 30999, comm: ib_mad1 Not tainted 2.6.12.2
RIP: 0010:[<ffffffff88039267>] <ffffffff88039267>{:ib_ipoib:ipoib_mcast_join_finish+119}
RSP: 0000:ffff81016d9edc58  EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff810168810000 RCX: 0000000000000000
RDX: ffff810164047480 RSI: ffff810164047490 RDI: ffff8101688100c4
RBP: ffff810164047480 R08: 0000000000000000 R09: ffff81016d9edd38
R10: ffff81016d9eddf8 R11: 0000000000000001 R12: 0000000000000000
R13: ffff810168810380 R14: ffff810168810000 R15: ffff81006b487098
FS:  0000000000000000(0000) GS:ffffffff80579f80(0000) knlGS:0000000000000000
CS:  0010 DS: 0018 ES: 0018 CR0: 000000008005003b
CR2: 0000000000000020 CR3: 0000000095c96000 CR4: 00000000000006e0
Process ib_mad1 (pid: 30999, threadinfo ffff81016d9ec000, task ffff81017f3c69c0)
Stack: 0000000106426560 0000000000000001 0000000000000096 0000000000000296
       0000000000000296 0000000000000096 0000000000000096 ffff81016d9edcb0
       ffffffff88032c60 ffffffff8022bf06
Call Trace:<ffffffff8022bf06>{idr_remove+386} <ffffffff88039cdf>{:ib_ipoib:ipoib_mcast_join_complete+43}
       <ffffffff880001b5>{:ib_core:ib_unpack+198} <ffffffff88030d4c>{:ib_sa:ib_sa_mcmember_rec_callback+64}
       <ffffffff88030505>{:ib_sa:recv_handler+117} <ffffffff8800ce93>{:ib_mad:ib_mad_completion_handler+941}
       <ffffffff8800cae6>{:ib_mad:ib_mad_completion_handler+0}
       <ffffffff801412df>{worker_thread+476} <ffffffff8012d7c5>{default_wake_function+0}
       <ffffffff8012bb71>{__wake_up_common+64} <ffffffff8012d7c5>{default_wake_function+0}
       <ffffffff80145292>{keventd_create_kthread+0} <ffffffff80141103>{worker_thread+0}
       <ffffffff80145292>{keventd_create_kthread+0} <ffffffff801453c3>{kthread+204}
       <ffffffff8010e14f>{child_rip+8} <ffffffff80145292>{keventd_create_kthread+0}
       <ffffffff801452f7>{kthread+0} <ffffffff8010e147>{child_rip+0}


Code: 8b 40 20 0f c8 41 89 85 f0 02 00 00 41 89 85 84 03 00 00 8b
RIP <ffffffff88039267>{:ib_ipoib:ipoib_mcast_join_finish+119} RSP <ffff81016d9edc58>
CR2: 0000000000000020



-- 
MST