- 论坛徽章:
- 0
|
本帖最后由 stanleyru 于 2012-12-18 11:34 编辑
Crashed time:2012-12-17 18:31:24
crash stack dump, the system crashed at time:1355740284! (jiffies:429843489
Invalid address request at 0000000000000014
LKCD:CPU:12 die, Process ip (pid: 7446, ti=ffff8801b3498000 task=ffff8803f90e37c0 task.ti=ffff8801b3498000)
CPU: 12
RIP: 0010:[<ffffffff813782bc>] _write_lock_bh+0x15/0x25 Tainted: P
EFLAGS: 0000000000010206
RAX: ffff8801b3499fd8 RBX: ffff8801bed48800 RCX: 0000000000000000 RDX: ffff8801bed48800
RSI: ffff8801b3499958 RDI: 0000000000000014 RBP: ffff8801b3499908 RSP: ffff8801b34998f8
R8 : ffff8801bed48800 R9 : ffff8801b3499778 R10: 0000000000000001 R11: ffffffff000493e0
R12: 0000000000000014 R13: 00000000fffffffe R14: ffff8801b3499998 R15: 0000000000000001
CS: 0010 DS: 0000 ES: 0000 SS: 0018 FS: 00007f61d7a2e700[0000] GS: ffffc200000f0000[0000]
KERNEL_GS:0000000000000000
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000
DR6: 00000000ffff0ff0 DR7: 0000000000000400
CR0: 0000000080050033 CR2: 0000000000000014 CR3: 000000019ed68000 CR4: 00000000000006e0
Code: f0 81 2f 00 00 00 01 74 05 e8 c6 92 e1 ff c9 c3 55 48 89 e5 48 83 ec 10 48 89 7d f8 e8 0b 69 cc
Stack:
ffff88063b2ba180 0000000000000014 ffff8801b3499948 ffffffff8132a576
ffff8801b3499978 ffff8801b3499958 0000000000000007 ffff880c2a8ef540
0000000000000000 000000010034e8e7 ffff8801b3499978 ffffffff8132a700
Call Trace:
[<ffffffff8132a576>] __ip6_del_rt+0x36/0x63
[<ffffffff8132a700>] ip6_del_rt+0x2c/0x2e
[<ffffffff81327196>] ipv6_del_addr+0x21d/0x254
[<ffffffff81328560>] inet6_addr_del+0xa5/0xe6
[<ffffffff813285ee>] inet6_rtm_deladdr+0x4d/0x54
[<ffffffff812cdb6e>] rtnetlink_rcv_msg+0x222/0x23d
[<ffffffff812d49d8>] netlink_rcv_skb+0x85/0xf1
[<ffffffff812cd94c>] ? rtnetlink_rcv_msg+0x0/0x23d
[<ffffffff812cd945>] rtnetlink_rcv+0x21/0x28
宕机是因为__ip6_del_rt()中的write_lock_bh()时table为空....
kernel版本为2.6.30.10
不停的添加删除IPv6 addr ifconfig ,不停的show route v6,不停的动态无状态学习地址 v6。
通过对dst_alloc申请时的内存地址进行记录到一个哈希表中。
dst_release时进行是否在哈希表的命中判断，dst_destroy将记录的dst地址从哈希表中摘除。可以发现 dst_release不可命中哈希表中，这现象只出来过一次,
但也足够我确定为二种情况：
第一种：dst被踩(从当时printk dst的地址,我可以发现dst地址正常，没有任何的异常。还有就通过内存中的数据我能知道struct rt6_info结构中的dst_entry内容正常无任何异常,
但struct rt6_info的其他部则全部为0，即第一种情况可以被否决);
第二种: dst使用了已经释放的dst_entry内存..。。。
曾参考3.7的内核修复过一个问题如下函数。。。。
static int __ip6_del_rt(struct rt6_info *rt, struct nl_info *info)
{
int err;
struct fib6_table *table;
struct net *net = dev_net(rt->rt6i_dev);
if (rt == net->ipv6.ip6_null_entry) {
err = -ENOENT;
--- return err;
+++ goto out;
}
table = rt->rt6i_table;
write_lock_bh(&table->tb6_lock);
err = fib6_del(rt, info);
write_unlock_bh(&table->tb6_lock);
+++out:
dst_release(&rt->u.dst);
return err;
}
|
|
免费注册
发表于 2012-12-17 20:50
