Yang Yingliang 7fe0ee099a net: 8139cp: fix a BUG_ON triggered by wrong bytes_compl ... Using iperf to send packets(GSO mode is on), a bug is triggered: [ 212.672781] kernel BUG at lib/dynamic_queue_limits.c:26! [ 212.673396] invalid opcode: 0000 [#1] SMP [ 212.673882] Modules linked in: 8139cp(O) nls_utf8 edd fuse loop dm_mod ipv6 i2c_piix4 8139too i2c_core intel_agp joydev pcspkr hid_generic intel_gtt floppy sr_mod mii button sg cdrom ext3 jbd mbcache usbhid hid uhci_hcd ehci_hcd usbcore sd_mod usb_common crc_t10dif crct10dif_common processor thermal_sys hwmon scsi_dh_emc scsi_dh_rdac scsi_dh_hp_sw scsi_dh ata_generic ata_piix libata scsi_mod [last unloaded: 8139cp] [ 212.676084] CPU: 0 PID: 4124 Comm: iperf Tainted: G O 3.12.0-0.7-default+ #16 [ 212.676084] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2007 [ 212.676084] task: ffff8800d83966c0 ti: ffff8800db4c8000 task.ti: ffff8800db4c8000 [ 212.676084] RIP: 0010:[<ffffffff8122e23f>] [<ffffffff8122e23f>] dql_completed+0x17f/0x190 [ 212.676084] RSP: 0018:ffff880116e03e30 EFLAGS: 00010083 [ 212.676084] RAX: 00000000000005ea RBX: 0000000000000f7c RCX: 0000000000000002 [ 212.676084] RDX: ffff880111dd0dc0 RSI: 0000000000000bd4 RDI: ffff8800db6ffcc0 [ 212.676084] RBP: ffff880116e03e48 R08: 0000000000000992 R09: 0000000000000000 [ 212.676084] R10: ffffffff8181e400 R11: 0000000000000004 R12: 000000000000000f [ 212.676084] R13: ffff8800d94ec840 R14: ffff8800db440c80 R15: 000000000000000e [ 212.676084] FS: 00007f6685a3c700(0000) GS:ffff880116e00000(0000) knlGS:0000000000000000 [ 212.676084] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 212.676084] CR2: 00007f6685ad6460 CR3: 00000000db714000 CR4: 00000000000006f0 [ 212.676084] Stack: [ 212.676084] ffff8800db6ffc00 000000000000000f ffff8800d94ec840 ffff880116e03eb8 [ 212.676084] ffffffffa041509f ffff880116e03e88 0000000f16e03e88 ffff8800d94ec000 [ 212.676084] 00000bd400059858 000000050000000f ffffffff81094c36 ffff880116e03eb8 [ 212.676084] Call Trace: [ 212.676084] <IRQ> [ 212.676084] [<ffffffffa041509f>] cp_interrupt+0x4ef/0x590 [8139cp] [ 212.676084] [<ffffffff81094c36>] ? ktime_get+0x56/0xd0 [ 212.676084] [<ffffffff8108cf73>] handle_irq_event_percpu+0x53/0x170 [ 212.676084] [<ffffffff8108d0cc>] handle_irq_event+0x3c/0x60 [ 212.676084] [<ffffffff8108fdb5>] handle_fasteoi_irq+0x55/0xf0 [ 212.676084] [<ffffffff810045df>] handle_irq+0x1f/0x30 [ 212.676084] [<ffffffff81003c8b>] do_IRQ+0x5b/0xe0 [ 212.676084] [<ffffffff8142beaa>] common_interrupt+0x6a/0x6a [ 212.676084] <EOI> [ 212.676084] [<ffffffffa0416a21>] ? cp_start_xmit+0x621/0x97c [8139cp] [ 212.676084] [<ffffffffa0416a09>] ? cp_start_xmit+0x609/0x97c [8139cp] [ 212.676084] [<ffffffff81378ed9>] dev_hard_start_xmit+0x2c9/0x550 [ 212.676084] [<ffffffff813960a9>] sch_direct_xmit+0x179/0x1d0 [ 212.676084] [<ffffffff813793f3>] dev_queue_xmit+0x293/0x440 [ 212.676084] [<ffffffff813b0e46>] ip_finish_output+0x236/0x450 [ 212.676084] [<ffffffff810e59e7>] ? __alloc_pages_nodemask+0x187/0xb10 [ 212.676084] [<ffffffff813b10e8>] ip_output+0x88/0x90 [ 212.676084] [<ffffffff813afa64>] ip_local_out+0x24/0x30 [ 212.676084] [<ffffffff813aff0d>] ip_queue_xmit+0x14d/0x3e0 [ 212.676084] [<ffffffff813c6fd1>] tcp_transmit_skb+0x501/0x840 [ 212.676084] [<ffffffff813c8323>] tcp_write_xmit+0x1e3/0xb20 [ 212.676084] [<ffffffff81363237>] ? skb_page_frag_refill+0x87/0xd0 [ 212.676084] [<ffffffff813c8c8b>] tcp_push_one+0x2b/0x40 [ 212.676084] [<ffffffff813bb7e6>] tcp_sendmsg+0x926/0xc90 [ 212.676084] [<ffffffff813e1d21>] inet_sendmsg+0x61/0xc0 [ 212.676084] [<ffffffff8135e861>] sock_aio_write+0x101/0x120 [ 212.676084] [<ffffffff81107cf1>] ? vma_adjust+0x2e1/0x5d0 [ 212.676084] [<ffffffff812163e0>] ? timerqueue_add+0x60/0xb0 [ 212.676084] [<ffffffff81130b60>] do_sync_write+0x60/0x90 [ 212.676084] [<ffffffff81130d44>] ? rw_verify_area+0x54/0xf0 [ 212.676084] [<ffffffff81130f66>] vfs_write+0x186/0x190 [ 212.676084] [<ffffffff811317fd>] SyS_write+0x5d/0xa0 [ 212.676084] [<ffffffff814321e2>] system_call_fastpath+0x16/0x1b [ 212.676084] Code: ca 41 89 dc 41 29 cc 45 31 db 29 c2 41 89 c5 89 d0 45 29 c5 f7 d0 c1 e8 1f e9 43 ff ff ff 66 0f 1f 44 00 00 31 c0 e9 7b ff ff ff <0f> 0b eb fe 66 66 66 66 2e 0f 1f 84 00 00 00 00 00 c7 47 40 00 [ 212.676084] RIP [<ffffffff8122e23f>] dql_completed+0x17f/0x190 ------------[ cut here ]------------ When a skb has frags, bytes_compl plus skb->len nr_frags times in cp_tx(). It's not the correct value(actually, it should plus skb->len once) and it will trigger the BUG_ON(bytes_compl > num_queued - dql->num_completed). So only increase bytes_compl when finish sending all frags. pkts_compl also has a wrong value, fix it too. It's introduced by commit 871f0d4c ("8139cp: enable bql"). Suggested-by: Eric Dumazet <edumazet@google.com> Signed-off-by: Yang Yingliang <yangyingliang@huawei.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2013-11-29 16:18:23 -05:00
..
accessibility	…
acpi	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2013-11-19 15:50:47 -08:00
amba	DMA-API: amba: get rid of separate dma_mask	2013-10-31 14:48:38 +00:00
ata	tree-wide: use reinit_completion instead of INIT_COMPLETION	2013-11-15 09:32:21 +09:00
atm	atm: idt77252: fix dev refcnt leak	2013-11-19 15:53:02 -05:00
auxdisplay	…
base	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial	2013-11-15 16:47:22 -08:00
bcma	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2013-11-13 17:40:34 +09:00
block	Merge branch 'for-linus' of git://git.kernel.dk/linux-block	2013-11-15 16:33:41 -08:00
bluetooth	Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth	2013-11-05 15:58:21 -05:00
bus	Merge branch 'for-linus' of git://git.linaro.org/people/rmk/linux-arm	2013-11-14 08:51:29 +09:00
cdrom	…
char	The /dev/random changes for 3.13 including a number of improvements in	2013-11-16 10:19:15 -08:00
clk	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial	2013-11-15 16:47:22 -08:00
clocksource	…
connector	connector: improved unaligned access error fix	2013-11-14 17:19:20 -05:00
cpufreq	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial	2013-11-15 16:47:22 -08:00
cpuidle	ACPI and power management updates for 3.13-rc1	2013-11-14 13:41:48 +09:00
crypto	tree-wide: use reinit_completion instead of INIT_COMPLETION	2013-11-15 09:32:21 +09:00
dca	…
devfreq	Merge branch 'pm-devfreq'	2013-11-07 19:24:20 +01:00
dio	…
dma	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial	2013-11-15 16:47:22 -08:00
edac	Merge branch 'linux_next' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-edac	2013-11-18 14:51:52 -08:00
eisa	…
extcon	…
firewire	tree-wide: use reinit_completion instead of INIT_COMPLETION	2013-11-15 09:32:21 +09:00
firmware	Merge branch 'for-linus-dma-masks' of git://git.linaro.org/people/rmk/linux-arm	2013-11-14 07:55:21 +09:00
fmc	…
gpio	Merge branch 'for-linus' of git://git.linaro.org/people/rmk/linux-arm	2013-11-14 08:51:29 +09:00
gpu	Merge branch 'i2c/for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux	2013-11-18 15:50:07 -08:00
hid	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid	2013-11-15 16:48:22 -08:00
hsi	…
hv	…
hwmon	Merge branch 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging	2013-11-15 16:35:10 -08:00
hwspinlock	…
i2c	Merge branch 'i2c/for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux	2013-11-18 15:50:07 -08:00
ide	ide: pmac: remove unnecessary pci_set_drvdata()	2013-11-14 18:21:25 -05:00
idle	ACPI and power management updates for 3.13-rc1	2013-11-14 13:41:48 +09:00
iio	kfifo API type safety	2013-11-15 09:32:23 +09:00
infiniband	Main batch of InfiniBand/RDMA changes for 3.13:	2013-11-18 15:36:04 -08:00
input	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid	2013-11-15 16:48:22 -08:00
iommu	Don't try to compile shmobile-iommu outside of ARM	2013-11-15 18:57:42 -08:00
ipack	…
irqchip	Merge branch 'for-linus' of git://git.linaro.org/people/rmk/linux-arm	2013-11-14 08:51:29 +09:00
isdn	net: rework recvmsg handler msg_name and msg_namelen logic	2013-11-20 21:52:30 -05:00
leds	…
lguest	x86, asmlinkage, lguest: Pass in globals into assembler statement	2013-11-07 12:13:05 +10:30
macintosh	DeviceTree updates for 3.13. This is a bit larger pull request than	2013-11-12 16:52:17 +09:00
mailbox	…
md	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial	2013-11-15 16:47:22 -08:00
media	Merge branch 'i2c/for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux	2013-11-18 15:50:07 -08:00
memory	…
memstick	tree-wide: use reinit_completion instead of INIT_COMPLETION	2013-11-15 09:32:21 +09:00
message	drivers/message/i2o/driver.c: add missing destroy_workqueue() on error in i2o_driver_register()	2013-11-13 12:09:26 +09:00
mfd	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial	2013-11-15 16:47:22 -08:00
misc	Merge branch 'i2c/for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux	2013-11-18 15:50:07 -08:00
mmc	MMC highlights for 3.13:	2013-11-18 14:47:30 -08:00
mtd	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial	2013-11-15 16:47:22 -08:00
net	net: 8139cp: fix a BUG_ON triggered by wrong bytes_compl	2013-11-29 16:18:23 -05:00
nfc	…
ntb	…
nubus	…
of	Merge branch 'for-linus-dma-masks' of git://git.linaro.org/people/rmk/linux-arm	2013-11-14 07:55:21 +09:00
oprofile	…
parisc	…
parport	Kconfig cleanups for v3.13	2013-11-15 14:05:15 -08:00
pci	kfifo API type safety	2013-11-15 09:32:23 +09:00
pcmcia	DeviceTree updates for 3.13. This is a bit larger pull request than	2013-11-12 16:52:17 +09:00
phy	…
pinctrl	pinctrl: single: call pcs_soc->rearm() whenever IRQ mask is changed	2013-11-14 10:43:17 -08:00
platform	tree-wide: use reinit_completion instead of INIT_COMPLETION	2013-11-15 09:32:21 +09:00
pnp	ACPI and power management updates for 3.13-rc1	2013-11-14 13:41:48 +09:00
power	Highlights:	2013-11-18 15:35:09 -08:00
powercap	PowerCap: Fix build error with option -Werror=format-security	2013-11-05 02:36:57 +01:00
pps	drivers/pps/clients/pps-gpio.c: remove redundant of_match_ptr	2013-11-13 12:09:35 +09:00
ps3	…
ptp	…
pwm	pwm: samsung: Fix kernel warning while unexporting a channel	2013-11-01 11:17:57 +01:00
rapidio	…
regulator	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial	2013-11-15 16:47:22 -08:00
remoteproc	…
reset	…
rpmsg	…
rtc	tree-wide: use reinit_completion instead of INIT_COMPLETION	2013-11-15 09:32:21 +09:00
s390	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux	2013-11-19 11:43:21 -08:00
sbus	…
scsi	genetlink/pmcraid: use proper genetlink multicast API	2013-11-28 18:26:30 -05:00
sfi	…
sh	…
sn	…
spi	tree-wide: use reinit_completion instead of INIT_COMPLETION	2013-11-15 09:32:21 +09:00
ssb	…
staging	Merge branch 'topic/kbuild-fixes-for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media	2013-11-18 15:10:05 -08:00
target	…
tc	…
thermal	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2013-11-19 15:50:47 -08:00
tty	Features:	2013-11-15 13:34:37 +09:00
uio	drivers/uio/uio_pruss.c: use gen_pool_dma_alloc() to allocate sram memory	2013-11-13 12:09:23 +09:00
usb	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial	2013-11-15 16:47:22 -08:00
uwb	Driver Core / sysfs patches for 3.13-rc1	2013-11-07 11:42:15 +09:00
vfio	…
vhost	…
video	ARM: SoC fixes for 3.13 merge window	2013-11-16 12:45:55 -08:00
virt	…
virtio	Nothing really exciting: some groundwork for changing virtio endian, and	2013-11-15 13:28:47 +09:00
vlynq	…
vme	…
w1	drivers/w1/masters/w1-gpio.c: use dev_get_platdata()	2013-11-15 09:32:21 +09:00
watchdog	watchdog: w83627hf: Use helper functions to access superio registers	2013-11-18 21:34:19 +01:00
xen	Features:	2013-11-15 13:34:37 +09:00
zorro	…
Kconfig	ACPI and power management updates for 3.13-rc1	2013-11-14 13:41:48 +09:00
Makefile	ACPI and power management updates for 3.13-rc1	2013-11-14 13:41:48 +09:00