On Thu, 11 Oct 2007 16:48:27 -0700 (PDT) David Miller <[EMAIL PROTECTED]> wrote:
> From: TAKANO Ryousei <[EMAIL PROTECTED]> > Date: Thu, 11 Oct 2007 22:51:46 +0900 (JST) > > > Modules linked in: 8021q tcp_bic netconsole evdev joydev sg st sr_mod > > ohci_hcd i2c_amd756 i2c_amd8111 i2c_core ipv6 tg3 usbhid usbcore ff_memless > > dm_mod ext3 jbd sata_sil libata sd_mod scsi_mod > ... > > RIP points at __list_del (net_rx_action -> list_move_tail -> __list_del). > > There is a contract between the driver's ->poll() method and > net_rx_action() in that it is assumed that if the entire quota has > been used up, the driver will not perform a netif_rx_complete(). > > It seems that in a corner case the tg3 driver, which you appear to be > using, will not abide by this rule. That corner case is when the card > has exactly "budget" receive packets pending. In such a case > tg3_has_work() will be false, and we will RX complete when work_done > >= budget, which violates the above mentioned rule. > > Can you see if the following test patch makes the crash go away? > > Michael, I know you're not pleased with this patch and neither am > I. It might be better to just strictly RX complete when > (work < budget) and if tg3_has_work(), trigger a HW interrupt. > > Alternatively we could loop in tg3_poll() until either budget > is exhausted or tg3_has_work() returns false. Actually, this sounds > like a cleaner scheme the more I think about it. > > BNX2 likely has a similar issue. sky2 as well. -- Stephen Hemminger <[EMAIL PROTECTED]> - To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html
