Bug 8452

Summary:	e1000 network module may cause kernel oopses and panic on rmmod
Product:	Drivers	Reporter:	Artem S. Tashkinov (aros)
Component:	Network	Assignee:	Jeff Garzik (jgarzik)
Status:	RESOLVED CODE_FIX
Severity:	high	CC:	auke-jan.h.kok, jbrandeb, protasnb
Priority:	P2
Hardware:	i386
OS:	Linux
Kernel Version:	2.6.20.7	Subsystem:
Regression:	---	Bisected commit-id:
Attachments:	.config dmesg

Description Artem S. Tashkinov 2007-05-08 04:58:34 UTC

Most recent kernel where this bug did *NOT* occur: not known
Distribution: FC6

Hardware Environment: 
2 x Intel(R) Xeon(TM) CPU 3.00GHz HT (cpu family : 15, model : 4, stepping : 3)
2 x 1GB ECC DDR RAM
Intel Xeon Motherboard

00:00.0 Host bridge: Intel Corporation E7520 Memory Controller Hub (rev 0c)
00:00.1 Class ff00: Intel Corporation E7525/E7520 Error Reporting Registers (rev 0c)
00:01.0 System peripheral: Intel Corporation E7520 DMA Controller (rev 0c)
00:02.0 PCI bridge: Intel Corporation E7525/E7520/E7320 PCI Express Port A (rev 0c)
00:04.0 PCI bridge: Intel Corporation E7525/E7520 PCI Express Port B (rev 0c)
00:05.0 PCI bridge: Intel Corporation E7520 PCI Express Port B1 (rev 0c)
00:06.0 PCI bridge: Intel Corporation E7520 PCI Express Port C (rev 0c)
00:1d.0 USB Controller: Intel Corporation 82801EB/ER (ICH5/ICH5R) USB UHCI
Controller #1 (rev 02)
00:1d.1 USB Controller: Intel Corporation 82801EB/ER (ICH5/ICH5R) USB UHCI
Controller #2 (rev 02)
00:1d.2 USB Controller: Intel Corporation 82801EB/ER (ICH5/ICH5R) USB UHCI
Controller #3 (rev 02)
00:1d.7 USB Controller: Intel Corporation 82801EB/ER (ICH5/ICH5R) USB2 EHCI
Controller (rev 02)
00:1e.0 PCI bridge: Intel Corporation 82801 PCI Bridge (rev c2)
00:1f.0 ISA bridge: Intel Corporation 82801EB/ER (ICH5/ICH5R) LPC Interface
Bridge (rev 02)
00:1f.1 IDE interface: Intel Corporation 82801EB/ER (ICH5/ICH5R) IDE Controller
(rev 02)
00:1f.2 IDE interface: Intel Corporation 82801EB (ICH5) SATA Controller (rev 02)
00:1f.3 SMBus: Intel Corporation 82801EB/ER (ICH5/ICH5R) SMBus Controller (rev 02)
01:00.0 PCI bridge: Intel Corporation 6700PXH PCI Express-to-PCI Bridge A (rev 09)
01:00.1 PIC: Intel Corporation 6700/6702PXH I/OxAPIC Interrupt Controller A (rev 09)
01:00.2 PCI bridge: Intel Corporation 6700PXH PCI Express-to-PCI Bridge B (rev 09)
01:00.3 PIC: Intel Corporation 6700PXH I/OxAPIC Interrupt Controller B (rev 09)
02:03.0 Communication controller: Digium, Inc. Wildcard TE210P (rev 02)
05:00.0 Ethernet controller: Marvell Technology Group Ltd. 88E8050 PCI-E ASF
Gigabit Ethernet Controller (rev 18)
07:04.0 Ethernet controller: Intel Corporation 82541GI/PI Gigabit Ethernet
Controller (rev 05)
07:0c.0 VGA compatible controller: ATI Technologies Inc Rage XL (rev 27)

Software Environment: Kernel 2.6.20.7
Problem Description:

2. rmmod'ing e1000 module may cause kernel oops or/and panic. Here's how it
happened the last time:

May  8 17:30:36 localhost kernel: Modules linked in: sky2 8021q
cpufreq_powersave cpufreq_ondemand p4_clockmod speedstep_lib nf_
nat_ftp nf_conntrack_ftp ipt_owner ipt_ULOG ipt_LOG xt_limit ipt_REJECT
xt_tcpudp xt_multiport iptable_filter ipt_MASQUERADE xt_
state iptable_nat nf_nat nf_conntrack_ipv4 nf_conntrack nfnetlink ip_tables
x_tables video thermal processor fan button battery
ac parport_pc parport cdc_acm ehci_hcd uhci_hcd e1000 psmouse pcspkr i2c_i801
dm_snapshot dm_zero dm_mirror
May  8 17:30:36 localhost kernel: CPU:    1
May  8 17:30:36 localhost kernel: EIP:    0060:[<c0184ef2>]    Not tainted VLI
May  8 17:30:36 localhost kernel: EFLAGS: 00010246   (2.6.20.7 #1)
May  8 17:30:36 localhost kernel: EIP is at remove_proc_entry+0x22/0x1a3
May  8 17:30:36 localhost kernel: eax: 00000000   ebx: f730a8e0   ecx: ffffffff
  edx: f7904240
May  8 17:30:36 localhost kernel: esi: 00000010   edi: 00000000   ebp: f7905000
  esp: cf8e7e4c
May  8 17:30:36 localhost kernel: ds: 007b   es: 007b   ss: 0068
May  8 17:30:36 localhost kernel: Process ip (pid: 16503, ti=cf8e6000
task=f63f1000 task.ti=cf8e6000)
May  8 17:30:36 localhost kernel: Stack: daaf2000 00000286 00000286 ebef6980
f7904240 00000000 f730a8e0 00000010
May  8 17:30:36 localhost kernel:        c03a3e00 f7905000 c013830c 00001000
00000c00 f7905400 00000000 c03a3e28
May  8 17:30:36 localhost kernel:        00000202 f7905400 f7905000 00001003
00000000 f887c552 cf8e7ea4 cf8e7ea4
May  8 17:30:36 localhost kernel: Call Trace:
May  8 17:30:36 localhost kernel:  [<c013830c>] free_irq+0x7f/0x106
May  8 17:30:36 localhost kernel:  [<f887c552>] e1000_close+0x2c/0xc0 [e1000]
May  8 17:30:36 localhost kernel:  [<c02afa54>] dev_deactivate+0x72/0xa5
May  8 17:30:36 localhost kernel:  [<c02a5d59>] dev_close+0x51/0x6a
May  8 17:30:36 localhost kernel:  [<c02a5217>] dev_change_flags+0x47/0xf5
May  8 17:30:36 localhost kernel:  [<c02dd8d2>] devinet_ioctl+0x536/0x6a7
May  8 17:30:36 localhost kernel:  [<c02a6434>] dev_ifsioc+0xcb/0x300
May  8 17:30:36 localhost kernel:  [<c02a5fb8>] dev_load+0x24/0x4e
May  8 17:30:36 localhost kernel:  [<c029ba95>] sock_ioctl+0x40/0x1c0
May  8 17:30:36 localhost kernel:  [<c029ba55>] sock_ioctl+0x0/0x1c0
May  8 17:30:36 localhost kernel:  [<c016134f>] do_ioctl+0x1f/0x6d
May  8 17:30:36 localhost kernel:  [<c01613ed>] vfs_ioctl+0x50/0x273
May  8 17:30:36 localhost kernel:  [<c0161644>] sys_ioctl+0x34/0x50
May  8 17:30:36 localhost kernel:  [<c0102d16>] sysenter_past_esp+0x5f/0x85
May  8 17:30:36 localhost kernel:  =======================
May  8 17:30:36 localhost kernel: Code: d8 83 c4 04 5b 5e 5f 5d c3 55 57 56 53
83 ec 18 89 54 24 10 89 44 24 14 85 d2 0f 84 38 0
1 00 00 8b 7c 24 14 31 c0 b9 ff ff ff ff <f2> ae f7 d1 49 89 cd b8 c0 7e 38 c0
e8 c5 88 16 00 8b 5c 24 10

Steps to reproduce: rmmod e1000

Comment 1 Artem S. Tashkinov 2007-05-08 05:01:45 UTC

May  8 17:30:36 localhost kernel: BUG: unable to handle kernel NULL pointer
dereference at virtual address 00000000
May  8 17:30:36 localhost kernel:  printing eip:
May  8 17:30:36 localhost kernel: c0184ef2
May  8 17:30:36 localhost kernel: *pde = 00000000
May  8 17:30:36 localhost kernel: Oops: 0000 [#1]
May  8 17:30:36 localhost kernel: PREEMPT SMP

Comment 2 Jesse Brandeburg 2007-05-17 20:40:37 UTC

please attach .config.  We have this hardware, but may need more details to 
reproduce.  full dmesg would be useful.

Comment 3 Artem S. Tashkinov 2007-05-30 00:41:08 UTC

Created attachment 11615 [details]
.config

Comment 4 Artem S. Tashkinov 2007-05-30 00:42:20 UTC

Created attachment 11616 [details]
dmesg

It's a usual dmesg

Comment 5 Natalie Protasevich 2007-07-20 00:54:21 UTC

Any updates, is the bug still in 2.6.22+?
Thanks.

Comment 6 Auke Kok 2007-07-20 09:18:52 UTC

To my knowledge this is fixed in 2.6.22.

Comment 7 Artem S. Tashkinov 2007-07-20 10:20:30 UTC

I no longer observe this bug, let's close until I discover something new.