2.6.19 panic on boot -- i386

[Pete Clements]

2.6.19 panics at boot. Good up through rc6-git11.
Hand copied screen below.
--
Pete Clements

Call Trace:
[<f894cda0>] ndisc_send_rs+0x420/0x460 [ipv6]
[<f894cdac>] ndisc_send_rs+0x42c/0x460 [ipv6]
[<f894cda0>] ndisc_send rs+0x420/0x460 [ipv6]
[<f8940ac3>] addrconf_dad_completed+0x93/0xe0 [ipv6]
[<f89437e9>] addrconf_dad_timer+0x119/0x120 [ipv6]
[<c0115e31>] rebalance_tick+0x131/0x350
[<f89436d0>] addrconf_dad_timer+0x0/0x120 [ipv6]
[<c01255f3>] run_timer_softirq+0x113/0x190
[<c01209e5>] __do_softirq+0x75/0xf0
[<c0120a9b>] do_softirq+03b/0x50
[<c010ea05>] smp_apic_timer_interrupt+0xa5/0xc0
[<c0103ba7>] apic_timer_interrupt+0x1f/0x24
[<c0101d20>] default_idle+0x0/0x60
[<c0101d51>] default_idle+031/0x60
[<c0101dec>] cpu_idle+0x6c/0x90
[<c03d386e>] start_kernel+0x34e/0x3d0
[<c03d3290>] unknown_bootoption+0x0/0x290
========================
Code: 8c 00 00 00 89 44 24 10 8b 44 24 2c 89 44 24 0c 8b 41 60 c7 04 24 e4 ac 36
c0 89 44 24 08 8b 44 24 30 89 44 24 04 e8 9d 51 e6 ff <0f> 0b 5d 00 1a 84 36 c0
83 c4 24 c3 90 55 57 56 53 83 ec 2c 8b
EIP: [<c02b7283>] skb_over_panic+0x63/0x70 SS:ESP 0068:c03cfe08
<0>Kernel panic - not syncing: Fatal exception in interrupt
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majo...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

[David Miller]

From: Pete Clements <cl...@clem.clem-digital.net>
Date: Wed, 29 Nov 2006 22:13:09 -0500 (EST)

> 2.6.19 panics at boot. Good up through rc6-git11.
> Hand copied screen below.

Here is the fix, which was posted in response to a seperate
report of this problem here:

commit c28728decc37fe52c8cdf48b3e0c0cf9b0c2fefb
Author: David S. Miller <da...@sunset.davemloft.net>
Date: Wed Nov 29 18:14:47 2006 -0800

[IPV6] NDISC: Calculate packet length correctly for allocation.

MAX_HEADER does not include the ipv6 header length in it,
so we need to add it in explicitly.

Signed-off-by: David S. Miller <da...@davemloft.net>

diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 73eb8c3..c42d4c2 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -441,7 +441,8 @@ static void ndisc_send_na(struct net_dev
struct sk_buff *skb;
int err;

- len = sizeof(struct icmp6hdr) + sizeof(struct in6_addr);
+ len = sizeof(struct ipv6hdr) + sizeof(struct icmp6hdr) +
+ sizeof(struct in6_addr);

/* for anycast or proxy, solicited_addr != src_addr */
ifp = ipv6_get_ifaddr(solicited_addr, dev, 1);
@@ -556,7 +557,8 @@ void ndisc_send_ns(struct net_device *de
if (err < 0)
return;

- len = sizeof(struct icmp6hdr) + sizeof(struct in6_addr);
+ len = sizeof(struct ipv6hdr) + sizeof(struct icmp6hdr) +
+ sizeof(struct in6_addr);
send_llinfo = dev->addr_len && !ipv6_addr_any(saddr);
if (send_llinfo)
len += ndisc_opt_addr_space(dev);
@@ -632,7 +634,7 @@ void ndisc_send_rs(struct net_device *de
if (err < 0)
return;

- len = sizeof(struct icmp6hdr);
+ len = sizeof(struct ipv6hdr) + sizeof(struct icmp6hdr);
if (dev->addr_len)
len += ndisc_opt_addr_space(dev);

@@ -1381,7 +1383,8 @@ void ndisc_send_redirect(struct sk_buff
struct in6_addr *target)
{
struct sock *sk = ndisc_socket->sk;
- int len = sizeof(struct icmp6hdr) + 2 * sizeof(struct in6_addr);
+ int len = sizeof(struct ipv6hdr) + sizeof(struct icmp6hdr) +
+ 2 * sizeof(struct in6_addr);
struct sk_buff *buff;
struct icmp6hdr *icmph;
struct in6_addr saddr_buf;

[Chris Wright]

* David Miller (da...@davemloft.net) wrote:
> Check sta...@kernel.org's inbox, I just sent it in :)

Ooh, nice timing!

thanks,
-chris