[ovs-dev] [XCP] OVS-1.4.2 BUG: unable to handle kernel NULL pointer dereference

[frankpaulharms at gmail.com]

I've updated OVS on XCP-1.1 to OVS-1.4.2.
I notice random kernel crashes.

Questions:
- Is that simply a bug of 1.4.2 or is there a version limit regarding the xcp kernel (e.g. not higher than 1.0.2)?
- Which ovs version is recommended if someone likes to upgrade?


Crash log:
<1>BUG: unable to handle kernel NULL pointer dereference at 00000076
<1>IP: [<f0f16d69>] queue_userspace_packet+0x19/0x310 [openvswitch_mod]
<4>*pdpt = 00000004ef736027 *pde = 0000000000000000
<0>Oops: 0000 [#1] SMP
<0>last sysfs file: /sys/devices/platform/host2/session1/target2:0:0/2:0:0:2/timeout
<4>Modules linked in: tun nfs nfs_acl auth_rpcgss dm_round_robin scsi_dh_rdac dm_multipath scsi_dh iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi i2c_dev i2c_core lockd sunrpc ixgbe 8021q openvswitch_mod ipt_REJECT nf_connt
rack_ipv4 nf_defrag_ipv4 xt_state nf_conntrack xt_tcpudp iptable_filter ip_tables x_tables binfmt_misc dm_mirror video output sbs sbshc fan battery ac parport_pc lp parport nvram sg usbhid container sr_mod cdrom evdev e1000e thermal bnx2
 button processor thermal_sys hpilo piix tpm_tis 8250_pnp tpm serio_raw 8250 pata_acpi serial_core tpm_bios ata_piix ata_generic libata i5k_amb rtc_cmos hwmon rtc_core pcspkr rtc_lib dm_region_hash dm_log dm_mod ide_gd_mod hpsa cciss sd_
mod scsi_mod ext3 jbd uhci_hcd ohci_hcd ehci_hcd usbcore fbcon font tileblit bitblit softcursor [last unloaded: ixgbe]
<4>
<4>Pid: 1273, comm: netback/0 Not tainted (2.6.32.12-0.7.1.xs1.1.0.327.170596xen #1) ProLiant DL380 G5
<4>EIP: 0061:[<f0f16d69>] EFLAGS: 00010282 CPU: 0
<4>EIP is at queue_userspace_packet+0x19/0x310 [openvswitch_mod]
<4>EAX: 0000000c EBX: ed015c54 ECX: ed015c54 EDX: ffffffea
<4>ESI: ffffffea EDI: ffffffea EBP: ed015b44 ESP: ed015b08 
<4> DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0069
<0>Process netback/0 (pid: 1273, ti=ed014000 task=eea82030 task.ti=ed014000)
<0>Stack:
<4> 00000040 ed5b8810 ed015c54 ffffffea 0000000c 00000000 ea595380 00000008
<4><0> ea595380 00000009 ed015b44 f0f20b13 ed015c54 ffffffea ffffffea ed015bdc
<4><0> f0f17155 eacb4000 0000000c ea595380 ed015bdc c033cf77 f72e15f5 e94731fc
<0>Call Trace:
<4> [<f0f20b13>] ? rpl_skb_gso_segment+0x53/0x80 [openvswitch_mod]
<4> [<f0f17155>] ? ovs_dp_upcall+0xf5/0x180 [openvswitch_mod]
<4> [<c033cf77>] ? tcp_write_xmit+0x47/0x900
<4> [<f0f204dc>] ? flex_array_get+0x4c/0x70 [openvswitch_mod]
<4> [<f0f19174>] ? find_bucket+0x14/0x20 [openvswitch_mod]
<4> [<f0f191e7>] ? ovs_flow_tbl_lookup+0x27/0x80 [openvswitch_mod]
<4> [<f0f172c4>] ? ovs_dp_process_received_packet+0xe4/0xf0 [openvswitch_mod]
<4> [<f0f1dd60>] ? ovs_vport_receive+0x70/0x80 [openvswitch_mod]
<4> [<f0f1f96d>] ? netdev_frame_hook+0x3d/0x80 [openvswitch_mod]
<4> [<c030240f>] ? netif_receive_skb+0x1af/0x660
<4> [<c0325dca>] ? ip_local_deliver_finish+0x9a/0x1f0
<4> [<c0325d30>] ? ip_local_deliver_finish+0x0/0x1f0
<4> [<c03058b2>] ? process_backlog+0x92/0xe0
<4> [<c0305629>] ? net_rx_action+0x159/0x230
<4> [<c013117a>] ? __do_softirq+0xba/0x180
<4> [<c01312b5>] ? do_softirq+0x75/0x80
<4> [<c0302e5a>] ? netif_rx_ni+0x1a/0x20
<4> [<c02acd12>] ? net_tx_action+0xe92/0x1520
<4> [<c0106a51>] ? local_clock+0x41/0x80
<4> [<c037d4c9>] ? schedule+0x2e9/0x970
<4> [<c02ad43f>] ? netbk_action_thread+0x7f/0x160
<4> [<c0140700>] ? autoremove_wake_function+0x0/0x50
<4> [<c02ad3c0>] ? netbk_action_thread+0x0/0x160
<4> [<c0140444>] ? kthread+0x74/0x80
<4> [<c01403d0>] ? kthread+0x0/0x80
<4> [<c010480b>] ? kernel_thread_helper+0x7/0x10
<0>Code: 00 00 55 83 e8 10 89 e5 e8 f5 5b 27 cf 5d c3 8d 76 00 55 89 e5 57 56 53 83 ec 30 89 45 d4 89 55 d0 89 4d cc c7 45 d8 00 00 00 00 <66> 83 ba 8c 00 00 00 00 0f 85 e7 01 00 00 8b 75 d0 bb e5 ff ff
<0>EIP: [<f0f16d69>] queue_userspace_packet+0x19/0x310 [openvswitch_mod] SS:ESP 0069:ed015b08
<0>CR2: 0000000000000076