[ovs-dev] 答复: [bug] ovs crash when call xlate_normal_flood

Linhaifeng haifeng.lin at huawei.com
Thu Jun 21 05:55:39 UTC 2018


Or stop upcall thread before xlate_remove_ofproto in destruct.

发件人: Linhaifeng
发送时间: 2018年6月21日 13:49
收件人: 'dev at openvswitch.org' <dev at openvswitch.org>
主题: [bug] ovs crash when call xlate_normal_flood

Should we use rwlock to use xbridge->xbundles? xbridge->xbundles may write in main thread and read in upcall thread.

The crash stack as follow:
#5  0x00000000004a04e8 in xlate_normal_flood (ctx=ctx at entry=0x7faeee7b6f30, in_xbundle=in_xbundle at entry=0x553d950, vlan=vlan at entry=0) at ofproto/ofproto_dpif_xlate.c:2509
2509       in ofproto/ofproto_dpif_xlate.c
(gdb) info locals
xbundle = 0xffffffffffffffe8
(gdb) p xbundle->ofbundle
Cannot access memory at address 0xfffffffffffffff8
(gdb) p in_xbundle->ofbundle
$5 = (struct ofbundle *) 0x0
(gdb) p in_xbundle
$6 = (struct xbundle *) 0x553d950
(gdb) p *in_xbundle
$7 = {hmap_node = {hash = 0, next = 0x0}, ofbundle = 0x0, list_node = {prev = 0x0, next = 0x0}, xbridge = 0x0, xports = {prev = 0x0, next = 0x0}, name = 0x0, bond = 0x0, lacp = 0x0, vlan_mode = PORT_VLAN_ACCESS, vlan = 0,
  trunks = 0x0, use_priority_tags = false, floodable = false, protected = false, external_id = 0}

(gdb) bt
#0  0x00007fb05ea85197 in raise () from /usr/lib64/libc.so.6
#1  0x00007fb05ea86888 in abort () from /usr/lib64/libc.so.6
#2  0x000000000065e1e9 in PAT_abort ()
#3  0x000000000065b32d in patchIllInsHandler ()
#4  <signal handler called>
#5  0x00000000004a04e8 in xlate_normal_flood (ctx=ctx at entry=0x7faeee7b6f30, in_xbundle=in_xbundle at entry=0x553d950, vlan=vlan at entry=0) at ofproto/ofproto_dpif_xlate.c:2509
#6  0x00000000004a0e6e in xlate_normal (ctx=0x7faeee7b6f30) at ofproto/ofproto_dpif_xlate.c:2736
#7  xlate_output_action (ctx=ctx at entry=0x7faeee7b6f30, port=<optimized out>, max_len=<optimized out>, may_packet_in=may_packet_in at entry=true) at ofproto/ofproto_dpif_xlate.c:4312
#8  0x000000000049d240 in do_xlate_actions (ofpacts=<optimized out>, ofpacts_len=<optimized out>, ctx=ctx at entry=0x7faeee7b6f30) at ofproto/ofproto_dpif_xlate.c:5262
#9  0x000000000049e410 in xlate_recursively (deepens=true, rule=0x6a4be00, ctx=0x7faeee7b6f30) at ofproto/ofproto_dpif_xlate.c:3587
#10 xlate_table_action (ctx=0x7faeee7b6f30, in_port=<optimized out>, table_id=<optimized out>, may_packet_in=<optimized out>, honor_table_miss=<optimized out>) at ofproto/ofproto_dpif_xlate.c:3654
#11 0x000000000049faf7 in compose_output_action__ (ctx=ctx at entry=0x7faeee7b6f30, ofp_port=<optimized out>, xr=<optimized out>, check_stp=check_stp at entry=true) at ofproto/ofproto_dpif_xlate.c:3317
#12 0x00000000004a0126 in compose_output_action (xr=<optimized out>, ofp_port=<optimized out>, ctx=0x7faeee7b6f30) at ofproto/ofproto_dpif_xlate.c:3567
#13 output_normal (ctx=ctx at entry=0x7faeee7b6f30, out_xbundle=out_xbundle at entry=0x3005770, vlan=vlan at entry=0) at ofproto/ofproto_dpif_xlate.c:2113
#14 0x00000000004a0511 in xlate_normal_flood (ctx=ctx at entry=0x7faeee7b6f30, in_xbundle=in_xbundle at entry=0x3008a40, vlan=vlan at entry=0) at ofproto/ofproto_dpif_xlate.c:2517
#15 0x00000000004a0e6e in xlate_normal (ctx=0x7faeee7b6f30) at ofproto/ofproto_dpif_xlate.c:2736
#16 xlate_output_action (ctx=ctx at entry=0x7faeee7b6f30, port=<optimized out>, max_len=<optimized out>, may_packet_in=may_packet_in at entry=true) at ofproto/ofproto_dpif_xlate.c:4312
#17 0x000000000049d240 in do_xlate_actions (ofpacts=<optimized out>, ofpacts_len=<optimized out>, ctx=ctx at entry=0x7faeee7b6f30) at ofproto/ofproto_dpif_xlate.c:5262
#18 0x000000000049e410 in xlate_recursively (deepens=true, rule=0x6a32500, ctx=0x7faeee7b6f30) at ofproto/ofproto_dpif_xlate.c:3587
#19 xlate_table_action (ctx=0x7faeee7b6f30, in_port=<optimized out>, table_id=<optimized out>, may_packet_in=<optimized out>, honor_table_miss=<optimized out>) at ofproto/ofproto_dpif_xlate.c:3654
#20 0x000000000049faf7 in compose_output_action__ (ctx=ctx at entry=0x7faeee7b6f30, ofp_port=<optimized out>, xr=<optimized out>, check_stp=check_stp at entry=true) at ofproto/ofproto_dpif_xlate.c:3317
#21 0x00000000004a0126 in compose_output_action (xr=<optimized out>, ofp_port=<optimized out>, ctx=0x7faeee7b6f30) at ofproto/ofproto_dpif_xlate.c:3567
#22 output_normal (ctx=ctx at entry=0x7faeee7b6f30, out_xbundle=out_xbundle at entry=0x93e3e10, vlan=vlan at entry=0) at ofproto/ofproto_dpif_xlate.c:2113
#23 0x00000000004a0511 in xlate_normal_flood (ctx=ctx at entry=0x7faeee7b6f30, in_xbundle=in_xbundle at entry=0x894de90, vlan=vlan at entry=0) at ofproto/ofproto_dpif_xlate.c:2517
#24 0x00000000004a0e6e in xlate_normal (ctx=0x7faeee7b6f30) at ofproto/ofproto_dpif_xlate.c:2736
#25 xlate_output_action (ctx=ctx at entry=0x7faeee7b6f30, port=<optimized out>, max_len=<optimized out>, may_packet_in=may_packet_in at entry=true) at ofproto/ofproto_dpif_xlate.c:4312
#26 0x000000000049d240 in do_xlate_actions (ofpacts=<optimized out>, ofpacts_len=<optimized out>, ctx=ctx at entry=0x7faeee7b6f30) at ofproto/ofproto_dpif_xlate.c:5262
#27 0x00000000004a27df in xlate_actions (xin=xin at entry=0x7faeee7b8550, xout=xout at entry=0x7faeee7dd320) at ofproto/ofproto_dpif_xlate.c:6119
#28 0x00000000004959bb in upcall_xlate (wc=0x7faeee7dd378, odp_actions=0x7faeee7dd338, upcall=0x7faeee7dd2c0, udpif=0x1807190) at ofproto/ofproto_dpif_upcall.c:1185
#29 process_upcall (udpif=udpif at entry=0x1807190, upcall=upcall at entry=0x7faeee7dd2c0, odp_actions=odp_actions at entry=0x7faeee7dd338, wc=wc at entry=0x7faeee7dd378) at ofproto/ofproto_dpif_upcall.c:1322
#30 0x000000000049716c in recv_upcalls (handler=0x64775d0, handler=0x64775d0) at ofproto/ofproto_dpif_upcall.c:863
#31 0x000000000049764a in udpif_upcall_handler (arg=0x64775d0) at ofproto/ofproto_dpif_upcall.c:783
#32 0x00000000005388f8 in ovsthread_wrapper (aux_=<optimized out>) at lib/ovs_thread.c:682
#33 0x00007fb0601a8dc5 in start_thread () from /usr/lib64/libpthread.so.0
#34 0x00007fb05eb477bd in clone () from /usr/lib64/libc.so.6



More information about the dev mailing list