* Andrew Nelless <andrew@nelless.net> wrote:

> Hi,
>
> I booted up 2.6.24-rc1 this morning [Real early over a brew ;-)] and
> was having a problems with multiple ~5 second hangs on SATA/drive init
> (Something to do with "EH" something-or-other and resets but I'll
> email in separately about it later unless its fixed by the time I get
> the chance).
>
> Anyway, I went to fire up netconsole to get a decent log dump and hit
> across the following nasty. Netconsole works fine in 2.6.23.1 with a
> similar config and the same kernel parameters.
>
> A shot of the screen is the only method I could come up with to
> capture the log, I hope that is OK, it is pretty readable.
>
>
> The nasty:
> http://andotnet.nfshost.com/linux/2.6.24-rc1-netconsole-nullderef.jpg

the NULL dereference is here:

 (gdb) list *0xffffffff804a9504
 0xffffffff804a9504 is in natsemi_poll (drivers/net/natsemi.c:717).
 712             return count;
 713     }
 714
 715     static inline void __iomem *ns_ioaddr(struct net_device *dev)
 716     {
 717             return (void __iomem *) dev->base_addr;
 718     }
 719

which is this code from natsemi.c:

 2227            struct net_device *dev = np->dev;
 2228            void __iomem * ioaddr = ns_ioaddr(dev);
 2229            int work_done = 0;

seems like the NAPI changes in -rc1 added an np->dev field but forgot to
initialize it ...

does the patch below fix the oops for you?

	Ingo

-------------------->
Subject: natsemi: fix oops, link back netdevice from private-struct
From: Ingo Molnar <mingo@elte.hu>

this commit:

  commit bea3348e
  Author: Stephen Hemminger <shemminger@linux-foundation.org>
  Date:   Wed Oct 3 16:41:36 2007 -0700

      [NET]: Make NAPI polling independent of struct net_device objects.

added np->dev to drivers/net/natsemi.c's struct netdev_private, but
forgot to initialize that new field upon driver init. The result was
a predictable NULL dereference oops the first time the hardware
generated an interrupt.
Reported-by: Andrew Nelless <andrew@nelless.net>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

napi_disable / napi_enable must be applied on all ehea queues.
Signed-off-by: Jan-Bernd Themann <themann@de.ibm.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

This patch fixes a cut'n'paste error in
commit 1b76b316.
Signed-off-by: Adrian Bunk <bunk@kernel.org>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

bond_deinit() can now become static.
Signed-off-by: Adrian Bunk <bunk@kernel.org>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

This patch contains the following cleanups:
- make ipg_nic_get_stats() static
- move DefaultPhyParam[] from ipg.h to ipg.c and make it static
Signed-off-by: Adrian Bunk <bunk@kernel.org>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

According to git, the only one who touched this file during the last
5 years was me when removing drivers...

modinfo offers less ancient information.
Signed-off-by: Adrian Bunk <bunk@kernel.org>
Acked-by: Geert Uytterhoeven <geert@linux-m68k.org>
Acked-by: Paul Gortmaker <paul.gortmaker@gmail.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

The patch is big.  Really big.  You just won't believe how vastly hugely
mindbogglingly big it is.  I mean you may think it's a long way down the
road to the chemist, but that's just peanuts to how big the patch from
2.6.23 is.

But it's all good.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Add a port type definition for the Freescale UART driver ports (mcf.c).
Signed-off-by: Greg Ungerer <gerg@uclinux.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Remove old definitions of the timer function pointers.
Add definitions of the common hardware timer functions.
Signed-off-by: Greg Ungerer <gerg@uclinux.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Create definition for DMA channels on the ColdFire 532x family.
Signed-off-by: Greg Ungerer <gerg@uclinux.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Add platform support structure for use with new ColdFire UART driver.
Signed-off-by: Greg Ungerer <gerg@uclinux.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Mark the m68knommu memory init functions as __init.
Signed-off-by: Greg Ungerer <gerg@uclinux.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Mark the m68knommu setup_arch() function as __init.
Signed-off-by: Greg Ungerer <gerg@uclinux.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Removed header includes not needed.
Remove use of old m68knommu timer function pointers.
Signed-off-by: Greg Ungerer <gerg@uclinux.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Clean up 68EZ328 timer support code. Removed header includes not needed.
Remove use of old m68knommu timer function pointers.
Signed-off-by: Greg Ungerer <gerg@uclinux.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Clean up 68360 timer support code. Removed header includes not needed.
Remove use of old m68knommu timer function pointers. Use common function
naming for 68328 timer functions.
Signed-off-by: Greg Ungerer <gerg@uclinux.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Use common function naming for 68328 timer functions to make them
consistent with the various other hardware m68knommu timers.
Signed-off-by: Greg Ungerer <gerg@uclinux.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Clean up 68328 timer support code. Removed header includes not needed.
Remove use of old m68knommu timer function pointers.
Signed-off-by: Greg Ungerer <gerg@uclinux.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Remove unused variables from setup.c code.
Signed-off-by: Greg Ungerer <gerg@uclinux.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

* 'irq-upstream' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/misc-2.6:
  [SPARC, XEN, NET/CXGB3] use irq_handler_t where appropriate
  drivers/char/riscom8: clean up irq handling
  isdn/sc: irq handler clean
  isdn/act2000: fix major bug. clean irq handler.
  char/pcmcia/synclink_cs: trim trailing whitespace
  drivers/char/ip2: separate polling and irq-driven work entry points
  drivers/char/ip2: split out irq core logic into separate function
  [NETDRVR] lib82596, netxen: delete pointless tests from irq handler
  Eliminate pointless casts from void* in a few driver irq handlers.
  [PARPORT] Remove unused 'irq' argument from parport irq functions
  [PARPORT] Kill useful 'irq' arg from parport_{generic_irq,ieee1284_interrupt}
  [PARPORT] Consolidate code copies into a single generic irq handler

* 'warnings' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/misc-2.6:
  ni5010: kill unused variable
  eexpress: fix !SMP unused-var warning
  cgroup: kill unused variable

* 'upstream-linus' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/netdev-2.6: (39 commits)
  Remove Andrew Morton from list of net driver maintainers.
  bonding: Acquire correct locks in alb for promisc change
  bonding: Convert more locks to _bh, acquire rtnl, for new locking
  bonding: Convert locks to _bh, rework alb locking for new locking
  bonding: Convert miimon to new locking
  bonding: Convert balance-rr transmit to new locking
  Convert bonding timers to workqueues
  Update MAINTAINERS to reflect my (jgarzik's) current efforts.
  pasemi_mac: fix typo
  defxx.c: dfx_bus_init() is __devexit not __devinit
  s390 MAINTAINERS
  remove header_ops bug in qeth driver
  sky2: crash on remove
  MIPSnet: Delete all the useless debugging printks.
  AR7 ethernet: small post-merge cleanups and fixes
  mv643xx_eth: Hook up mv643xx_get_sset_count
  mv643xx_eth: Remove obsolete checksum offload comment
  mv643xx_eth: Merge drivers/net/mv643xx_eth.h into mv643xx_eth.c
  mv643xx_eth: Remove unused register defines
  mv643xx_eth: Clean up mv643xx_eth.h
  ...

* 'upstream-linus' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/libata-dev:
  jmicron: update quirk for JMB361/3/5/6
  libata: add HTS542525K9SA00 to NCQ blacklist
  libata-core: auditting chk_status v check_status
  [libata] checkpatch-inspired cleanups

Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

Set bits 0, 4, 5 and 7 of PCI configuration register 0x40 in the
quirk.  This has the following effects and is recommended by the
vendor.

* Force enable of IDE channels (used to be left alone as BIOS
  configured)

* Change initial phase behavior of PIO cycle such that the host pulls
  down the bus instead of tristating it.  Vendor recommends this
  setting.

The above settings are better for the current generation of
controllers and needed for the upcoming next generation.

Tested on JMB363.
Signed-off-by: Tejun Heo <htejun@gmail.com>
Cc: Ethan Hsiao <ethanhsiao@jmicron.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

Another one doing spurious NCQ completions.  Blacklist it.
Signed-off-by: Tejun Heo <htejun@gmail.com>
Cc: Luca Tettamanti <kronos.it@gmail.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

Did a complete audit of these and found we have another error case.

ata_bus_softreset calls ata_check_status which means that it tries to do
an ioread8 on the port blindly and check versus 0xFF for an error.

It should of course be using the ap->ops method for this via chk_status,
and this bug causes a wrog status call on the NS87415 at least.
Signed-off-by: Alan Cox <alan@redhat.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

Tackle the relatively sane complaints of checkpatch --file.

The vast majority is indentation and whitespace changes, the rest are

* #include fixes
* printk KERN_xxx prefix addition
* BSS/initializer cleanups
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

He now rules the world, not just this tiny tract of land.
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
Acked-by: Andrew Morton

	Update ALB mode monitor to hold correct locks (RTNL and nothing
else) when calling dev_set_promiscuity.
Signed-off-by: Andy Gospodarek <andy@greyhouse.net>
Signed-off-by: Jay Vosburgh <fubar@us.ibm.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

	Convert more lock acquisitions to _bh flavor to avoid deadlock
with workqueue activity and add acquisition of RTNL in appropriate places.
Affects ALB mode, as well as core bonding functions and sysfs.
Signed-off-by: Andy Gospodarek <andy@greyhouse.net>
Signed-off-by: Jay Vosburgh <fubar@us.ibm.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

	Convert locking-related activity to new & improved system.
Convert some lock acquisitions to _bh and rework parts of ALB mode, both
to avoid deadlocks with workqueue activity.
Signed-off-by: Andy Gospodarek <andy@greyhouse.net>
Signed-off-by: Jay Vosburgh <fubar@us.ibm.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

	Convert mii (link state) monitor to acquire correct locks for
failover events.  In particular, failovers generally require RTNL at a low
level (when manipulating device MAC addresses, for example) and no other
locks.  The high level monitor is responsible for acquiring a known set
of locks, RTNL, the bond->lock for read and the slave_lock for write, and
the low level failover processing can then release appropriate locks as
needed.  This patch provides the high level portion.

	As it is undesirable to acquire RTNL for every monitor pass (which
may occur as often as every 10 ms), the miimon has been converted to
do conditional locking.  A first pass inspects all slaves to determine
if any action is required, and if so, a second pass (after acquring RTNL)
is done to perform any actions (doing a complete rescan, as the situation
may have changed when all locks were released).
Signed-off-by: Andy Gospodarek <andy@greyhouse.net>
Signed-off-by: Jay Vosburgh <fubar@us.ibm.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

	Change locking in balance-rr transmit processing to use a free
running counter to determine which slave to transmit on.  Instead, a
free-running counter is maintained, and modulo arithmetic used to select
a slave for transmit.

	This removes lock operations from the TX path, and eliminates
a deadlock introduced by the conversion to work queues.
Signed-off-by: Andy Gospodarek <andy@greyhouse.net>
Signed-off-by: Jay Vosburgh <fubar@us.ibm.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

	Convert bonding timers to workqueues.  This converts the various
monitor functions to run in periodic work queues instead of timers.  This
patch introduces the framework and convers the calls, but does not resolve
various locking issues, and does not stand alone.
Signed-off-by: Andy Gospodarek <andy@greyhouse.net>
Signed-off-by: Jay Vosburgh <fubar@us.ibm.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

Remove net driver entries (they fall under the more general 'net driver
maintainer') umbrella.

Remove entries for older drivers that either no longer exist, are about
to be removed, or I no longer care about.
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

Add missing &:

drivers/net/pasemi_mac.c: In function 'pasemi_mac_clean_rx':
drivers/net/pasemi_mac.c:553: warning: passing argument 1 of 'prefetch'
makes pointer from integer without a cast
Signed-off-by: Olof Johansson <olof@lixom.net>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

 The dfx_bus_uninit() call is called from dfx_unregister() which is
__devexit and which is ultimately the ->remove call for the device.
Signed-off-by: Maciej W. Rozycki <macro@linux-mips.org>
Signed-off-by: Jeff Garzik <jeff@garzik.org>