kernel crashes with instruction pointer at "rb_erase+0x1fb/0x390" if [intel|amd]_iommu=on and TSO with bnx2x driver are enabled.

Solution Verified - Updated -


  • Red Hat Enterprise Linux 7 system crashed due to kernel panic
BUG: unable to handle kernel NULL pointer dereference at           (null)
RIP: 0010:[<ffffffff812bf01b>]  [<ffffffff812bf01b>] rb_erase+0x1fb/0x390
  • When TSO (TCP segmentation offload) is enabled in network setting
$ ethtool -k eth0
Features for eth0:
tcp-segmentation-offload: on
    tx-tcp-segmentation: on
    tx-tcp-ecn-segmentation: on
    tx-tcp6-segmentation: on
  • And "[intel|amd]_iommu=on" is used as the boot parameter (/boot/grub2/grub.cfg)
linux16 /boot/vmlinuz-3.10.0-123.el7.x86_64 root=/dev/sda5  intel_iommu=on  crashkernel=130M@0M ro rhgb quiet LANG=en_US.UTF-8


  • Red Hat Enterprise Linux 7
  • kernel-3.10.0-123.el7
  • bnx2x driver
  • Enabled TSO (TCP segmentation offload)
  • Specified [intel|amd]_iommu=on kernel parameter in grub.cfg

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase of over 48,000 articles and solutions.

Current Customers and Partners

Log in for full access

Log In