kernel crashes with instruction pointer at "rb_erase+0x1fb/0x390" if [intel|amd]_iommu=on and TSO with bnx2x driver are enabled.
Issue
- Red Hat Enterprise Linux 7 system crashed due to kernel panic
BUG: unable to handle kernel NULL pointer dereference at (null)
...
RIP: 0010:[<ffffffff812bf01b>] [<ffffffff812bf01b>] rb_erase+0x1fb/0x390
..
- When TSO (TCP segmentation offload) is enabled in network setting
$ ethtool -k eth0
Features for eth0:
tcp-segmentation-offload: on
tx-tcp-segmentation: on
tx-tcp-ecn-segmentation: on
tx-tcp6-segmentation: on
- And "[intel|amd]_iommu=on" is used as the boot parameter (/boot/grub2/grub.cfg)
linux16 /boot/vmlinuz-3.10.0-123.el7.x86_64 root=/dev/sda5 intel_iommu=on crashkernel=130M@0M ro rhgb quiet LANG=en_US.UTF-8
Environment
- Red Hat Enterprise Linux 7
- kernel-3.10.0-123.el7
- bnx2x driver
- Enabled TSO (TCP segmentation offload)
- Specified [intel|amd]_iommu=on kernel parameter in grub.cfg
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase of over 48,000 articles and solutions.
Close
Welcome! Check out the Getting Started with Red Hat page for quick tours and guides for common tasks.