kernel BUG at mm/slab.c

<2>GMAC: swgmac_linux_xmit_frames No More Free Tx Descriptors
<2>GMAC: swgmac_linux_xmit_frames No More Free Tx Descriptors
<2>GMAC: swgmac_linux_xmit_frames No More Free Tx Descriptors
<2>GMAC: swgmac_linux_xmit_frames No More Free Tx Descriptors
<2>GMAC: swgmac_linux_xmit_frames No More Free Tx Descriptors
<2>GMAC: swgmac_linux_xmit_frames No More Free Tx Descriptors
<2>GMAC: swgmac_linux_xmit_frames No More Free Tx Descriptors
<2>GMAC: swgmac_linux_xmit_frames No More Free Tx Descriptors
<2>GMAC: swgmac_linux_xmit_frames No More Free Tx Descriptors
<2>GMAC: swgmac_linux_xmit_frames No More Free Tx Descriptors
<2>GMAC: swgmac_linux_xmit_frames No More Free Tx Descriptors
<2>GMAC: swgmac_linux_xmit_frames No More Free Tx Descriptors
<2>GMAC: swgmac_linux_xmit_frames No More Free Tx Descriptors
<2>GMAC: swgmac_linux_xmit_frames No More Free Tx Descriptors
<2>GMAC: swgmac_linux_xmit_frames No More Free Tx Descriptors
kernel BUG at mm/slab.c:602!
<0>Kernel panic - not syncing: BUG!

解决方法：

(1) 定位出错代码

static inline struct slab *page_get_slab(struct page *page)
{
        BUG_ON(!PageSlab(page));
        return (struct slab *)page->lru.prev;
}

(2) 跟踪PageSlab()函数，PageSlab()函数的宏定义位于

__PAGEFLAG(Slab, slab)

#define TESTPAGEFLAG(uname, lname)                                      \
static inline int Page##uname(struct page *page)                        \
                        { return test_bit(PG_##lname, &page->flags); }

#define __PAGEFLAG(uname, lname) TESTPAGEFLAG(uname, lname)             \
        __SETPAGEFLAG(uname, lname)  __CLEARPAGEFLAG(uname, lname)

由此可知PageSlab函数原型为：

static inline int PageSlab(struct page *page)                       
{
   return test_bit(PG_slab, &page->flags);
}

        因为slab分配器中使用的页面都会加上PG_slab标志，以跟一般页面的区别。在释放内存的时候，经常需要用到从页面到slab的对应转换关系。而page_get_slab()函数在释放内存的时候经常会被引用到，这样可以定位应该是skb内存块释放出了问题。仔细阅读网卡驱动程序，终于发现了问题。

 status = gmac_set_tx_qptr(gmacdev, dma_addr, skb->len, (u64)skb,0,0,0,offload_needed);
 if(status < 0){
          TR0("%s No More Free Tx Descriptors\n",__FUNCTION__);
          dev_kfree_skb (skb); //出错的根源。
      //  dev_kfree_skb (skb); // 修改后的代码
          netif_stop_queue(netdev);
          local_irq_restore(flags);
          return -EBUSY;
 }