Message ID | 1274991504.2446.13.camel@edumazet-laptop |
---|---|
State | Accepted, archived |
Delegated to: | David Miller |
Headers | show |
From: Eric Dumazet <eric.dumazet@gmail.com> Date: Thu, 27 May 2010 22:18:24 +0200 > [PATCH] net: fix __neigh_event_send() > > commit 7fee226ad23 (net: add a noref bit on skb dst) missed one spot > where an skb is enqueued, with a possibly not refcounted dst entry. > > __neigh_event_send() inserts skb into arp_queue, so we must make sure > dst entry is refcounted, or dst entry can be freed by garbage collector > after caller exits from rcu protected section. > > Reported-by: Ingo Molnar <mingo@elte.hu> > Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Applied, thanks Eric. Ingo can we get a confirmation that this fixes the bootup crash? Thanks! -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
* David Miller <davem@davemloft.net> wrote: > From: Eric Dumazet <eric.dumazet@gmail.com> > Date: Thu, 27 May 2010 22:18:24 +0200 > > > [PATCH] net: fix __neigh_event_send() > > > > commit 7fee226ad23 (net: add a noref bit on skb dst) missed one spot > > where an skb is enqueued, with a possibly not refcounted dst entry. > > > > __neigh_event_send() inserts skb into arp_queue, so we must make sure > > dst entry is refcounted, or dst entry can be freed by garbage collector > > after caller exits from rcu protected section. > > > > Reported-by: Ingo Molnar <mingo@elte.hu> > > Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> > > Applied, thanks Eric. > > Ingo can we get a confirmation that this fixes the bootup crash? Sure, will let you know how it goes. Thanks, Ingo -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
* Ingo Molnar <mingo@elte.hu> wrote: > > * David Miller <davem@davemloft.net> wrote: > > > From: Eric Dumazet <eric.dumazet@gmail.com> > > Date: Thu, 27 May 2010 22:18:24 +0200 > > > > > [PATCH] net: fix __neigh_event_send() > > > > > > commit 7fee226ad23 (net: add a noref bit on skb dst) missed one spot > > > where an skb is enqueued, with a possibly not refcounted dst entry. > > > > > > __neigh_event_send() inserts skb into arp_queue, so we must make sure > > > dst entry is refcounted, or dst entry can be freed by garbage collector > > > after caller exits from rcu protected section. > > > > > > Reported-by: Ingo Molnar <mingo@elte.hu> > > > Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> > > > > Applied, thanks Eric. > > > > Ingo can we get a confirmation that this fixes the bootup crash? > > Sure, will let you know how it goes. Preliminary testing shows that Eric's patch solves the problem. Tested-by: Ingo Molnar <mingo@elte.hu> Thanks! Ingo -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
From: Ingo Molnar <mingo@elte.hu> Date: Fri, 28 May 2010 10:24:40 +0200 > Preliminary testing shows that Eric's patch solves the problem. > > Tested-by: Ingo Molnar <mingo@elte.hu> Thanks a lot for testing Ingo. -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/net/core/neighbour.c b/net/core/neighbour.c index bff3790..6ba1c0e 100644 --- a/net/core/neighbour.c +++ b/net/core/neighbour.c @@ -934,6 +934,7 @@ int __neigh_event_send(struct neighbour *neigh, struct sk_buff *skb) kfree_skb(buff); NEIGH_CACHE_STAT_INC(neigh->tbl, unres_discards); } + skb_dst_force(skb); __skb_queue_tail(&neigh->arp_queue, skb); } rc = 1;