From patchwork Thu May 27 20:18:24 2010 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Eric Dumazet X-Patchwork-Id: 53780 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 778E6B7D1A for ; Fri, 28 May 2010 06:18:56 +1000 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1758839Ab0E0USb (ORCPT ); Thu, 27 May 2010 16:18:31 -0400 Received: from mail-wy0-f174.google.com ([74.125.82.174]:47832 "EHLO mail-wy0-f174.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1758734Ab0E0US3 (ORCPT ); Thu, 27 May 2010 16:18:29 -0400 Received: by wyb29 with SMTP id 29so318919wyb.19 for ; Thu, 27 May 2010 13:18:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:subject:from:to:cc :in-reply-to:references:content-type:date:message-id:mime-version :x-mailer:content-transfer-encoding; bh=vd5OGTO4PoBXQkOulJxutnehIvs/EWcTIVsRm1lRFEQ=; b=GuHkOgwBriwf8mfZ9EdOkHR3vlcKMRAHLxt/CZG3xW6x0NTeXjj2061r4rr6/YK+/E l2mH2GmuBceZHOYWp5DcMTEeyFQ6V7QGkFrk1K6dDucie3iayqm6MMH195RbJCowg1Xx A0XAtYxvnmgu9EEPstkIzTugZe6ghzaPRP35Q= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=subject:from:to:cc:in-reply-to:references:content-type:date :message-id:mime-version:x-mailer:content-transfer-encoding; b=U4m4eH3LaRrBZakq+2xT1n09vvk4Ja51rFzxVhu1566Rqto4PlPbT8Z7UQ4C5MWtqc yiBCzjFdIEXlpfBrEG72f41xj/7rbbcYNNwwDbvyLWCFrDeImOZt3Up9TrxuJZz+5IBw RQZF0qTj1WZG3OYYYrJVjoc7vz/J2fiIZdP2M= Received: by 10.227.154.83 with SMTP id n19mr10750564wbw.147.1274991507487; Thu, 27 May 2010 13:18:27 -0700 (PDT) Received: from [127.0.0.1] ([85.17.35.125]) by mx.google.com with ESMTPS id k13sm969885wed.23.2010.05.27.13.18.25 (version=SSLv3 cipher=RC4-MD5); Thu, 27 May 2010 13:18:27 -0700 (PDT) Subject: Re: boot crash in arp_error_report() (Re: [GIT] Networking) From: Eric Dumazet To: Linus Torvalds Cc: Ingo Molnar , David Miller , Thomas Gleixner , Andrew Morton , netdev@vger.kernel.org, Linux Kernel Mailing List In-Reply-To: <1274989637.2446.1.camel@edumazet-laptop> References: <20100525.165945.39198480.davem@davemloft.net> <20100527190652.GA20303@elte.hu> <1274989637.2446.1.camel@edumazet-laptop> Date: Thu, 27 May 2010 22:18:24 +0200 Message-ID: <1274991504.2446.13.camel@edumazet-laptop> Mime-Version: 1.0 X-Mailer: Evolution 2.28.3 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org Le jeudi 27 mai 2010 à 21:47 +0200, Eric Dumazet a écrit : > I am looking at this bug report, as I am probably at fault, please give > me one or two hour ;) I believe problem comes from commit 7fee226ad2 (net: add a noref bit on skb dst) We probably should add a WARN in __skb_queue_tail() and similar enqueue functions to catch other problems. I'll post a followup. Thanks ! [PATCH] net: fix __neigh_event_send() commit 7fee226ad23 (net: add a noref bit on skb dst) missed one spot where an skb is enqueued, with a possibly not refcounted dst entry. __neigh_event_send() inserts skb into arp_queue, so we must make sure dst entry is refcounted, or dst entry can be freed by garbage collector after caller exits from rcu protected section. Reported-by: Ingo Molnar Signed-off-by: Eric Dumazet Tested-by: Ingo Molnar --- net/core/neighbour.c | 1 + 1 file changed, 1 insertion(+) -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/net/core/neighbour.c b/net/core/neighbour.c index bff3790..6ba1c0e 100644 --- a/net/core/neighbour.c +++ b/net/core/neighbour.c @@ -934,6 +934,7 @@ int __neigh_event_send(struct neighbour *neigh, struct sk_buff *skb) kfree_skb(buff); NEIGH_CACHE_STAT_INC(neigh->tbl, unres_discards); } + skb_dst_force(skb); __skb_queue_tail(&neigh->arp_queue, skb); } rc = 1;