From patchwork Wed Jan 14 05:35:34 2009 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Herbert Xu X-Patchwork-Id: 18356 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.176.167]) by ozlabs.org (Postfix) with ESMTP id 09E4BDE12C for ; Wed, 14 Jan 2009 16:36:14 +1100 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754619AbZANFfo (ORCPT ); Wed, 14 Jan 2009 00:35:44 -0500 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1759468AbZANFfn (ORCPT ); Wed, 14 Jan 2009 00:35:43 -0500 Received: from rhun.apana.org.au ([64.62.148.172]:38320 "EHLO arnor.apana.org.au" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1759421AbZANFfl (ORCPT ); Wed, 14 Jan 2009 00:35:41 -0500 Received: from gondolin.me.apana.org.au ([192.168.0.6]) by arnor.apana.org.au with esmtp (Exim 4.63 #1 (Debian)) id 1LMyPg-0000xU-GD; Wed, 14 Jan 2009 16:35:36 +1100 Received: from herbert by gondolin.me.apana.org.au with local (Exim 4.69) (envelope-from ) id 1LMyPe-00041H-Gi; Wed, 14 Jan 2009 16:35:34 +1100 Date: Wed, 14 Jan 2009 16:35:34 +1100 From: Herbert Xu To: "David S. Miller" , Chris Caputo Cc: netdev@vger.kernel.org Subject: Re: panic with 2.6.28 while doing "ip -6 route" Message-ID: <20090114053534.GA15267@gondor.apana.org.au> References: MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.18 (2008-05-17) Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org On Wed, Jan 14, 2009 at 02:30:11AM +0000, Chris Caputo wrote: > On a 2.6.28 x86 system with a full IPv6 route table - 1,524 routes - I can > reproducibly panic the system with the following: > > ip -6 route | head > > The above finishes and a command prompt is shown. Then about half of the > time I get a panic: > > BUG: unable to handle kernel paging request at 01000014 > [] ? inet6_rtm_delroute+0x0/0x22 > [] ? inet6_rtm_delroute+0x1c/0x22 > [] ? rtnetlink_rcv_msg+0x188/0x1a2 > [] ? rtnetlink_rcv_msg+0x0/0x1a2 > [] ? netlink_rcv_skb+0x30/0x75 > [] ? rtnetlink_rcv+0x17/0x1f > [] ? netlink_unicast+0x1a8/0x209 > [] ? netlink_sendmsg+0x21a/0x227 > [] ? sock_sendmsg+0xca/0xe1 > [] ? autoremove_wake_function+0x0/0x33 > [] ? nommu_map_single+0x0/0x41 > [] ? dev_kfree_skb_any+0x23/0x2e > [] ? e1000_unmap_and_free_tx_resource+0x5b/0x70 [e1000] > [] ? copy_from_user+0x2c/0x4f > [] ? verify_iovec+0x40/0x73 > [] ? sys_sendmsg+0x14f/0x1aa > [] ? sys_socketcall+0x140/0x16d > [] ? sysenter_do_call+0x12/0x25 > Code: 00 ff 48 0c 8b 81 dc 01 00 00 ff 40 14 39 53 18 75 07 c7 43 18 00 00 00 00 b8 d0 2d 5a c0 e8 a6 3f 04 00 8b 15 e4 2d 5a c0 eb 1f <80> 7a 14 02 75 16 39 72 10 75 11 8b 86 88 00 00 00 85 c0 89 42 > EIP: [] fib6_del+0xd9/0x395 SS:ESP 0068:f6457c10 > Kernel panic - not syncing: Fatal exception in interrupt > Rebooting in 10 seconds.. I'm surprised that it's taken nearly 3 years for this bug to show itself. It even survived a move from route.c :) ipv6: Fix fib6_dump_table walker leak When a fib6 table dump is prematurely ended, we won't unlink its walker from the list. This causes all sorts of grief for other users of the list later. Reported-by: Chris Caputo Signed-off-by: Herbert Xu Thanks, diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c index 29c7c99..52ee1dc 100644 --- a/net/ipv6/ip6_fib.c +++ b/net/ipv6/ip6_fib.c @@ -298,6 +298,10 @@ static void fib6_dump_end(struct netlink_callback *cb) struct fib6_walker_t *w = (void*)cb->args[2]; if (w) { + if (cb->args[4]) { + cb->args[4] = 0; + fib6_walker_unlink(w); + } cb->args[2] = 0; kfree(w); } @@ -330,15 +334,12 @@ static int fib6_dump_table(struct fib6_table *table, struct sk_buff *skb, read_lock_bh(&table->tb6_lock); res = fib6_walk_continue(w); read_unlock_bh(&table->tb6_lock); - if (res != 0) { - if (res < 0) - fib6_walker_unlink(w); - goto end; + if (res <= 0) { + fib6_walker_unlink(w); + cb->args[4] = 0; } - fib6_walker_unlink(w); - cb->args[4] = 0; } -end: + return res; }