Re: [PATCH net-next-2.6] netlink: netlink_recvmsg() fix

[Johannes Berg <johannes@sipsolutions.net>]

On Sun, 2010-07-25 at 21:55 -0700, David Miller wrote:
> From: Eric Dumazet <eric.dumazet@gmail.com>
> Date: Wed, 21 Jul 2010 10:43:55 +0200
> 
> > [PATCH net-next-2.6 v3] netlink: netlink_recvmsg() fix
> > 
> > commit 1dacc76d0014 
> > (net/compat/wext: send different messages to compat tasks)
> > introduced a race condition on netlink, in case MSG_PEEK is used.
> > 
> > An skb given by skb_recv_datagram() might be shared, we must copy it
> > before any modification, or risk fatal corruption.
> > 
> > Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
> 
> Applied, thanks Eric.

I keep getting errors like below in 2.6.35+wireless-testing. Not saying
that it's this patch's fault, but it is the only thing I remember
touching that area.

[10548.768754] =============================================================================
[10548.773474] BUG kmalloc-4096: Object already free
[10548.775342] -----------------------------------------------------------------------------
[10548.775344] 
[10548.778505] INFO: Allocated in wireless_send_event+0x1f2/0x410 age=1 cpu=0 pid=28521
[10548.778505] INFO: Freed in skb_release_data+0xd0/0xe0 age=2 cpu=2 pid=27730
[10548.778505] INFO: Slab 0xffffea0003fa4b80 objects=7 used=1 fp=0xffff880122f12090 flags=0x80000000000040c3
[10548.778505] INFO: Object 0xffff880122f12090 @offset=8336 fp=0xffff880122f11048
[10548.778505] 
[10548.778505] Bytes b4 0xffff880122f12080:  6c a3 0f 00 01 00 00 00 5a 5a 5a 5a 5a 5a 5a 5a l�......ZZZZZZZZ
...
[10548.778505]   Object 0xffff880122f13080:  6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b a5 kkkkkkkkkkkkkkk�
[10548.778505]  Redzone 0xffff880122f13090:  bb bb bb bb bb bb bb bb                         ��������        
[10548.778505]  Padding 0xffff880122f130d0:  5a 5a 5a 5a 5a 5a 5a 5a                         ZZZZZZZZ        
[10548.778505] Pid: 916, comm: avahi-daemon Tainted: G        W   2.6.35-wl-67184-g1595c70-dirty #12
[10548.778505] Call Trace:
[10548.778505]  [<ffffffff81133993>] print_trailer+0x103/0x160
[10548.778505]  [<ffffffff81133a31>] object_err+0x41/0x50
[10548.778505]  [<ffffffff81135b0f>] __slab_free+0x24f/0x3b0
[10548.778505]  [<ffffffff81135da2>] kfree+0x132/0x1a0
[10548.778505]  [<ffffffff81383710>] skb_release_data+0xd0/0xe0
[10548.778505]  [<ffffffff813831be>] __kfree_skb+0x1e/0xa0
[10548.778505]  [<ffffffff813832c2>] kfree_skb+0x42/0xb0
[10548.778505]  [<ffffffff813ac3f2>] netlink_recvmsg+0x422/0x480
[10548.778505]  [<ffffffff8137afdd>] sock_recvmsg+0xfd/0x130
[10548.778505]  [<ffffffff8137c1e4>] __sys_recvmsg+0x144/0x2e0
[10548.778505]  [<ffffffff8137c629>] sys_recvmsg+0x49/0x80
[10548.778505]  [<ffffffff8100b132>] system_call_fastpath+0x16/0x1b
[10548.778505] FIX kmalloc-4096: Object at 0xffff880122f12090 not freed


johannes