Re: [2.6.33-rc5 regression] NULL pointer dereference in vlan_skb_recv - probably introduced by commit 9793241fe92f7d9303fb221e43fc598eb065f267

[Eric Dumazet <eric.dumazet@gmail.com>]

Le 24/01/2010 17:25, Américo Wang a écrit :
> On Sun, Jan 24, 2010 at 04:25:49PM +0100, Bruno Prémont wrote:
>> On Sun, 24 January 2010 Eric Dumazet <eric.dumazet@gmail.com> wrote:
>>> Le 23/01/2010 22:31, Bruno Prémont a écrit :
>>>>> Above part of code did change between 2.6.32 and 2.6.33-rc5 with
>>>>> commit 9793241fe92f7d9303fb221e43fc598eb065f267 (vlan: Precise RX
>>>>> stats accounting)
>>>>> http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=9793241fe92f7d9303fb221e43fc598eb065f267
>>>>
>>>> Reverting just that commit gets the system running correctly.
>>>>
>>>> Bruno
>>>
>>> I have no idea how this patch can break vlan networking.
>>>
>>> Your disassembly and .config seems to show your machine is not SMP
>>
>> Exact
>>
>>> Maybe something is broken on UP and alloc_percpu() ?
>>
>> Apparently not, see below and previous mail
>>
>>> Could you add a debug in vlan_dev_init()
>>
>> In addition to previous mail, I'm also dumping the result of
>> vlan_dev_info(dev) shows that the returned pointer is not the same
>> during vlan_dev_init() and vlan_skb_recv() ...
>>
>> diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
>> index b788978..f370ce1 100644
>> --- a/net/8021q/vlan_dev.c
>> +++ b/net/8021q/vlan_dev.c
>> @@ -165,8 +165,11 @@ int vlan_skb_recv(struct sk_buff *skb, struct net_device *dev,
>>
>>        rx_stats = per_cpu_ptr(vlan_dev_info(dev)->vlan_rx_stats,
>>                               smp_processor_id());
> 
> 
> I am thinking if vlan_dev_info(dev) here should be
> vlan_dev_info(skb->dev)...
> 
> 

Yes, I came to same conclusion :)

Thanks