From: yajun.deng@linux.dev
To: "Jakub Kicinski" <kuba@kernel.org>, "David Ahern" <dsahern@gmail.com>
Cc: "Matthieu Baerts" <matthieu.baerts@tessares.net>,
"David Ahern" <dsahern@kernel.org>,
ciorneiioana@gmail.com, netdev@vger.kernel.org,
davem@davemloft.net
Subject: Re: [PATCH net-next] ipv4: Fix refcount warning for new fib_info
Date: Tue, 03 Aug 2021 07:39:03 +0000 [thread overview]
Message-ID: <7eb04004be9b50c4a6877c2b0291574c@linux.dev> (raw)
In-Reply-To: <20210802132031.2331e6b7@kicinski-fedora-pc1c0hjn.dhcp.thefacebook.com>
August 3, 2021 4:20 AM, "Jakub Kicinski" <kuba@kernel.org> wrote:
> On Mon, 2 Aug 2021 12:04:01 -0600 David Ahern wrote:
>
>> On 8/2/21 11:58 AM, Matthieu Baerts wrote:
>> Hi David,
>>
>> On 02/08/2021 18:02, David Ahern wrote:
>> Ioana reported a refcount warning when booting over NFS:
>>
>> [ 5.042532] ------------[ cut here ]------------
>> [ 5.047184] refcount_t: addition on 0; use-after-free.
>> [ 5.052324] WARNING: CPU: 7 PID: 1 at lib/refcount.c:25 refcount_warn_saturate+0xa4/0x150
>> ...
>> [ 5.167201] Call trace:
>> [ 5.169635] refcount_warn_saturate+0xa4/0x150
>> [ 5.174067] fib_create_info+0xc00/0xc90
>> [ 5.177982] fib_table_insert+0x8c/0x620
>> [ 5.181893] fib_magic.isra.0+0x110/0x11c
>> [ 5.185891] fib_add_ifaddr+0xb8/0x190
>> [ 5.189629] fib_inetaddr_event+0x8c/0x140
>>
>> fib_treeref needs to be set after kzalloc. The old code had a ++ which
>> led to the confusion when the int was replaced by a refcount_t.
>>
>> Thank you for the patch!
>>
>> My CI was also complaining of not being able to run kernel selftests [1].
>> Your patch fixes the issue, thanks!
>>
>> Tested-by: Matthieu Baerts <matthieu.baerts@tessares.net>
>>
>> Given how easily it is to trigger the warning, I get the impression the
>> original was an untested patch.
>
> Yeah :( In hindsight any refcount patch which doesn't contain a
> refcount_set() is suspicious. Thanks for the quick fix, applied!
Sorry for that, there is another patch needed to apply for the same reason. I just submitted it.
prev parent reply other threads:[~2021-08-03 7:39 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-08-02 16:02 [PATCH net-next] ipv4: Fix refcount warning for new fib_info David Ahern
2021-08-02 17:58 ` Matthieu Baerts
2021-08-02 18:04 ` David Ahern
2021-08-02 20:20 ` Jakub Kicinski
2021-08-03 7:39 ` yajun.deng [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=7eb04004be9b50c4a6877c2b0291574c@linux.dev \
--to=yajun.deng@linux.dev \
--cc=ciorneiioana@gmail.com \
--cc=davem@davemloft.net \
--cc=dsahern@gmail.com \
--cc=dsahern@kernel.org \
--cc=kuba@kernel.org \
--cc=matthieu.baerts@tessares.net \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.