public inbox for linux-kernel@vger.kernel.org
 help / color / mirror / Atom feed
From: Willy Tarreau <w@1wt.eu>
To: linux-kernel@vger.kernel.org, stable@kernel.org
Cc: Satyam Sharma <ssatyam@cse.iitk.ac.in>,
	"David S. Miller" <davem@davemloft.net>,
	Greg Kroah-Hartman <gregkh@suse.de>, Willy Tarreau <w@1wt.eu>
Subject: [2.6.20.17 review 08/58] Netpoll leak
Date: Wed, 22 Aug 2007 11:38:52 +0200	[thread overview]
Message-ID: <20070822083945.%N@1wt.eu> (raw)
In-Reply-To: 20070822083844.%N@1wt.eu

[-- Attachment #1: 0008-Netpoll-leak.patch --]
[-- Type: text/plain, Size: 1634 bytes --]

[NETPOLL]: Fix a leak-n-bug in netpoll_cleanup()

93ec2c723e3f8a216dde2899aeb85c648672bc6b applied excessive duct tape to
the netpoll beast's netpoll_cleanup(), thus substituting one leak with
another, and opening up a little buglet :-)

net_device->npinfo (netpoll_info) is a shared and refcounted object and
cannot simply be set NULL the first time netpoll_cleanup() is called.
Otherwise, further netpoll_cleanup()'s see np->dev->npinfo == NULL and
become no-ops, thus leaking. And it's a bug too: the first call to
netpoll_cleanup() would thus (annoyingly) "disable" other (still alive)
netpolls too. Maybe nobody noticed this because netconsole (only user
of netpoll) never supported multiple netpoll objects earlier.

This is a trivial and obvious one-line fixlet.

Signed-off-by: Satyam Sharma <ssatyam@cse.iitk.ac.in>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Willy Tarreau <w@1wt.eu>
---
 net/core/netpoll.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index 522e441..3431d48 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -776,7 +776,6 @@ void netpoll_cleanup(struct netpoll *np)
 				spin_unlock_irqrestore(&npinfo->rx_lock, flags);
 			}
 
-			np->dev->npinfo = NULL;
 			if (atomic_dec_and_test(&npinfo->refcnt)) {
 				skb_queue_purge(&npinfo->arp_tx);
  				skb_queue_purge(&npinfo->txq);
@@ -784,6 +783,7 @@ void netpoll_cleanup(struct netpoll *np)
  				flush_scheduled_work();
 
 				kfree(npinfo);
+				np->dev->npinfo = NULL;
 			}
 		}
 
-- 
1.5.2.5

-- 

  parent reply	other threads:[~2007-08-22  8:55 UTC|newest]

Thread overview: 85+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2007-08-22  8:38 [2.6.20.17 review 00/58] 2.6.20.17 -stable review Willy Tarreau
2007-08-22  9:38 ` [2.6.20.17 review 01/58] Fix IPCOMP crashes Willy Tarreau
2007-08-22  9:38 ` [2.6.20.17 review 03/58] SCTP scope_id handling fix Willy Tarreau
2007-08-22  9:38 ` [2.6.20.17 review 04/58] gen estimator timer unload race Willy Tarreau
2007-08-22  9:38 ` [2.6.20.17 review 05/58] gen estimator deadlock fix Willy Tarreau
2007-08-22  9:38 ` [2.6.20.17 review 07/58] Fix ipv6 link down handling Willy Tarreau
2007-08-22  9:38 ` Willy Tarreau [this message]
2007-08-22  9:38 ` [2.6.20.17 review 09/58] Sparc64 bootup assembler bug Willy Tarreau
2007-08-22  9:38 ` [2.6.20.17 review 11/58] Fix sparc32 udelay() rounding errors Willy Tarreau
2007-08-22  9:38 ` [2.6.20.17 review 13/58] KVM: SVM: Reliably detect if SVM was disabled by BIOS Willy Tarreau
2007-08-22  9:38 ` [2.6.20.17 review 14/58] USB: fix warning caused by autosuspend counter going negative Willy Tarreau
2007-08-22  9:38 ` [2.6.20.17 review 15/58] aacraid: fix security hole Willy Tarreau
2007-08-22  9:39 ` [2.6.20.17 review 16/58] V4L: Add check for valid control ID to v4l2_ctrl_next Willy Tarreau
2007-08-22  9:39 ` [2.6.20.17 review 17/58] V4L: wm8775/wm8739: Fix memory leak when unloading module Willy Tarreau
2007-08-22  9:39 ` [2.6.20.17 review 18/58] splice: fix double page unlock Willy Tarreau
2007-08-22  9:39 ` [2.6.20.17 review 19/58] drm/i915: Fix i965 secured batchbuffer usage (CVE-2007-3851) Willy Tarreau
2007-08-22  9:39 ` [2.6.20.17 review 20/58] Fix leak on /proc/lockdep_stats Willy Tarreau
2007-08-22  9:39 ` [2.6.20.17 review 21/58] CPU online file permission Willy Tarreau
2007-08-22  9:39 ` [2.6.20.17 review 22/58] Fix user struct leakage with locked IPC shem segment Willy Tarreau
2007-08-22  9:39 ` [2.6.20.17 review 23/58] md: handle writes to broken raid10 arrays gracefully Willy Tarreau
2007-08-22  9:39 ` [2.6.20.17 review 24/58] md: raid10: fix use-after-free of bio Willy Tarreau
2007-08-22  9:39 ` [2.6.20.17 review 25/58] pcmcia: give socket time to power down Willy Tarreau
2007-08-22  9:39 ` [2.6.20.17 review 26/58] "ext4_ext_put_in_cache" uses __u32 to receive physical block number Willy Tarreau
2007-08-22  9:39 ` [2.6.20.17 review 27/58] Include serial_reg.h with userspace headers Willy Tarreau
2007-08-22  9:23   ` Russell King
2007-08-22 12:22     ` Willy Tarreau
2007-08-22  9:39 ` [2.6.20.17 review 28/58] dm io: fix panic on large request Willy Tarreau
2007-08-22  9:39 ` [2.6.20.17 review 29/58] softmac: Fix ESSID problem Willy Tarreau
2007-08-22  9:39 ` [2.6.20.17 review 30/58] nfsd: fix possible read-ahead cache and export table corruption Willy Tarreau
2007-08-22  9:39 ` [2.6.20.17 review 31/58] readahead: MIN_RA_PAGES/MAX_RA_PAGES macros Willy Tarreau
2007-08-22  9:39 ` [2.6.20.17 review 32/58] fs: 9p/conv.c error path fix Willy Tarreau
2007-08-22 15:53   ` Eric Van Hensbergen
2007-08-22 16:06     ` Willy Tarreau
2007-08-22 18:59     ` [stable] " Greg KH
2007-08-22 20:31       ` Willy Tarreau
2007-08-22  9:39 ` [2.6.20.17 review 33/58] forcedeth bug fix: cicada phy Willy Tarreau
2007-08-22  9:39 ` [2.6.20.17 review 34/58] forcedeth bug fix: vitesse phy Willy Tarreau
2007-08-22  9:39 ` [2.6.20.17 review 35/58] forcedeth bug fix: realtek phy Willy Tarreau
2007-08-22 15:56   ` Chuck Ebbert
2007-08-22 16:10     ` Willy Tarreau
2007-08-22 18:15   ` Prakash Punnoor
2007-08-22 20:42     ` Willy Tarreau
2007-08-22 23:05       ` Greg KH
2007-08-23 15:50         ` Prakash Punnoor
2007-08-23 16:55           ` [stable] " Greg KH
2007-08-23 19:27             ` [PATCH] fix realtek phy id in forcedeth Willy Tarreau
2007-08-25  4:01               ` Jeff Garzik
2007-08-22  9:39 ` [2.6.20.17 review 36/58] acpi-cpufreq: Proper ReadModifyWrite of PERF_CTL MSR Willy Tarreau
2007-08-22  9:39 ` [2.6.20.17 review 38/58] jbd2 commit: fix transaction dropping Willy Tarreau
2007-08-22  9:39 ` [2.6.20.17 review 39/58] hugetlb: fix race in alloc_fresh_huge_page() Willy Tarreau
2007-08-22  9:39 ` [2.6.20.17 review 40/58] do not limit locked memory when RLIMIT_MEMLOCK is RLIM_INFINITY Willy Tarreau
2007-08-22  9:39 ` [2.6.20.17 review 41/58] drivers/video/macmodes.c:mac_find_mode() mustnt be __devinit Willy Tarreau
2007-08-22  9:39 ` [2.6.20.17 review 42/58] nfsd: fix possible oops on re-insertion of rpcsec_gss modules Willy Tarreau
2007-08-22  9:39 ` [2.6.20.17 review 43/58] dm snapshot: permit invalid activation Willy Tarreau
2007-08-22  9:39 ` [2.6.20.17 review 45/58] Hangup TTY before releasing rfcomm_dev Willy Tarreau
2007-08-22  9:39 ` [2.6.20.17 review 46/58] Keep rfcomm_dev on the list until it is freed Willy Tarreau
2007-08-22  9:39 ` [2.6.20.17 review 47/58] IPV6: /proc/net/anycast6 unbalanced inet6_dev refcnt Willy Tarreau
2007-08-22  9:39 ` [2.6.20.17 review 48/58] sx: switch subven and subid values Willy Tarreau
2007-08-22  9:39 ` [2.6.20.17 review 49/58] UML: exports for hostfs Willy Tarreau
2007-08-22  9:39 ` [2.6.20.17 review 50/58] random: fix bound check ordering (CVE-2007-3105) Willy Tarreau
2007-08-22  9:39 ` [2.6.20.17 review 51/58] softmac: Fix deadlock of wx_set_essid with assoc work Willy Tarreau
2007-08-22  9:39 ` [2.6.20.17 review 52/58] ata_piix: update map 10b for ich8m Willy Tarreau
2007-08-22  9:39 ` [2.6.20.17 review 53/58] direct-io: fix error-path crashes Willy Tarreau
2007-08-22  9:39 ` [2.6.20.17 review 54/58] stifb: detect cards in double buffer mode more reliably Willy Tarreau
2007-08-22  9:39 ` [2.6.20.17 review 55/58] pata_atiixp: add SB700 PCI ID Willy Tarreau
2007-08-22  9:39 ` [2.6.20.17 review 57/58] CPUFREQ: ondemand: add a check to avoid negative load calculation Willy Tarreau
2007-08-22  9:39 ` [2.6.20.17 review 58/58] Reset current->pdeath_signal on SUID binary execution (CVE-2007-3848) Willy Tarreau
2007-08-22 11:10 ` [2.6.20.17 review 00/58] 2.6.20.17 -stable review Michal Piotrowski
2007-08-22 12:10   ` Willy Tarreau
2007-08-22 13:23   ` James Morris
2007-08-22 13:36     ` Stephen Smalley
2007-08-22 13:42       ` Stephen Smalley
2007-08-22 14:08         ` James Morris
2007-08-22 14:29           ` Michal Piotrowski
2007-08-22 14:32             ` Stephen Smalley
2007-08-22 16:33             ` James Morris
2007-08-22 16:46               ` Michal Piotrowski
2007-08-22 17:38                 ` James Morris
2007-08-22 18:08                   ` Michal Piotrowski
2007-08-22 17:50                 ` Michal Piotrowski
2007-08-22 19:15                   ` Stephen Smalley
2007-08-22 20:16                     ` Willy Tarreau
2007-08-23 11:13                       ` Michal Piotrowski
2007-08-23 14:08                         ` Willy Tarreau
2007-08-22 13:38     ` James Morris

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20070822083945.%N@1wt.eu \
    --to=w@1wt.eu \
    --cc=davem@davemloft.net \
    --cc=gregkh@suse.de \
    --cc=linux-kernel@vger.kernel.org \
    --cc=ssatyam@cse.iitk.ac.in \
    --cc=stable@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox