From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1758541AbYD2RWy (ORCPT ); Tue, 29 Apr 2008 13:22:54 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1751749AbYD2RU2 (ORCPT ); Tue, 29 Apr 2008 13:20:28 -0400 Received: from mail.suse.de ([195.135.220.2]:51886 "EHLO mx1.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1757863AbYD2RU0 (ORCPT ); Tue, 29 Apr 2008 13:20:26 -0400 Date: Tue, 29 Apr 2008 10:18:11 -0700 From: Greg KH To: linux-kernel@vger.kernel.org, stable@kernel.org Cc: Justin Forbes , Zwane Mwaikambo , "Theodore Ts'o" , Randy Dunlap , Dave Jones , Chuck Wolber , Chris Wedgwood , Michael Krufky , Chuck Ebbert , Domenico Andreoli , torvalds@linux-foundation.org, akpm@linux-foundation.org, alan@lxorguk.ukuu.org.uk, Bernard Pidoux , "David S. Miller" Subject: [08/37] rose: Socket lock was not released before returning to user space Message-ID: <20080429171811.GI14724@suse.de> References: <20080429171222.073929148@mini.kroah.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline; filename="rose-socket-lock-was-not-released-before-returning-to-user-space.patch" In-Reply-To: <20080429171730.GA14724@suse.de> User-Agent: Mutt/1.5.16 (2007-06-09) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 2.6.25-stable review patch. If anyone has any objections, please let us know. ------------------ From: Bernard Pidoux [ Upstream commit: 43837b1e6c5aef803d57009a68db18df13e64892 ] ================================================ [ BUG: lock held when returning to user space! ] ------------------------------------------------ xfbbd/3683 is leaving the kernel with locks still held! 1 lock held by xfbbd/3683: #0: (sk_lock-AF_ROSE){--..}, at: [] rose_connect+0x73/0x420 [rose] INFO: task xfbbd:3683 blocked for more than 120 seconds. "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. xfbbd D 00000246 0 3683 3669 c6965ee0 00000092 c02c5c40 00000246 c0f6b5f0 c0f6b5c0 c0f6b5f0 c0f6b5c0 c0f6b614 c6965f18 c024b74b ffffffff c06ba070 00000000 00000000 00000001 c6ab07c0 c012d450 c0f6b634 c0f6b634 c7b5bf10 c0d6004c c7b5bf10 c6965f40 Call Trace: [] lock_sock_nested+0x6b/0xd0 [] ? autoremove_wake_function+0x0/0x40 [] sock_fasync+0x41/0x150 [] sock_close+0x19/0x40 [] __fput+0xb4/0x170 [] fput+0x18/0x20 [] filp_close+0x3e/0x70 [] sys_close+0x69/0xb0 [] sysenter_past_esp+0x5f/0xa5 ======================= INFO: lockdep is turned off. Signed-off-by: Bernard Pidoux Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- net/rose/af_rose.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) --- a/net/rose/af_rose.c +++ b/net/rose/af_rose.c @@ -760,8 +760,10 @@ static int rose_connect(struct socket *s rose->neighbour = rose_get_neigh(&addr->srose_addr, &cause, &diagnostic); - if (!rose->neighbour) - return -ENETUNREACH; + if (!rose->neighbour) { + err = -ENETUNREACH; + goto out_release; + } rose->lci = rose_new_lci(rose->neighbour); if (!rose->lci) { --