From mboxrd@z Thu Jan 1 00:00:00 1970 From: Eric Dumazet Subject: Re: [Bugme-new] [Bug 16120] New: Oops: 0000 [#1] SMP, unable to handle kernel NULL pointer dereference at (null) Date: Sat, 05 Jun 2010 11:36:13 +0200 Message-ID: <1275730573.5238.15.camel@edumazet-laptop> References: <20100604161737.25c7940a.akpm@linux-foundation.org> <1275729426.5238.6.camel@edumazet-laptop> <1275730457.5238.14.camel@edumazet-laptop> Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: QUOTED-PRINTABLE Cc: David Miller , netdev@vger.kernel.org, bugzilla-daemon@bugzilla.kernel.org, bugme-daemon@bugzilla.kernel.org, alex.vizor@gmail.com, Patrick McHardy To: Andrew Morton Return-path: Received: from mail-ww0-f46.google.com ([74.125.82.46]:62892 "EHLO mail-ww0-f46.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932656Ab0FEJgT (ORCPT ); Sat, 5 Jun 2010 05:36:19 -0400 Received: by wwc33 with SMTP id 33so89569wwc.19 for ; Sat, 05 Jun 2010 02:36:18 -0700 (PDT) In-Reply-To: <1275730457.5238.14.camel@edumazet-laptop> Sender: netdev-owner@vger.kernel.org List-ID: Le samedi 05 juin 2010 =C3=A0 11:34 +0200, Eric Dumazet a =C3=A9crit : > Le samedi 05 juin 2010 =C3=A0 11:17 +0200, Eric Dumazet a =C3=A9crit = : > > Le vendredi 04 juin 2010 =C3=A0 16:17 -0700, Andrew Morton a =C3=A9= crit : > > > (switched to email. Please respond via emailed reply-to-all, not= via the > > > bugzilla web interface). > > >=20 > > > On Fri, 4 Jun 2010 09:25:58 GMT > > > bugzilla-daemon@bugzilla.kernel.org wrote: > > >=20 > > > > https://bugzilla.kernel.org/show_bug.cgi?id=3D16120 > > > >=20 > > > > Summary: Oops: 0000 [#1] SMP, unable to handle kerne= l NULL > > > > pointer dereference at (null) > > > > Product: Platform Specific/Hardware > > > > Version: 2.5 > > > > Kernel Version: 2.6.35-rc1 > > > > Platform: All > > > > OS/Version: Linux > > > > Tree: Mainline > > > > Status: NEW > > > > Severity: high > > > > Priority: P1 > > > > Component: x86-64 > > > > AssignedTo: platform_x86_64@kernel-bugs.osdl.org > > > > ReportedBy: alex.vizor@gmail.com > > > > Regression: Yes > > > >=20 > > > >=20 > > > > Created an attachment (id=3D26647) > > > > --> (https://bugzilla.kernel.org/attachment.cgi?id=3D26647) id= ) > >=20 > > > > 2.6.35-rc1 kernel log > > > >=20 > > > > It happens randomly, almost a week I used 2.6.35-rc1 and don't = have any > > > > problems. But since last day it happened twice. > > > >=20 > > > > I attached kernel log, please inform me if I can help in invest= igation. > > > >=20 > > >=20 > > > ip6mr_sk_done() oopsed. > >=20 > > Only thing I found a first glance is a typo but this should not be = the > > root of the problem. > >=20 >=20 > At a second glance, I think the problem is that we probably cleanup=20 > in the wrong order. >=20 > ip6mr_rules_exit() is probably called before icmpv6_sk_exit() ? >=20 > I dont know how to fix this order, no more time for me until Monday. >=20 >=20 > We should reinit mr6_tables list in ip6mr_rules_exit() in any case >=20 >=20 > [PATCH] ip6mr: fixes >=20 > 1) Fix a typo in ip6mr_for_each_table() definition >=20 > 2) Re-initiliaze mr6_tables in ip6mr_rules_exit() >=20 > bugzilla report : https://bugzilla.kernel.org/attachment.cgi?id=3D266= 47 >=20 Ah well, crap... https://bugzilla.kernel.org/show_bug.cgi?id=3D16120 Sorry, I really have to run... > Signed-off-by: Eric Dumazet >=20 > diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c > index 073071f..e2ff192 100644 > --- a/net/ipv6/ip6mr.c > +++ b/net/ipv6/ip6mr.c > @@ -120,7 +120,7 @@ static void mroute_clean_tables(struct mr6_table = *mrt); > static void ipmr_expire_process(unsigned long arg); > =20 > #ifdef CONFIG_IPV6_MROUTE_MULTIPLE_TABLES > -#define ip6mr_for_each_table(mrt, met) \ > +#define ip6mr_for_each_table(mrt, net) \ > list_for_each_entry_rcu(mrt, &net->ipv6.mr6_tables, list) > =20 > static struct mr6_table *ip6mr_get_table(struct net *net, u32 id) > @@ -256,6 +256,7 @@ static void __net_exit ip6mr_rules_exit(struct ne= t *net) > =20 > list_for_each_entry_safe(mrt, next, &net->ipv6.mr6_tables, list) > ip6mr_free_table(mrt); > + INIT_LIST_HEAD(&net->ipv6.mr6_tables); > fib_rules_unregister(net->ipv6.mr6_rules_ops); > } > #else >=20