From: Chris Mason <clm@fb.com>
To: Eric Dumazet <eric.dumazet@gmail.com>
Cc: <netdev@vger.kernel.org>
Subject: Re: crash in __kfree_skb on v3.18-rc5 with CONFIG_DEBUG_PAGEALLOC
Date: Fri, 21 Nov 2014 12:18:03 -0500 [thread overview]
Message-ID: <1416590283.24312.8@mail.thefacebook.com> (raw)
In-Reply-To: <1416588995.8629.114.camel@edumazet-glaptop2.roam.corp.google.com>
On Fri, Nov 21, 2014 at 11:56 AM, Eric Dumazet <eric.dumazet@gmail.com>
wrote:
> On Fri, 2014-11-21 at 11:47 -0500, Chris Mason wrote:
>
>> Once my current run is done, I can revert this and try a loop. But
>> I
>> don't see how this commit causes a use-after-free on the skb itself?
>
> Well, it is so obvious, you really want to make me miserable ;)
>
> I am testing the revert and send it asap.
Grin, no I just don't know what fclones really are ;) So dropping the
ref by one on the clone opens up the skb to be freed and another CPU
races in and frees skb before we can do the assignment lower down.
I've added your revert here and I'll restart the test. It takes a few
hours to get to the point where I've fallen over so far today, but I'll
just leave it in a loop all day long.
Thanks!
-chris
next prev parent reply other threads:[~2014-11-21 17:18 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-11-21 16:16 crash in __kfree_skb on v3.18-rc5 with CONFIG_DEBUG_PAGEALLOC Chris Mason
2014-11-21 16:31 ` Eric Dumazet
2014-11-21 16:37 ` Eric Dumazet
2014-11-21 16:47 ` Chris Mason
2014-11-21 16:56 ` Eric Dumazet
2014-11-21 17:18 ` Chris Mason [this message]
2014-11-21 16:41 ` Chris Mason
2014-11-21 16:57 ` Chris Mason
2014-11-21 17:04 ` [PATCH net] net: Revert "net: avoid one atomic operation in skb_clone()" Eric Dumazet
2014-11-21 18:05 ` Sabrina Dubroca
2014-11-21 19:29 ` Eric Dumazet
2014-11-21 19:39 ` Chris Mason
2014-11-21 19:47 ` [PATCH v2 " Eric Dumazet
2014-11-21 20:27 ` David Miller
2014-11-21 21:15 ` Chris Mason
2014-11-21 16:33 ` crash in __kfree_skb on v3.18-rc5 with CONFIG_DEBUG_PAGEALLOC Chris Mason
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1416590283.24312.8@mail.thefacebook.com \
--to=clm@fb.com \
--cc=eric.dumazet@gmail.com \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).