From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Serge E. Hallyn" Subject: Re: [2.6.30-git21] Network Namespace test failure Date: Wed, 24 Jun 2009 22:46:05 -0500 Message-ID: <20090625034605.GA27319@us.ibm.com> References: <4A422F1E.3050208@in.ibm.com> <20090624140056.GA11912@us.ibm.com> <4A42391A.4040802@in.ibm.com> <20090625031449.GA26767@us.ibm.com> <20090625033847.GA27181@us.ibm.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: netdev , serue@linux.vnet.ibm.com, David Miller , matthltc@us.ibm.com, Stephen Hemminger To: Sachin Sant Return-path: Received: from e36.co.us.ibm.com ([32.97.110.154]:35295 "EHLO e36.co.us.ibm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750724AbZFYDqA (ORCPT ); Wed, 24 Jun 2009 23:46:00 -0400 Received: from d03relay02.boulder.ibm.com (d03relay02.boulder.ibm.com [9.17.195.227]) by e36.co.us.ibm.com (8.13.1/8.13.1) with ESMTP id n5P3iZRu011077 for ; Wed, 24 Jun 2009 21:44:35 -0600 Received: from d03av02.boulder.ibm.com (d03av02.boulder.ibm.com [9.17.195.168]) by d03relay02.boulder.ibm.com (8.13.8/8.13.8/NCO v9.2) with ESMTP id n5P3k3gv259888 for ; Wed, 24 Jun 2009 21:46:03 -0600 Received: from d03av02.boulder.ibm.com (loopback [127.0.0.1]) by d03av02.boulder.ibm.com (8.12.11.20060308/8.13.3) with ESMTP id n5P3k15P026582 for ; Wed, 24 Jun 2009 21:46:02 -0600 Content-Disposition: inline In-Reply-To: <20090625033847.GA27181@us.ibm.com> Sender: netdev-owner@vger.kernel.org List-ID: Quoting Serge E. Hallyn (serue@us.ibm.com): > Quoting Serge E. Hallyn (serue@us.ibm.com): > > Quoting Sachin Sant (sachinp@in.ibm.com): > > > Serge E. Hallyn wrote: > > >> Precise kernel version and .config? > > >> > > > Kernel version is 2.6.30-git21 (626f380d0b264a1e40237f5a2a3dffc5d14f256e) > > > > Thanks. I bisected it to commit > > ae0e8e82205c903978a79ebf5e31c670b61fa5b4 : "veth: prevent oops caused by > > netdev destructor". That moves the free_percpu(priv->stats) from > > veth_dev_free to veth_close(). Since it gets allocated at > > veth_dev_init, and dveth_xmit uses it unconditionally, that seems like a > > likely cause of the oops? > > Indeed the following patch fixes it on my end. Sachin can you give > this one a shot? BTW - according to the original patch, my patch is not a proper fix, bc the destructor can't point to code in the module. I'm not sure offhand what is a proper fix, though, so this patch seemed ok for having Sachin test but is not intended as a mergeable fix. > thanks, > -serge > > >From 7193023ad09dbc4b57909c0204c19ed93472cd9e Mon Sep 17 00:00:00 2001 > From: root > Date: Wed, 24 Jun 2009 20:26:17 -0700 > Subject: [PATCH 1/1] veth: don't free priv->status until dev->destructor > > Since commit ae0e8e82205c903978a79ebf5e31c670b61fa5b4, priv->status > has been freed at veth_close(). But that causes a NULL deref at > veth_xmit. This patch moves priv->status free back to the device > destructor. > > Signed-off-by: Serge Hallyn > --- > drivers/net/veth.c | 13 ++++++++++--- > 1 files changed, 10 insertions(+), 3 deletions(-) > > diff --git a/drivers/net/veth.c b/drivers/net/veth.c > index 8e56fcf..6000aae 100644 > --- a/drivers/net/veth.c > +++ b/drivers/net/veth.c > @@ -259,8 +259,6 @@ static int veth_close(struct net_device *dev) > netif_carrier_off(dev); > netif_carrier_off(priv->peer); > > - free_percpu(priv->stats); > - priv->stats = NULL; > return 0; > } > > @@ -301,6 +299,15 @@ static const struct net_device_ops veth_netdev_ops = { > .ndo_set_mac_address = eth_mac_addr, > }; > > +static void veth_dev_free(struct net_device *dev) > +{ > + struct veth_priv *priv; > + > + priv = netdev_priv(dev); > + free_percpu(priv->stats); > + free_netdev(dev); > +} > + > static void veth_setup(struct net_device *dev) > { > ether_setup(dev); > @@ -308,7 +315,7 @@ static void veth_setup(struct net_device *dev) > dev->netdev_ops = &veth_netdev_ops; > dev->ethtool_ops = &veth_ethtool_ops; > dev->features |= NETIF_F_LLTX; > - dev->destructor = free_netdev; > + dev->destructor = veth_dev_free; > } > > /* > -- > 1.6.2.3