From mboxrd@z Thu Jan 1 00:00:00 1970 From: Felipe W Damasio Subject: Re: [PATCH] tproxy: nf_tproxy_assign_sock() can handle tw sockets Date: Fri, 16 Jul 2010 12:41:51 -0300 Message-ID: References: <1278626921.2435.73.camel@edumazet-laptop> <1278695580.2696.55.camel@edumazet-laptop> <1278742649.2538.17.camel@edumazet-laptop> <4C395459.6080407@redhat.com> <1278835332.2538.51.camel@edumazet-laptop> <1279032023.2634.384.camel@edumazet-laptop> <1279036193.2634.468.camel@edumazet-laptop> <1279077678.2444.95.camel@edumazet-laptop> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: QUOTED-PRINTABLE Cc: Avi Kivity , David Miller , Patrick McHardy , linux-kernel@vger.kernel.org, netdev To: Eric Dumazet Return-path: In-Reply-To: Sender: linux-kernel-owner@vger.kernel.org List-Id: netdev.vger.kernel.org Hi All, 2010/7/14 Felipe W Damasio : > Hi Mr. Dumazet, > > 2010/7/14 Eric Dumazet : >> RDX being the sk pointer (and sk+0x38 contains the corrupted "sk_pro= t" value) >> , we notice RBP contains same "sk" value + 0x200000 =A0(2 Mbytes). >> >> (same remark on your initial bug report) >> >> Could you enable CONFIG_FRAME_POINTER=3Dy in your config ? I did, this is the new bug: general protection fault: 0000 [#1] SMP last sysfs file: /sys/devices/pci0000:00/0000:00:1f.3/i2c-0/name CPU 2 Modules linked in: e1000e Pid: 4209, comm: squid Not tainted 2.6.34 #4 DX58SO/ RIP: 0010:[] [] sock_rfree+0x2a/0x= 3c RSP: 0018:ffff88042d781ba8 EFLAGS: 00010282 RAX: 9a7e7f4602400d48 RBX: ffff88034c918e00 RCX: 0000000000000720 RDX: ffff880413a82e00 RSI: ffff8804161e5e2a RDI: ffff88034c918e00 RBP: ffff88042d781ba8 R08: ffff88042d781b98 R09: 0000000000000000 R10: 0000000000040570 R11: 0000000000000000 R12: ffff880413882e00 R13: 00000000000005a8 R14: 00000000000005a8 R15: 000000000000a84d =46S: 00007f9aa0007710(0000) GS:ffff880001a80000(0000) knlGS:000000000= 0000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f11f831f020 CR3: 000000042d5f8000 CR4: 00000000000006e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Process squid (pid: 4209, threadinfo ffff88042d780000, task ffff88042e3= 25620) Stack: ffff88042d781bc8 ffffffff8137fda0 ffff880413882e00 ffff88034c918e00 <0> ffff88042d781be8 ffffffff8137fb3b ffff88034c918e00 ffff88034c918e00 <0> ffff88042d781cd8 ffffffff813be69b ffff88042d781c38 ffffffff813c76e4 Call Trace: [] skb_release_head_state+0x75/0xc0 [] __kfree_skb+0x11/0x86 [] tcp_recvmsg+0x6b9/0x8be [] ? tcp_current_mss+0x46/0x65 [] sock_common_recvmsg+0x32/0x47 [] ? selinux_socket_recvmsg+0x1d/0x1f [] __sock_recvmsg+0x6a/0x76 [] sock_aio_read+0xe9/0x102 [] ? avc_has_perm+0x4e/0x60 [] do_sync_read+0xc7/0x10d [] ? selinux_file_permission+0xa5/0xb2 [] ? security_file_permission+0x11/0x13 [] vfs_read+0xbb/0x102 [] sys_read+0x47/0x70 [] system_call_fastpath+0x16/0x1b Code: c3 48 8b 57 18 55 8b 87 d8 00 00 00 48 89 e5 48 8d 8a ac 00 00 00 f0 29 82 ac 00 00 00 48 8b 57 18 8b 8f d8 00 00 00 48 8b 42 38 <48> 83 b8 b0 00 00 00 00 74 06 01 8a f4 00 00 00 c9 c3 55 48 89 RIP [] sock_rfree+0x2a/0x3c RSP ---[ end trace 8932efc1ba58ce6e ]--- Does this tell you anything? Cheers, =46elipe Damasio