From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752663Ab1CUNcs (ORCPT ); Mon, 21 Mar 2011 09:32:48 -0400 Received: from mail-fx0-f46.google.com ([209.85.161.46]:39879 "EHLO mail-fx0-f46.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751458Ab1CUNcq (ORCPT ); Mon, 21 Mar 2011 09:32:46 -0400 DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=subject:from:to:cc:in-reply-to:references:content-type:date :message-id:mime-version:x-mailer:content-transfer-encoding; b=ut17b3iTU9UTrBfWppt6QR01d0ppLEhmM7XNezDTGMsL25/S6+qqkmjPMlOoa2YOMO fElFUjfMhme+Fv0IK0oRA3ECryDwfYSlAzMD7ecBBQXYo2C1Ax3inJw1uO5mP9B7ZhFI QX6lKeZCi1lSjhj+bxqicIls4use/MWmDySSU= Subject: Re: [held lock freed] Re: [GIT] Networking From: Eric Dumazet To: Ingo Molnar , David Miller Cc: David Miller , torvalds@linux-foundation.org, akpm@linux-foundation.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Peter Zijlstra , Thomas Gleixner , Arnd Bergmann In-Reply-To: <20110321125320.GA23490@elte.hu> References: <20110320.195156.226769634.davem@davemloft.net> <20110321125320.GA23490@elte.hu> Content-Type: text/plain; charset="UTF-8" Date: Mon, 21 Mar 2011 14:32:26 +0100 Message-ID: <1300714346.2884.284.camel@edumazet-laptop> Mime-Version: 1.0 X-Mailer: Evolution 2.30.3 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Le lundi 21 mars 2011 à 13:53 +0100, Ingo Molnar a écrit : > Dave, > > lockdep caught this held-lock-freed incident in the networking code: > > [ 21.121321] EXT3-fs (sda5): using internal journal > [ 21.127218] EXT3-fs (sda5): mounted filesystem with ordered data mode > [ 22.034265] rc.sysinit used greatest stack depth: 5796 bytes left > [ 22.511213] IPv4 FIB: Using LC-trie version 0.409 > [ 22.646483] > [ 22.646484] ========================= > [ 22.648398] [ BUG: held lock freed! ] > [ 22.648398] ------------------------- > [ 22.648398] ifconfig/329 is freeing memory f5d01680-f5d018ff, with a lock still held there! > [ 22.648398] (sk_lock-AF_IPX){......}, at: [] ipx_release+0x21/0xf0 > [ 22.648398] 1 lock held by ifconfig/329: > [ 22.648398] #0: (sk_lock-AF_IPX){......}, at: [] ipx_release+0x21/0xf0 > [ 22.648398] > [ 22.648398] stack backtrace: > [ 22.648398] Pid: 329, comm: ifconfig Not tainted 2.6.38-tip+ #109381 > [ 22.648398] Call Trace: > [ 22.648398] [] ? printk+0x2d/0x2f > [ 22.648398] [] debug_check_no_locks_freed+0x10b/0x130 > [ 22.648398] [] kmem_cache_free+0x61/0x120 > [ 22.648398] [] ? __sk_free+0xbc/0x150 > [ 22.648398] [] __sk_free+0xbc/0x150 > [ 22.648398] [] ? skb_dequeue+0x44/0x60 > [ 22.648398] [] sk_free+0x25/0x30 > [ 22.648398] [] ipx_release+0xb7/0xf0 > [ 22.648398] [] sock_release+0x16/0x60 > [ 22.648398] [] sock_close+0x15/0x30 > [ 22.648398] [] ? sock_close+0x0/0x30 > [ 22.648398] [] fput+0xcc/0x260 > [ 22.648398] [] filp_close+0x4a/0x80 > [ 22.648398] [] put_files_struct+0x146/0x170 > [ 22.648398] [] ? put_files_struct+0x30/0x170 > [ 22.648398] [] exit_files+0x3c/0x50 > [ 22.648398] [] do_exit+0x10c/0x770 > [ 22.648398] [] ? vfs_write+0xf0/0x160 > [ 22.648398] [] ? do_sync_write+0x0/0xe0 > [ 22.648398] [] do_group_exit+0x34/0x90 > [ 22.648398] [] sys_exit_group+0x18/0x20 > [ 22.648398] [] sysenter_do_call+0x12/0x32 > > Not sure whether it's VFS or networking related - my guess it's the latter. > The bug was introduced between 016aa2ed1cc9 and a44f99c7efdb. > > The box has booted up fine after the lockdep report. Config attached. Hi Ingo, thanks for this report. Here is a probable fix. [PATCH] ipx: fix ipx_release() Commit b0d0d915d1d1a0 (remove the BKL) added a regression, because sock_put() can free memory while we are going to use it later. Fix is to delay sock_put() _after_ release_sock(). Reported-by: Ingo Molnar Signed-off-by: Eric Dumazet Cc: Arnd Bergmann --- net/ipx/af_ipx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/ipx/af_ipx.c b/net/ipx/af_ipx.c index 2731b51..9680226 100644 --- a/net/ipx/af_ipx.c +++ b/net/ipx/af_ipx.c @@ -148,7 +148,6 @@ static void ipx_destroy_socket(struct sock *sk) ipx_remove_socket(sk); skb_queue_purge(&sk->sk_receive_queue); sk_refcnt_debug_dec(sk); - sock_put(sk); } /* @@ -1404,6 +1403,7 @@ static int ipx_release(struct socket *sock) sk_refcnt_debug_release(sk); ipx_destroy_socket(sk); release_sock(sk); + sock_put(sk); out: return 0; }