Re: [PATCH] Bug in 2.4.5 in proc_pid_make_inode ()

["Ulrich Weigand" <Ulrich.Weigand@de.ibm.com>]

Martin Wilck wrote:

>I have recently experienced a number of kernel OOPSes
>in "top" under heavy load. Kernel is 2.4.5 (IA64, but
>this has nothing to do the IA64 patch).

Same here; I just debugged these on S/390 ...

>I have seen 2.4.6-pre6 contains changes to this subroutine as well,
>but they seem to be attacking a different problem.
>Having analyzed the stack trace and the kernel code with objdump,
>I am pretty certain that the changes in 2.4.6-pre6 do not fix my problem
>(if they did, I would see a crash in proc_pid_delete_inode rather
>than in proc_delete_inode).

I think the -pre6 code should be OK.  Note that the crash in
proc_delete_inode() occurs because the pointer to the parent
proc_dir_entry (which is taken from inode->u.generic_ip) is
non-zero.

In 2.4.5, this is the case because proc_pid_make_inode
assigns a value to inode->u.proc_i.task before calling iput().
That field overlays inode->u.generic_ip ...

In the 2.4.6-pre patches, the test for a zero pid is moved to
*before* assigning to inode->u.proc_i.task.  Therefore, when
iput calls proc_delete_inode(), the 'de' pointer will be
zero, and nothing will happen.

Whether this is particularly pretty is debateable, but it
appears to be correct.


Mit freundlichen Gruessen / Best Regards

Ulrich Weigand

--
  Dr. Ulrich Weigand
  Linux for S/390 Design & Development
  IBM Deutschland Entwicklung GmbH, Schoenaicher Str. 220, 71032 Boeblingen
  Phone: +49-7031/16-3727   ---   Email: Ulrich.Weigand@de.ibm.com