From: "Dan Merillat" <dan.merillat@gmail.com>
To: "Greg KH" <gregkh@suse.de>
Cc: linux-kernel@vger.kernel.org, stable@kernel.org,
"Justin Forbes" <jmforbes@linuxtx.org>,
"Zwane Mwaikambo" <zwane@arm.linux.org.uk>,
"Theodore Ts'o" <tytso@mit.edu>,
"Randy Dunlap" <rdunlap@xenotime.net>,
"Dave Jones" <davej@redhat.com>,
"Chuck Wolber" <chuckw@quantumlinux.com>,
"Chris Wedgwood" <reviews@ml.cw.f00f.org>,
"Michael Krufky" <mkrufky@linuxtv.org>,
"Chuck Ebbert" <cebbert@redhat.com>,
"Domenico Andreoli" <cavokz@gmail.com>,
torvalds@linux-foundation.org, akpm@linux-foundation.org,
alan@lxorguk.ukuu.org.uk, bunk@stusta.de,
"Patrick McHardy" <kaber@trash.net>,
"David S. Miller" <davem@davemloft.net>
Subject: Re: [37/50] Fix inet_diag OOPS.
Date: Mon, 24 Sep 2007 22:03:40 +0000 [thread overview]
Message-ID: <a56dfcf00709241503j58cc8f82lbb581f29b17ab3d5@mail.gmail.com> (raw)
In-Reply-To: <20070924162206.GL13510@kroah.com>
[-- Attachment #1: Type: text/plain, Size: 455 bytes --]
On 9/24/07, Greg KH <gregkh@suse.de> wrote:
> netlink_run_queue() doesn't handle multiple processes processing the
> queue concurrently. Serialize queue processing in inet_diag to fix
> a oops in netlink_rcv_skb caused by netlink_run_queue passing a
> NULL for the skb.
I just got this one on 2.6.23-RC1, looks the same to me but posting
the oops anyway to doublecheck.
(is it possible to get gmail not to mangle code/patches/oopses without
attaching?)
[-- Attachment #2: oops.txt --]
[-- Type: text/plain, Size: 3136 bytes --]
[1015205.245213] Unable to handle kernel NULL pointer dereference at 0000000000000068 RIP:
[1015205.245221] [<ffffffff804eb6a5>] netlink_run_queue+0xb2/0x104
[1015205.245233] PGD a449067 PUD 2e803067 PMD 0
[1015205.245237] Oops: 0000 [1] SMP
[1015205.245240] CPU 1
[1015205.245242] Modules linked in: tcp_diag inet_diag radeon drm iscsi_tcp libiscsi scsi_transport_iscsi ipv6 fuse eeprom tsdev usbhid ff_memless snd_intel8x0 snd_ac97_codec fan ac97_bus snd_pcm thermal i2c_nforce2 k8temp ohci1394 ehci_hcd snd_timer ohci_hcd serio_raw pcspkr rtc hwmon button processor snd snd_page_alloc usbcore i2c_core ide_generic
[1015205.245267] Pid: 26036, comm: identd Not tainted 2.6.23-rc3 #1
[1015205.245269] RIP: 0010:[<ffffffff804eb6a5>] [<ffffffff804eb6a5>] netlink_run_queue+0xb2/0x104
[1015205.245274] RSP: 0018:ffff81002a1d5bf8 EFLAGS: 00010202
[1015205.245276] RAX: 0000000000000000 RBX: ffff81003d94f600 RCX: ffff81000c9fe3c0
[1015205.245278] RDX: 0000000000000009 RSI: 0000000000000202 RDI: ffff81003d91d0c4
[1015205.245281] RBP: 0000000000000000 R08: ffff8100059813c0 R09: ffff81003d91d000
[1015205.245283] R10: 000000007fffffff R11: ffff81000c9fe3c0 R12: ffff81002a1d5c44
[1015205.245286] R13: ffff81003d91d000 R14: ffff81003d91d0b0 R15: ffffffff8819aa95
[1015205.245289] FS: 0000000041001950(0063) GS:ffff81003faaaa40(0000) knlGS:00000000f7415a10
[1015205.245291] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[1015205.245294] CR2: 0000000000000068 CR3: 000000002c973000 CR4: 00000000000006e0
[1015205.245296] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[1015205.245298] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[1015205.245301] Process identd (pid: 26036, threadinfo ffff81002a1d4000, task ffff81002a3d50c0)
[1015205.245303] Stack: 0000000000000000 ffff81003d91d000 000000000000004c ffff81001f219400
[1015205.245308] ffff81003d94f600 ffff81002a1d5d60 0000000000000000 ffffffff8819a024
[1015205.245311] 0000000000000292 00000001804cffe4 ffff81003d91d000 ffffffff804ebb37
[1015205.245315] Call Trace:
[1015205.245323] [<ffffffff8819a024>] :inet_diag:inet_diag_rcv+0x24/0x2f
[1015205.245328] [<ffffffff804ebb37>] netlink_data_ready+0x12/0x50
[1015205.245331] [<ffffffff804ea93d>] netlink_sendskb+0x23/0x3d
[1015205.245334] [<ffffffff804ebb12>] netlink_sendmsg+0x2a9/0x2bc
[1015205.245342] [<ffffffff8022841c>] __wake_up_common+0x3e/0x68
[1015205.245348] [<ffffffff804ca69c>] sock_aio_write+0x110/0x128
[1015205.245357] [<ffffffff802654bd>] __pagevec_lru_add_active+0xd1/0xe1
[1015205.245363] [<ffffffff80284388>] do_sync_write+0xc9/0x10c
[1015205.245371] [<ffffffff80243546>] autoremove_wake_function+0x0/0x2e
[1015205.245380] [<ffffffff80284b60>] vfs_write+0xe1/0x157
[1015205.245385] [<ffffffff802850ab>] sys_write+0x45/0x6e
[1015205.245390] [<ffffffff8020b3ce>] system_call+0x7e/0x83
[1015205.245396]
[1015205.245397]
[1015205.245397] Code: 8b 55 68 83 fa 0f 77 93 48 89 ef e8 ad 50 fe ff 41 ff 0c 24
[1015205.245405] RIP [<ffffffff804eb6a5>] netlink_run_queue+0xb2/0x104
[1015205.245409] RSP <ffff81002a1d5bf8>
[1015205.245410] CR2: 0000000000000068
next prev parent reply other threads:[~2007-09-24 22:03 UTC|newest]
Thread overview: 59+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20070924161246.983665021@mini.kroah.org>
2007-09-24 16:17 ` [00/50] 2.6.22-stable review Greg KH
2007-09-24 16:19 ` [01/50] V4L: ivtv: fix VIDIOC_S_FBUF: new OSD values were never set Greg KH
2007-09-24 16:19 ` [02/50] DVB: get_dvb_firmware: update script for new location of sp8870 firmware Greg KH
2007-09-24 16:19 ` [03/50] DVB: get_dvb_firmware: update script for new location of tda10046 firmware Greg KH
2007-09-24 16:19 ` [04/50] DVB: b2c2-flexcop: fix Airstar HD5000 tuning regression Greg KH
2007-09-24 16:20 ` [05/50] setpgid(child) fails if the child was forked by sub-thread Greg KH
2007-09-24 16:20 ` [06/50] sigqueue_free: fix the race with collect_signal() Greg KH
2007-09-24 16:20 ` [07/50] kconfig: oldconfig shall not set symbols if it does not need to Greg KH
2007-09-24 16:20 ` [08/50] MTD: Makefile fix for mtdsuper Greg KH
2007-09-24 16:20 ` [09/50] USB: fix linked list insertion bugfix for usb core Greg KH
2007-09-24 16:20 ` [10/50] ACPI: Validate XSDT, use RSDT if XSDT fails Greg KH
2007-09-24 16:20 ` [11/50] POWERPC: Flush registers to proper task context Greg KH
2007-09-24 16:20 ` [12/50] 3w-9xxx: Fix dma mask setting Greg KH
2007-09-24 16:20 ` [13/50] MTD: Initialise s_flags in get_sb_mtd_aux() Greg KH
2007-09-24 16:20 ` [14/50] JFFS2: fix write deadlock regression Greg KH
2007-09-24 16:20 ` [15/50] V4L: cx88: Avoid a NULL pointer dereference during mpeg_open() Greg KH
2007-09-24 16:20 ` [16/50] hwmon: End of I/O region off-by-one Greg KH
2007-09-24 16:20 ` [17/50] Fix debug regression in video/pwc Greg KH
2007-09-24 16:20 ` [18/50] splice: fix direct splice error handling Greg KH
2007-09-24 16:21 ` [19/50] rpc: fix garbage in printk in svc_tcp_accept() Greg KH
2007-09-24 16:21 ` [20/50] disable sys_timerfd() Greg KH
2007-09-24 16:21 ` [21/50] afs: mntput called before dput Greg KH
2007-09-24 16:21 ` [22/50] Fix DAC960 driver on machines which dont support 64-bit DMA Greg KH
2007-09-24 16:21 ` [23/50] Fix "Fix DAC960 driver on machines which dont support 64-bit DMA" Greg KH
2007-09-24 16:21 ` [24/50] firewire: fw-ohci: ignore failure of pci_set_power_state (fix suspend regression) Greg KH
2007-09-24 16:21 ` [25/50] futex_compat: fix list traversal bugs Greg KH
2007-09-24 16:21 ` [26/50] Leases can be hidden by flocks Greg KH
2007-09-24 16:21 ` [27/50] ext34: ensure do_split leaves enough free space in both blocks Greg KH
2007-09-24 16:21 ` [28/50] nfs: fix oops re sysctls and V4 support Greg KH
2007-09-24 16:21 ` [29/50] dir_index: error out instead of BUG on corrupt dx dirs Greg KH
2007-09-24 16:21 ` [30/50] ieee1394: ohci1394: fix initialization if built non-modular Greg KH
2007-09-24 16:21 ` [31/50] Correctly close old nfsd/lockd sockets Greg KH
2007-09-24 16:21 ` [32/50] Fix race with shared tag queue maps Greg KH
2007-09-24 16:21 ` [33/50] crypto: blkcipher_get_spot() handling of buffer at end of page Greg KH
2007-09-24 16:21 ` [34/50] fix realtek phy id in forcedeth Greg KH
2007-09-24 16:21 ` [35/50] Fix decnet device address listing Greg KH
2007-09-24 16:22 ` [36/50] Fix device address listing for ipv4 Greg KH
2007-09-24 16:22 ` [37/50] Fix inet_diag OOPS Greg KH
2007-09-24 22:03 ` Dan Merillat [this message]
2007-09-25 4:03 ` Patrick McHardy
2007-09-24 16:22 ` [38/50] Fix IPV6 append OOPS Greg KH
2007-09-24 16:22 ` [39/50] Fix IPSEC AH4 options handling Greg KH
2007-09-24 16:22 ` [40/50] Fix ipv6 double-sock-release with MSG_CONFIRM Greg KH
2007-09-24 16:22 ` [41/50] : Fix IPV6 DAD handling Greg KH
2007-09-24 16:22 ` [42/50] Fix ipv6 source address handling Greg KH
2007-09-24 22:05 ` roel
2007-09-24 16:22 ` [43/50] Fix oops in vlan and bridging code Greg KH
2007-09-24 16:22 ` [44/50] Fix tc_ematch kbuild Greg KH
2007-09-24 16:22 ` [45/50] Handle snd_una in tcp_cwnd_down() Greg KH
2007-09-24 16:22 ` [46/50] Fix TCP DSACK cwnd handling Greg KH
2007-09-24 16:22 ` [47/50] Fix datagram recvmsg NULL iov handling regression Greg KH
2007-09-24 16:22 ` [48/50] Fix pktgen src_mac handling Greg KH
2007-09-24 16:22 ` [49/50] Fix sparc64 v100 platform booting Greg KH
2007-09-24 16:22 ` [50/50] bcm43xx: Fix cancellation of work queue crashes Greg KH
2007-09-24 16:31 ` [00/50] 2.6.22-stable review Greg KH
2007-09-24 16:44 ` Chris Wedgwood
2007-09-24 16:46 ` Chris Wedgwood
2007-09-24 17:14 ` Greg KH
2007-09-24 17:13 ` Greg KH
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=a56dfcf00709241503j58cc8f82lbb581f29b17ab3d5@mail.gmail.com \
--to=dan.merillat@gmail.com \
--cc=akpm@linux-foundation.org \
--cc=alan@lxorguk.ukuu.org.uk \
--cc=bunk@stusta.de \
--cc=cavokz@gmail.com \
--cc=cebbert@redhat.com \
--cc=chuckw@quantumlinux.com \
--cc=davej@redhat.com \
--cc=davem@davemloft.net \
--cc=gregkh@suse.de \
--cc=jmforbes@linuxtx.org \
--cc=kaber@trash.net \
--cc=linux-kernel@vger.kernel.org \
--cc=mkrufky@linuxtv.org \
--cc=rdunlap@xenotime.net \
--cc=reviews@ml.cw.f00f.org \
--cc=stable@kernel.org \
--cc=torvalds@linux-foundation.org \
--cc=tytso@mit.edu \
--cc=zwane@arm.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®