netdev - Re: [Bugme-new] [Bug 7962] New: oops in port_carrier

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20070209074211.GA1631@ff.dom.local>
Date:	Fri, 9 Feb 2007 08:42:11 +0100
From:	Jarek Poplawski <jarkao2@...pl>
To:	Stephen Hemminger <shemminger@...ux-foundation.org>
Cc:	Andrew Morton <akpm@...ux-foundation.org>, netdev@...r.kernel.org,
	"bugme-daemon\@kernel-bugs\.osdl\.org" 
	<bugme-daemon@...zilla.kernel.org>, pterjan@...il.com
Subject: Re: [Bugme-new] [Bug 7962] New: oops in port_carrier_check

On 07-02-2007 23:09, Stephen Hemminger wrote:
> On Wed, 7 Feb 2007 12:52:16 -0800
> Andrew Morton <akpm@...ux-foundation.org> wrote:
...
>> Feb  7 21:20:18 plop kernel: BUG: unable to handle kernel paging request at
>> virtual address 6b6b6b6b
>> Feb  7 21:20:18 plop kernel:  printing eip:
>> Feb  7 21:20:18 plop kernel: *pde = 00000000
>> Feb  7 21:20:18 plop kernel: Oops: 0000 [#1]
>> Feb  7 21:20:18 plop kernel: CPU:    0
>> Feb  7 21:20:19 plop kernel: EIP:    0060:[pg0+814360305/1067136000]    Not
>> tainted VLI
>> Feb  7 21:20:19 plop kernel: EIP:    0060:[<f0eed6f1>]    Not tainted VLI
>> Feb  7 21:20:19 plop kernel: EFLAGS: 00010202   (2.6.20.0.rc7-1mdv #1)
>> Feb  7 21:20:19 plop kernel: EIP is at port_carrier_check+0x22/0x75 [bridge]
>> Feb  7 21:20:19 plop kernel: eax: 6b6b6b6b   ebx: 6b6b6b6b   ecx: 00000000  

I think it's caused by pending delayed workqueue
trying to use dev after kfree (POISON_FREE in eax, ebx). 

> static void port_carrier_check(struct work_struct *work)
> {
>        struct net_bridge_port *p;
>        struct net_device *dev;
>        struct net_bridge *br;
>
>        dev = container_of(work, struct net_bridge_port,
>                           carrier_check.work)->dev;
>        work_release(work);
>
>        rtnl_lock();
>        p = dev->br_port;
>        if (!p)
>                goto done;
>        br = p->br;
>
>        if (netif_carrier_ok(dev))
>                p->path_cost = port_cost(dev);
>
>        if (br->dev->flags & IFF_UP) {

My investigation seems to point at this line (p == ebx
but not NULL because of mem debugging on, probably).

Regards,
Jarek P.
-
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html