[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20090625033847.GA27181@us.ibm.com>
Date: Wed, 24 Jun 2009 22:38:47 -0500
From: "Serge E. Hallyn" <serue@...ibm.com>
To: Sachin Sant <sachinp@...ibm.com>
Cc: netdev <netdev@...r.kernel.org>, serue@...ux.vnet.ibm.com,
David Miller <davem@...emloft.net>, matthltc@...ibm.com,
Stephen Hemminger <shemminger@...tta.com>
Subject: Re: [2.6.30-git21] Network Namespace test failure
Quoting Serge E. Hallyn (serue@...ibm.com):
> Quoting Sachin Sant (sachinp@...ibm.com):
> > Serge E. Hallyn wrote:
> >> Precise kernel version and .config?
> >>
> > Kernel version is 2.6.30-git21 (626f380d0b264a1e40237f5a2a3dffc5d14f256e)
>
> Thanks. I bisected it to commit
> ae0e8e82205c903978a79ebf5e31c670b61fa5b4 : "veth: prevent oops caused by
> netdev destructor". That moves the free_percpu(priv->stats) from
> veth_dev_free to veth_close(). Since it gets allocated at
> veth_dev_init, and dveth_xmit uses it unconditionally, that seems like a
> likely cause of the oops?
Indeed the following patch fixes it on my end. Sachin can you give
this one a shot?
thanks,
-serge
>From 7193023ad09dbc4b57909c0204c19ed93472cd9e Mon Sep 17 00:00:00 2001
From: root <root@...3b203.beaverton.ibm.com>
Date: Wed, 24 Jun 2009 20:26:17 -0700
Subject: [PATCH 1/1] veth: don't free priv->status until dev->destructor
Since commit ae0e8e82205c903978a79ebf5e31c670b61fa5b4, priv->status
has been freed at veth_close(). But that causes a NULL deref at
veth_xmit. This patch moves priv->status free back to the device
destructor.
Signed-off-by: Serge Hallyn <serue@...ibm.com>
---
drivers/net/veth.c | 13 ++++++++++---
1 files changed, 10 insertions(+), 3 deletions(-)
diff --git a/drivers/net/veth.c b/drivers/net/veth.c
index 8e56fcf..6000aae 100644
--- a/drivers/net/veth.c
+++ b/drivers/net/veth.c
@@ -259,8 +259,6 @@ static int veth_close(struct net_device *dev)
netif_carrier_off(dev);
netif_carrier_off(priv->peer);
- free_percpu(priv->stats);
- priv->stats = NULL;
return 0;
}
@@ -301,6 +299,15 @@ static const struct net_device_ops veth_netdev_ops = {
.ndo_set_mac_address = eth_mac_addr,
};
+static void veth_dev_free(struct net_device *dev)
+{
+ struct veth_priv *priv;
+
+ priv = netdev_priv(dev);
+ free_percpu(priv->stats);
+ free_netdev(dev);
+}
+
static void veth_setup(struct net_device *dev)
{
ether_setup(dev);
@@ -308,7 +315,7 @@ static void veth_setup(struct net_device *dev)
dev->netdev_ops = &veth_netdev_ops;
dev->ethtool_ops = &veth_ethtool_ops;
dev->features |= NETIF_F_LLTX;
- dev->destructor = free_netdev;
+ dev->destructor = veth_dev_free;
}
/*
--
1.6.2.3
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists