netdev - [BUG?] __ip_route_output_key bad unlock balance detected

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:	Fri, 11 Feb 2011 01:48:51 +0900
From:	Minchan Kim <minchan.kim@...il.com>
To:	"David S. Miller" <davem@...emloft.net>,
	James Morris <jmorris@...ei.org>, netdev@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	Andrew Morton <akpm@...ux-foundation.org>
Subject: [BUG?] __ip_route_output_key bad unlock balance detected

When I boot in mmotm-02-04 + usb patch[1], I always see the below bug message.
I think [1] isn't related to the bug.
Is it a know BUG?

[1] : https://patchwork.kernel.org/patch/535901/

== CUT_HERE ==

type=1400 audit(1297075905.998:17): apparmor="STATUS"
operation="profile_load" name="/usr/bin/evince-thumbnailer" pid=663
comm="apparmor_parser"

=====================================
[ BUG: bad unlock balance detected! ]
-------------------------------------
host/956 is trying to release lock (rcu_read_lock) at:
[<c0531d51>] __ip_route_output_key+0x231/0x8b0
but there are no more locks to release!

other info that might help us debug this:
no locks held by host/956.

stack backtrace:
Pid: 956, comm: host Not tainted 2.6.38-rc3-mm1-fix-usb+ #3
Call Trace:
 [<c01821b2>] ? print_unlock_inbalance_bug+0xd2/0xe0
 [<c0531d51>] ? __ip_route_output_key+0x231/0x8b0
 [<c0531d51>] ? __ip_route_output_key+0x231/0x8b0
 [<c0531d51>] ? __ip_route_output_key+0x231/0x8b0
 [<c0184d63>] ? lock_release+0x153/0x1d0
 [<c0531d65>] ? __ip_route_output_key+0x245/0x8b0
 [<c0531c29>] ? __ip_route_output_key+0x109/0x8b0
 [<c01827fc>] ? check_usage+0x5c/0x3d0
 [<c05323eb>] ? ip_route_output_flow+0x1b/0x60
 [<c055b792>] ? udp_sendmsg+0x572/0x6b0
 [<c0183748>] ? __lock_acquire+0x198/0x1280
 [<c056485a>] ? inet_sendmsg+0xaa/0xe0
 [<c05647b0>] ? inet_sendmsg+0x0/0xe0
 [<c04f8079>] ? sock_sendmsg+0xd9/0x100
 [<c01fbe90>] ? might_fault+0x50/0xa0
 [<c01fbed6>] ? might_fault+0x96/0xa0
 [<c037da4d>] ? _copy_from_user+0x3d/0x130
 [<c050129b>] ? verify_iovec+0x5b/0xb0
 [<c04f87ed>] ? sys_sendmsg+0x15d/0x280
 [<c0184989>] ? lock_release_non_nested+0x59/0x2e0
 [<c01e7295>] ? __free_pages+0x35/0x40
 [<c01fbe90>] ? might_fault+0x50/0xa0
 [<c01fbe90>] ? might_fault+0x50/0xa0
 [<c01fbed6>] ? might_fault+0x96/0xa0
 [<c01fbe90>] ? might_fault+0x50/0xa0
 [<c037da4d>] ? _copy_from_user+0x3d/0x130
 [<c04f8ebb>] ? sys_socketcall+0xeb/0x2a0
 [<c05d9b15>] ? restore_all_notrace+0x0/0x18
 [<c0103023>] ? sysenter_do_call+0x12/0x38
RPC: Registered udp transport module.
RPC: Registered tcp transport module.
RPC: Registered tcp NFSv4.1 backchannel transport module.
Installing knfsd (copyright (C) 1996 okir@...ad.

==

The bug is cased by follwing as.
int __ip_route_output_key(struct net *net, struct rtable **rp,
...
...
...
                        RT_CACHE_STAT_INC(out_hit);
                        rcu_read_unlock_bh();
                        *rp = rth;
                        return 0;
                }
                RT_CACHE_STAT_INC(out_hlist_search);
        }
        rcu_read_unlock_bh();

slow_output:
        rcu_read_lock();
        res = ip_route_output_slow(net, rp, flp);
        rcu_read_unlock(); <=== bad unlock balance detected !!!
        return res;




-- 
Kind regards,
Minchan Kim

Download attachment "minchan.config" of type "application/octet-stream" (100699 bytes)