[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20230419070234.GC44666@unreal>
Date: Wed, 19 Apr 2023 10:02:34 +0300
From: Leon Romanovsky <leon@...nel.org>
To: David Ahern <dsahern@...nel.org>
Cc: kernel test robot <oliver.sang@...el.com>,
Wangyang Guo <wangyang.guo@...el.com>,
Jakub Kicinski <kuba@...nel.org>, oe-lkp@...ts.linux.dev,
lkp@...el.com, Linux Memory Management List <linux-mm@...ck.org>,
Arjan van de Ven <arjan@...ux.intel.com>,
Thomas Gleixner <tglx@...utronix.de>,
Eric Dumazet <edumazet@...gle.com>, netdev@...r.kernel.org,
steffen.klassert@...unet.com
Subject: Re: [linux-next:master] [net] d288a162dd: canonical_address#:#[##]
On Wed, Apr 19, 2023 at 08:59:16AM +0300, Leon Romanovsky wrote:
> On Tue, Apr 18, 2023 at 02:43:02PM -0600, David Ahern wrote:
> > On 4/18/23 10:41 AM, Leon Romanovsky wrote:
> > > Hi,
> > >
> > > I came to the following diff which eliminates the kernel panics,
> > > unfortunately I can explain only second hunk, but first is required
> > > too.
> > >
> > > diff --git a/net/core/dst.c b/net/core/dst.c
> > > index 3247e84045ca..750c8edfe29a 100644
> > > --- a/net/core/dst.c
> > > +++ b/net/core/dst.c
> > > @@ -72,6 +72,8 @@ void dst_init(struct dst_entry *dst, struct dst_ops *ops,
> > > dst->flags = flags;
> > > if (!(flags & DST_NOCOUNT))
> > > dst_entries_add(ops, 1);
> > > +
> > > + INIT_LIST_HEAD(&dst->rt_uncached);
> >
> > d288a162dd1c73507da582966f17dd226e34a0c0 moved rt_uncached from rt6_info
> > and rtable to dst_entry. Only ipv4 and ipv6 usages initialize it. Since
> > it is now in dst_entry, dst_init is the better place so it can be
> > removed from rt_dst_alloc and rt6_info_init.
>
> This is why I placed it there, but the rt_uncached list is initialized
> in xfrm6 right before first call to rt6_uncached_list_add().
>
> 70 static int xfrm6_fill_dst(struct xfrm_dst *xdst, struct net_device *dev,
> 71 const struct flowi *fl)
> 72 {
> ...
> 92 INIT_LIST_HEAD(&xdst->u.rt6.dst.rt_uncached);
> 93 rt6_uncached_list_add(&xdst->u.rt6);
>
> My silly explanation is that xfrm6_dst_destroy() can be called before xfrm6_fill_dst().
David,
I think that I found how it is possible.
2959 static struct xfrm_dst *xfrm_create_dummy_bundle(struct net *net,
2960 struct xfrm_flo *xflo,
2961 const struct flowi *fl,
2962 int num_xfrms,
2963 u16 family)
2964 {
...
2971 xdst = xfrm_alloc_dst(net, family);
2972 if (IS_ERR(xdst))
2973 return xdst;
...
2981 dst1 = &xdst->u.dst;
...
3005 err = xfrm_fill_dst(xdst, dev, fl);
3006 if (err)
3007 goto free_dst;
3008
3009 out:
3010 return xdst;
3011
3012 free_dst:
3013 dst_release(dst1); <-- release of dst1 which has not-initialized rt_uncached.
Thanks
>
> Thanks
>
> >
Powered by blists - more mailing lists