1. 05 9月, 2009 12 次提交
  2. 10 8月, 2009 1 次提交
    • R
      sctp: fix missing destroy of percpu counter variable in sctp_proc_exit() · 418372b0
      Rafael Laufer 提交于
      Commit 1748376b,
      	net: Use a percpu_counter for sockets_allocated
      
      added percpu_counter function calls to sctp_proc_init code path, but
      forgot to add them to sctp_proc_exit().  This resulted in a following
      Ooops when performing this test
      	# modprobe sctp
      	# rmmod -f sctp
      	# modprobe sctp
      
      [  573.862512] BUG: unable to handle kernel paging request at f8214a24
      [  573.862518] IP: [<c0308b8f>] __percpu_counter_init+0x3f/0x70
      [  573.862530] *pde = 37010067 *pte = 00000000
      [  573.862534] Oops: 0002 [#1] SMP
      [  573.862537] last sysfs file: /sys/module/libcrc32c/initstate
      [  573.862540] Modules linked in: sctp(+) crc32c libcrc32c binfmt_misc bridge
      stp bnep lp snd_hda_codec_analog snd_hda_intel snd_hda_codec snd_hwdep
      snd_pcm_oss snd_mixer_oss arc4 joydev snd_pcm ecb pcmcia snd_seq_dummy
      snd_seq_oss iwlagn iwlcore snd_seq_midi snd_rawmidi snd_seq_midi_event
      yenta_socket rsrc_nonstatic thinkpad_acpi snd_seq snd_timer snd_seq_device
      mac80211 psmouse sdhci_pci sdhci nvidia(P) ppdev video snd soundcore serio_raw
      pcspkr iTCO_wdt iTCO_vendor_support led_class ricoh_mmc pcmcia_core intel_agp
      nvram agpgart usbhid parport_pc parport output snd_page_alloc cfg80211 btusb
      ohci1394 ieee1394 e1000e [last unloaded: sctp]
      [  573.862589]
      [  573.862593] Pid: 5373, comm: modprobe Tainted: P  R        (2.6.31-rc3 #6)
      7663B15
      [  573.862596] EIP: 0060:[<c0308b8f>] EFLAGS: 00010286 CPU: 1
      [  573.862599] EIP is at __percpu_counter_init+0x3f/0x70
      [  573.862602] EAX: f8214a20 EBX: f80faa14 ECX: c48c0000 EDX: f80faa20
      [  573.862604] ESI: f80a7000 EDI: 00000000 EBP: f69d5ef0 ESP: f69d5eec
      [  573.862606]  DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
      [  573.862610] Process modprobe (pid: 5373, ti=f69d4000 task=c2130c70
      task.ti=f69d4000)
      [  573.862612] Stack:
      [  573.862613]  00000000 f69d5f18 f80a70a8 f80fa9fc 00000000 fffffffc f69d5f30
      c018e2d4
      [  573.862619] <0> 00000000 f80a7000 00000000 f69d5f88 c010112b 00000000
      c07029c0 fffffffb
      [  573.862626] <0> 00000000 f69d5f38 c018f83f f69d5f54 c0557cad f80fa860
      00000001 c07010c0
      [  573.862634] Call Trace:
      [  573.862644]  [<f80a70a8>] ? sctp_init+0xa8/0x7d4 [sctp]
      [  573.862650]  [<c018e2d4>] ? marker_update_probe_range+0x184/0x260
      [  573.862659]  [<f80a7000>] ? sctp_init+0x0/0x7d4 [sctp]
      [  573.862662]  [<c010112b>] ? do_one_initcall+0x2b/0x160
      [  573.862666]  [<c018f83f>] ? tracepoint_module_notify+0x2f/0x40
      [  573.862671]  [<c0557cad>] ? notifier_call_chain+0x2d/0x70
      [  573.862678]  [<c01588fd>] ? __blocking_notifier_call_chain+0x4d/0x60
      [  573.862682]  [<c016b2f1>] ? sys_init_module+0xb1/0x1f0
      [  573.862686]  [<c0102ffc>] ? sysenter_do_call+0x12/0x28
      [  573.862688] Code: 89 48 08 b8 04 00 00 00 e8 df aa ec ff ba f4 ff ff ff 85
      c0 89 43 14 74 31 b8 b0 18 71 c0 e8 19 b9 24 00 a1 c4 18 71 c0 8d 53 0c <89> 50
      04 89 43 0c b8 b0 18 71 c0 c7 43 10 c4 18 71 c0 89 15 c4
      [  573.862725] EIP: [<c0308b8f>] __percpu_counter_init+0x3f/0x70 SS:ESP
      0068:f69d5eec
      [  573.862730] CR2: 00000000f8214a24
      [  573.862734] ---[ end trace 39c4e0b55e7cf54d ]---
      Signed-off-by: NRafael Laufer <rlaufer@cisco.com>
      Signed-off-by: NVlad Yasevich <vladislav.yasevich@hp.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      418372b0
  3. 06 8月, 2009 1 次提交
  4. 07 7月, 2009 1 次提交
    • W
      sctp: fix warning at inet_sock_destruct() while release sctp socket · 1bc4ee40
      Wei Yongjun 提交于
      Commit 'net: Move rx skb_orphan call to where needed' broken sctp protocol
      with warning at inet_sock_destruct(). Actually, sctp can do this right with
      sctp_sock_rfree_frag() and sctp_skb_set_owner_r_frag() pair.
      
          sctp_sock_rfree_frag(skb);
          sctp_skb_set_owner_r_frag(skb, newsk);
      
      This patch not revert the commit d55d87fd,
      instead remove the sctp_sock_rfree_frag() function.
      
      ------------[ cut here ]------------
      WARNING: at net/ipv4/af_inet.c:151 inet_sock_destruct+0xe0/0x142()
      Modules linked in: sctp ipv6 dm_mirror dm_region_hash dm_log dm_multipath
      scsi_mod ext3 jbd uhci_hcd ohci_hcd ehci_hcd [last unloaded: scsi_wait_scan]
      Pid: 1808, comm: sctp_test Not tainted 2.6.31-rc2 #40
      Call Trace:
       [<c042dd06>] warn_slowpath_common+0x6a/0x81
       [<c064a39a>] ? inet_sock_destruct+0xe0/0x142
       [<c042dd2f>] warn_slowpath_null+0x12/0x15
       [<c064a39a>] inet_sock_destruct+0xe0/0x142
       [<c05fde44>] __sk_free+0x19/0xcc
       [<c05fdf50>] sk_free+0x18/0x1a
       [<ca0d14ad>] sctp_close+0x192/0x1a1 [sctp]
       [<c0649f7f>] inet_release+0x47/0x4d
       [<c05fba4d>] sock_release+0x19/0x5e
       [<c05fbab3>] sock_close+0x21/0x25
       [<c049c31b>] __fput+0xde/0x189
       [<c049c3de>] fput+0x18/0x1a
       [<c049988f>] filp_close+0x56/0x60
       [<c042f422>] put_files_struct+0x5d/0xa1
       [<c042f49f>] exit_files+0x39/0x3d
       [<c043086a>] do_exit+0x1a5/0x5dd
       [<c04a86c2>] ? d_kill+0x35/0x3b
       [<c0438fa4>] ? dequeue_signal+0xa6/0x115
       [<c0430d05>] do_group_exit+0x63/0x8a
       [<c0439504>] get_signal_to_deliver+0x2e1/0x2f9
       [<c0401d9e>] do_notify_resume+0x7c/0x6b5
       [<c043f601>] ? autoremove_wake_function+0x0/0x34
       [<c04a864e>] ? __d_free+0x3d/0x40
       [<c04a867b>] ? d_free+0x2a/0x3c
       [<c049ba7e>] ? vfs_write+0x103/0x117
       [<c05fc8fa>] ? sys_socketcall+0x178/0x182
       [<c0402a56>] work_notifysig+0x13/0x19
      ---[ end trace 9db92c463e789fba ]---
      Signed-off-by: NWei Yongjun <yjwei@cn.fujitsu.com>
      Acked-by: NHerbert Xu <herbert@gondor.apana.org.au>
      Acked-by: NVlad Yasevich <vladislav.yasevich@hp.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      1bc4ee40
  5. 30 6月, 2009 1 次提交
  6. 23 6月, 2009 1 次提交
  7. 18 6月, 2009 1 次提交
  8. 10 6月, 2009 1 次提交
  9. 09 6月, 2009 1 次提交
  10. 03 6月, 2009 11 次提交
  11. 28 4月, 2009 1 次提交
  12. 31 3月, 2009 1 次提交
    • A
      proc 2/2: remove struct proc_dir_entry::owner · 99b76233
      Alexey Dobriyan 提交于
      Setting ->owner as done currently (pde->owner = THIS_MODULE) is racy
      as correctly noted at bug #12454. Someone can lookup entry with NULL
      ->owner, thus not pinning enything, and release it later resulting
      in module refcount underflow.
      
      We can keep ->owner and supply it at registration time like ->proc_fops
      and ->data.
      
      But this leaves ->owner as easy-manipulative field (just one C assignment)
      and somebody will forget to unpin previous/pin current module when
      switching ->owner. ->proc_fops is declared as "const" which should give
      some thoughts.
      
      ->read_proc/->write_proc were just fixed to not require ->owner for
      protection.
      
      rmmod'ed directories will be empty and return "." and ".." -- no harm.
      And directories with tricky enough readdir and lookup shouldn't be modular.
      We definitely don't want such modular code.
      
      Removing ->owner will also make PDE smaller.
      
      So, let's nuke it.
      
      Kudos to Jeff Layton for reminding about this, let's say, oversight.
      
      http://bugzilla.kernel.org/show_bug.cgi?id=12454Signed-off-by: NAlexey Dobriyan <adobriyan@gmail.com>
      99b76233
  13. 22 3月, 2009 1 次提交
  14. 19 3月, 2009 1 次提交
  15. 14 3月, 2009 4 次提交
  16. 04 3月, 2009 1 次提交