There're some percpu_counter list corruption and poison overwritten warnings
in recent kernel, which is resulted by fc66f95c.
commit fc66f95c switches to use percpu_counter, in ip6_route_net_init, kernel
init the percpu_counter for dst entries, but, the percpu_counter is never destroyed
in ip6_route_net_exit. So if the related data is freed by kernel, the freed percpu_counter
is still on the list, then if we insert/remove other percpu_counter, list corruption
resulted. Also, if the insert/remove option modifies the ->prev,->next pointer of
the freed value, the poison overwritten is resulted then.
With the following patch, the percpu_counter list corruption and poison overwritten
warnings disappeared.
Signed-off-by: Xiaotian Feng <[email protected]>
Cc: "David S. Miller" <[email protected]>
Cc: Alexey Kuznetsov <[email protected]>
Cc: "Pekka Savola (ipv6)" <[email protected]>
Cc: James Morris <[email protected]>
Cc: Hideaki YOSHIFUJI <[email protected]>
Cc: Patrick McHardy <[email protected]>
---
net/ipv6/route.c | 2 ++
1 files changed, 2 insertions(+), 0 deletions(-)
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 25661f9..fc32833 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -2741,6 +2741,7 @@ static void __net_exit ip6_route_net_exit(struct net *net)
kfree(net->ipv6.ip6_prohibit_entry);
kfree(net->ipv6.ip6_blk_hole_entry);
#endif
+ dst_entries_destroy(&net->ipv6.ip6_dst_ops);
}
static struct pernet_operations ip6_route_net_ops = {
@@ -2832,5 +2833,6 @@ void ip6_route_cleanup(void)
xfrm6_fini();
fib6_gc_cleanup();
unregister_pernet_subsys(&ip6_route_net_ops);
+ dst_entries_destroy(&ip6_dst_blackhole_ops);
kmem_cache_destroy(ip6_dst_ops_template.kmem_cachep);
}
--
1.7.3.2
Le mercredi 03 novembre 2010 à 10:11 +0800, Xiaotian Feng a écrit :
> There're some percpu_counter list corruption and poison overwritten warnings
> in recent kernel, which is resulted by fc66f95c.
>
> commit fc66f95c switches to use percpu_counter, in ip6_route_net_init, kernel
> init the percpu_counter for dst entries, but, the percpu_counter is never destroyed
> in ip6_route_net_exit. So if the related data is freed by kernel, the freed percpu_counter
> is still on the list, then if we insert/remove other percpu_counter, list corruption
> resulted. Also, if the insert/remove option modifies the ->prev,->next pointer of
> the freed value, the poison overwritten is resulted then.
>
> With the following patch, the percpu_counter list corruption and poison overwritten
> warnings disappeared.
>
> Signed-off-by: Xiaotian Feng <[email protected]>
> Cc: "David S. Miller" <[email protected]>
> Cc: Alexey Kuznetsov <[email protected]>
> Cc: "Pekka Savola (ipv6)" <[email protected]>
> Cc: James Morris <[email protected]>
> Cc: Hideaki YOSHIFUJI <[email protected]>
> Cc: Patrick McHardy <[email protected]>
> ---
Good catch, thanks !
Any reason you didnt Cc me (the author of the patch) ?
Acked-by: Eric Dumazet <[email protected]>
On 11/03/2010 01:22 PM, Eric Dumazet wrote:
> Le mercredi 03 novembre 2010 à 10:11 +0800, Xiaotian Feng a écrit :
>> There're some percpu_counter list corruption and poison overwritten warnings
>> in recent kernel, which is resulted by fc66f95c.
>>
>> commit fc66f95c switches to use percpu_counter, in ip6_route_net_init, kernel
>> init the percpu_counter for dst entries, but, the percpu_counter is never destroyed
>> in ip6_route_net_exit. So if the related data is freed by kernel, the freed percpu_counter
>> is still on the list, then if we insert/remove other percpu_counter, list corruption
>> resulted. Also, if the insert/remove option modifies the ->prev,->next pointer of
>> the freed value, the poison overwritten is resulted then.
>>
>> With the following patch, the percpu_counter list corruption and poison overwritten
>> warnings disappeared.
>>
>> Signed-off-by: Xiaotian Feng<[email protected]>
>> Cc: "David S. Miller"<[email protected]>
>> Cc: Alexey Kuznetsov<[email protected]>
>> Cc: "Pekka Savola (ipv6)"<[email protected]>
>> Cc: James Morris<[email protected]>
>> Cc: Hideaki YOSHIFUJI<[email protected]>
>> Cc: Patrick McHardy<[email protected]>
>> ---
>
> Good catch, thanks !
>
> Any reason you didnt Cc me (the author of the patch) ?
Sorry, I just used get_maintainer.pl to get the cc list...
>
> Acked-by: Eric Dumazet<[email protected]>
>
>
>
>
From: Eric Dumazet <[email protected]>
Date: Wed, 03 Nov 2010 06:22:53 +0100
> Le mercredi 03 novembre 2010 ? 10:11 +0800, Xiaotian Feng a ?crit :
>> There're some percpu_counter list corruption and poison overwritten warnings
>> in recent kernel, which is resulted by fc66f95c.
>>
>> commit fc66f95c switches to use percpu_counter, in ip6_route_net_init, kernel
>> init the percpu_counter for dst entries, but, the percpu_counter is never destroyed
>> in ip6_route_net_exit. So if the related data is freed by kernel, the freed percpu_counter
>> is still on the list, then if we insert/remove other percpu_counter, list corruption
>> resulted. Also, if the insert/remove option modifies the ->prev,->next pointer of
>> the freed value, the poison overwritten is resulted then.
>>
>> With the following patch, the percpu_counter list corruption and poison overwritten
>> warnings disappeared.
>>
>> Signed-off-by: Xiaotian Feng <[email protected]>
...
> Acked-by: Eric Dumazet <[email protected]>
Applied, thanks!