Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1758227Ab2HURSH (ORCPT ); Tue, 21 Aug 2012 13:18:07 -0400 Received: from mail-qc0-f174.google.com ([209.85.216.174]:45950 "EHLO mail-qc0-f174.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1758022Ab2HURSC convert rfc822-to-8bit (ORCPT ); Tue, 21 Aug 2012 13:18:02 -0400 MIME-Version: 1.0 In-Reply-To: <5033B199.6080305@parallels.com> References: <20120809124436.5156.26944.stgit@localhost.localdomain> <20120809.161639.1789560369123168415.davem@davemloft.net> <5033B199.6080305@parallels.com> Date: Tue, 21 Aug 2012 13:18:01 -0400 Message-ID: Subject: Re: [PATCH] tun: don't zeroize sock->file on detach From: Neal Cardwell To: Stanislav Kinsbursky Cc: David Miller , "dhowells@redhat.com" , "netdev@vger.kernel.org" , "rick.jones2@hp.com" , "ycheng@google.com" , "linux-kernel@vger.kernel.org" , mikulas@artax.karlin.mff.cuni.cz Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8BIT X-System-Of-Record: true Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2143 Lines: 56 On Tue, Aug 21, 2012 at 12:04 PM, Stanislav Kinsbursky wrote: > 10.08.2012 03:16, David Miller пишет: > >> From: Stanislav Kinsbursky >> Date: Thu, 09 Aug 2012 16:50:40 +0400 >> >>> This is a fix for bug, introduced in 3.4 kernel by commit >>> 1ab5ecb90cb6a3df1476e052f76a6e8f6511cb3d, which, among other things, >>> replaced >>> simple sock_put() by sk_release_kernel(). Below is sequence, which leads >>> to >>> oops for non-persistent devices: >>> >>> tun_chr_close() >>> tun_detach() <== tun->socket.file = NULL >>> tun_free_netdev() >>> sk_release_sock() >>> sock_release(sock->file == NULL) >>> iput(SOCK_INODE(sock)) <== dereference on NULL pointer >>> >>> This patch just removes zeroing of socket's file from __tun_detach(). >>> sock_release() will do this. >>> >>> Cc: stable@vger.kernel.org >>> Reported-by: Ruan Zhijie >>> Tested-by: Ruan Zhijie >>> Acked-by: Al Viro >>> Acked-by: Eric Dumazet >>> Acked-by: Yuchung Cheng >>> Signed-off-by: Stanislav Kinsbursky >> >> >> Applied, thanks. >> > > Hi, David. > I found out, that this commit: b09e786bd1dd66418b69348cb110f3a64764626a > was previous attempt to fix the problem. > I believe this commit have to be dropped. Have you tried testing with that commit reverted? AFAICT from reading the code, if you revert b09e786bd1dd66418b69348cb110f3a64764626a then the sockets_in_use count becomes incorrect, because sock_release() will be calling this_cpu_sub() for each tun socket teardown when there was no corresponding this_cpu_add() for the tun socket (because the tun socket is not allocated with sock_alloc()). Can you sketch in more detail why that commit should be dropped? neal -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/