]>
Commit | Line | Data |
---|---|---|
9534f53b JR |
1 | commit 0a9c73014415d2a84dac346c1e12169142a6ad37 |
2 | Author: Patrick McHardy <kaber@trash.net> | |
3 | Date: Tue Sep 11 11:33:28 2007 +0200 | |
4 | ||
5 | [INET_DIAG]: Fix oops in netlink_rcv_skb | |
6 | ||
7 | netlink_run_queue() doesn't handle multiple processes processing the | |
8 | queue concurrently. Serialize queue processing in inet_diag to fix | |
9 | a oops in netlink_rcv_skb caused by netlink_run_queue passing a | |
10 | NULL for the skb. | |
11 | ||
12 | BUG: unable to handle kernel NULL pointer dereference at virtual address 00000054 | |
13 | [349587.500454] printing eip: | |
14 | [349587.500457] c03318ae | |
15 | [349587.500459] *pde = 00000000 | |
16 | [349587.500464] Oops: 0000 [#1] | |
17 | [349587.500466] PREEMPT SMP | |
18 | [349587.500474] Modules linked in: w83627hf hwmon_vid i2c_isa | |
19 | [349587.500483] CPU: 0 | |
20 | [349587.500485] EIP: 0060:[<c03318ae>] Not tainted VLI | |
21 | [349587.500487] EFLAGS: 00010246 (2.6.22.3 #1) | |
22 | [349587.500499] EIP is at netlink_rcv_skb+0xa/0x7e | |
23 | [349587.500506] eax: 00000000 ebx: 00000000 ecx: c148d2a0 edx: c0398819 | |
24 | [349587.500510] esi: 00000000 edi: c0398819 ebp: c7a21c8c esp: c7a21c80 | |
25 | [349587.500517] ds: 007b es: 007b fs: 00d8 gs: 0033 ss: 0068 | |
26 | [349587.500521] Process oidentd (pid: 17943, ti=c7a20000 task=cee231c0 task.ti=c7a20000) | |
27 | [349587.500527] Stack: 00000000 c7a21cac f7c8ba78 c7a21ca4 c0331962 c0398819 f7c8ba00 0000004c | |
28 | [349587.500542] f736f000 c7a21cb4 c03988e3 00000001 f7c8ba00 c7a21cc4 c03312a5 0000004c | |
29 | [349587.500558] f7c8ba00 c7a21cd4 c0330681 f7c8ba00 e4695280 c7a21d00 c03307c6 7fffffff | |
30 | [349587.500578] Call Trace: | |
31 | [349587.500581] [<c010361a>] show_trace_log_lvl+0x1c/0x33 | |
32 | [349587.500591] [<c01036d4>] show_stack_log_lvl+0x8d/0xaa | |
33 | [349587.500595] [<c010390e>] show_registers+0x1cb/0x321 | |
34 | [349587.500604] [<c0103bff>] die+0x112/0x1e1 | |
35 | [349587.500607] [<c01132d2>] do_page_fault+0x229/0x565 | |
36 | [349587.500618] [<c03c8d3a>] error_code+0x72/0x78 | |
37 | [349587.500625] [<c0331962>] netlink_run_queue+0x40/0x76 | |
38 | [349587.500632] [<c03988e3>] inet_diag_rcv+0x1f/0x2c | |
39 | [349587.500639] [<c03312a5>] netlink_data_ready+0x57/0x59 | |
40 | [349587.500643] [<c0330681>] netlink_sendskb+0x24/0x45 | |
41 | [349587.500651] [<c03307c6>] netlink_unicast+0x100/0x116 | |
42 | [349587.500656] [<c0330f83>] netlink_sendmsg+0x1c2/0x280 | |
43 | [349587.500664] [<c02fcce9>] sock_sendmsg+0xba/0xd5 | |
44 | [349587.500671] [<c02fe4d1>] sys_sendmsg+0x17b/0x1e8 | |
45 | [349587.500676] [<c02fe92d>] sys_socketcall+0x230/0x24d | |
46 | [349587.500684] [<c01028d2>] syscall_call+0x7/0xb | |
47 | [349587.500691] ======================= | |
48 | [349587.500693] Code: f0 ff 4e 18 0f 94 c0 84 c0 0f 84 66 ff ff ff 89 f0 e8 86 e2 fc ff e9 5a ff ff ff f0 ff 40 10 eb be 55 89 e5 57 89 d7 56 89 c6 53 <8b> 50 54 83 fa 10 72 55 8b 9e 9c 00 00 00 31 c9 8b 03 83 f8 0f | |
49 | ||
50 | Reported by Athanasius <link@miggy.org> | |
51 | ||
52 | Signed-off-by: Patrick McHardy <kaber@trash.net> | |
53 | Signed-off-by: David S. Miller <davem@davemloft.net> | |
54 | ||
55 | diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c | |
56 | index dbeacd8..def007e 100644 | |
57 | --- a/net/ipv4/inet_diag.c | |
58 | +++ b/net/ipv4/inet_diag.c | |
59 | @@ -836,12 +836,16 @@ static int inet_diag_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh) | |
60 | return inet_diag_get_exact(skb, nlh); | |
61 | } | |
62 | ||
63 | +static DEFINE_MUTEX(inet_diag_mutex); | |
64 | + | |
65 | static void inet_diag_rcv(struct sock *sk, int len) | |
66 | { | |
67 | unsigned int qlen = 0; | |
68 | ||
69 | do { | |
70 | + mutex_lock(&inet_diag_mutex); | |
71 | netlink_run_queue(sk, &qlen, &inet_diag_rcv_msg); | |
72 | + mutex_unlock(&inet_diag_mutex); | |
73 | } while (qlen); | |
74 | } | |
75 |