From: Linus Torvalds <torvalds@linux-foundation.org>
To: Ingo Molnar <mingo@elte.hu>
Cc: David Miller <davem@davemloft.net>,
Thomas Gleixner <tglx@linutronix.de>,
Andrew Morton <akpm@linux-foundation.org>,
netdev@vger.kernel.org,
Linux Kernel Mailing List <linux-kernel@vger.kernel.org>
Subject: Re: boot crash in arp_error_report() (Re: [GIT] Networking)
Date: Thu, 27 May 2010 12:27:56 -0700 (PDT) [thread overview]
Message-ID: <alpine.LFD.2.00.1005271213091.3689@i5.linux-foundation.org> (raw)
In-Reply-To: <20100527190652.GA20303@elte.hu>
On Thu, 27 May 2010, Ingo Molnar wrote:
>
> FYI, this boot crash in arp_error_report() started triggering in -tip testing:
>
> [ 113.285384] BUG: unable to handle kernel paging request at 6b6b6b87
That's the POISON_FREE signature, with an offset of 28 (0x1c).
And it looks like the whole function got captured in the Code: sequence.
It looks like this:
0: 55 push %ebp
1: 89 e5 mov %esp,%ebp
3: 53 push %ebx
4: 0f 1f 44 00 00 nopl 0x0(%eax,%eax,1)
9: 89 d3 mov %edx,%ebx
b: 89 d0 mov %edx,%eax
d: e8 fa fb ff ff call 0xfffffc0c # skb_dst()
12: 85 c0 test %eax,%eax # dst
14: 74 12 je 0x28
16: 8b 40 40 mov 0x40(%eax),%eax # dst->ops
19: 85 c0 test %eax,%eax
1b: 74 0b je 0x28
1d:* 8b 50 1c mov 0x1c(%eax),%edx <-- trapping instruction
20: 85 d2 test %edx,%edx
22: 74 04 je 0x28
24: 89 d8 mov %ebx,%eax
26: ff d2 call *%edx # dst->ops->link_failure()
28: 89 d8 mov %ebx,%eax
2a: e8 9b 50 fa ff call 0xfffa50ca # skb_free()
2f: 5b pop %ebx
30: 5d pop %ebp
31: c3 ret
Where most of it is "dst_link_failure()" being inlined (that last "callq"
is the call to kfree_skb().
Looks like 'dst' points to free'd memory, so when we load a pointer from
it (the dst->ops) field, we get 0x6b6b6b6b, and then when we try to load
dst->ops->link_failure it oopses.
tl;dr: that
struct dst_entry *dst = skb_dst(skb);
in dst_link_failure seems to result in a stale skb.
Linus
next prev parent reply other threads:[~2010-05-27 19:31 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2010-05-25 23:59 [GIT] Networking David Miller
2010-05-27 19:06 ` boot crash in arp_error_report() (Re: [GIT] Networking) Ingo Molnar
2010-05-27 19:27 ` Linus Torvalds [this message]
2010-05-27 19:47 ` Eric Dumazet
2010-05-27 20:18 ` Eric Dumazet
2010-05-27 23:10 ` boot crash in arp_error_report() David Miller
2010-05-28 8:05 ` Ingo Molnar
2010-05-28 8:24 ` Ingo Molnar
2010-05-28 8:53 ` David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=alpine.LFD.2.00.1005271213091.3689@i5.linux-foundation.org \
--to=torvalds@linux-foundation.org \
--cc=akpm@linux-foundation.org \
--cc=davem@davemloft.net \
--cc=linux-kernel@vger.kernel.org \
--cc=mingo@elte.hu \
--cc=netdev@vger.kernel.org \
--cc=tglx@linutronix.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.