[2.5.69-mm1] kernel BUG at include/linux/module.h:284!

[2.5.69-mm1] kernel BUG at include/linux/module.h:284!

[Kimmo Sundqvist]

Got one like this...

------------[ cut here ]------------
kernel BUG at include/linux/module.h:284!
invalid operand: 0000 [#1]
CPU:    0
EIP:    0060:[<f8d4c1e5>]    Not tainted VLI
EFLAGS: 00010246
EIP is at inet6_create+0x191/0x3e0 [ipv6]
eax: 00000000   ebx: f6614000   ecx: 00000002   edx: f8d7ed20
esi: f657ebe0   edi: 0000003a   ebp: f6615f40   esp: f6615f30
ds: 007b   es: 007b   ss: 0068
Process modprobe (pid: 245, threadinfo=f6614000 task=f78086e0)
Stack: 00000001 f76c14e0 00000028 f8d7d060 ffffff9f c0232b51 f76c14e0 0000003a
       00000000 f8d7f848 c03033dc 00000000 c01211c4 f8d7e494 f7fe7f20 f6f0e4c0
              f8d7e4ec c03033dc f6614000 f8d739e7 f8d07621 0000000a 00000003
0000003a
Call Trace:
 [<f8d7d060>] rawv6_protosw+0x0/0x20 [ipv6]
 [<c0232b51>] sock_create+0x149/0x264
 [<f8d7f848>] __icmpv6_socket+0x0/0x8 [ipv6]
 [<c01211c4>] register_proc_table+0x100/0x118
 [<f8d7e494>] ipv6_net_table+0x0/0x58 [ipv6]
 [<f8d7e4ec>] ipv6_root_table+0x0/0x74 [ipv6]
 [<f8d739e7>] in6addr_loopback+0x3a0b/0x4de4 [ipv6]
 [<f8d07621>] icmpv6_init+0x31/0x140 [ipv6]
 [<f8d7f848>] __icmpv6_socket+0x0/0x8 [ipv6]
 [<f8d7ece0>] +0x0/0x100 [ipv6]
 [<f8d07149>] inet6_init+0xe9/0x2b0 [ipv6]
 [<f8d7d048>] inet6_family_ops+0x0/0x18 [ipv6]
 [<c01308ba>] sys_init_module+0x10e/0x1b0
 [<c0108e1f>] syscall_call+0x7/0xb

    Code: 00 74 08 0f 0b 1e 01 e5 f4 d6 f8 c7 86 2c 01 00 00 e0 ec d7 f8 b8 e0 
ec d7 f8 85 c0 74 38 50 e8 e6 30 3e c7 83 c4 04 85 c0 75 0b <0f> 0b 1c 01 e7 
f3 d6 f8 8d 76 00 ff 43 14 8b 43 10 c1 e0 05 05


*** lspci ***

00:00.0 Host bridge: VIA Technologies, Inc. VT82C693A/694x [Apollo PRO133x] 
(rev c4)
00:01.0 PCI bridge: VIA Technologies, Inc. VT82C598/694x [Apollo MVP3/Pro133x 
AGP]
00:07.0 ISA bridge: VIA Technologies, Inc. VT82C686 [Apollo Super South] (rev 
40)
00:07.1 IDE interface: VIA Technologies, Inc. Bus Master IDE (rev 06)
00:07.2 USB Controller: VIA Technologies, Inc. UHCI USB (rev 16)
00:07.3 USB Controller: VIA Technologies, Inc. UHCI USB (rev 16)
00:07.4 Bridge: VIA Technologies, Inc. VT82C686 [Apollo Super ACPI] (rev 40)
00:0b.0 Multimedia audio controller: Ensoniq 5880 AudioPCI (rev 02)
00:0c.0 Ethernet controller: 3Com Corporation 3c900 Combo [Boomerang]
00:0e.0 Unknown mass storage controller: Triones Technologies, Inc. HPT366 / 
HPT370 (rev 03)
01:00.0 VGA compatible controller: Matrox Graphics, Inc. MGA G200 AGP (rev 03)

*** cat /proc/modules ***

ppp_async 9920 1 [unsafe], Live 0xf8d12000
ipv6 214884 0 - Loading 0xf8d4c000
microcode 5600 0 - Live 0xf8d0a000
nls_iso8859_1 4256 1 - Live 0xf8c58000
nls_cp437 5920 1 - Live 0xf8c42000
vfat 13504 1 - Live 0xf8c45000
fat 41120 1 vfat, Live 0xf8c4c000
msr 3424 0 - Live 0xf8940000
minix 30340 0 - Live 0xf898e000
via686a 16580 0 - Live 0xf8963000
i2c_sensor 2848 1 via686a, Live 0xf893e000
hfs 92960 0 - Live 0xf8976000
ppp_synctty 8224 0 - Live 0xf8942000
ppp_generic 27848 4 ppp_async,ppp_synctty, Live 0xf8954000
slhc 6272 1 ppp_generic, Live 0xf8934000
3c59x 30120 1 - Live 0xf894b000
i2c_core 18304 2 via686a,i2c_sensor, Live 0xf8938000

gcc version 2.95.4 20011002 (Debian prerelease)
Linux minjami 2.5.69-mm1 #1 SMP Tue May 6 14:04:44 EEST 2003 i686 unknown

-Kimmo S.

Re: [2.5.69-mm1] kernel BUG at include/linux/module.h:284!

[David S. Miller]

[-- Attachment #1: Type: text/plain, Size: 621 bytes --]

On Tue, 2003-05-06 at 05:44, Kimmo Sundqvist wrote:
> Got one like this...
...
> Call Trace:
>  [<f8d7d060>] rawv6_protosw+0x0/0x20 [ipv6]
>  [<c0232b51>] sock_create+0x149/0x264
>  [<f8d7f848>] __icmpv6_socket+0x0/0x8 [ipv6]

Crap.  Well, two problems. Attached is a fix for the first
one, the second one is harder.

Arnaldo, ipv6 creates a socket of it's own type during
module init, try_module_get() on the current module fails
during module load... do you see the problem?

Rusty, you said you were working on a solution for modules
that call themselves during their own init?

-- 
David S. Miller <davem@redhat.com>

[-- Attachment #2: diff --]
[-- Type: text/plain, Size: 1369 bytes --]

# This is a BitKeeper generated patch for the following project:
# Project Name: Linux kernel tree
# This patch format is intended for GNU patch command version 2.5 or higher.
# This patch includes the following deltas:
#	           ChangeSet	1.1074  -> 1.1075 
#	 net/ipv6/af_inet6.c	1.32    -> 1.33   
#
# The following is the BitKeeper ChangeSet Log
# --------------------------------------------
# 03/05/06	davem@nuts.ninka.net	1.1075
# [IPV6]: Kill spurious module_{get,put}().
# --------------------------------------------
#
diff -Nru a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
--- a/net/ipv6/af_inet6.c	Tue May  6 06:16:05 2003
+++ b/net/ipv6/af_inet6.c	Tue May  6 06:16:05 2003
@@ -111,7 +111,6 @@
 #ifdef INET_REFCNT_DEBUG
 	atomic_dec(&inet6_sock_nr);
 #endif
-	module_put(THIS_MODULE);
 }
 
 static __inline__ kmem_cache_t *inet6_sk_slab(int protocol)
@@ -243,11 +242,6 @@
 	atomic_inc(&inet6_sock_nr);
 	atomic_inc(&inet_sock_nr);
 #endif
-	if (!try_module_get(THIS_MODULE)) {
-		inet_sock_release(sk);
-		return -EBUSY;
-	}
-
 	if (inet->num) {
 		/* It assumes that any protocol which allows
 		 * the user to assign a number at socket
@@ -259,7 +253,6 @@
 	if (sk->prot->init) {
 		int err = sk->prot->init(sk);
 		if (err != 0) {
-			module_put(THIS_MODULE);
 			inet_sock_release(sk);
 			return err;
 		}

Re: [2.5.69-mm1] kernel BUG at include/linux/module.h:284!

[Rusty Russell]

In message <1052227331.983.46.camel@rth.ninka.net> you write:
> Arnaldo, ipv6 creates a socket of it's own type during
> module init, try_module_get() on the current module fails
> during module load... do you see the problem?
> 
> Rusty, you said you were working on a solution for modules
> that call themselves during their own init?

In fact, it's backwards.  Currently we *do* allow try_module_get()
during init:

/* FIXME: It'd be nice to isolate modules during init, too, so they
   aren't used before they (may) fail.  But presently too much code
   (IDE & SCSI) require entry into the module during init. */
static inline int module_is_live(struct module *mod)
{
	return mod->state != MODULE_STATE_GOING;
}

This probably won't change before 2.6: sure, there are races, but
we've lived with them so far.  I don't like it, but that's the
Realpolitik of the Linux Kernel.

There are a few ways of fixing it.  Viro suggested every interface be
explicitly split into "reserve and commit".  To put it mildly, I shy
away from changing every module for an obscure race which so few
people understand anyway.  There's the make_module_live() function,
where a module says "I'm finished init already".  Of course, you can't
fail initialization after this.  Or, the current module notifier could
be extended, to have an event after module init.

None of these would be one-liners for IPv6, AFAICT.

Hope that clarifies,
Rusty.
--
  Anyone who quotes me in their sig is an idiot. -- Rusty Russell.

Re: [2.5.69-mm1] kernel BUG at include/linux/module.h:284!

[David S. Miller]

   From: Rusty Russell <rusty@rustcorp.com.au>
   Date: Wed, 07 May 2003 13:48:15 +1000

   In message <1052227331.983.46.camel@rth.ninka.net> you write:
   > Arnaldo, ipv6 creates a socket of it's own type during
   > module init, try_module_get() on the current module fails
   > during module load... do you see the problem?
   > 
   > Rusty, you said you were working on a solution for modules
   > that call themselves during their own init?
   
   In fact, it's backwards.

You're, of course, right.  I misread the bug report, and this
patch below ought to fix it.  It's untested, but I'll do that in
a bit and push upstream.

# This is a BitKeeper generated patch for the following project:
# Project Name: Linux kernel tree
# This patch format is intended for GNU patch command version 2.5 or higher.
# This patch includes the following deltas:
#	           ChangeSet	1.1083  -> 1.1084 
#	  net/ipv4/af_inet.c	1.44    -> 1.45   
#	 net/ipv6/af_inet6.c	1.33    -> 1.34   
#
# The following is the BitKeeper ChangeSet Log
# --------------------------------------------
# 03/05/06	davem@nuts.ninka.net	1.1084
# [IPV4/IPV6]: Set owner field in family ops.
# --------------------------------------------
#
diff -Nru a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
--- a/net/ipv4/af_inet.c	Tue May  6 23:58:43 2003
+++ b/net/ipv4/af_inet.c	Tue May  6 23:58:43 2003
@@ -926,6 +926,7 @@
 struct net_proto_family inet_family_ops = {
 	.family = PF_INET,
 	.create = inet_create,
+	.owner	= THIS_MODULE,
 };
 
 
diff -Nru a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
--- a/net/ipv6/af_inet6.c	Tue May  6 23:58:43 2003
+++ b/net/ipv6/af_inet6.c	Tue May  6 23:58:43 2003
@@ -535,6 +535,7 @@
 struct net_proto_family inet6_family_ops = {
 	.family = PF_INET6,
 	.create = inet6_create,
+	.owner	= THIS_MODULE,
 };
 
 #ifdef MODULE