[OOPS] less /proc/net/igmp

[OOPS] less /proc/net/igmp

[Marcel Sebek]

This Oops appears on 2.5.74+ kernels (including 2.6.0-test4) when
I'm trying to read /proc/net/igmp with 'less', 'cat' displays
the file content without oops:

LILO boot: linux init=/bin/bash
 ...
[snip]
 ...
bash# mount /proc
bash# cat /proc/net/igmp
Idx	Device    : Count Querier	Group    Users Timer	Reporter
bash# less /proc/net/igmp
Idx	Device    : Count Querier	Group    Users Timer	Reporter
bash# ifup -a
bash# cat /proc/net/igmp
Idx	Device    : Count Querier	Group    Users Timer	Reporter
1	lo        :     0      V2
				010000E0     1 0:FFFA22F0		0
bash# less /proc/net/igmp
Unable to handle kernel paging request at virtual address 08051be0
 printing eip:
08051be0
*pde = 0fb66067
*pfe = 00000000
Oops: 0004 [#1]
CPU:    0
EIP:    0073:[<08051be0>]    Not tainted
EFLAGS: 00010246
EIP is at 0x8051be0
eax: 0805fb68   ebx: 00000001   ecx: 00000000   edx: 00000019
esi: 08060649   edi: 08057543   ebp: bffffd8c   esp: bfffda50
ds: 007b   es: 007b   ss: 007b
Process less (pid 20, threadinfo = cfab6000 task = c13560cd)
 <0>Kernel panic: Fatal exception in interrupt
In interrupt handler - not syncing


EIP points to the begin of the function clr_linenum() in
less-374/linenum.c:78 (instruction 'push %ebp').

Kernel is compiled by gcc-2.95.4 (20011002) from Debian woody.
Less is from woody and also from the original sources.


-- 
Marcel Sebek
jabber: sebek@jabber.cz                     ICQ: 279852819
linux user number: 307850                 GPG ID: 5F88735E
GPG FP: 0F01 BAB8 3148 94DB B95D  1FCA 8B63 CA06 5F88 735E

Re: [OOPS] less /proc/net/igmp

[Nagendra Singh Tomar]

Hi Marcel,
	 I don't have the kernel, I didn't try it also, but I have faced 
a similar problem sometimes back so I feel that it might be the same 
problem. I have posted a similar question sometimes back on this list.
If you do an strace of both 'cat' and 'less' you will see that 'cat' does 
not maintain the offset into the file in the application. It just believes 
that subsequent reads will give data after the point it has read, 'less'( 
as well as brother 'more') 
on the other hand does an lseek(fd, last_read_return_value, SEEK_SET) 
after every read, then it issues a read call. 
Now if you see proc_file_read() in the kernel source, you will see that to 
support proc files which are more than PAGE_SIZE long, they have a hack 
that it allows the caller to interpret the offset not as byte offsets but 
as anything, mostly number of records read ..
I feel ur /proc/net/igmp file is more than a PAGE_SIZE long, because that 
is when this problem is more likely to happen, but it can happen otherwise 
also if things are not handled properly.
The problem is probably in  the proc_read function of /proc/net/igmp

Thanx
tomar




 On Mon, 25 Aug 2003, Marcel Sebek wrote:

> This Oops appears on 2.5.74+ kernels (including 2.6.0-test4) when
> I'm trying to read /proc/net/igmp with 'less', 'cat' displays
> the file content without oops:
> 
> LILO boot: linux init=/bin/bash
>  ...
> [snip]
>  ...
> bash# mount /proc
> bash# cat /proc/net/igmp
> Idx	Device    : Count Querier	Group    Users Timer	Reporter
> bash# less /proc/net/igmp
> Idx	Device    : Count Querier	Group    Users Timer	Reporter
> bash# ifup -a
> bash# cat /proc/net/igmp
> Idx	Device    : Count Querier	Group    Users Timer	Reporter
> 1	lo        :     0      V2
> 				010000E0     1 0:FFFA22F0
> 0
> bash# less /proc/net/igmp
> Unable to handle kernel paging request at virtual address 08051be0
>  printing eip:
> 08051be0
> *pde = 0fb66067
> *pfe = 00000000
> Oops: 0004 [#1]
> CPU:    0
> EIP:    0073:[<08051be0>]    Not tainted
> EFLAGS: 00010246
> EIP is at 0x8051be0
> eax: 0805fb68   ebx: 00000001   ecx: 00000000   edx: 00000019
> esi: 08060649   edi: 08057543   ebp: bffffd8c   esp: bfffda50
> ds: 007b   es: 007b   ss: 007b
> Process less (pid 20, threadinfo = cfab6000 task = c13560cd)
>  <0>Kernel panic: Fatal exception in interrupt
> In interrupt handler - not syncing
> 
> 
> EIP points to the begin of the function clr_linenum() in
> less-374/linenum.c:78 (instruction 'push %ebp').
> 
> Kernel is compiled by gcc-2.95.4 (20011002) from Debian woody.
> Less is from woody and also from the original sources.
> 
> 
> 

Re: [OOPS] less /proc/net/igmp

[YOSHIFUJI Hideaki / 吉藤英明]

Hello.

In article <20030825163206.GA1340@penguin.penguin> (at Mon, 25 Aug 2003 18:32:06 +0200), Marcel Sebek <sebek64@post.cz> says:

> This Oops appears on 2.5.74+ kernels (including 2.6.0-test4) when
> I'm trying to read /proc/net/igmp with 'less', 'cat' displays
> the file content without oops:
:
> [snip]
>  ...
> bash# mount /proc
> bash# cat /proc/net/igmp
> Idx	Device    : Count Querier	Group    Users Timer	Reporter
> bash# less /proc/net/igmp
> Idx	Device    : Count Querier	Group    Users Timer	Reporter
> bash# ifup -a
> bash# cat /proc/net/igmp
> Idx	Device    : Count Querier	Group    Users Timer	Reporter
> 1	lo        :     0      V2
> 				010000E0     1 0:FFFA22F0		0
> bash# less /proc/net/igmp
> Unable to handle kernel paging request at virtual address 08051be0
>  printing eip:
> 08051be0
> *pde = 0fb66067
> *pfe = 00000000
> Oops: 0004 [#1]
> CPU:    0
> EIP:    0073:[<08051be0>]    Not tainted
> EFLAGS: 00010246
> EIP is at 0x8051be0
> eax: 0805fb68   ebx: 00000001   ecx: 00000000   edx: 00000019
> esi: 08060649   edi: 08057543   ebp: bffffd8c   esp: bfffda50
> ds: 007b   es: 007b   ss: 007b
> Process less (pid 20, threadinfo = cfab6000 task = c13560cd)
>  <0>Kernel panic: Fatal exception in interrupt
> In interrupt handler - not syncing

I could not reproduce this issue.  anyone?

-- 
Hideaki YOSHIFUJI @ USAGI Project <yoshfuji@linux-ipv6.org>
GPG FP: 9022 65EB 1ECF 3AD1 0BDF  80D8 4807 F894 E062 0EEA

Re: [OOPS] less /proc/net/igmp

[Owen Ford]

[-- Attachment #1: Type: text/plain, Size: 1659 bytes --]

On Tue, 2003-08-26 at 01:03, YOSHIFUJI Hideaki / 吉藤英明 wrote:
> Hello.
> 
> In article <20030825163206.GA1340@penguin.penguin> (at Mon, 25 Aug 2003 18:32:06 +0200), Marcel Sebek <sebek64@post.cz> says:
> 
> > This Oops appears on 2.5.74+ kernels (including 2.6.0-test4) when
> > I'm trying to read /proc/net/igmp with 'less', 'cat' displays
> > the file content without oops:
> :
> > [snip]
> >  ...
> > bash# mount /proc
> > bash# cat /proc/net/igmp
> > Idx	Device    : Count Querier	Group    Users Timer	Reporter
> > bash# less /proc/net/igmp
> > Idx	Device    : Count Querier	Group    Users Timer	Reporter
> > bash# ifup -a
> > bash# cat /proc/net/igmp
> > Idx	Device    : Count Querier	Group    Users Timer	Reporter
> > 1	lo        :     0      V2
> > 				010000E0     1 0:FFFA22F0		0
> > bash# less /proc/net/igmp
> > Unable to handle kernel paging request at virtual address 08051be0
> >  printing eip:
> > 08051be0
> > *pde = 0fb66067
> > *pfe = 00000000
> > Oops: 0004 [#1]
> > CPU:    0
> > EIP:    0073:[<08051be0>]    Not tainted
> > EFLAGS: 00010246
> > EIP is at 0x8051be0
> > eax: 0805fb68   ebx: 00000001   ecx: 00000000   edx: 00000019
> > esi: 08060649   edi: 08057543   ebp: bffffd8c   esp: bfffda50
> > ds: 007b   es: 007b   ss: 007b
> > Process less (pid 20, threadinfo = cfab6000 task = c13560cd)
> >  <0>Kernel panic: Fatal exception in interrupt
> > In interrupt handler - not syncing
> 
> I could not reproduce this issue.  anyone?

I can confirm. I have it with 2.6.0-test4.

Let me know what useful info I can provide.  The oops is the same.

-- 
Owen Ford <oford@arghblech.com>

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: [OOPS] less /proc/net/igmp

[Christian Axelsson]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

I can verify this on 2.6.0-test4-mm1 and 2.6.0-test3-mm4

- --
Christan Axelsson
smiler@lanil.mine.nu
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQE/SwEbyqbmAWw8VdkRAg6SAJ98RVCbWmsVTH/vtg0McK7vSshn4QCffiI9
q7B10AWRBqYC64JD0UHG6LQ=
=lpLs
-----END PGP SIGNATURE-----

Re: [OOPS] less /proc/net/igmp

[Owen Ford]

[-- Attachment #1: Type: text/plain, Size: 883 bytes --]

On Tue, 2003-08-26 at 01:41, Christian Axelsson wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> I can verify this on 2.6.0-test4-mm1 and 2.6.0-test3-mm4
> 
> - --
> Christan Axelsson
> smiler@lanil.mine.nu
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.2.2 (GNU/Linux)
> Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org
> 
> iD8DBQE/SwEbyqbmAWw8VdkRAg6SAJ98RVCbWmsVTH/vtg0McK7vSshn4QCffiI9
> q7B10AWRBqYC64JD0UHG6LQ=
> =lpLs
> -----END PGP SIGNATURE-----
> 
> 
> -
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at  http://www.tux.org/lkml/

It goes back even farther.  I have it with all of the 2.6 series.
-- 
Owen Ford <oford@arghblech.com>

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: [OOPS] less /proc/net/igmp

[YOSHIFUJI Hideaki / 吉藤英明]

Please CC: netdev.

In article <1061878985.3463.2.camel@spider.hotmonkeyporn.com> (at 26 Aug 2003 01:23:06 -0500), Owen Ford <oford@arghblech.com> says:

> > I could not reproduce this issue.  anyone?
> 
> I can confirm. I have it with 2.6.0-test4.
> 
> Let me know what useful info I can provide.  The oops is the same.

Okay, everyone. I'll try to fix this.

-- 
Hideaki YOSHIFUJI @ USAGI Project <yoshfuji@linux-ipv6.org>
GPG FP: 9022 65EB 1ECF 3AD1 0BDF  80D8 4807 F894 E062 0EEA

Re: [OOPS] less /proc/net/igmp

[James Morris]

On Tue, 26 Aug 2003, YOSHIFUJI Hideaki / [iso-2022-jp] ^[$B5HF#1QL@^[(B wrote:

> I could not reproduce this issue.  anyone?

'less /proc/net/igmp' does it for me.


- James
-- 
James Morris
<jmorris@intercode.com.au>

Re: [OOPS] less /proc/net/igmp

[YOSHIFUJI Hideaki / 吉藤英明]

Hello.

In article <20030826.173226.114994096.yoshfuji@linux-ipv6.org> (at Tue, 26 Aug 2003 17:32:26 +0900 (JST)), YOSHIFUJI Hideaki / 吉藤英明 <yoshfuji@linux-ipv6.org> says:

> > I can confirm. I have it with 2.6.0-test4.
> > 
> > Let me know what useful info I can provide.  The oops is the same.
> 
> Okay, everyone. I'll try to fix this.

Please try this patch.

Index: linux-2.6/net/ipv4/igmp.c
===================================================================
RCS file: /home/cvs/linux-2.5/net/ipv4/igmp.c,v
retrieving revision 1.33
diff -u -r1.33 igmp.c
--- linux-2.6/net/ipv4/igmp.c	21 Aug 2003 17:47:23 -0000	1.33
+++ linux-2.6/net/ipv4/igmp.c	26 Aug 2003 15:18:03 -0000
@@ -2122,6 +2122,7 @@
 			break;
 		}
 		read_unlock(&in_dev->lock);
+		in_dev_put(in_dev);
 	}
 	return im;
 }
@@ -2181,7 +2182,9 @@
 	if (likely(state->in_dev != NULL)) {
 		read_unlock(&state->in_dev->lock);
 		in_dev_put(state->in_dev);
+		state->in_dev = NULL;
 	}
+	state->dev = NULL;
 	read_unlock(&dev_base_lock);
 }
 
@@ -2284,6 +2287,7 @@
 			spin_unlock_bh(&im->lock);
 		}
 		read_unlock_bh(&idev->lock);
+		in_dev_put(idev);
 	}
 	return psf;
 }
@@ -2350,12 +2354,16 @@
 static void igmp_mcf_seq_stop(struct seq_file *seq, void *v)
 {
 	struct igmp_mcf_iter_state *state = igmp_mcf_seq_private(seq);
-	if (likely(state->im != NULL))
+	if (likely(state->im != NULL)) {
 		spin_unlock_bh(&state->im->lock);
+		state->im = NULL;
+	}
 	if (likely(state->idev != NULL)) {
 		read_unlock_bh(&state->idev->lock);
 		in_dev_put(state->idev);
+		state->idev = NULL;
 	}
+	state->dev = NULL;
 	read_unlock(&dev_base_lock);
 }
 
Index: linux-2.6/net/ipv6/mcast.c
===================================================================
RCS file: /home/cvs/linux-2.5/net/ipv6/mcast.c,v
retrieving revision 1.30
diff -u -r1.30 mcast.c
--- linux-2.6/net/ipv6/mcast.c	21 Aug 2003 23:44:54 -0000	1.30
+++ linux-2.6/net/ipv6/mcast.c	26 Aug 2003 15:18:03 -0000
@@ -2078,6 +2078,7 @@
 			break;
 		}
 		read_unlock_bh(&idev->lock);
+		in6_dev_put(idev);
 	}
 	return im;
 }
@@ -2135,7 +2136,9 @@
 	if (likely(state->idev != NULL)) {
 		read_unlock_bh(&state->idev->lock);
 		in6_dev_put(state->idev);
+		state->idev = NULL;
 	}
+	state->dev = NULL;
 	read_unlock(&dev_base_lock);
 }
 
@@ -2225,6 +2228,7 @@
 			spin_unlock_bh(&im->mca_lock);
 		}
 		read_unlock_bh(&idev->lock);
+		in6_dev_put(idev);
 	}
 	return psf;
 }
@@ -2291,12 +2295,16 @@
 static void igmp6_mcf_seq_stop(struct seq_file *seq, void *v)
 {
 	struct igmp6_mcf_iter_state *state = igmp6_mcf_seq_private(seq);
-	if (likely(state->im != NULL))
+	if (likely(state->im != NULL)) {
 		spin_unlock_bh(&state->im->mca_lock);
+		state->im = NULL;
+	}
 	if (likely(state->idev != NULL)) {
 		read_unlock_bh(&state->idev->lock);
 		in6_dev_put(state->idev);
+		state->idev = NULL;
 	}
+	state->dev = NULL;
 	read_unlock(&dev_base_lock);
 }
 


-- 
Hideaki YOSHIFUJI @ USAGI Project <yoshfuji@linux-ipv6.org>
GPG FP: 9022 65EB 1ECF 3AD1 0BDF  80D8 4807 F894 E062 0EEA

Re: [OOPS] less /proc/net/igmp

[Matt Gibson]

On Tuesday 26 Aug 2003 17:54, YOSHIFUJI Hideaki / 吉藤英明 wrote:
> Hello.
>
> > Okay, everyone. I'll try to fix this.
>
> Please try this patch.

Works fine for me now, against an almost-vanilla 2.6.0-test4.

Thanks,

Matt

-- 
"It's the small gaps between the rain that count,
 and learning how to live amongst them."
	      -- Jeff Noon

Re: [OOPS] less /proc/net/igmp

[Owen Ford]

[-- Attachment #1: Type: text/plain, Size: 567 bytes --]

On Tue, 2003-08-26 at 11:54, YOSHIFUJI Hideaki / 吉藤英明 wrote:
> Hello.
> 
> In article <20030826.173226.114994096.yoshfuji@linux-ipv6.org> (at Tue, 26 Aug 2003 17:32:26 +0900 (JST)), YOSHIFUJI Hideaki / 吉藤英明 <yoshfuji@linux-ipv6.org> says:
> 
> > > I can confirm. I have it with 2.6.0-test4.
> > > 
> > > Let me know what useful info I can provide.  The oops is the same.
> > 
> > Okay, everyone. I'll try to fix this.
> 
> Please try this patch.

That seems to have done the job nicely.  Thanks.
 
-- 
Owen Ford <oford@arghblech.com>

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]