From patchwork Tue Jan 22 04:40:06 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Dumazet X-Patchwork-Id: 2015401 Return-Path: X-Original-To: patchwork-linux-nfs@patchwork.kernel.org Delivered-To: patchwork-process-083081@patchwork1.kernel.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by patchwork1.kernel.org (Postfix) with ESMTP id 958863FD1A for ; Tue, 22 Jan 2013 04:40:27 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752837Ab3AVEkM (ORCPT ); Mon, 21 Jan 2013 23:40:12 -0500 Received: from mail-pb0-f52.google.com ([209.85.160.52]:57657 "EHLO mail-pb0-f52.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752688Ab3AVEkL (ORCPT ); Mon, 21 Jan 2013 23:40:11 -0500 Received: by mail-pb0-f52.google.com with SMTP id ro2so3707082pbb.25 for ; Mon, 21 Jan 2013 20:40:10 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=x-received:subject:from:to:cc:in-reply-to:references:content-type :date:message-id:mime-version:x-mailer:content-transfer-encoding; bh=VBu43bq4TyQ5/FMQb3FyqypCATPVkVUiV1nvVIf7ME4=; b=jtCBjwv8r79EzkYYa4nXp8seZeUMWFgeUzeNRf+mYsPp4WWRU4IP7kspyQs+wxIkQL qcJNF5vlwzebEMXIbX2SlqmWRzIZ1t+swdfBIC7rsqHUxSqBwGvHgCVe4+uP8Jy4ga0I jJmVD/AGdfK6KWEiAFC7VxihKokIzw8uXVtzIbChhUHkAW357tbG+ZoxM70txjbbSL/h uz1Yxe9Lf6e3E5dFwzTSVZH86L5npwyVXK84feDru9GaLILzwyYrRSi1mE2zQxT5Y77H aBMf1qRUHn4aAb37lN0QSTLLeyBEuHvbNcs+8grj/REIUszzG+lgs89yYdc8ghMA556j Kabg== X-Received: by 10.68.239.232 with SMTP id vv8mr54655357pbc.53.1358829610629; Mon, 21 Jan 2013 20:40:10 -0800 (PST) Received: from [172.19.241.243] ([172.19.241.243]) by mx.google.com with ESMTPS id a1sm10458952pav.2.2013.01.21.20.40.07 (version=SSLv3 cipher=RC4-SHA bits=128/128); Mon, 21 Jan 2013 20:40:09 -0800 (PST) Subject: Re: 3.7.3+: Bad paging request in ip_rcv_finish while running NFS traffic. From: Eric Dumazet To: Ben Greear Cc: netdev , "linux-nfs@vger.kernel.org" In-Reply-To: <50FDDE35.7070806@candelatech.com> References: <50FDADF4.3060601@candelatech.com> <50FDDE35.7070806@candelatech.com> Date: Mon, 21 Jan 2013 20:40:06 -0800 Message-ID: <1358829606.3464.3151.camel@edumazet-glaptop> Mime-Version: 1.0 X-Mailer: Evolution 2.28.3 Sender: linux-nfs-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-nfs@vger.kernel.org On Mon, 2013-01-21 at 16:32 -0800, Ben Greear wrote: > On 01/21/2013 01:07 PM, Ben Greear wrote: > > I posted about this a few days ago, but this time the patches applied > > are minimal and there are no out-of-tree kernel modules loaded. > > Here's another crash, this time with SLUB memory debugging turned on. > > Seems much harder to hit this way...I've only managed this one. I > believe the RCX register might be interesting...that 6b is probably > freed memory poisioning. Maybe skb or skb_dest() is already freed? > > I have added a 'verify_mem_not_deleted(skb)' before the > dst_input line in ip_rcv_finish..but so far, it hasn't > hit the problem... > There is no way skb is freed here. I would say macvlan is at fault here. It probably lacks a proper (dev->flags & IFF_UP) test. Please try : --- To unsubscribe from this list: send the line "unsubscribe linux-nfs" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c index d3fb97d..c07bdef 100644 --- a/drivers/net/macvlan.c +++ b/drivers/net/macvlan.c @@ -111,9 +111,15 @@ static int macvlan_broadcast_one(struct sk_buff *skb, const struct ethhdr *eth, bool local) { struct net_device *dev = vlan->dev; + if (!skb) return NET_RX_DROP; + if (!(dev->flags & IFF_UP)) { + kfree_skb(skb); + return NET_RX_DROP; + } + if (local) return vlan->forward(dev, skb);