Re: 2.5.46-bk3: BUG in skbuff.c:178

Petr Vandrovec (VANDROVE@vc.cvut.cz)
Fri, 8 Nov 2002 21:33:24 +0200


On 8 Nov 02 at 12:01, Andrew Morton wrote:
> > Single-CPU system, running 2.5.46-bk3. Whiling compiling bk4, and running
> > a script that was pinging every host on my subnet (I was running arp -a
> > to see what was in the arp table at the time), I hit this BUG.
>
> I'd be suspecting the seq_file conversion in arp.c. The read_lock_bh()
> stuff in there looks, umm, unclear ;)

Yes, see my emails from 23th Oct, 25th Oct (2.5.44: Strange oopses from
userspace), from Nov 6th + Nov 7th: Preempt count check when leaving
IRQ.

But while yesterday I had no idea, today I have one (it looks like that
nobody else is going to fix it for me :-( ) :
seq subsystem can call arp_seq_start/next/stop several times, but
state->is_pneigh is set to 0 only once, by memset in arp_seq_open :-(

I think that arp_seq_start should do

{
+ struct arp_iter_state* state = seq->private;
+ seq->is_pneigh = 0;
+ seq->bucket = 0;
read_lock_bh(&arp_tbl.lock);
return *pos ? arp_get_bucket(seq, pos) : (void *)1;
}

and we can drop memset from arp_seq_open. I'll try it, and if it will
survive my tests, I'll send real patch.

Best regards,
Petr Vandrovec
vandrove@vc.cvut.cz

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/