[net-next:master] general protection fault in __nla_put()

Hi David,

This is a very reproducible bug, introduced by the following commit

tree:   git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git master
head:   36bdbcae2fa2a6dfa99344d4190fcea0aa7b7c25
commit: 97cac0821af4474ec4ba3a9e7a36b98ed9b6db88 [96/99] ipv6: Store route neighbour in rt6_info struct.

[   80.878774] IPv6: ADDRCONF(NETDEV_UP): bond0: link is not ready
[   80.880350] 8021q: adding VLAN 0 to HW filter on device bond0
[   80.882116] general protection fault: 0000 [#1] SMP DEBUG_PAGEALLOC
[   80.883606] CPU 0 
[   80.884216] Modules linked in:
[   80.884296] 
[   80.884296] Pid: 1, comm: swapper/0 Not tainted 3.5.0-rc4+ #16 Bochs Bochs
[   80.884296] RIP: 0010:[<ffffffff816ce77e>]  [<ffffffff816ce77e>] __nla_put+0x1f/0x26
[   80.884296] RSP: 0018:ffff88001d819910  EFLAGS: 00010282
[   80.884296] RAX: ffff880012167c2c RBX: 5a5a5a5a5a5a5d3a RCX: 0000000000000010
[   80.884296] RDX: ffff880012167c3c RSI: 5a5a5a5a5a5a5d3a RDI: ffff880012167c2c
[   80.884296] RBP: ffff88001d819920 R08: ffff880012167c28 R09: ffff880012167bf0
[   80.884296] R10: ffffffff840401a0 R11: ffffffff840401a0 R12: 0000000000000010
[   80.884296] R13: ffff8800120c3f00 R14: 0000000000000000 R15: 0000000000000000
[   80.884296] FS:  0000000000000000(0000) GS:ffff88001f200000(0000) knlGS:0000000000000000
[   80.884296] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[   80.884296] CR2: 0000000000000000 CR3: 0000000004014000 CR4: 00000000000006f0
[   80.884296] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   80.884296] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[   80.884296] Process swapper/0 (pid: 1, threadinfo ffff88001d818000, task ffff88001d814040)
[   80.884296] Stack:
[   80.884296]  ffff8800120c3f00 ffff880012168e70 ffff88001d819960 ffffffff816ce7bf
[   80.884296]  ffff88001d819950 5a5a5a5a5a5a5d3a ffffffff00000010 ffff880000000005
[   80.884296]  ffff88001d819960 ffff880012167bf0 ffff88001d819a00 ffffffff82afa9b0
[   80.884296] Call Trace:
[   80.884296]  [<ffffffff816ce7bf>] nla_put+0x3a/0x4a
[   80.884296]  [<ffffffff82afa9b0>] rt6_fill_node.constprop.35+0x325/0x486
[   80.884296]  [<ffffffff8117598d>] ? __kmalloc_node_track_caller+0x35/0x3e
[   80.884296]  [<ffffffff829d69cb>] ? __alloc_skb+0xaf/0x15a
[   80.884296]  [<ffffffff82afaf82>] inet6_rt_notify+0xb2/0x130
[   80.884296]  [<ffffffff82afc56f>] fib6_add+0x359/0x55a
[   80.884296]  [<ffffffff810dbeb0>] ? lock_acquired+0x1e4/0x219
[   80.884296]  [<ffffffff82af7ae5>] __ip6_ins_rt+0x3c/0x57
[   80.884296]  [<ffffffff82af9c10>] ip6_route_add+0x49e/0x58d
[   80.884296]  [<ffffffff82af0bcc>] addrconf_add_mroute+0x82/0x98
[   80.884296]  [<ffffffff82af24a8>] addrconf_add_dev+0x61/0x83
[   80.884296]  [<ffffffff82af429a>] addrconf_dev_config+0x78/0xd4
[   80.884296]  [<ffffffff82af5fb1>] addrconf_notify+0x164/0x283
[   80.884296]  [<ffffffff82e4fcc2>] notifier_call_chain+0x65/0x95
[   80.884296]  [<ffffffff810b54ab>] __raw_notifier_call_chain+0xe/0x10
[   80.884296]  [<ffffffff810b54c1>] raw_notifier_call_chain+0x14/0x16
[   80.884296]  [<ffffffff829df1c8>] call_netdevice_notifiers+0x4a/0x4f
[   80.884296]  [<ffffffff829e4934>] __dev_notify_flags+0x37/0x5b
[   80.884296]  [<ffffffff829e49a0>] dev_change_flags+0x48/0x54
[   80.884296]  [<ffffffff8467e322>] ip_auto_config.part.10+0x14a/0xd52
[   80.884296]  [<ffffffff82e4c452>] ? _raw_spin_unlock+0x28/0x3b
[   80.884296]  [<ffffffff811da21f>] ? proc_register+0x192/0x1a6
[   80.884296]  [<ffffffff8467c8c6>] ? tcp_v4_init+0x30/0x30
[   80.884296]  [<ffffffff8467ef2a>] ? ip_auto_config.part.10+0xd52/0xd52
[   80.884296]  [<ffffffff8467ef5d>] ip_auto_config+0x33/0x35
[   80.884296]  [<ffffffff81002099>] do_one_initcall+0x7f/0x13a
[   80.884296]  [<ffffffff845f1d0a>] kernel_init+0x141/0x1c5
[   80.884296]  [<ffffffff845f1590>] ? do_early_param+0x8c/0x8c
[   80.884296]  [<ffffffff82e545f4>] kernel_thread_helper+0x4/0x10
[   80.884296]  [<ffffffff82e4c830>] ? retint_restore_args+0x13/0x13
[   80.884296]  [<ffffffff845f1bc9>] ? start_kernel+0x3e7/0x3e7
[   80.884296]  [<ffffffff82e545f0>] ? gs_change+0x13/0x13
[   80.884296] Code: 4c 89 c0 41 5b 5b 41 5c 41 5d 5d c3 55 48 89 e5 41 54 41 89 d4 53 48 89 cb e8 a2 ff ff ff 48 83 c0 04 49 63 cc 48 89 de 48 89 c7 <f3> a4 5b 41 5c 5d c3 55 48 89 e5 53 48 89 fb 48 83 ec 28 89 55 
[   80.884296] RIP  [<ffffffff816ce77e>] __nla_put+0x1f/0x26
[   80.884296]  RSP <ffff88001d819910>
[   80.964726] ---[ end trace 7265c51d764fcc58 ]---
[   80.965811] Kernel panic - not syncing: Fatal exception in interrupt

commit 97cac0821af4474ec4ba3a9e7a36b98ed9b6db88
Author: David S. Miller [off-list ref]
Date:   Mon Jul 2 22:43:47 2012 -0700

    ipv6: Store route neighbour in rt6_info struct.
    
    This makes for a simplified conversion away from dst_get_neighbour*().
    
    All code outside of ipv6 will use neigh lookups via dst_neigh_lookup*().
    
    Signed-off-by: David S. Miller [off-list ref]

diff --git a/include/net/ip6_fib.h b/include/net/ip6_fib.h
index a192f78..0fedbd8 100644
--- a/include/net/ip6_fib.h
+++ b/include/net/ip6_fib.h

@@ -86,6 +86,8 @@ struct fib6_table;
 struct rt6_info {
 	struct dst_entry		dst;
 
+	struct neighbour		*n;
+
 	/*
 	 * Tail elements of dst_entry (__refcnt etc.)
 	 * and these elements (rarely used in hot path) are in

diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index c94e4aa..6d9c0ab 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c

@@ -88,6 +88,7 @@ static int ip6_finish_output2(struct sk_buff *skb)
 	struct dst_entry *dst = skb_dst(skb);
 	struct net_device *dev = dst->dev;
 	struct neighbour *neigh;
+	struct rt6_info *rt;
 
 	skb->protocol = htons(ETH_P_IPV6);
 	skb->dev = dev;

@@ -123,7 +124,8 @@ static int ip6_finish_output2(struct sk_buff *skb)
 	}
 
 	rcu_read_lock();
-	neigh = dst_get_neighbour_noref(dst);
+	rt = (struct rt6_info *) dst;
+	neigh = rt->n;
 	if (neigh) {
 		int res = dst_neigh_output(dst, neigh, skb);
 

@@ -944,6 +946,7 @@ static int ip6_dst_lookup_tail(struct sock *sk,
 	struct net *net = sock_net(sk);
 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
 	struct neighbour *n;
+	struct rt6_info *rt;
 #endif
 	int err;
 

@@ -972,7 +975,8 @@ static int ip6_dst_lookup_tail(struct sock *sk,
 	 * dst entry of the nexthop router
 	 */
 	rcu_read_lock();
-	n = dst_get_neighbour_noref(*dst);
+	rt = (struct rt6_info *) dst;
+	n = rt->n;
 	if (n && !(n->nud_state & NUD_VALID)) {
 		struct inet6_ifaddr *ifp;
 		struct flowi6 fl_gw6;

diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 34b2988..ceff71d 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c

@@ -155,7 +155,7 @@ static int rt6_bind_neighbour(struct rt6_info *rt, struct net_device *dev)
 		if (IS_ERR(n))
 			return PTR_ERR(n);
 	}
-	dst_set_neighbour(&rt->dst, n);
+	rt->n = n;
 
 	return 0;
 }

@@ -285,6 +285,9 @@ static void ip6_dst_destroy(struct dst_entry *dst)
 	struct rt6_info *rt = (struct rt6_info *)dst;
 	struct inet6_dev *idev = rt->rt6i_idev;
 
+	if (rt->n)
+		neigh_release(rt->n);
+
 	if (!(rt->dst.flags & DST_HOST))
 		dst_destroy_metrics_generic(dst);
 

@@ -335,12 +338,19 @@ static void ip6_dst_ifdown(struct dst_entry *dst, struct net_device *dev,
 	struct net_device *loopback_dev =
 		dev_net(dev)->loopback_dev;
 
-	if (dev != loopback_dev && idev && idev->dev == dev) {
-		struct inet6_dev *loopback_idev =
-			in6_dev_get(loopback_dev);
-		if (loopback_idev) {
-			rt->rt6i_idev = loopback_idev;
-			in6_dev_put(idev);
+	if (dev != loopback_dev) {
+		if (idev && idev->dev == dev) {
+			struct inet6_dev *loopback_idev =
+				in6_dev_get(loopback_dev);
+			if (loopback_idev) {
+				rt->rt6i_idev = loopback_idev;
+				in6_dev_put(idev);
+			}
+		}
+		if (rt->n && rt->n->dev == dev) {
+			rt->n->dev = loopback_dev;
+			dev_hold(loopback_dev);
+			dev_put(dev);
 		}
 	}
 }

@@ -430,7 +440,7 @@ static void rt6_probe(struct rt6_info *rt)
 	 * to no more than one per minute.
 	 */
 	rcu_read_lock();
-	neigh = rt ? dst_get_neighbour_noref(&rt->dst) : NULL;
+	neigh = rt ? rt->n : NULL;
 	if (!neigh || (neigh->nud_state & NUD_VALID))
 		goto out;
 	read_lock_bh(&neigh->lock);

@@ -477,7 +487,7 @@ static inline int rt6_check_neigh(struct rt6_info *rt)
 	int m;
 
 	rcu_read_lock();
-	neigh = dst_get_neighbour_noref(&rt->dst);
+	neigh = rt->n;
 	if (rt->rt6i_flags & RTF_NONEXTHOP ||
 	    !(rt->rt6i_flags & RTF_GATEWAY))
 		m = 1;

@@ -824,7 +834,7 @@ static struct rt6_info *rt6_alloc_clone(struct rt6_info *ort,
 
 	if (rt) {
 		rt->rt6i_flags |= RTF_CACHE;
-		dst_set_neighbour(&rt->dst, neigh_clone(dst_get_neighbour_noref_raw(&ort->dst)));
+		rt->n = neigh_clone(ort->n);
 	}
 	return rt;
 }

@@ -858,7 +868,7 @@ restart:
 	dst_hold(&rt->dst);
 	read_unlock_bh(&table->tb6_lock);
 
-	if (!dst_get_neighbour_noref_raw(&rt->dst) && !(rt->rt6i_flags & RTF_NONEXTHOP))
+	if (!rt->n && !(rt->rt6i_flags & RTF_NONEXTHOP))
 		nrt = rt6_alloc_cow(rt, &fl6->daddr, &fl6->saddr);
 	else if (!(rt->dst.flags & DST_HOST))
 		nrt = rt6_alloc_clone(rt, &fl6->daddr);

@@ -1178,7 +1188,7 @@ struct dst_entry *icmp6_dst_alloc(struct net_device *dev,
 
 	rt->dst.flags |= DST_HOST;
 	rt->dst.output  = ip6_output;
-	dst_set_neighbour(&rt->dst, neigh);
+	rt->n = neigh;
 	atomic_set(&rt->dst.__refcnt, 1);
 	rt->rt6i_dst.addr = fl6->daddr;
 	rt->rt6i_dst.plen = 128;

@@ -1715,7 +1725,7 @@ void rt6_redirect(const struct in6_addr *dest, const struct in6_addr *src,
 	dst_confirm(&rt->dst);
 
 	/* Duplicate redirect: silently ignore. */
-	old_neigh = dst_get_neighbour_noref_raw(&rt->dst);
+	old_neigh = rt->n;
 	if (neigh == old_neigh)
 		goto out;
 

@@ -1728,7 +1738,7 @@ void rt6_redirect(const struct in6_addr *dest, const struct in6_addr *src,
 		nrt->rt6i_flags &= ~RTF_GATEWAY;
 
 	nrt->rt6i_gateway = *(struct in6_addr *)neigh->primary_key;
-	dst_set_neighbour(&nrt->dst, neigh_clone(neigh));
+	nrt->n = neigh_clone(neigh);
 
 	if (ip6_ins_rt(nrt))
 		goto out;

@@ -2442,7 +2452,7 @@ static int rt6_fill_node(struct net *net,
 		goto nla_put_failure;
 
 	rcu_read_lock();
-	n = dst_get_neighbour_noref(&rt->dst);
+	n = rt->n;
 	if (n) {
 		if (nla_put(skb, RTA_GATEWAY, 16, &n->primary_key) < 0) {
 			rcu_read_unlock();

@@ -2666,7 +2676,7 @@ static int rt6_info_route(struct rt6_info *rt, void *p_arg)
 	seq_puts(m, "00000000000000000000000000000000 00 ");
 #endif
 	rcu_read_lock();
-	n = dst_get_neighbour_noref(&rt->dst);
+	n = rt->n;
 	if (n) {
 		seq_printf(m, "%pi6", n->primary_key);
 	} else {

diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index d749484..bb02038 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c

@@ -103,6 +103,7 @@ static int xfrm6_fill_dst(struct xfrm_dst *xdst, struct net_device *dev,
 
 	/* Sheit... I remember I did this right. Apparently,
 	 * it was magically lost, so this code needs audit */
+	xdst->u.rt6.n = neigh_clone(rt->n);
 	xdst->u.rt6.rt6i_flags = rt->rt6i_flags & (RTF_ANYCAST |
 						   RTF_LOCAL);
 	xdst->u.rt6.rt6i_metric = rt->rt6i_metric;

Steffen Klassert posted a patch which fixes this.

On Thu, Jul 05, 2012 at 02:22:00PM -0700, David Miller wrote:

Steffen Klassert posted a patch which fixes this.

Steffen's patch converts one oops message into another.

tree:   git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git master
head:   700db99d0140e9da2a31e08ebd3e1b121691aa26
commit: a2de86f63cfc92f7aaf11e7b9d9f2150946a1622 [1/2] ipv6: Initialize the neighbour pointer of rt6_info on allocation

x86_64-allyesdebian         BBB

That 3 'B's indicate boot failures for all the 3 commits (detailed
below).  Where commit 0 still has the old error message. Commit 1 and
2 (both with Steffen's fix) trigger another oops. Note that commit 2
is boot tested 9 times, all of them produce about the same error message.

0:      B c90a9bb  [   77.308688] general protection fault: 0000 [#1] SMP DEBUG_PAGEALLOC [__nla_put nla_put inet6_rt_notify fib6_add __ip6_ins_rt ip6_route_add addrconf_add_mroute addrconf_add_dev addrconf_dev_config addrconf_notify notifier_call_chain __raw_notifier_call_chain raw_notifier_call_chain call_netdevice_notifiers __dev_notify_flags dev_change_flags ip_auto_config do_one_initcall kernel_init kernel_thread_helper]
1:      B a2de86f  [  127.378529] BUG: unable to handle kernel paging request at 00000000d8be176d [ip6_dst_lookup_tail ip6_dst_lookup_flow ip6_datagram_connect inet_dgram_connect sys_connect system_call_fastpath]
2:      B 700db99  [   86.189249] BUG: unable to handle kernel paging request at 00000000d0d4176d [ip6_dst_lookup_tail ip6_dst_lookup_flow ip6_datagram_connect inet_dgram_connect sys_connect system_call_fastpath]
2:      B 700db99  [   91.294019] BUG: unable to handle kernel paging request at 00000000eac8176d [ip6_dst_lookup_tail ip6_dst_lookup_flow ip6_datagram_connect inet_dgram_connect sys_connect system_call_fastpath]
2:      B 700db99  [  136.361566] BUG: unable to handle kernel paging request at 000000008eab176d [ip6_dst_lookup_tail ip6_dst_lookup_flow ip6_datagram_connect inet_dgram_connect sys_connect system_call_fastpath]
2:      B 700db99  [  133.408933] BUG: unable to handle kernel paging request at 000000009bc2176d [ip6_dst_lookup_tail ip6_dst_lookup_flow ip6_datagram_connect inet_dgram_connect sys_connect system_call_fastpath]
2:      B 700db99  [  136.259517] BUG: unable to handle kernel paging request at 00000000b79d176d [ip6_dst_lookup_tail ip6_dst_lookup_flow ip6_datagram_connect inet_dgram_connect sys_connect system_call_fastpath]
2:      B 700db99  [   82.898992] BUG: unable to handle kernel paging request at 000000003ae1176d [ip6_dst_lookup_tail ip6_dst_lookup_flow ip6_datagram_connect inet_dgram_connect sys_connect system_call_fastpath]
2:      B 700db99  [   85.065760] BUG: unable to handle kernel paging request at 00000000a2c1176d [ip6_dst_lookup_tail ip6_dst_lookup_flow ip6_datagram_connect inet_dgram_connect sys_connect system_call_fastpath]
2:      B 700db99  [   83.797562] BUG: unable to handle kernel paging request at 00000000fca1176d [ip6_dst_lookup_tail ip6_dst_lookup_flow ip6_datagram_connect inet_dgram_connect sys_connect system_call_fastpath]
2:      B 700db99  [  157.345636] BUG: unable to handle kernel paging request at 0000000067bc176d [ip6_dst_lookup_tail ip6_dst_lookup_flow ip6_datagram_connect inet_dgram_connect sys_connect system_call_fastpath]

[  124.000087] vhci_hcd: changed 0
[  126.016883] vhci_hcd: changed 0
[  127.378529] BUG: unable to handle kernel paging request at 00000000d8be176d
[  127.381203] IP: [<ffffffff82aecfc2>] ip6_dst_lookup_tail+0xd5/0x1d8
[  127.381203] PGD 0 
[  127.381203] Oops: 0000 [#1] SMP DEBUG_PAGEALLOC
[  127.381203] CPU 0 
[  127.381203] Modules linked in:
[  127.381203] 
[  127.381203] 
[  127.381203] Pid: 3073, comm: sshd Not tainted 3.5.0-rc5+ #2 Bochs Bochs
[  127.381203] RIP: 0010:[<ffffffff82aecfc2>]  [<ffffffff82aecfc2>] ip6_dst_lookup_tail+0xd5/0x1d8
[  127.381203] RSP: 0018:ffff8800122d1d08  EFLAGS: 00010206
[  127.381203] RAX: 00000000d8be1600 RBX: ffff8800122d1db0 RCX: 0000000000000015
[  127.381203] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000246
[  127.381203] RBP: ffff8800122d1d98 R08: ffff88001f3d5580 R09: ffffffff85124e70
[  127.381203] R10: ffffffff840401a0 R11: ffff88001214be70 R12: ffff8800122d1e10
[  127.381203] R13: 0000000000000000 R14: ffffffff855c5e00 R15: ffff88000cf6e938
[  127.381203] FS:  00007fc9742597c0(0000) GS:ffff88001f200000(0000) knlGS:0000000000000000
[  127.381203] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  127.381203] CR2: 00000000d8be176d CR3: 000000001219a000 CR4: 00000000000006f0
[  127.381203] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  127.381203] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[  127.381203] Process sshd (pid: 3073, threadinfo ffff8800122d0000, task ffff880011c74d40)
[  127.381203] Stack:
[  127.381203]  ffff8800122d1d18 ffff8800122d1e34 ffff8800122d1d28 ffffffff8111ee10
[  127.381203]  ffff8800122d1d48 ffffffff8111f528 ffffffff810c0f1e ffffffff810da5f8
[  127.381203]  ffff8800122d1d68 00000000810da56c 0000000000000092 00000000b4cb58b8
[  127.381203] Call Trace:
[  127.381203]  [<ffffffff8111ee10>] ? irq_trace+0x14/0x21
[  127.381203]  [<ffffffff8111f528>] ? time_hardirqs_off+0x26/0x2a
[  127.381203]  [<ffffffff810c0f1e>] ? local_clock+0x3b/0x52
[  127.381203]  [<ffffffff810da5f8>] ? trace_hardirqs_off+0xd/0xf
[  127.381203]  [<ffffffff81097236>] ? _local_bh_enable_ip+0xbb/0xd8
[  127.381203]  [<ffffffff82aed0f9>] ip6_dst_lookup_flow+0x34/0x7e
[  127.381203]  [<ffffffff82b11a51>] ip6_datagram_connect+0x34b/0x4a4
[  127.381203]  [<ffffffff81097261>] ? local_bh_enable_ip+0xe/0x10
[  127.381203]  [<ffffffff82ab37c0>] inet_dgram_connect+0x3f/0x6e
[  127.381203]  [<ffffffff829d1aa3>] sys_connect+0x9b/0xd9
[  127.381203]  [<ffffffff810de26a>] ? trace_hardirqs_on_caller+0x123/0x17f
[  127.381203]  [<ffffffff816b050e>] ? trace_hardirqs_on_thunk+0x3a/0x3f
[  127.381203]  [<ffffffff82e53629>] system_call_fastpath+0x16/0x1b
[  127.381203] Code: 8a 48 6e c0 e9 05 0f b6 c9 eb 02 31 c9 4c 8b 85 78 ff ff ff 49 8d 54 24 14 4c 89 f7 e8 fa db 00 00 85 c0 0f 85 bb 00 00 00 eb a4 <f6> 80 6d 01 00 00 de 0f 85 a5 00 00 00 e8 53 fc ff ff 48 8b 03 
[  127.381203] RIP  [<ffffffff82aecfc2>] ip6_dst_lookup_tail+0xd5/0x1d8
[  127.381203]  RSP <ffff8800122d1d08>
[  127.381203] CR2: 00000000d8be176d
[  127.484620] ---[ end trace 86ddee5921c27d8c ]---

commit a2de86f63cfc92f7aaf11e7b9d9f2150946a1622
Author: Steffen Klassert [off-list ref]
Date:   Thu Jul 5 03:18:28 2012 +0000

    ipv6: Initialize the neighbour pointer of rt6_info on allocation
    
    git commit 97cac082 (ipv6: Store route neighbour in rt6_info struct)
    added a neighbour pointer to rt6_info. Currently we don't initialize
    this pointer at allocation time. We assume this pointer to be valid
    if it is not a null pointer, so initialize it on allocation.
    
    Signed-off-by: Steffen Klassert [off-list ref]
    Signed-off-by: David S. Miller [off-list ref]

diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index ceff71d..6cc6c88 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c

@@ -273,7 +273,7 @@ static inline struct rt6_info *ip6_dst_alloc(struct net *net,
 					0, 0, flags);
 
 	if (rt) {
-		memset(&rt->rt6i_table, 0,
+		memset(&rt->n, 0,
 		       sizeof(*rt) - sizeof(struct dst_entry));
 		rt6_init_peer(rt, table ? &table->tb6_peers : net->ipv6.peers);
 	}

On Fri, 2012-07-06 at 13:58 +0800, Fengguang Wu wrote:

On Thu, Jul 05, 2012 at 02:22:00PM -0700, David Miller wrote:

quoted

Steffen Klassert posted a patch which fixes this.

Steffen's patch converts one oops message into another.

tree:   git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git master
head:   700db99d0140e9da2a31e08ebd3e1b121691aa26
commit: a2de86f63cfc92f7aaf11e7b9d9f2150946a1622 [1/2] ipv6: Initialize the neighbour pointer of rt6_info on allocation

x86_64-allyesdebian         BBB

Please try :

diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 6d9c0ab..c6af596 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c

@@ -975,7 +975,7 @@ static int ip6_dst_lookup_tail(struct sock *sk,
 	 * dst entry of the nexthop router
 	 */
 	rcu_read_lock();
-	rt = (struct rt6_info *) dst;
+	rt = (struct rt6_info *) *dst;
 	n = rt->n;
 	if (n && !(n->nud_state & NUD_VALID)) {
 		struct inet6_ifaddr *ifp;

On Fri, 2012-07-06 at 08:13 +0200, Eric Dumazet wrote:

David, what do you think if I submit a patch using following accessor ?

/* get a rt6_info given a dst_entry pointer */
static inline struct rt6_info *dst_rt6_info(struct dst_entry *dst)
{
	return (struct rt6_info *)dst;
}

From: Eric Dumazet <redacted>
Date: Fri, 06 Jul 2012 08:13:47 +0200

This is obviously correct, please submit this formally.

Fengguang Wu can I ask you politely not to quote the quilty patch in
it's entirety when reporting bugs?  That screws up my workflow because
that patch goes then gets installed as a new patch in patchwork and I
have to therefore tick it off every time you report a bug.

From: Eric Dumazet <redacted>
Date: Fri, 06 Jul 2012 08:41:47 +0200

David, what do you think if I submit a patch using following accessor ?

/* get a rt6_info given a dst_entry pointer */
static inline struct rt6_info *dst_rt6_info(struct dst_entry *dst)
{
	return (struct rt6_info *)dst;
}

I'd rather we simply not use address-of pointers in our interfaces
like we do now in some spots.

99 times out of 100 it's a case where PTR_ERR() would do.

I spent a lot of time moving both ipv4 and ipv6 in this direction,
we're almost there, and should simply finish off the remaining
cases.

On Thu, 2012-07-05 at 23:44 -0700, David Miller wrote:

From: Eric Dumazet <redacted>
Date: Fri, 06 Jul 2012 08:41:47 +0200

quoted

David, what do you think if I submit a patch using following accessor ?

/* get a rt6_info given a dst_entry pointer */
static inline struct rt6_info *dst_rt6_info(struct dst_entry *dst)
{
	return (struct rt6_info *)dst;
}

I'd rather we simply not use address-of pointers in our interfaces
like we do now in some spots.

99 times out of 100 it's a case where PTR_ERR() would do.

I spent a lot of time moving both ipv4 and ipv6 in this direction,
we're almost there, and should simply finish off the remaining
cases.

Not sure what you mean. I dont use address of pointer.

I suggested a type safe thing

ie change all

struct rt6_info *rt = (struct rt6_info *)dst;

by

struct rt6_info *rt = dst_rt6_info(dst);


same generated code, but we have compiler checks instead of a raw cast.

From: Eric Dumazet <redacted>
Date: Fri, 06 Jul 2012 08:53:07 +0200

Not sure what you mean. I dont use address of pointer.

I'm talking about the cases where this caused a bug here.

Passing "struct dst_entry **dst" as an argument.

It's just stupid, and a relic of code that wants to return
a route and a locallized error at the same time.

I'm saying that in the end we should simply return "struct dst_entry
*" from such functions.

Anyways, please submit your original patch in this thread so I
can get this simple case fixed in net-next.

From: Eric Dumazet <edumazet@google.com>

Fix a bug in ip6_dst_lookup_tail(), where typeof(dst) is 
"struct dst_entry **", not "struct dst_entry *"

Reported-by: Fengguang Wu <redacted>
Signed-off-by: Eric Dumazet <edumazet@google.com>
---

diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 6d9c0ab..c6af596 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c

@@ -975,7 +975,7 @@ static int ip6_dst_lookup_tail(struct sock *sk,
 	 * dst entry of the nexthop router
 	 */
 	rcu_read_lock();
-	rt = (struct rt6_info *) dst;
+	rt = (struct rt6_info *) *dst;
 	n = rt->n;
 	if (n && !(n->nud_state & NUD_VALID)) {
 		struct inet6_ifaddr *ifp;

From: Eric Dumazet <redacted>
Date: Fri, 06 Jul 2012 09:19:05 +0200

From: Eric Dumazet <edumazet@google.com>

Fix a bug in ip6_dst_lookup_tail(), where typeof(dst) is 
"struct dst_entry **", not "struct dst_entry *"

Reported-by: Fengguang Wu <redacted>
Signed-off-by: Eric Dumazet <edumazet@google.com>

Applied, thanks Eric.

Hi David,

Fengguang Wu can I ask you politely not to quote the quilty patch in
it's entirety when reporting bugs?  That screws up my workflow because
that patch goes then gets installed as a new patch in patchwork and I
have to therefore tick it off every time you report a bug.

Sorry for that!  Is it fine to _attach_ the referenced patch, or just
a raw diff?  Or, the commit SHA and subject are all you want to see?

Thanks,
Fengguang

On Fri, Jul 06, 2012 at 03:37:45PM +0800, Fengguang Wu wrote:

Hi David,

quoted

Fengguang Wu can I ask you politely not to quote the quilty patch in
it's entirety when reporting bugs?  That screws up my workflow because
that patch goes then gets installed as a new patch in patchwork and I
have to therefore tick it off every time you report a bug.

Sorry for that!  Is it fine to _attach_ the referenced patch, or just
a raw diff?  Or, the commit SHA and subject are all you want to see?

I used git-format-patch which makes a formal patch. How about git-show?
The output will be less like a formal patch, for example:

:       commit c5fb75aafab2fe31353b96cf556c1a689f8ac7e9
:       Author: Fengguang Wu [off-list ref]
:       Date:   Thu Jun 14 22:36:29 2012 +0800

:           pms: fix build error in pms_probe()
:           
:           drivers/media/video/pms.c: In function ‘pms_probe’:
:           drivers/media/video/pms.c:1047:2: error: implicit declaration of function ‘kzalloc’ [-Werror=implicit-function-declaration]
:           drivers/media/video/pms.c:1047:6: warning: assignment makes pointer from integer without a cast [enabled by default]
:           drivers/media/video/pms.c:1116:2: error: implicit declaration of function ‘kfree’ [-Werror=implicit-function-declaration]
:           
:           Signed-off-by: Fengguang Wu [off-list ref]

:       diff --git a/drivers/media/video/pms.c b/drivers/media/video/pms.c
:       index af2d908..77f9c92 100644
:       --- a/drivers/media/video/pms.c
:       +++ b/drivers/media/video/pms.c
:       @@ -26,6 +26,7 @@
:        #include <linux/fs.h>
:        #include <linux/kernel.h>
:        #include <linux/mm.h>
:       +#include <linux/slab.h>
:        #include <linux/ioport.h>
:        #include <linux/init.h>
:        #include <linux/mutex.h>

Thanks,
Fengguang

From: Fengguang Wu <redacted>
Date: Fri, 6 Jul 2012 15:37:45 +0800

Sorry for that!  Is it fine to _attach_ the referenced patch, or just
a raw diff?  Or, the commit SHA and subject are all you want to see?

Don't provide the diff at all, in any form.  Even if you attach it
patchwork can still parse it and queued it up.

From: Fengguang Wu <redacted>
Date: Fri, 6 Jul 2012 15:52:45 +0800

On Fri, Jul 06, 2012 at 03:37:45PM +0800, Fengguang Wu wrote:

quoted

Hi David,

quoted

Fengguang Wu can I ask you politely not to quote the quilty patch in
it's entirety when reporting bugs?  That screws up my workflow because
that patch goes then gets installed as a new patch in patchwork and I
have to therefore tick it off every time you report a bug.

Sorry for that!  Is it fine to _attach_ the referenced patch, or just
a raw diff?  Or, the commit SHA and subject are all you want to see?

I used git-format-patch which makes a formal patch. How about git-show?
The output will be less like a formal patch, for example:

No patch, in any format.

It's completely pointless to attach the diff, anyone can use the
commit log message and SHA ID to fetch the patch if they want.

It's redundancy therefore also makes it a huge waste of bandwidth.  I
have no idea why you provide it in the first place.

On Fri, Jul 06, 2012 at 01:29:21AM -0700, David Miller wrote:

From: Fengguang Wu <redacted>
Date: Fri, 6 Jul 2012 15:52:45 +0800

quoted

On Fri, Jul 06, 2012 at 03:37:45PM +0800, Fengguang Wu wrote:

quoted

Hi David,

quoted

Fengguang Wu can I ask you politely not to quote the quilty patch in
it's entirety when reporting bugs?  That screws up my workflow because
that patch goes then gets installed as a new patch in patchwork and I
have to therefore tick it off every time you report a bug.

Sorry for that!  Is it fine to _attach_ the referenced patch, or just
a raw diff?  Or, the commit SHA and subject are all you want to see?

I used git-format-patch which makes a formal patch. How about git-show?
The output will be less like a formal patch, for example:

No patch, in any format.

It's completely pointless to attach the diff, anyone can use the
commit log message and SHA ID to fetch the patch if they want.

OK!

It's redundancy therefore also makes it a huge waste of bandwidth.  I
have no idea why you provide it in the first place.

I find it very convenient on myself for confirming the error/warning..

Thanks,
Fengguang