Re: Kernel 4.1.12 crash
From: Guillaume Nault <hidden>
Date: 2015-12-02 17:23:38
Subsystem:
networking drivers, ppp over ethernet, the rest · Maintainers:
Andrew Lunn, "David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Linus Torvalds
Possibly related (same subject, not in this thread)
- 2015-11-26 · Re: Kernel 4.1.12 crash · Guillaume Nault <hidden>
- 2015-11-25 · Re: Kernel 4.1.12 crash · Guillaume Nault <hidden>
- 2015-11-25 · Re: Kernel 4.1.12 crash · Andrew <hidden>
- 2015-11-24 · Re: Kernel 4.1.12 crash · Andrew <hidden>
- 2015-11-22 · Re: Kernel 4.1.12 crash · Andrew <hidden>
On Mon, Nov 30, 2015 at 09:42:08PM +0100, Guillaume Nault wrote:
On Mon, Nov 30, 2015 at 04:03:37PM +0100, Guillaume Nault wrote:quoted
Yes, it most likely was introduced by 287f3a943fef ("pppoe: Use workqueue to die properly when a PADT is received"). I still have to figure out why.I confirm the bug comes from this commit. It happens if pppoe_connect() reinitialises po->proto.pppoe.padt_work after pppoe_disc_rcv() has added it to the system's work queue, and before that work got scheduled. Then when scheduling occurs, the worker thread tries to run a corrupted structure and crashes. I'm going to work on a patch.
You can try the following. It's not yet a proper fix as there are still a few things that bug me in pppoe_connect(). ---
diff --git a/drivers/net/ppp/pppoe.c b/drivers/net/ppp/pppoe.c
index 5e0b432..865b74d 100644
--- a/drivers/net/ppp/pppoe.c
+++ b/drivers/net/ppp/pppoe.c@@ -568,6 +568,9 @@ static int pppoe_create(struct net *net, struct socket *sock, int kern) sk->sk_family = PF_PPPOX; sk->sk_protocol = PX_PROTO_OE; + INIT_WORK(&pppox_sk(sk)->proto.pppoe.padt_work, + pppoe_unbind_sock_work); + return 0; }
@@ -632,8 +635,6 @@ static int pppoe_connect(struct socket *sock, struct sockaddr *uservaddr, lock_sock(sk); - INIT_WORK(&po->proto.pppoe.padt_work, pppoe_unbind_sock_work); - error = -EINVAL; if (sp->sa_protocol != PX_PROTO_OE) goto end;
@@ -663,8 +664,6 @@ static int pppoe_connect(struct socket *sock, struct sockaddr *uservaddr, po->pppoe_dev = NULL; } - memset(sk_pppox(po) + 1, 0, - sizeof(struct pppox_sock) - sizeof(struct sock)); sk->sk_state = PPPOX_NONE; }