Messages in this thread Patch in this message | | | Date | Wed, 13 Apr 2011 10:54:46 -0700 (PDT) | Subject | Re: System crash, bisect points to "connector: convert to synchronous netlink message processing" | From | David Miller <> |
| |
From: Venkatesh Pallipadi <venki@google.com> Date: Wed, 13 Apr 2011 10:25:39 -0700
> I started seeing crashes with linus git recently. The failure > signature is something like:
There is a fix in net-2.6 for this already:
-------------------- commit 0e08785845093ef4ed220463a739bc8d0db95de7 Author: Patrick McHardy <kaber@trash.net> Date: Tue Apr 12 05:39:51 2011 +0000
connector: fix skb double free in cn_rx_skb() When a skb is delivered to a registered callback, cn_call_callback() incorrectly returns -ENODEV after freeing the skb, causing cn_rx_skb() to free the skb a second time. Reported-by: Eric B Munson <emunson@mgebm.net> Signed-off-by: Patrick McHardy <kaber@trash.net> Tested-by: Eric B Munson <emunson@mgebm.net> Signed-off-by: David S. Miller <davem@davemloft.net>
diff --git a/drivers/connector/connector.c b/drivers/connector/connector.c index d770058..219d88a 100644 --- a/drivers/connector/connector.c +++ b/drivers/connector/connector.c @@ -142,6 +142,7 @@ static int cn_call_callback(struct sk_buff *skb) cbq->callback(msg, nsp); kfree_skb(skb); cn_queue_release_callback(cbq); + err = 0; } return err;
| |