Skip to contentSkip to conversation

Linux 2.5.74: BUG at mm/slab.c:1537

DISCUSSION Manfred Spraul 3 participants 3 messages Jul 3, 2003 – Jul 4, 2003

Subsystems (3)
Networking IPv4/IPv6 Arm/actions semi architecture
lore
Share & tools
lore

Manfred Spraul

author
#0 lore raw

The problem is caused by changeset 1.1310.102.3, 2003/07/01 02:01:51+10:00, [email protected]:

http://linus.bkbits.net:8080/linux-2.5/diffs/net/ipv4/raw.c@3f005eebc5YsuvTFXhDo-QDhPEgh5Q?nav=index.html
(Subject: [NET] fixed /proc/net/raw{,6} seq_file support)

raw_iter_state is just an integer. Without that patch, the integer is stored directly in the seq->private pointer (note the & in the define of raw_seq_private, around line 690 of net/ipv4/raw.c). The patch converts part of the code to an pointer to an integer, but other parts still consider seq->private as an integer. The oops is actually a BUG statement in kmalloc: it complains (if CONFIG_DEBUG_SLAB is enabled) about the invalid pointer.

--
Manfred

#1 lore raw
Quoted 7 lines · Manfred Spraul

The problem is caused by changeset 1.1310.102.3, 2003/07/01 02:01:51+10:00, [email protected]:

http://linus.bkbits.net:8080/linux-2.5/diffs/net/ipv4/raw.c@3f005eebc5YsuvTFXhDo-QDhPEgh5Q?nav=index.html
(Subject: [NET] fixed /proc/net/raw{,6} seq_file support)

Quoted 8 lines

raw_iter_state is just an integer. Without that patch, the integer is stored directly in the seq->private pointer (note the & in the define of raw_seq_private, around line 690 of net/ipv4/raw.c). The patch converts part of the code to an pointer to an integer, but other parts still consider seq->private as an integer. The oops is actually a BUG statement in kmalloc: it complains (if CONFIG_DEBUG_SLAB is enabled) about the invalid pointer.

This is the patch out of bugzilla. I'm not sure who wrote it, and there is no description.

(Could people please not do that? If you have a patch which fixes a bug, please squirt it to the mailing list)

 25-akpm/net/ipv4/igmp.c          |    4 ++--
 25-akpm/net/ipv4/raw.c           |    2 +-
 25-akpm/net/ipv6/anycast.c       |    2 +-
 25-akpm/net/ipv6/ip6_flowlabel.c |    2 +-
 25-akpm/net/ipv6/mcast.c         |    4 ++--
 25-akpm/net/ipv6/raw.c           |    2 +-
 6 files changed, 8 insertions(+), 8 deletions(-)
net/ipv4/igmp.c renamed from net/ipv4/igmp.c~netstat-oops-fix +2 -2
diff -puN net/ipv4/igmp.c~netstat-oops-fix net/ipv4/igmp.c
@@ -2099,7 +2099,7 @@ struct igmp_mc_iter_state {
 	struct in_device *in_dev;
 };
 
-#define	igmp_mc_seq_private(seq)	((struct igmp_mc_iter_state *)&seq->private)
+#define	igmp_mc_seq_private(seq)	((struct igmp_mc_iter_state *)(seq)->private)
 
 static inline struct ip_mc_list *igmp_mc_get_first(struct seq_file *seq)
 {

@@ -2254,7 +2254,7 @@ struct igmp_mcf_iter_state {
 	struct ip_mc_list *im;
 };
 
-#define igmp_mcf_seq_private(seq)	((struct igmp_mcf_iter_state *)&seq->private)
+#define igmp_mcf_seq_private(seq)	((struct igmp_mcf_iter_state *)(seq)->private)
 
 static inline struct ip_sf_list *igmp_mcf_get_first(struct seq_file *seq)
 {
net/ipv4/raw.c renamed from net/ipv4/raw.c~netstat-oops-fix +1 -1
diff -puN net/ipv4/raw.c~netstat-oops-fix net/ipv4/raw.c
@@ -687,7 +687,7 @@ struct raw_iter_state {
 	int bucket;
 };
 
-#define raw_seq_private(seq) ((struct raw_iter_state *)&seq->private)
+#define raw_seq_private(seq) ((struct raw_iter_state *)(seq)->private)
 
 static struct sock *raw_get_first(struct seq_file *seq)
 {
net/ipv6/anycast.c renamed from net/ipv6/anycast.c~netstat-oops-fix +1 -1
diff -puN net/ipv6/anycast.c~netstat-oops-fix net/ipv6/anycast.c
@@ -441,7 +441,7 @@ struct ac6_iter_state {
 	struct inet6_dev *idev;
 };
 
-#define ac6_seq_private(seq)	((struct ac6_iter_state *)&seq->private)
+#define ac6_seq_private(seq)	((struct ac6_iter_state *)(seq)->private)
 
 static inline struct ifacaddr6 *ac6_get_first(struct seq_file *seq)
 {
net/ipv6/ip6_flowlabel.c renamed from net/ipv6/ip6_flowlabel.c~netstat-oops-fix +1 -1
diff -puN net/ipv6/ip6_flowlabel.c~netstat-oops-fix net/ipv6/ip6_flowlabel.c
@@ -559,7 +559,7 @@ struct ip6fl_iter_state {
 	int bucket;
 };
 
-#define ip6fl_seq_private(seq)	((struct ip6fl_iter_state *)&(seq)->private)
+#define ip6fl_seq_private(seq)	((struct ip6fl_iter_state *)(seq)->private)
 
 static struct ip6_flowlabel *ip6fl_get_first(struct seq_file *seq)
 {
net/ipv6/mcast.c renamed from net/ipv6/mcast.c~netstat-oops-fix +2 -2
diff -puN net/ipv6/mcast.c~netstat-oops-fix net/ipv6/mcast.c
@@ -2045,7 +2045,7 @@ struct igmp6_mc_iter_state {
 	struct inet6_dev *idev;
 };
 
-#define igmp6_mc_seq_private(seq)	((struct igmp6_mc_iter_state *)&seq->private)
+#define igmp6_mc_seq_private(seq)	((struct igmp6_mc_iter_state *)(seq)->private)
 
 static inline struct ifmcaddr6 *igmp6_mc_get_first(struct seq_file *seq)
 {

@@ -2185,7 +2185,7 @@ struct igmp6_mcf_iter_state {
 	struct ifmcaddr6 *im;
 };
 
-#define igmp6_mcf_seq_private(seq)	((struct igmp6_mcf_iter_state *)&seq->private)
+#define igmp6_mcf_seq_private(seq)	((struct igmp6_mcf_iter_state *)(seq)->private)
 
 static inline struct ip6_sf_list *igmp6_mcf_get_first(struct seq_file *seq)
 {
net/ipv6/raw.c renamed from net/ipv6/raw.c~netstat-oops-fix +1 -1
diff -puN net/ipv6/raw.c~netstat-oops-fix net/ipv6/raw.c
@@ -913,7 +913,7 @@ struct raw6_iter_state {
 	int bucket;
 };
 
-#define raw6_seq_private(seq) ((struct raw6_iter_state *)&seq->private)
+#define raw6_seq_private(seq) ((struct raw6_iter_state *)(seq)->private)
 
 static struct sock *raw6_get_first(struct seq_file *seq)
 {

_

#2 lore raw

In article <[email protected]> (at Thu, 3 Jul 2003 14:17:58 -0700), Andrew Morton <[email protected]> says:

Quoted 5 lines

This is the patch out of bugzilla. I'm not sure who wrote it, and there is no description.

(Could people please not do that? If you have a patch which fixes a bug, please squirt it to the mailing list)

I am so sorry to have introduced this bug.
I am the author of the patch, and I have already submit it here and to netdev.

http://www.ussg.iu.edu/hypermail/linux/kernel/0307.0/0503.html

Signature · 2 lines
Hideaki YOSHIFUJI @ USAGI Project <[email protected]>
GPG FP: 9022 65EB 1ECF 3AD1 0BDF  80D8 4807 F894 E062 0EEA