Hi again,

First of all, I would like to know if anybody was able to fix this
problem that got kinda lost in the thread:

On Thu, Apr 22, 2010 at 16:05, Martín Ferrari <martin.ferrari@gmail.com> wrote:

> I have just downloaded and compiled 2.6.32-2 and 2.6.34-rc5 from
> kernel.org using the .config from the debian package, and the oops is
> reproducible in both.
>
> This small C file reproduces the error every time:
>
> $ cat netnsoops.c
> #include <stdio.h>
> #include <stdlib.h>
> #define _GNU_SOURCE
> #include <sched.h>
>
> int main(int argc, char *argv[])
> {
> * * * *int c;
> * * * *unsigned long flags = CLONE_NEWNET;
>
> * * * *if(unshare(flags) == -1) {
> * * * * * * * *perror("unshare");
> * * * * * * * *return 1;
> * * * *}
> * * * *system("ip link add name FOO type veth peer name BAR");
> * * * *system("ip link set FOO netns 1");
> * * * *system("ip link show");
> * * * *return 0;
> }

Secondly, I discovered another related bug, just more subtle.

I'm creating a dummy device, moving it into a name space and then
taking it back to netns 1. Later, when I delete the dummy, I get an
oops:

[ 610.540091] BUG: unable to handle kernel NULL pointer dereference
at 0000000000000028
[ 610.541512] IP: [<ffffffff81138f71>] sysfs_find_dirent+0x9/0x2f
[ 610.542369] PGD 3799d067 PUD 37bb3067 PMD 0
[ 610.543370] Oops: 0000 [#1] SMP
[ 610.544018] last sysfs file: /sys/devices/virtual/net/lo/operstate
[ 610.544018] CPU 0
[ 610.544018] Modules linked in: dummy loop parport_pc parport
snd_pcm snd_timer tpm_tis tpm tpm_bios snd soundcore snd_page_alloc
pcspkr psmouse serio_raw i2c_piix4 evdev i2c_core button processor
ext3 jbd mbcache ide_cd_mod cdrom ide_gd_mod ata_generic ata_piix
8139too libata scsi_mod floppy piix 8139cp mii thermal thermal_sys
ide_core [last unloaded: scsi_wait_scan]
[ 610.544018]
[ 610.544018] Pid: 1359, comm: ip Tainted: G W 2.6.34-rc5 #1 /
[ 610.544018] RIP: 0010:[<ffffffff81138f71>] [<ffffffff81138f71>]
sysfs_find_dirent+0x9/0x2f
[ 610.544018] RSP: 0018:ffff88003789f988 EFLAGS: 00010296
[ 610.544018] RAX: ffff88003789e000 RBX: 0000000000000000 RCX: ffff88007d3d2cd8
[ 610.544018] RDX: 0000000000000003 RSI: ffffffff814a6352 RDI: 0000000000000000
[ 610.544018] RBP: ffffffff814a6352 R08: 000000037f80e800 R09: ffff88007d3d2ce8
[ 610.544018] R10: ffff88007d3d2800 R11: 0000000000000006 R12: ffffffff814a6352
[ 610.544018] R13: ffff88007d3d2c48 R14: 0000000000000000 R15: ffff88003789fbb8
[ 610.544018] FS: 00007f22855f7700(0000) GS:ffff880001a00000(0000)
knlGS:0000000000000000
[ 610.544018] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[ 610.544018] CR2: 0000000000000028 CR3: 000000007d4df000 CR4: 00000000000006f0
[ 610.544018] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 610.544018] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[ 610.544018] Process ip (pid: 1359, threadinfo ffff88003789e000,
task ffff88007d2b69f0)
[ 610.544018] Stack:
[ 610.544018] 000000037f80e800 0000000000000000 0000000000000000
ffffffff81138fbb
[ 610.544018] <0> 0000000000000296 ffff88007d3d2c38 ffffffff816698d0
ffffffff8113a980
[ 610.544018] <0> ffff88007d3d2c38 ffff88007d3d2c38 ffff88007d3d2800
0000000000000000
[ 610.544018] Call Trace:
[ 610.544018] [<ffffffff81138fbb>] ? sysfs_get_dirent+0x24/0x43
[ 610.544018] [<ffffffff8113a980>] ? sysfs_remove_group+0x24/0xcf
[ 610.544018] [<ffffffff8120f776>] ? device_del+0x3b/0x1a0
[ 610.544018] [<ffffffff81244139>] ? rollback_registered_many+0x15d/0x1c8
[ 610.544018] [<ffffffff8124d81e>] ? rtnetlink_rcv_msg+0x0/0x1f5
[ 610.544018] [<ffffffff81244273>] ? unregister_netdevice_queue+0x78/0xa9
[ 610.544018] [<ffffffff8124c22b>] ? rtnl_dellink+0xb7/0xdb
[ 610.544018] [<ffffffff8125e887>] ? netlink_rcv_skb+0x34/0x7c
[ 610.544018] [<ffffffff8124d818>] ? rtnetlink_rcv+0x1f/0x25
[ 610.544018] [<ffffffff8125e67b>] ? netlink_unicast+0xe2/0x148
[ 610.544018] [<ffffffff8125edaf>] ? netlink_sendmsg+0x23f/0x252
[ 610.544018] [<ffffffff8123388d>] ? sock_sendmsg+0x83/0x9b
[ 610.544018] [<ffffffff810b3e0d>] ? __alloc_pages_nodemask+0x10f/0x5e2
[ 610.544018] [<ffffffff8123c76f>] ? copy_from_user+0x13/0x25
[ 610.544018] [<ffffffff8123cb25>] ? verify_iovec+0x49/0x84
[ 610.544018] [<ffffffff81233b62>] ? sys_sendmsg+0x225/0x2af
[ 610.544018] [<ffffffff81234e17>] ? sys_recvmsg+0x48/0x56
[ 610.544018] [<ffffffff81008ac2>] ? system_call_fastpath+0x16/0x1b
[ 610.544018] Code: fb 74 1a 8b 07 85 c0 75 11 be 9d 00 00 00 48 c7
c7 da 56 4b 81 e8 2b cf f0 ff f0 ff 03 48 89 d8 5b c3 55 48 89 f5 53
48 83 ec 08 <48> 8b 5f 28 eb 14 48 8b 7b 18 48 89 ee e8 46 a4 04 00 85
c0 74
[ 610.544018] RIP [<ffffffff81138f71>] sysfs_find_dirent+0x9/0x2f
[ 610.544018] RSP <ffff88003789f988>
[ 610.544018] CR2: 0000000000000028
[ 610.597008] ---[ end trace f92104e98ea87a47 ]---


To reproduce:

$ cat netnsoops2.c
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/wait.h>
#define _GNU_SOURCE
#include <sched.h>

int main(int argc, char *argv[])
{
int pipefd[2];
pid_t pid;
unsigned long flags = CLONE_NEWNET;

if(system("ip link add name FOO type dummy"))
return 1;
if(pipe(pipefd) == -1) {
perror("pipe");
return 1;
}
pid = fork();
if(pid == -1) {
perror("fork");
return 1;
}
if(pid) {
char buf[256];
read(pipefd[0], buf, 1);
snprintf(buf, sizeof(buf), "ip link set FOO netns %d", pid);
system(buf);
} else {
if(unshare(flags) == -1) {
perror("unshare");
return 1;
}
write(pipefd[1], "a", 1);
system("ip link set FOO netns 1");
return 0;
}
waitpid(pid, NULL, 0);
system("ip link show");
system("ip link del FOO");
return 0;
}


--
Martín Ferrari



--
To UNSUBSCRIBE, email to debian-kernel-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
Archive: AANLkTin_KDKEejs1ld-qv5jOyuALysjZ8NLC2-786htJ@mail.gmail.com">http://lists.debian.org/AANLkTin_KDKEejs1ld-qv5jOyuALysjZ8NLC2-786htJ@mail.gmail.com

Martín Ferrari <martin.ferrari@gmail.com> writes:

> Hi again,
>
> First of all, I would like to know if anybody was able to fix this
> problem that got kinda lost in the thread:

I can't reproduce this on 2.6.35-rc1+

Can you please test a 2.6.35-rc version? If you can still reproduce
it there can you send me your .config? Otherwise I expect my last
round of changes to sysfs fixed whatever was the underlying problem.

Thanks,
Eric



--
To UNSUBSCRIBE, email to debian-kernel-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
Archive: m1zkxjwjq9.fsf@fess.ebiederm.org">http://lists.debian.org/m1zkxjwjq9.fsf@fess.ebiederm.org

Hi,

On Thu, Jul 22, 2010 at 18:43, Eric W. Biederman <ebiederm@xmission.com> wrote:

>> First of all, I would like to know if anybody was able to fix this
>> problem *that got kinda lost in the thread:
>
> I can't reproduce this on 2.6.35-rc1+
>
> Can you please test a 2.6.35-rc version? *If you can still reproduce
> it there can you send me your .config? *Otherwise I expect my last
> round of changes to sysfs fixed whatever was the underlying problem.

I just download and compiled rc6, and all of these problems seem to be
solved. Thanks a lot!

--
Martín Ferrari



--
To UNSUBSCRIBE, email to debian-kernel-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
Archive: AANLkTimC8q6_ZU60VX5SmXGqsD+RCpf4RaF3MLQptsG4@mail .gmail.com">http://lists.debian.org/AANLkTimC8q6_ZU60VX5SmXGqsD+RCpf4RaF3MLQptsG4@mail .gmail.com

Martín Ferrari <martin.ferrari@gmail.com> writes:

> Hi,
>
> On Thu, Jul 22, 2010 at 18:43, Eric W. Biederman <ebiederm@xmission.com> wrote:
>
>>> First of all, I would like to know if anybody was able to fix this
>>> problem *that got kinda lost in the thread:
>>
>> I can't reproduce this on 2.6.35-rc1+
>>
>> Can you please test a 2.6.35-rc version? *If you can still reproduce
>> it there can you send me your .config? *Otherwise I expect my last
>> round of changes to sysfs fixed whatever was the underlying problem.
>
> I just download and compiled rc6, and all of these problems seem to be
> solved. Thanks a lot!

Welcome. I'm glad to hear there wasn't some weird corner case
that I had missed.

Eric



--
To UNSUBSCRIBE, email to debian-kernel-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
Archive: m1tynmtw39.fsf@fess.ebiederm.org">http://lists.debian.org/m1tynmtw39.fsf@fess.ebiederm.org