Re: Kernel oops during netfilter memory allocation

[Alexey Dobriyan]

On Mon, Aug 20, 2007 at 06:08:08PM +0200, Thomas Jarosch wrote:
> I'm currently debugging a kernel oops with kernel 2.6.21.7 that occurs
> from time to time with our netfilter accounting module ipt_ACCOUNT 
> (http://www.intra2net.com/de/produkte/opensource/ipt_account/).

	kernel BUG at arch/i386/mm/highmem.c:38
 
> static unsigned int ipt_crash_target(struct sk_buff **pskb,
>                                    const struct net_device *in,
>                                    const struct net_device *out,
>                                    unsigned int hooknum,
> #if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,17)
>                                    const struct xt_target *target,
> #endif
> #if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,19)
>                                    const void *targinfo)
> #else
>                                    const void *targinfo,
>                                    void *userinfo)
> #endif
> {
>     char *data;
> 
>     spin_lock_bh(&ipt_crash_lock);
> 
>     if ((data = (char *)get_zeroed_page(GFP_ATOMIC)) == NULL) {

Try this.

commit b8c1c5da1520977cb55a358f20fc09567d40cad9
tree c762e6ad77297beed0978337ce2f5b0c50add739
parent 01e457cfcd5b6b6f18d0bb8cec0c5d43df56557e
author Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> 1185303760 -0700
committer Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxxxxxxxxx> 1185305099 -0700

slab: correctly handle __GFP_ZERO

Use the correct local variable when calling into the page allocator.  Local
`flags' can have __GFP_ZERO set, which causes us to pass __GFP_ZERO into the
page allocator, possibly from illegal contexts.  The page allocator will later
do prep_zero_page()->kmap_atomic(..., KM_USER0) from irq contexts and will
then go BUG.

Cc: Mike Galbraith <efault@xxxxxx>
Acked-by: Christoph Lameter <clameter@xxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
Signed-off-by: Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxxx>
diff --git a/mm/slab.c b/mm/slab.c
index bde271c..a684778 100644
--- a/mm/slab.c
+++ b/mm/slab.c
@@ -2776,7 +2776,7 @@ static int cache_grow(struct kmem_cache *cachep,
 	 * 'nodeid'.
 	 */
 	if (!objp)
-		objp = kmem_getpages(cachep, flags, nodeid);
+		objp = kmem_getpages(cachep, local_flags, nodeid);
 	if (!objp)
 		goto failed;
 
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/