Re: Linux 3.1-rc9

From: Thomas Gleixner
Date: Tue Oct 25 2011 - 08:31:46 EST

On Tue, 25 Oct 2011, David Miller wrote:

> From: Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxxx>
> Date: Tue, 25 Oct 2011 09:13:48 +0200
> > Added netdev, because this seems to be a generic networking bug (ABBA
> > between sk_lock and icsk_retransmit_timer if my quick scan looks
> > correct).
> >
> > Davem?
> I suspect that's all just a side effect of whatever is creating the
> preempt_count imbalance.

Something is holding socket lock and it was acquired in sk_clone()
which does bh_lock_sock() and returns with the lock held, though I got
completely lost in the gazillions of possible callchains ...

While staring at it I found an missing unlock in sk_clone() itself,
but that's not the one which causes the leak. Lockdep would have
complained about that separately :)



Subject: net: Unlock sock before calling sk_free()

Signed-off-by: Thomas Gleixner <tglx@xxxxxxxxxxxxx>

Index: linux-2.6/net/core/sock.c
--- linux-2.6.orig/net/core/sock.c
+++ linux-2.6/net/core/sock.c
@@ -1260,6 +1260,7 @@ struct sock *sk_clone(const struct sock
/* It is still raw copy of parent, so invalidate
* destructor and make plain sk_free() */
newsk->sk_destruct = NULL;
+ bh_unlock_sock(newsk);
newsk = NULL;
goto out;

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at
Please read the FAQ at