Oops, sent a corrupt and old version of the patch. Here's the correct patch.
While running a insmod/rmmod loop with the mptsas driver (vanilla 2.6.19, IBM Intellistation Z30, SAS1064E controller if it matters), I encountered a bad dereference of the pointer "de": spin_unlock(&proc_subdir_lock); if (filldir(dirent, de->name, de->namelen, filp->f_pos, de->low_ino, de->mode >> 12) < 0) goto out; spin_lock(&proc_subdir_lock); filp->f_pos++; de = de->next; I believe what's happening here is that proc_readdir drops proc_subdir_lock to call filldir() on the /proc/mpt directory at the same time mptbase is being unloaded. The unload causes the removal of /proc/mpt, which means that de is overwritten with the slab poison value as it is being freed. We reacquire the lock and try to grab the next value of de, but by then the next pointer has been lost, and we crash. Signed-off-by: Darrick J. Wong <[EMAIL PROTECTED]> --- fs/proc/generic.c | 7 +++++-- fs/proc/inode.c | 4 ++-- fs/proc/internal.h | 3 +++ 3 files changed, 10 insertions(+), 4 deletions(-) diff --git a/fs/proc/generic.c b/fs/proc/generic.c index 4ba0300..7e77d7e 100644 --- a/fs/proc/generic.c +++ b/fs/proc/generic.c @@ -429,7 +429,7 @@ struct dentry *proc_lookup(struct inode int proc_readdir(struct file * filp, void * dirent, filldir_t filldir) { - struct proc_dir_entry * de; + struct proc_dir_entry * de, *next; unsigned int ino; int i; struct inode *inode = filp->f_dentry->d_inode; @@ -477,13 +477,16 @@ int proc_readdir(struct file * filp, do { /* filldir passes info to user space */ + de_get(de); spin_unlock(&proc_subdir_lock); if (filldir(dirent, de->name, de->namelen, filp->f_pos, de->low_ino, de->mode >> 12) < 0) goto out; spin_lock(&proc_subdir_lock); filp->f_pos++; - de = de->next; + next = de->next; + de_put(de); + de = next; } while (de); spin_unlock(&proc_subdir_lock); } diff --git a/fs/proc/inode.c b/fs/proc/inode.c index 49dfb2a..4b5a61c 100644 --- a/fs/proc/inode.c +++ b/fs/proc/inode.c @@ -21,7 +21,7 @@ #include <asm/uaccess.h> #include "internal.h" -static inline struct proc_dir_entry * de_get(struct proc_dir_entry *de) +struct proc_dir_entry * de_get(struct proc_dir_entry *de) { if (de) atomic_inc(&de->count); @@ -31,7 +31,7 @@ static inline struct proc_dir_entry * de /* * Decrements the use count and checks for deferred deletion. */ -static void de_put(struct proc_dir_entry *de) +void de_put(struct proc_dir_entry *de) { if (de) { lock_kernel(); diff --git a/fs/proc/internal.h b/fs/proc/internal.h index 987c773..f4751ac 100644 --- a/fs/proc/internal.h +++ b/fs/proc/internal.h @@ -65,3 +65,6 @@ static inline int proc_fd(struct inode * { return PROC_I(inode)->fd; } + +struct proc_dir_entry * de_get(struct proc_dir_entry *de); +void de_put(struct proc_dir_entry *de); - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/