On Thu, Jun 8, 2017 at 2:27 PM, Ben Greear <gree...@candelatech.com> wrote: > > As far as I can tell, the patch did not help, or at least we still reproduce > the > crash easily.
netlink dump is serialized by nlk->cb_mutex so I don't think that patch makes any sense w.r.t race condition. > (gdb) l *(fib6_walk_continue+0x76) > 0x188c6 is in fib6_walk_continue > (/home/greearb/git/linux-2.6/net/ipv6/ip6_fib.c:1593). > 1588 if (fn == w->root) > 1589 return 0; > 1590 pn = fn->parent; > 1591 w->node = pn; > 1592 #ifdef CONFIG_IPV6_SUBTREES > 1593 if (FIB6_SUBTREE(pn) == fn) { Apparently fn->parent is NULL here for some reason, but I don't know if that is expected or not. If a simple NULL check is not enough here, we have to trace why it is NULL. > 1594 WARN_ON(!(fn->fn_flags & RTN_ROOT)); > 1595 w->state = FWS_L; > 1596 continue; > 1597 } > (gdb) l *(inet6_dump_fib+0x1ab) > 0x1939b is in inet6_dump_fib > (/home/greearb/git/linux-2.6/net/ipv6/ip6_fib.c:392). > 387 w->skip = w->count; > 388 } else > 389 w->skip = 0; > 390 > 391 res = fib6_walk_continue(w); > 392 read_unlock_bh(&table->tb6_lock); > 393 if (res <= 0) { > 394 fib6_walker_unlink(net, w); > 395 cb->args[4] = 0; > 396 } > (gdb) Thanks.