Re: KERNEL: assertion (!atomic_read(&sk->sk_rmem_alloc)) failed at net/netlink/af_netlink.c (126)

[Herbert Xu]

Hi Dave:

Here is the version for 2.4.
 
Unfortunately my patch only closed half the race.  There is still
a chunk of code between netlink_dump_start and netlink_dump that runs
outside the cb lock which isn't protected by an sk reference.

Here is a better patch which protects the entire netlink_dump function
with a sk reference.

The other call to netlink_dump by recvmsg is safe as the open file
descriptor already holds a reference.  As such the final sock_put
in netlink_dump can be turned into a __sock_put since there is at
least one reference held by the caller.

Signed-off-by: Herbert Xu <[EMAIL PROTECTED]>
 
Cheers,
-- 
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <[EMAIL PROTECTED]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

--- linux-2.4/net/netlink/af_netlink.c.orig     2005-04-01 09:20:05.000000000 
+1000
+++ linux-2.4/net/netlink/af_netlink.c  2005-04-01 09:21:06.000000000 +1000
@@ -981,11 +981,9 @@
        len = cb->dump(skb, cb);
 
        if (len > 0) {
-               sock_hold(sk);
                spin_unlock(&sk->protinfo.af_netlink->cb_lock);
                skb_queue_tail(&sk->receive_queue, skb);
                sk->data_ready(sk, len);
-               sock_put(sk);
                return 0;
        }
 
@@ -1000,7 +998,7 @@
        spin_unlock(&sk->protinfo.af_netlink->cb_lock);
 
        netlink_destroy_callback(cb);
-       sock_put(sk);
+       __sock_put(sk);
        return 0;
 }
 
@@ -1037,9 +1035,11 @@
                return -EBUSY;
        }
        sk->protinfo.af_netlink->cb = cb;
+       sock_hold(sk);
        spin_unlock(&sk->protinfo.af_netlink->cb_lock);
 
        netlink_dump(sk);
+       sock_put(sk);
        return 0;
 }