David, your tree git+ssh://master.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6.17.git is oopsing all over the place. Reverting "[NET]: Do not lose accepted socket when -ENFILE/-EMFILE." makes it stop:
diff -puN net/socket.c~0001-NET-Do-not-lose-accepted-socket-when-ENFILE-EMFILE net/socket.c --- devel/net/socket.c~0001-NET-Do-not-lose-accepted-socket-when-ENFILE-EMFILE 2006-01-28 17:08:35.000000000 -0800 +++ devel-akpm/net/socket.c 2006-01-28 17:08:48.000000000 -0800 @@ -351,8 +351,8 @@ static struct dentry_operations sockfs_d /* * Obtains the first available file descriptor and sets it up for use. * - * These functions create file structures and maps them to fd space - * of the current process. On success it returns file descriptor + * This function creates file structure and maps it to fd space + * of current process. On success it returns file descriptor * and file struct implicitly stored in sock->file. * Note that another thread may close file descriptor before we return * from this function. We use the fact that now we do not refer @@ -365,67 +365,52 @@ static struct dentry_operations sockfs_d * but we take care of internal coherence yet. */ -static int sock_alloc_fd(struct file **filep) +int sock_map_fd(struct socket *sock) { int fd; + struct qstr this; + char name[32]; + + /* + * Find a file descriptor suitable for return to the user. + */ fd = get_unused_fd(); - if (likely(fd >= 0)) { + if (fd >= 0) { struct file *file = get_empty_filp(); - if (unlikely(!file)) { + if (!file) { put_unused_fd(fd); - return -ENFILE; + fd = -ENFILE; + goto out; } - *filep = file; - } else - *filep = NULL; - return fd; -} -static int sock_attach_fd(struct socket *sock, struct file *file) -{ - struct qstr this; - char name[32]; - - this.len = sprintf(name, "[%lu]", SOCK_INODE(sock)->i_ino); - this.name = name; - this.hash = SOCK_INODE(sock)->i_ino; - - file->f_dentry = d_alloc(sock_mnt->mnt_sb->s_root, &this); - if (unlikely(!file->f_dentry)) - return -ENOMEM; - - file->f_dentry->d_op = &sockfs_dentry_operations; - d_add(file->f_dentry, SOCK_INODE(sock)); - file->f_vfsmnt = mntget(sock_mnt); - file->f_mapping = file->f_dentry->d_inode->i_mapping; - - sock->file = file; - file->f_op = SOCK_INODE(sock)->i_fop = &socket_file_ops; - file->f_mode = FMODE_READ | FMODE_WRITE; - file->f_flags = O_RDWR; - file->f_pos = 0; - file->private_data = sock; - - return 0; -} - -int sock_map_fd(struct socket *sock) -{ - struct file *newfile; - int fd = sock_alloc_fd(&newfile); - - if (likely(fd >= 0)) { - int err = sock_attach_fd(sock, newfile); - - if (unlikely(err < 0)) { - fput(newfile); + this.len = sprintf(name, "[%lu]", SOCK_INODE(sock)->i_ino); + this.name = name; + this.hash = SOCK_INODE(sock)->i_ino; + + file->f_dentry = d_alloc(sock_mnt->mnt_sb->s_root, &this); + if (!file->f_dentry) { + put_filp(file); put_unused_fd(fd); - return err; + fd = -ENOMEM; + goto out; } - fd_install(fd, newfile); + file->f_dentry->d_op = &sockfs_dentry_operations; + d_add(file->f_dentry, SOCK_INODE(sock)); + file->f_vfsmnt = mntget(sock_mnt); + file->f_mapping = file->f_dentry->d_inode->i_mapping; + + sock->file = file; + file->f_op = SOCK_INODE(sock)->i_fop = &socket_file_ops; + file->f_mode = FMODE_READ | FMODE_WRITE; + file->f_flags = O_RDWR; + file->f_pos = 0; + file->private_data = sock; + fd_install(fd, file); } + +out: return fd; } @@ -1367,8 +1352,7 @@ asmlinkage long sys_listen(int fd, int b asmlinkage long sys_accept(int fd, struct sockaddr __user *upeer_sockaddr, int __user *upeer_addrlen) { struct socket *sock, *newsock; - struct file *newfile; - int err, len, newfd; + int err, len; char address[MAX_SOCK_ADDR]; sock = sockfd_lookup(fd, &err); @@ -1388,38 +1372,28 @@ asmlinkage long sys_accept(int fd, struc */ __module_get(newsock->ops->owner); - newfd = sock_alloc_fd(&newfile); - if (newfd < 0) { - err = newfd; - goto out_release; - } - - err = sock_attach_fd(sock, newfile); - if (err < 0) - goto out_fd; - err = security_socket_accept(sock, newsock); if (err) - goto out_fd; + goto out_release; err = sock->ops->accept(sock, newsock, sock->file->f_flags); if (err < 0) - goto out_fd; + goto out_release; if (upeer_sockaddr) { if(newsock->ops->getname(newsock, (struct sockaddr *)address, &len, 2)<0) { err = -ECONNABORTED; - goto out_fd; + goto out_release; } err = move_addr_to_user(address, len, upeer_sockaddr, upeer_addrlen); if (err < 0) - goto out_fd; + goto out_release; } /* File flags are not inherited via accept() unlike another OSes. */ - fd_install(newfd, newfile); - err = newfd; + if ((err = sock_map_fd(newsock)) < 0) + goto out_release; security_socket_post_accept(sock, newsock); @@ -1427,9 +1401,6 @@ out_put: sockfd_put(sock); out: return err; -out_fd: - fput(newfile); - put_unused_fd(newfd); out_release: sock_release(newsock); goto out_put; _ Jan 28 17:03:16 sony kernel: ACPI: Video Device [NGFX] (multi-head: yes rom: no post: no) Jan 28 17:03:16 sony kernel: ACPI: Video Device [GFX0] (multi-head: yes rom: yes post: no) Jan 28 17:03:16 sony kernel: EXT3 FS on sda6, internal journal Jan 28 17:03:16 sony kernel: Adding 1052216k swap on /dev/sda5. Priority:-1 extents:1 across:1052216k Jan 28 17:03:16 sony kernel: Unable to handle kernel NULL pointer dereference at virtual address 00000004 Jan 28 17:03:16 sony kernel: printing eip: Jan 28 17:03:16 sony kernel: c0258d87 Jan 28 17:03:17 sony kernel: *pde = 3c9a7067 Jan 28 17:03:17 sony kernel: Oops: 0000 [#1] Jan 28 17:03:17 sony kernel: last sysfs file: /devices/system/cpu/cpu0/cpufreq/scaling_setspeed Jan 28 17:03:17 sony kernel: Modules linked in: autofs4 sunrpc video sony_acpi button battery ac nvram snd_hda_intel snd_hda_codec snd_seq_dummy snd_seq_oss snd_seq_midi_event snd_seq snd_seq_device snd_pcm_oss snd_mixer_oss ohci1394 ipw2200 snd_pcm ieee80211 ieee1394 ieee80211_crypt e100 mii ehci_hcd snd_timer uhci_hcd i2c_i801 snd soundcore snd_page_alloc i2c_core hw_random ext3 jbd ahci ata_piix libata sd_mod scsi_mod Jan 28 17:03:17 sony kernel: CPU: 0 Jan 28 17:03:17 sony kernel: EIP: 0060:[<c0258d87>] Not tainted VLI Jan 28 17:03:17 sony kernel: EFLAGS: 00210282 (2.6.16-rc1) Jan 28 17:03:17 sony kernel: EIP is at sys_accept+0x45/0x174 Jan 28 17:03:17 sony kernel: eax: 00000000 ebx: 00000005 ecx: f6eff3a4 edx: c1d8e000 Jan 28 17:03:17 sony kernel: esi: f6eff380 edi: f6eff380 ebp: c1d8e000 esp: c1d8eee0 Jan 28 17:03:17 sony kernel: ds: 007b es: 007b ss: 0068 Jan 28 17:03:17 sony kernel: Process hpiod (pid: 2311, threadinfo=c1d8e000 task=c1d8c560) Jan 28 17:03:17 sony kernel: Stack: <0>f6c19fbc 0000005a ffffffe9 c1d8ef14 c011810b 00000000 003d0f00 00000006 Jan 28 17:03:17 sony kernel: 420a5100 003d08c2 f7333560 c1d8e000 f7333574 c012744b c1d8e000 003d0f00 Jan 28 17:03:17 sony kernel: 00000000 f7333560 c0119f8f 00000000 c1d8efbc b7fa04d4 003d0f00 f6c3ab74 Jan 28 17:03:17 sony kernel: Call Trace: Jan 28 17:03:17 sony kernel: [<c011810b>] scheduler_tick+0x234/0x281 Jan 28 17:03:18 sony kernel: [<c012744b>] attach_pid+0x1d/0x9d Jan 28 17:03:18 sony kernel: [<c0119f8f>] copy_process+0x761/0xc22 Jan 28 17:03:18 sony kernel: [<c0259774>] sys_socketcall+0xa5/0x18b Jan 28 17:03:18 sony kernel: [<c0102afd>] syscall_call+0x7/0xb Jan 28 17:03:18 sony kernel: Code: 85 c0 89 c7 0f 84 9a 00 00 00 c7 44 24 08 e9 ff ff ff e8 21 f0 ff ff 85 c0 89 c6 74 7f 0f b7 47 20 66 89 46 20 8b 47 08 89 46 08 <8b> 58 04 85 db 74 15 89 d8 e8 6a 56 ed ff 85 c0 0f 84 0c 01 00 Jan 28 17:03:18 sony kernel: <1>Unable to handle kernel NULL pointer dereference at virtual address 0000001c Jan 28 17:03:18 sony kernel: printing eip: Jan 28 17:03:18 sony kernel: c0259007 Jan 28 17:03:18 sony kernel: *pde = 00000000 Jan 28 17:03:18 sony kernel: Oops: 0000 [#2] Jan 28 17:03:18 sony kernel: last sysfs file: /devices/system/cpu/cpu0/cpufreq/scaling_setspeed Jan 28 17:03:18 sony kernel: Modules linked in: autofs4 sunrpc video sony_acpi button battery ac nvram snd_hda_intel snd_hda_codec snd_seq_dummy snd_seq_oss snd_seq_midi_event snd_seq snd_seq_device snd_pcm_oss snd_mixer_oss ohci1394 ipw2200 snd_pcm ieee80211 ieee1394 ieee80211_crypt e100 mii ehci_hcd snd_timer uhci_hcd i2c_i801 snd soundcore snd_page_alloc i2c_core hw_random ext3 jbd ahci ata_piix libata sd_mod scsi_mod Jan 28 17:03:18 sony kernel: CPU: 0 Jan 28 17:03:18 sony kernel: EIP: 0060:[<c0259007>] Not tainted VLI Jan 28 17:03:18 sony kernel: EFLAGS: 00010246 (2.6.16-rc1) Jan 28 17:03:18 sony kernel: EIP is at sys_getpeername+0x44/0x85 Jan 28 17:03:18 sony kernel: eax: f681e680 ebx: 00000000 ecx: f730cee8 edx: f730cef0 Jan 28 17:03:19 sony kernel: esi: f681e680 edi: f730cef0 ebp: f730c000 esp: f730cee4 Jan 28 17:03:19 sony kernel: ds: 007b es: 007b ss: 0068 Jan 28 17:03:19 sony kernel: Process xinetd (pid: 2422, threadinfo=f730c000 task=f720fa90) Jan 28 17:03:19 sony kernel: Stack: <0>00000001 f7f5b244 00000000 f730cf2c f6829f94 c031fa20 00000000 c031fa20 Jan 28 17:03:19 sony kernel: 00000000 c014410f 0000000e c013f077 00000000 c1dae184 c17ed0e0 b7e4dda0 Jan 28 17:03:19 sony kernel: f6829f94 f7160ac0 00000002 f68d3b7c b7e4dda0 00000000 f7160ac0 c0144365 Jan 28 17:03:19 sony kernel: Call Trace: Jan 28 17:03:19 sony kernel: [<c014410f>] do_no_page+0x163/0x277 Jan 28 17:03:19 sony kernel: [<c013f077>] __pagevec_lru_add_active+0x91/0x9c Jan 28 17:03:19 sony kernel: [<c0144365>] __handle_mm_fault+0xce/0x1a5 Jan 28 17:03:19 sony kernel: [<c025978e>] sys_socketcall+0xbf/0x18b Jan 28 17:03:19 sony kernel: [<c0102afd>] syscall_call+0x7/0xb Jan 28 17:03:19 sony kernel: Code: 85 c0 89 c6 74 39 8b 15 c0 1c 3e c0 ff 92 04 02 00 00 89 44 24 04 85 c0 75 1d 8b 5e 08 8d 7c 24 08 89 fa 6a 01 8d 4c 24 04 89 f0 <ff> 53 1c 89 44 24 08 85 c0 5b 74 16 8b 46 10 e8 ac 9b ef ff 8b Jan 28 17:03:19 sony kernel: <1>Unable to handle kernel NULL pointer dereference at virtual address 00000008 - To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html