linux

mainlining shenanigans

Go to file

Bjørn Mork 49c2c3f246 cdc_ncm: avoid padding beyond end of skb Commit `4a0e3e989d` ("cdc_ncm: Add support for moving NDP to end of NCM frame") added logic to reserve space for the NDP at the end of the NTB/skb. This reservation did not take the final alignment of the NDP into account, causing us to reserve too little space. Additionally the padding prior to NDP addition did not ensure there was enough space for the NDP. The NTB/skb with the NDP appended would then exceed the configured max size. This caused the final padding of the NTB to use a negative count, padding to almost INT_MAX, and resulting in: [60103.825970] BUG: unable to handle kernel paging request at ffff9641f2004000 [60103.825998] IP: __memset+0x24/0x30 [60103.826001] PGD a6a06067 P4D a6a06067 PUD 4f65a063 PMD 72003063 PTE 0 [60103.826013] Oops: 0002 [#1] SMP NOPTI [60103.826018] Modules linked in: (removed( [60103.826158] CPU: 0 PID: 5990 Comm: Chrome_DevTools Tainted: G O 4.14.0-3-amd64 #1 Debian 4.14.17-1 [60103.826162] Hardware name: LENOVO 20081 BIOS 41CN28WW(V2.04) 05/03/2012 [60103.826166] task: ffff964193484fc0 task.stack: ffffb2890137c000 [60103.826171] RIP: 0010:__memset+0x24/0x30 [60103.826174] RSP: 0000:ffff964316c03b68 EFLAGS: 00010216 [60103.826178] RAX: 0000000000000000 RBX: 00000000fffffffd RCX: 000000001ffa5000 [60103.826181] RDX: 0000000000000005 RSI: 0000000000000000 RDI: ffff9641f2003ffc [60103.826184] RBP: ffff964192f6c800 R08: 00000000304d434e R09: ffff9641f1d2c004 [60103.826187] R10: 0000000000000002 R11: 00000000000005ae R12: ffff9642e6957a80 [60103.826190] R13: ffff964282ff2ee8 R14: 000000000000000d R15: ffff9642e4843900 [60103.826194] FS: 00007f395aaf6700(0000) GS:ffff964316c00000(0000) knlGS:0000000000000000 [60103.826197] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [60103.826200] CR2: ffff9641f2004000 CR3: 0000000013b0c000 CR4: 00000000000006f0 [60103.826204] Call Trace: [60103.826212] <IRQ> [60103.826225] cdc_ncm_fill_tx_frame+0x5e3/0x740 [cdc_ncm] [60103.826236] cdc_ncm_tx_fixup+0x57/0x70 [cdc_ncm] [60103.826246] usbnet_start_xmit+0x5d/0x710 [usbnet] [60103.826254] ? netif_skb_features+0x119/0x250 [60103.826259] dev_hard_start_xmit+0xa1/0x200 [60103.826267] sch_direct_xmit+0xf2/0x1b0 [60103.826273] __dev_queue_xmit+0x5e3/0x7c0 [60103.826280] ? ip_finish_output2+0x263/0x3c0 [60103.826284] ip_finish_output2+0x263/0x3c0 [60103.826289] ? ip_output+0x6c/0xe0 [60103.826293] ip_output+0x6c/0xe0 [60103.826298] ? ip_forward_options+0x1a0/0x1a0 [60103.826303] tcp_transmit_skb+0x516/0x9b0 [60103.826309] tcp_write_xmit+0x1aa/0xee0 [60103.826313] ? sch_direct_xmit+0x71/0x1b0 [60103.826318] tcp_tasklet_func+0x177/0x180 [60103.826325] tasklet_action+0x5f/0x110 [60103.826332] __do_softirq+0xde/0x2b3 [60103.826337] irq_exit+0xae/0xb0 [60103.826342] do_IRQ+0x81/0xd0 [60103.826347] common_interrupt+0x98/0x98 [60103.826351] </IRQ> [60103.826355] RIP: 0033:0x7f397bdf2282 [60103.826358] RSP: 002b:00007f395aaf57d8 EFLAGS: 00000206 ORIG_RAX: ffffffffffffff6e [60103.826362] RAX: 0000000000000000 RBX: 00002f07bc6d0900 RCX: 00007f39752d7fe7 [60103.826365] RDX: 0000000000000022 RSI: 0000000000000147 RDI: 00002f07baea02c0 [60103.826368] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 [60103.826371] R10: 00000000ffffffff R11: 0000000000000000 R12: 00002f07baea02c0 [60103.826373] R13: 00002f07bba227a0 R14: 00002f07bc6d090c R15: 0000000000000000 [60103.826377] Code: 90 90 90 90 90 90 90 0f 1f 44 00 00 49 89 f9 48 89 d1 83 e2 07 48 c1 e9 03 40 0f b6 f6 48 b8 01 01 01 01 01 01 01 01 48 0f af c6 <f3> 48 ab 89 d1 f3 aa 4c 89 c8 c3 90 49 89 f9 40 88 f0 48 89 d1 [60103.826442] RIP: __memset+0x24/0x30 RSP: ffff964316c03b68 [60103.826444] CR2: ffff9641f2004000 Commit `e1069bbfcf` ("net: cdc_ncm: Reduce memory use when kernel memory low") made this bug much more likely to trigger by reducing the NTB size under memory pressure. Link: https://bugs.debian.org/893393 Reported-by: Горбешко Богдан <bodqhrohro@gmail.com> Reported-and-tested-by: Dennis Wassenberg <dennis.wassenberg@secunet.com> Cc: Enrico Mioso <mrkiko.rs@gmail.com> Fixes: `4a0e3e989d` ("cdc_ncm: Add support for moving NDP to end of NCM frame") Signed-off-by: Bjørn Mork <bjorn@mork.no> Signed-off-by: David S. Miller <davem@davemloft.net>		2018-06-08 19:50:01 -04:00
arch	net: in virtio_net_hdr only add VLAN_HLEN to csum_start if payload holds vlan	2018-06-07 16:15:38 -04:00
block	Changes for 4.18:	2018-06-05 13:24:20 -07:00
certs	certs/blacklist_nohashes.c: fix const confusion in certs blacklist	2018-02-21 15:35:43 -08:00
crypto	- Introduce arithmetic overflow test helper functions (Rasmus)	2018-06-06 17:27:14 -07:00
Documentation	media updates for v4.18-rc1	2018-06-07 12:34:37 -07:00
drivers	cdc_ncm: avoid padding beyond end of skb	2018-06-08 19:50:01 -04:00
firmware	kbuild: remove all dummy assignments to obj-	2017-11-18 11:46:06 +09:00
fs	powerpc updates for 4.18	2018-06-07 10:23:33 -07:00
include	Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf	2018-06-07 20:06:25 -04:00
init	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2018-06-06 18:39:49 -07:00
ipc	Merge branch 'timers-2038-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2018-06-04 21:02:18 -07:00
kernel	Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf	2018-06-07 20:06:25 -04:00
lib	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2018-06-06 18:39:49 -07:00
LICENSES	LICENSES: Add Linux-OpenIB license text	2018-04-27 16:41:53 -06:00
mm	Changes for 4.18:	2018-06-05 13:24:20 -07:00
net	net/sched: act_simple: fix parsing of TCA_DEF_DATA	2018-06-08 18:49:19 -04:00
samples	samples/bpf: xdpsock: use skb Tx path for XDP_SKB	2018-06-05 15:48:57 +02:00
scripts	powerpc updates for 4.18	2018-06-07 10:23:33 -07:00
security	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2018-06-06 18:39:49 -07:00
sound	media updates for v4.18-rc1	2018-06-07 12:34:37 -07:00
tools	Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf	2018-06-07 20:06:25 -04:00
usr	kbuild: rename built-in.o to built-in.a	2018-03-26 02:01:19 +09:00
virt	Merge branch 'siginfo-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace	2018-06-04 15:23:48 -07:00
.clang-format	clang-format: add configuration file	2018-04-11 10:28:35 -07:00
.cocciconfig
.get_maintainer.ignore
.gitattributes	.gitattributes: set git diff driver for C source code files	2016-10-07 18:46:30 -07:00
.gitignore	Kbuild updates for v4.17 (2nd)	2018-04-15 17:21:30 -07:00
.mailmap	Merge branch 'asoc-4.17' into asoc-4.18 for compress dependencies	2018-04-26 12:24:28 +01:00
COPYING	COPYING: use the new text with points to the license files	2018-03-23 12:41:45 -06:00
CREDITS	MAINTAINERS/CREDITS: Drop METAG ARCHITECTURE	2018-03-05 16:34:24 +00:00
Kbuild	Kbuild updates for v4.15	2017-11-17 17:45:29 -08:00
Kconfig	kconfig: add basic helper macros to scripts/Kconfig.include	2018-05-29 03:31:19 +09:00
MAINTAINERS	media updates for v4.18-rc1	2018-06-07 12:34:37 -07:00
Makefile	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2018-06-06 18:39:49 -07:00
README	Docs: Added a pointer to the formatted docs to README	2018-03-21 09:02:53 -06:00

README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.
See Documentation/00-INDEX for a list of what is contained in each file.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.