Hannes Frederic Sowa
8822b64a0f
ipv6: call udp_push_pending_frames when uncorking a socket with AF_INET pending data
We accidentally call down to ip6_push_pending_frames when uncorking
pending AF_INET data on a ipv6 socket. This results in the following
splat (from Dave Jones):
skbuff: skb_under_panic: text:ffffffff816765f6 len:48 put:40 head:ffff88013deb6df0 data:ffff88013deb6dec tail:0x2c end:0xc0 dev:<NULL>
------------[ cut here ]------------
kernel BUG at net/core/skbuff.c:126!
invalid opcode: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC
Modules linked in: dccp_ipv4 dccp 8021q garp bridge stp dlci mpoa snd_seq_dummy sctp fuse hidp tun bnep nfnetlink scsi_transport_iscsi rfcomm can_raw can_bcm af_802154 appletalk caif_socket can caif ipt_ULOG x25 rose af_key pppoe pppox ipx phonet irda llc2 ppp_generic slhc p8023 psnap p8022 llc crc_ccitt atm bluetooth
+netrom ax25 nfc rfkill rds af_rxrpc coretemp hwmon kvm_intel kvm crc32c_intel snd_hda_codec_realtek ghash_clmulni_intel microcode pcspkr snd_hda_codec_hdmi snd_hda_intel snd_hda_codec snd_hwdep usb_debug snd_seq snd_seq_device snd_pcm e1000e snd_page_alloc snd_timer ptp snd pps_core soundcore xfs libcrc32c
CPU: 2 PID: 8095 Comm: trinity-child2 Not tainted 3.10.0-rc7+ #37
task: ffff8801f52c2520 ti: ffff8801e6430000 task.ti: ffff8801e6430000
RIP: 0010:[<ffffffff816e759c>] [<ffffffff816e759c>] skb_panic+0x63/0x65
RSP: 0018:ffff8801e6431de8 EFLAGS: 00010282
RAX: 0000000000000086 RBX: ffff8802353d3cc0 RCX: 0000000000000006
RDX: 0000000000003b90 RSI: ffff8801f52c2ca0 RDI: ffff8801f52c2520
RBP: ffff8801e6431e08 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000001 R12: ffff88022ea0c800
R13: ffff88022ea0cdf8 R14: ffff8802353ecb40 R15: ffffffff81cc7800
FS: 00007f5720a10740(0000) GS:ffff880244c00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000005862000 CR3: 000000022843c000 CR4: 00000000001407e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Stack:
ffff88013deb6dec 000000000000002c 00000000000000c0 ffffffff81a3f6e4
ffff8801e6431e18 ffffffff8159a9aa ffff8801e6431e90 ffffffff816765f6
ffffffff810b756b 0000000700000002 ffff8801e6431e40 0000fea9292aa8c0
Call Trace:
[<ffffffff8159a9aa>] skb_push+0x3a/0x40
[<ffffffff816765f6>] ip6_push_pending_frames+0x1f6/0x4d0
[<ffffffff810b756b>] ? mark_held_locks+0xbb/0x140
[<ffffffff81694919>] udp_v6_push_pending_frames+0x2b9/0x3d0
[<ffffffff81694660>] ? udplite_getfrag+0x20/0x20
[<ffffffff8162092a>] udp_lib_setsockopt+0x1aa/0x1f0
[<ffffffff811cc5e7>] ? fget_light+0x387/0x4f0
[<ffffffff816958a4>] udpv6_setsockopt+0x34/0x40
[<ffffffff815949f4>] sock_common_setsockopt+0x14/0x20
[<ffffffff81593c31>] SyS_setsockopt+0x71/0xd0
[<ffffffff816f5d54>] tracesys+0xdd/0xe2
Code: 00 00 48 89 44 24 10 8b 87 d8 00 00 00 48 89 44 24 08 48 8b 87 e8 00 00 00 48 c7 c7 c0 04 aa 81 48 89 04 24 31 c0 e8 e1 7e ff ff <0f> 0b 55 48 89 e5 0f 0b 55 48 89 e5 0f 0b 55 48 89 e5 0f 0b 55
RIP [<ffffffff816e759c>] skb_panic+0x63/0x65
RSP <ffff8801e6431de8>
This patch adds a check if the pending data is of address family AF_INET
and directly calls udp_push_ending_frames from udp_v6_push_pending_frames
if that is the case.
This bug was found by Dave Jones with trinity.
(Also move the initialization of fl6 below the AF_INET check, even if
not strictly necessary.)
Cc: Dave Jones <davej@redhat.com>
Cc: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-07-02 12:44:18 -07:00
..
2013-02-27 22:51:08 -05:00
2013-06-23 00:23:53 +01:00
2013-04-23 13:25:51 -04:00
2013-04-19 17:32:31 -04:00
2013-04-08 17:16:57 -04:00
2013-06-11 02:51:03 -07:00
2013-05-23 14:23:16 +02:00
2013-06-14 13:44:58 +02:00
2012-06-17 16:29:38 -07:00
2013-07-02 00:23:57 -07:00
2013-06-11 02:51:03 -07:00
2013-07-01 23:39:21 -07:00
2013-05-01 15:13:49 -04:00
2012-08-09 16:18:06 -07:00
2011-11-30 18:51:03 -05:00
2013-02-27 19:10:24 -08:00
2013-06-19 18:55:39 +02:00
2012-08-30 03:00:16 +02:00
2012-06-01 14:18:29 -04:00
2013-04-09 13:19:35 -04:00
2012-08-10 16:52:54 -07:00
2012-04-15 12:44:40 -04:00
2012-04-05 05:08:04 -04:00
2013-03-22 10:31:16 -04:00
2013-01-28 00:15:27 -05:00
2012-04-15 12:44:40 -04:00
2011-12-01 11:41:06 -05:00
2013-01-09 23:59:53 -08:00
2012-07-19 10:43:03 -07:00
2013-03-15 09:06:58 -04:00
2012-06-29 01:36:36 -07:00
2013-03-26 12:32:13 -04:00
2013-03-20 12:14:36 -04:00
2012-10-08 17:42:36 -04:00
2013-06-11 02:51:03 -07:00
2013-04-25 01:43:15 -04:00
2013-06-19 18:07:41 -07:00
2013-01-27 22:46:33 -05:00
2013-02-22 15:10:18 -05:00
2013-05-24 12:07:25 +02:00
2013-04-08 12:00:16 -04:00
2011-11-14 00:19:42 -05:00
2013-06-28 21:19:17 -07:00
2012-07-16 03:44:56 -07:00
2013-02-21 18:15:58 -05:00
2012-07-19 11:02:03 -07:00
2013-03-12 08:30:34 -04:00
2013-05-28 23:49:07 -07:00
2013-05-06 11:06:51 -04:00
2013-02-27 19:10:24 -08:00
2013-06-12 03:13:50 -07:00
2013-02-27 19:10:24 -08:00
2012-07-10 22:40:14 -07:00
2013-01-08 17:56:10 -08:00
2013-02-20 15:11:45 -05:00
2013-01-18 14:41:13 -05:00
2013-03-26 12:27:18 -04:00
2013-07-02 00:33:52 -07:00
2013-06-27 22:30:47 -07:00
2013-06-26 18:01:46 +09:00
2013-01-21 14:17:05 -05:00
2013-06-19 23:18:07 -07:00
2012-05-17 18:45:20 -04:00
2013-04-29 15:41:56 -04:00
2013-07-01 14:06:47 -07:00
2012-04-15 12:44:40 -04:00
2012-05-15 20:14:35 -04:00
2012-09-17 13:13:24 -04:00
2013-06-13 11:58:47 +02:00
2012-06-26 21:06:11 -07:00
2013-02-10 20:37:22 -05:00
2013-06-19 23:18:07 -07:00
2013-02-11 00:21:44 -05:00
2013-06-26 18:01:46 +09:00
2013-01-14 15:04:59 -05:00
2012-09-17 18:08:54 -07:00
2012-09-10 15:30:41 -04:00
2013-04-09 13:19:37 -04:00
2013-02-27 19:10:24 -08:00
2013-06-05 16:37:30 -07:00
2013-01-14 15:09:36 -05:00
2013-02-12 18:59:45 -05:00
2012-11-15 17:39:51 -05:00
2012-05-19 01:08:16 -04:00
2012-04-16 23:53:11 -04:00
2013-01-03 13:01:30 +01:00
2013-04-22 15:55:48 -04:00
2012-11-03 14:59:04 -04:00
2013-03-22 10:31:16 -04:00
2013-06-11 22:39:47 -07:00
2013-04-22 20:32:51 -04:00
2013-04-29 15:14:02 -04:00
2012-08-06 13:40:47 -07:00
2013-06-19 21:16:53 -07:00
2012-04-10 10:04:07 -07:00
2013-06-25 02:44:05 -07:00
2012-06-09 14:56:12 -07:00
2013-06-04 16:43:42 -07:00
2013-07-02 12:44:18 -07:00
2012-03-12 17:05:21 -07:00
2012-04-15 12:44:40 -04:00
2012-05-16 15:17:08 -04:00
2012-04-15 12:44:40 -04:00
2013-05-31 17:30:07 -07:00