lisa/android_kernel_xiaomi_sm8350
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
6edafaaf6f
android_kernel_xiaomi_sm8350/net/ipv4
History
Gui Jianfeng 6edafaaf6f tcp: Fix kernel panic when calling tcp_v(4/6)_md5_do_lookup 
If the following packet flow happen, kernel will panic.
MathineA			MathineB
		SYN
	---------------------->    
        	SYN+ACK
	<----------------------
		ACK(bad seq)
	---------------------->
When a bad seq ACK is received, tcp_v4_md5_do_lookup(skb->sk, ip_hdr(skb)->daddr))
is finally called by tcp_v4_reqsk_send_ack(), but the first parameter(skb->sk) is 
NULL at that moment, so kernel panic happens.
This patch fixes this bug.

OOPS output is as following:
[  302.812793] IP: [<c05cfaa6>] tcp_v4_md5_do_lookup+0x12/0x42
[  302.817075] Oops: 0000 [#1] SMP 
[  302.819815] Modules linked in: ipv6 loop dm_multipath rtc_cmos rtc_core rtc_lib pcspkr pcnet32 mii i2c_piix4 parport_pc i2c_core parport ac button ata_piix libata dm_mod mptspi mptscsih mptbase scsi_transport_spi sd_mod scsi_mod crc_t10dif ext3 jbd mbcache uhci_hcd ohci_hcd ehci_hcd [last unloaded: scsi_wait_scan]
[  302.849946] 
[  302.851198] Pid: 0, comm: swapper Not tainted (2.6.27-rc1-guijf #5)
[  302.855184] EIP: 0060:[<c05cfaa6>] EFLAGS: 00010296 CPU: 0
[  302.858296] EIP is at tcp_v4_md5_do_lookup+0x12/0x42
[  302.861027] EAX: 0000001e EBX: 00000000 ECX: 00000046 EDX: 00000046
[  302.864867] ESI: ceb69e00 EDI: 1467a8c0 EBP: cf75f180 ESP: c0792e54
[  302.868333]  DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068
[  302.871287] Process swapper (pid: 0, ti=c0792000 task=c0712340 task.ti=c0746000)
[  302.875592] Stack: c06f413a 00000000 cf75f180 ceb69e00 00000000 c05d0d86 000016d0 ceac5400 
[  302.883275]        c05d28f8 000016d0 ceb69e00 ceb69e20 681bf6e3 00001000 00000000 0a67a8c0 
[  302.890971]        ceac5400 c04250a3 c06f413a c0792eb0 c0792edc cf59a620 cf59a620 cf59a634 
[  302.900140] Call Trace:
[  302.902392]  [<c05d0d86>] tcp_v4_reqsk_send_ack+0x17/0x35
[  302.907060]  [<c05d28f8>] tcp_check_req+0x156/0x372
[  302.910082]  [<c04250a3>] printk+0x14/0x18
[  302.912868]  [<c05d0aa1>] tcp_v4_do_rcv+0x1d3/0x2bf
[  302.917423]  [<c05d26be>] tcp_v4_rcv+0x563/0x5b9
[  302.920453]  [<c05bb20f>] ip_local_deliver_finish+0xe8/0x183
[  302.923865]  [<c05bb10a>] ip_rcv_finish+0x286/0x2a3
[  302.928569]  [<c059e438>] dev_alloc_skb+0x11/0x25
[  302.931563]  [<c05a211f>] netif_receive_skb+0x2d6/0x33a
[  302.934914]  [<d0917941>] pcnet32_poll+0x333/0x680 [pcnet32]
[  302.938735]  [<c05a3b48>] net_rx_action+0x5c/0xfe
[  302.941792]  [<c042856b>] __do_softirq+0x5d/0xc1
[  302.944788]  [<c042850e>] __do_softirq+0x0/0xc1
[  302.948999]  [<c040564b>] do_softirq+0x55/0x88
[  302.951870]  [<c04501b1>] handle_fasteoi_irq+0x0/0xa4
[  302.954986]  [<c04284da>] irq_exit+0x35/0x69
[  302.959081]  [<c0405717>] do_IRQ+0x99/0xae
[  302.961896]  [<c040422b>] common_interrupt+0x23/0x28
[  302.966279]  [<c040819d>] default_idle+0x2a/0x3d
[  302.969212]  [<c0402552>] cpu_idle+0xb2/0xd2
[  302.972169]  =======================
[  302.974274] Code: fc ff 84 d2 0f 84 df fd ff ff e9 34 fe ff ff 83 c4 0c 5b 5e 5f 5d c3 90 90 57 89 d7 56 53 89 c3 50 68 3a 41 6f c0 e8 e9 55 e5 ff <8b> 93 9c 04 00 00 58 85 d2 59 74 1e 8b 72 10 31 db 31 c9 85 f6 
[  303.011610] EIP: [<c05cfaa6>] tcp_v4_md5_do_lookup+0x12/0x42 SS:ESP 0068:c0792e54
[  303.018360] Kernel panic - not syncing: Fatal exception in interrupt

Signed-off-by: Gui Jianfeng <guijianfeng@cn.fujitsu.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2008-08-06 23:50:04 -07:00
..
ipvs Merge branch 'stealer/ipvs/sync-daemon-cleanup-for-next' of git://git.stealer.net/linux-2.6 2008-07-16 20:07:06 -07:00
netfilter netfilter: ipt_recent: fix race between recent_mt_destroy and proc manipulations 2008-07-31 00:38:31 -07:00
af_inet.c Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6 2008-07-26 20:23:44 -07:00
ah4.c
arp.c mib: add net to NET_INC_STATS_BH 2008-07-16 20:31:16 -07:00
cipso_ipv4.c cipso: Relax too much careful cipso hash function. 2008-05-13 23:23:55 -07:00
datagram.c mib: add net to IP_INC_STATS_BH 2008-07-16 20:20:11 -07:00
devinet.c net: convert BUG_TRAP to generic WARN_ON 2008-07-25 21:43:18 -07:00
esp4.c ipsec: Interfamily IPSec BEET 2008-08-06 02:39:30 -07:00
fib_frontend.c netns: add namespace parameter to rt_cache_flush 2008-07-05 19:00:44 -07:00
fib_hash.c netns: add namespace parameter to rt_cache_flush 2008-07-05 19:00:44 -07:00
fib_lookup.h
fib_rules.c net: add fib_rules_ops to flush_cache method 2008-07-05 19:01:28 -07:00
fib_semantics.c Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6 2008-06-13 20:52:39 -07:00
fib_trie.c proc: consolidate per-net single-release callers 2008-07-18 04:07:44 -07:00
icmp.c mib: put icmpmsg statistics on struct net 2008-07-18 04:04:22 -07:00
igmp.c netns: Use net_eq() to compare net-namespaces for optimization. 2008-07-19 22:34:43 -07:00
inet_connection_sock.c net: convert BUG_TRAP to generic WARN_ON 2008-07-25 21:43:18 -07:00
inet_diag.c net: remove CVS keywords 2008-06-11 21:00:38 -07:00
inet_fragment.c net: convert BUG_TRAP to generic WARN_ON 2008-07-25 21:43:18 -07:00
inet_hashtables.c net: convert BUG_TRAP to generic WARN_ON 2008-07-25 21:43:18 -07:00
inet_lro.c net/inet_lro: remove setting skb->ip_summed when not LRO-able 2008-06-27 20:09:00 -07:00
inet_timewait_sock.c net: convert BUG_TRAP to generic WARN_ON 2008-07-25 21:43:18 -07:00
inetpeer.c net: remove CVS keywords 2008-06-11 21:00:38 -07:00
ip_forward.c mib: add net to IP_INC_STATS_BH 2008-07-16 20:20:11 -07:00
ip_fragment.c net: convert BUG_TRAP to generic WARN_ON 2008-07-25 21:43:18 -07:00
ip_gre.c Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6 2008-05-25 23:26:10 -07:00
ip_input.c mib: put ip statistics on struct net 2008-07-18 04:02:42 -07:00
ip_options.c net: remove CVS keywords 2008-06-11 21:00:38 -07:00
ip_output.c net: convert BUG_TRAP to generic WARN_ON 2008-07-25 21:43:18 -07:00
ip_sockglue.c net: remove CVS keywords 2008-06-11 21:00:38 -07:00
ipcomp.c ipcomp: Fix warnings after ipcomp consolidation. 2008-07-27 03:59:24 -07:00
ipconfig.c netns: Use net_eq() to compare net-namespaces for optimization. 2008-07-19 22:34:43 -07:00
ipip.c net: remove CVS keywords 2008-06-11 21:00:38 -07:00
ipmr.c netns: Use net_eq() to compare net-namespaces for optimization. 2008-07-19 22:34:43 -07:00
Kconfig ipsec: ipcomp - Merge IPComp implementations 2008-07-25 02:54:40 -07:00
Makefile
netfilter.c
proc.c tcp: MD5: Use MIB counter instead of warning for MD5 mismatch. 2008-07-30 03:27:25 -07:00
protocol.c net: remove CVS keywords 2008-06-11 21:00:38 -07:00
raw.c mib: add net to IP_INC_STATS 2008-07-16 20:19:49 -07:00
route.c ipv4: Fix over-ifdeffing of ip_static_sysctl_init. 2008-08-06 18:30:43 -07:00
syncookies.c syncookies: Make sure ECN is disabled 2008-07-26 02:21:54 -07:00
sysctl_net_ipv4.c net: Add missing extra2 parameter for ip_default_ttl sysctl 2008-08-03 14:06:44 -07:00
tcp_bic.c
tcp_cong.c
tcp_cubic.c rename div64_64 to div64_u64 2008-05-01 08:03:58 -07:00
tcp_diag.c net: remove CVS keywords 2008-06-11 21:00:38 -07:00
tcp_highspeed.c
tcp_htcp.c
tcp_hybla.c net: fix returning void-valued expression warnings 2008-05-01 02:47:38 -07:00
tcp_illinois.c
tcp_input.c net: convert BUG_TRAP to generic WARN_ON 2008-07-25 21:43:18 -07:00
tcp_ipv4.c tcp: Fix kernel panic when calling tcp_v(4/6)_md5_do_lookup 2008-08-06 23:50:04 -07:00
tcp_lp.c
tcp_minisocks.c tcp: Fix kernel panic when calling tcp_v(4/6)_md5_do_lookup 2008-08-06 23:50:04 -07:00
tcp_output.c tcp: Fix bitmask test in tcp_syn_options() 2008-07-21 18:45:34 -07:00
tcp_probe.c tcp: correct kcalloc usage 2008-07-10 16:51:32 -07:00
tcp_scalable.c
tcp_timer.c net: convert BUG_TRAP to generic WARN_ON 2008-07-25 21:43:18 -07:00
tcp_vegas.c net: fix returning void-valued expression warnings 2008-05-01 02:47:38 -07:00
tcp_vegas.h
tcp_veno.c net: fix returning void-valued expression warnings 2008-05-01 02:47:38 -07:00
tcp_westwood.c
tcp_yeah.c
tcp.c net: convert BUG_TRAP to generic WARN_ON 2008-07-25 21:43:18 -07:00
tunnel4.c [IPV4] TUNNEL4: Fix incoming packet length check for inter-protocol tunnel. 2008-06-05 04:02:33 +09:00
udp_impl.h net: change proto destroy method to return void 2008-06-14 17:04:49 -07:00
udp.c udplite: Protection against coverage value wrap-around 2008-07-21 13:35:08 -07:00
udplite.c mib: put udplite statistics on struct net 2008-07-18 04:03:45 -07:00
xfrm4_input.c
xfrm4_mode_beet.c ipsec: Interfamily IPSec BEET 2008-08-06 02:39:30 -07:00
xfrm4_mode_transport.c
xfrm4_mode_tunnel.c xfrm: fix fragmentation for ipv4 xfrm tunnel 2008-06-17 16:38:23 -07:00
xfrm4_output.c
xfrm4_policy.c
xfrm4_state.c
xfrm4_tunnel.c