lisa/android_kernel_xiaomi_sm8350
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
8984e41d18
android_kernel_xiaomi_sm8350/net
History
Wei Yongjun 8984e41d18 [IPV6]: Fix kernel panic while send SCTP data with IP fragments 
If ICMP6 message with "Packet Too Big" is received after send SCTP DATA,
kernel panic will occur when SCTP DATA is send again.

This is because of a bad dest address when call to skb_copy_bits().

The messages sequence is like this:

Endpoint A                             Endpoint B
                               <-------  SCTP DATA (size=1432)
ICMP6 message ------->
(Packet Too Big pmtu=1280)
                               <-------  Resend SCTP DATA (size=1432)
------------kernel panic---------------

 printing eip:
c05be62a
*pde = 00000000
Oops: 0002 [#1]
SMP
Modules linked in: scomm l2cap bluetooth ipv6 dm_mirror dm_mod video output sbs battery lp floppy sg i2c_piix4 i2c_core pcnet32 mii button ac parport_pc parport ide_cd cdrom serio_raw mptspi mptscsih mptbase scsi_transport_spi sd_mod scsi_mod ext3 jbd ehci_hcd ohci_hcd uhci_hcd
CPU:    0
EIP:    0060:[<c05be62a>]    Not tainted VLI
EFLAGS: 00010282   (2.6.23-rc2 #1)
EIP is at skb_copy_bits+0x4f/0x1ef
eax: 000004d0   ebx: ce12a980   ecx: 00000134   edx: cfd5a880
esi: c8246858   edi: 00000000   ebp: c0759b14   esp: c0759adc
ds: 007b   es: 007b   fs: 00d8  gs: 0000  ss: 0068
Process swapper (pid: 0, ti=c0759000 task=c06d0340 task.ti=c0713000)
Stack: c0759b88 c0405867 ce12a980 c8bff838 c789c084 00000000 00000028 cfd5a880
       d09f1890 000005dc 0000007b ce12a980 cfd5a880 c8bff838 c0759b88 d09bc521
       000004d0 fffff96c 00000200 00000100 c0759b50 cfd5a880 00000246 c0759bd4
Call Trace:
 [<c0405e1d>] show_trace_log_lvl+0x1a/0x2f
 [<c0405ecd>] show_stack_log_lvl+0x9b/0xa3
 [<c040608d>] show_registers+0x1b8/0x289
 [<c0406271>] die+0x113/0x246
 [<c0625dbc>] do_page_fault+0x4ad/0x57e
 [<c0624642>] error_code+0x72/0x78
 [<d09bc521>] ip6_output+0x8e5/0xab2 [ipv6]
 [<d09bcec1>] ip6_xmit+0x2ea/0x3a3 [ipv6]
 [<d0a3f2ca>] sctp_v6_xmit+0x248/0x253 [sctp]
 [<d0a3c934>] sctp_packet_transmit+0x53f/0x5ae [sctp]
 [<d0a34bf8>] sctp_outq_flush+0x555/0x587 [sctp]
 [<d0a34d3c>] sctp_retransmit+0xf8/0x10f [sctp]
 [<d0a3d183>] sctp_icmp_frag_needed+0x57/0x5b [sctp]
 [<d0a3ece2>] sctp_v6_err+0xcd/0x148 [sctp]
 [<d09cf1ce>] icmpv6_notify+0xe6/0x167 [ipv6]
 [<d09d009a>] icmpv6_rcv+0x7d7/0x849 [ipv6]
 [<d09be240>] ip6_input+0x1dc/0x310 [ipv6]
 [<d09be965>] ipv6_rcv+0x294/0x2df [ipv6]
 [<c05c3789>] netif_receive_skb+0x2d2/0x335
 [<c05c5733>] process_backlog+0x7f/0xd0
 [<c05c58f6>] net_rx_action+0x96/0x17e
 [<c042e722>] __do_softirq+0x64/0xcd
 [<c0406f37>] do_softirq+0x5c/0xac
 =======================
Code: 00 00 29 ca 89 d0 2b 45 e0 89 55 ec 85 c0 7e 35 39 45 08 8b 55 e4 0f 4e 45 08 8b 75 e0 8b 7d dc 89 c1 c1 e9 02 03 b2 a0 00 00 00 <f3> a5 89 c1 83 e1 03 74 02 f3 a4 29 45 08 0f 84 7b 01 00 00 01
EIP: [<c05be62a>] skb_copy_bits+0x4f/0x1ef SS:ESP 0068:c0759adc
Kernel panic - not syncing: Fatal exception in interrupt

Arnaldo says:
====================
Thanks! I'm to blame for this one, problem was introduced in:

b0e380b1d8

@@ -761,7 +762,7 @@ slow_path:
                /*
                 *      Copy a block of the IP datagram.
                 */
-               if (skb_copy_bits(skb, ptr, frag->h.raw, len))
+               if (skb_copy_bits(skb, ptr, skb_transport_header(skb),
len))
                        BUG();
                left -= len;
====================

Signed-off-by: Wei Yongjun <yjwei@cn.fujitsu.com>
Acked-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: Arnaldo Carvalho de Melo <acme@ghostprotocols.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
2007-08-21 20:59:08 -07:00
..
9p fs: 9p/conv.c error path fix 2007-07-31 15:39:42 -07:00
802 [SNAP]: Check packet length before reading 2007-08-21 20:58:13 -07:00
8021q [VLAN] net/8021q/vlanproc.c: fix check-after-use 2007-08-14 17:39:43 -07:00
appletalk [NET]: Make all initialized struct seq_operations const. 2007-07-10 23:07:31 -07:00
atm [ATM]: Clean up duplicate includes in net/atm/ 2007-08-13 22:52:01 -07:00
ax25 [AX25]: don't free pointers to statically allocated data 2007-08-14 17:24:05 -07:00
bluetooth [BLUETOOTH] l2cap: don't mangle cmd.len 2007-07-31 02:28:09 -07:00
bridge missing return in bridge sysfs code 2007-08-19 10:32:31 -07:00
core [NET]: Unexport dev_ethtool 2007-08-14 17:38:44 -07:00
dccp [DCCP]: Allocation in atomic context 2007-08-21 20:58:06 -07:00
decnet [DECNET]: kmalloc + memset conversion to kzalloc 2007-07-31 14:05:56 -07:00
econet [ECONET]: remove econet_packet_type on unload 2007-08-14 17:25:20 -07:00
ethernet [ETH]: Validate address in eth_mac_addr 2007-07-11 19:41:18 -07:00
ieee80211 [PATCH] softmac: Fix deadlock of wx_set_essid with assoc work 2007-08-06 15:06:03 -04:00
ipv4 [NETFILTER]: nf_nat_sip: don't drop short packets 2007-08-14 13:14:58 -07:00
ipv6 [IPV6]: Fix kernel panic while send SCTP data with IP fragments 2007-08-21 20:59:08 -07:00
ipx [NET]: Make all initialized struct seq_operations const. 2007-07-10 23:07:31 -07:00
irda [IrDA] Typo fix in irnetlink.c copyright 2007-07-21 19:06:53 -07:00
iucv [S390] Convert to smp_call_function_single. 2007-07-27 12:29:17 +02:00
key [PF_KEY]: Fix ipsec not working in 2.6.23-rc1-git10 2007-08-02 19:42:29 -07:00
lapb
llc [NET]: Make all initialized struct seq_operations const. 2007-07-10 23:07:31 -07:00
mac80211 [PATCH] mac80211: probe for hidden SSIDs in pre-auth scan 2007-08-14 16:48:23 -04:00
netfilter [NETFILTER]: nf_conntrack_sip: fix SIP-URI parsing 2007-08-14 13:14:35 -07:00
netlabel [NetLabel]: add missing rcu_dereference() calls in the LSM domain mapping hash table 2007-08-07 17:53:10 -07:00
netlink [GENETLINK]: Correctly report errors while registering a multicast group 2007-07-24 15:34:53 -07:00
netrom [NET] NETROM: Fix whitespace errors. 2007-07-19 10:44:32 +09:00
packet [NET] PACKET: Fix whitespace errors. 2007-07-19 10:44:35 +09:00
rfkill [NET] RFKILL: Fix whitespace errors. 2007-07-19 10:44:38 +09:00
rose [NET] ROSE: Fix whitespace errors. 2007-07-19 10:44:40 +09:00
rxrpc net/* misc endianness annotations 2007-07-26 11:11:56 -07:00
sched [PKT_SCHED]: Clean up duplicate includes in net/sched/ 2007-08-13 22:52:04 -07:00
sctp SCTP: remove useless code in function sctp_init_cause 2007-08-02 10:56:07 -04:00
sunrpc [SUNRPC]: Clean up duplicate includes in net/sunrpc/ 2007-08-13 22:52:05 -07:00
tipc [TIPC]: Clean up duplicate includes in net/tipc/ 2007-08-13 22:52:07 -07:00
unix [AF_UNIX]: Make code static. 2007-07-31 02:28:27 -07:00
wanrouter [NET]: Removal of duplicated include net/wanrouter/wanmain.c 2007-08-02 19:42:22 -07:00
wireless [PATCH] cfg80211: Radiotap parser 2007-07-12 16:07:24 -04:00
x25 [NET]: Make all initialized struct seq_operations const. 2007-07-10 23:07:31 -07:00
xfrm [XFRM]: Clean up duplicate includes in net/xfrm/ 2007-08-13 22:52:08 -07:00
compat.c O_CLOEXEC for SCM_RIGHTS 2007-07-16 09:05:45 -07:00
Kconfig 9p: Reorganization of 9p file system code 2007-07-14 15:13:40 -05:00
Makefile 9p: Reorganization of 9p file system code 2007-07-14 15:13:40 -05:00
nonet.c
socket.c [NET]: Fix unbalanced rcu_read_unlock in __sock_create 2007-08-15 14:46:02 -07:00
sysctl_net.c
TUNABLE