From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Yasushi SHOJI <yashi@atmark-techno.com>,
Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>,
"David S. Miller" <davem@davemloft.net>
Subject: [PATCH 4.3 37/55] sh_eth: fix kernel oops in skb_put()
Date: Wed, 20 Jan 2016 16:44:12 -0800 [thread overview]
Message-ID: <20160120232229.323533873@linuxfoundation.org> (raw)
In-Reply-To: <20160120232227.417513468@linuxfoundation.org>
4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
[ Upstream commit 248be83dcb3feb3f6332eb3d010a016402138484 ]
In a low memory situation the following kernel oops occurs:
Unable to handle kernel NULL pointer dereference at virtual address 00000050
pgd = 8490c000
[00000050] *pgd=4651e831, *pte=00000000, *ppte=00000000
Internal error: Oops: 17 [#1] PREEMPT ARM
Modules linked in:
CPU: 0 Not tainted (3.4-at16 #9)
PC is at skb_put+0x10/0x98
LR is at sh_eth_poll+0x2c8/0xa10
pc : [<8035f780>] lr : [<8028bf50>] psr: 60000113
sp : 84eb1a90 ip : 84eb1ac8 fp : 84eb1ac4
r10: 0000003f r9 : 000005ea r8 : 00000000
r7 : 00000000 r6 : 940453b0 r5 : 00030000 r4 : 9381b180
r3 : 00000000 r2 : 00000000 r1 : 000005ea r0 : 00000000
Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user
Control: 10c53c7d Table: 4248c059 DAC: 00000015
Process klogd (pid: 2046, stack limit = 0x84eb02e8)
[...]
This is because netdev_alloc_skb() fails and 'mdp->rx_skbuff[entry]' is left
NULL but sh_eth_rx() later uses it without checking. Add such check...
Reported-by: Yasushi SHOJI <yashi@atmark-techno.com>
Signed-off-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/renesas/sh_eth.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/net/ethernet/renesas/sh_eth.c
+++ b/drivers/net/ethernet/renesas/sh_eth.c
@@ -1481,6 +1481,7 @@ static int sh_eth_rx(struct net_device *
if (mdp->cd->shift_rd0)
desc_status >>= 16;
+ skb = mdp->rx_skbuff[entry];
if (desc_status & (RD_RFS1 | RD_RFS2 | RD_RFS3 | RD_RFS4 |
RD_RFS5 | RD_RFS6 | RD_RFS10)) {
ndev->stats.rx_errors++;
@@ -1496,12 +1497,11 @@ static int sh_eth_rx(struct net_device *
ndev->stats.rx_missed_errors++;
if (desc_status & RD_RFS10)
ndev->stats.rx_over_errors++;
- } else {
+ } else if (skb) {
if (!mdp->cd->hw_swap)
sh_eth_soft_swap(
phys_to_virt(ALIGN(rxdesc->addr, 4)),
pkt_len + 2);
- skb = mdp->rx_skbuff[entry];
mdp->rx_skbuff[entry] = NULL;
if (mdp->cd->rpadir)
skb_reserve(skb, NET_IP_ALIGN);
next prev parent reply other threads:[~2016-01-21 0:47 UTC|newest]
Thread overview: 62+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-01-21 0:43 [PATCH 4.3 00/55] 4.3.4-stable review Greg Kroah-Hartman
2016-01-21 0:43 ` [PATCH 4.3 01/55] Revert "vrf: fix double free and memory corruption on register_netdevice failure" Greg Kroah-Hartman
2016-01-21 0:43 ` [PATCH 4.3 02/55] vrf: fix double free and memory corruption on register_netdevice failure Greg Kroah-Hartman
2016-01-21 1:37 ` Ben Hutchings
2016-01-22 7:53 ` Greg Kroah-Hartman
2016-01-22 7:53 ` Greg Kroah-Hartman
2016-01-21 0:43 ` [PATCH 4.3 03/55] tipc: Fix kfree_skb() of uninitialised pointer Greg Kroah-Hartman
2016-01-21 0:43 ` [PATCH 4.3 04/55] ACPI: Use correct IRQ when uninstalling ACPI interrupt handler Greg Kroah-Hartman
2016-01-21 0:43 ` [PATCH 4.3 05/55] ACPI: Using correct irq when waiting for events Greg Kroah-Hartman
2016-01-21 0:43 ` [PATCH 4.3 06/55] ACPI / PM: Fix incorrect wakeup IRQ setting during suspend-to-idle Greg Kroah-Hartman
2016-01-21 0:43 ` [PATCH 4.3 07/55] tpm, tpm_tis: fix tpm_tis ACPI detection issue with TPM 2.0 Greg Kroah-Hartman
2016-01-21 0:43 ` [PATCH 4.3 08/55] toshiba_acpi: Initialize hotkey_event_type variable Greg Kroah-Hartman
2016-01-21 0:43 ` [PATCH 4.3 09/55] USB: cdc_acm: Ignore Infineon Flash Loader utility Greg Kroah-Hartman
2016-01-21 0:43 ` [PATCH 4.3 10/55] USB: serial: Another Infineon flash loader USB ID Greg Kroah-Hartman
2016-01-21 0:43 ` [PATCH 4.3 11/55] usb-storage: Fix scsi-sd failure "Invalid field in cdb" for USB adapter JMicron Greg Kroah-Hartman
2016-01-21 0:43 ` [PATCH 4.3 12/55] USB: cp210x: Remove CP2110 ID from compatibility list Greg Kroah-Hartman
2016-01-21 0:43 ` [PATCH 4.3 13/55] USB: add quirk for devices with broken LPM Greg Kroah-Hartman
2016-01-21 0:43 ` [PATCH 4.3 14/55] USB: whci-hcd: add check for dma mapping error Greg Kroah-Hartman
2016-01-21 0:43 ` [PATCH 4.3 15/55] usb: gadget: pxa27x: fix suspend callback Greg Kroah-Hartman
2016-01-21 0:43 ` [PATCH 4.3 16/55] USB: host: ohci-at91: fix a crash in ohci_hcd_at91_overcurrent_irq Greg Kroah-Hartman
2016-01-21 0:43 ` [PATCH 4.3 17/55] usb: musb: USB_TI_CPPI41_DMA requires dmaengine support Greg Kroah-Hartman
2016-01-21 0:43 ` [PATCH 4.3 18/55] usb: core : hub: Fix BOS NULL pointer kernel panic Greg Kroah-Hartman
2016-01-21 0:43 ` [PATCH 4.3 19/55] usb: Use the USB_SS_MULT() macro to decode burst multiplier for log message Greg Kroah-Hartman
2016-01-21 0:43 ` [PATCH 4.3 20/55] pppoe: fix memory corruption in padt work structure Greg Kroah-Hartman
2016-01-21 0:43 ` [PATCH 4.3 21/55] gre6: allow to update all parameters via rtnl Greg Kroah-Hartman
2016-01-21 0:43 ` [PATCH 4.3 22/55] atl1c: Improve driver not to do order 4 GFP_ATOMIC allocation Greg Kroah-Hartman
2016-01-21 0:43 ` [PATCH 4.3 24/55] vxlan: fix incorrect RCO bit in VXLAN header Greg Kroah-Hartman
2016-01-21 0:44 ` [PATCH 4.3 25/55] sctp: use the same clock as if sock source timestamps were on Greg Kroah-Hartman
2016-01-21 0:44 ` [PATCH 4.3 26/55] sctp: update the netstamp_needed counter when copying sockets Greg Kroah-Hartman
2016-01-21 0:44 ` [PATCH 4.3 27/55] sctp: also copy sk_tsflags when copying the socket Greg Kroah-Hartman
2016-01-21 0:44 ` [PATCH 4.3 29/55] net: qca_spi: fix transmit queue timeout handling Greg Kroah-Hartman
2016-01-21 0:44 ` [PATCH 4.3 30/55] r8152: fix lockup when runtime PM is enabled Greg Kroah-Hartman
2016-01-21 0:44 ` [PATCH 4.3 31/55] ipv6: sctp: clone options to avoid use after free Greg Kroah-Hartman
2016-01-21 0:44 ` [PATCH 4.3 32/55] phy: micrel: Fix finding PHY properties in MAC node Greg Kroah-Hartman
2016-01-21 0:44 ` [PATCH 4.3 33/55] openvswitch: Fix helper reference leak Greg Kroah-Hartman
2016-01-21 0:44 ` [PATCH 4.3 34/55] openvswitch: Respect conntrack zone even if invalid Greg Kroah-Hartman
2016-01-21 0:44 ` [PATCH 4.3 35/55] uapi: export ila.h Greg Kroah-Hartman
2016-01-21 0:44 ` Greg Kroah-Hartman [this message]
2016-01-21 0:44 ` [PATCH 4.3 38/55] net: fix IP early demux races Greg Kroah-Hartman
2016-01-21 0:44 ` [PATCH 4.3 39/55] pptp: verify sockaddr_len in pptp_bind() and pptp_connect() Greg Kroah-Hartman
2016-01-21 0:44 ` [PATCH 4.3 40/55] vlan: Fix untag operations of stacked vlans with REORDER_HEADER off Greg Kroah-Hartman
2016-01-21 0:44 ` [PATCH 4.3 41/55] skbuff: Fix offset error in skb_reorder_vlan_header Greg Kroah-Hartman
2016-01-21 0:44 ` [PATCH 4.3 42/55] net: check both type and procotol for tcp sockets Greg Kroah-Hartman
2016-01-21 0:44 ` [PATCH 4.3 43/55] net_sched: make qdisc_tree_decrease_qlen() work for non mq Greg Kroah-Hartman
2016-01-21 0:44 ` [PATCH 4.3 44/55] bluetooth: Validate socket address length in sco_sock_bind() Greg Kroah-Hartman
2016-01-21 0:44 ` [PATCH 4.3 45/55] net: fix uninitialized variable issue Greg Kroah-Hartman
2016-01-21 0:44 ` [PATCH 4.3 47/55] inet: tcp: fix inetpeer_set_addr_v4() Greg Kroah-Hartman
2016-01-21 0:44 ` [PATCH 4.3 48/55] rhashtable: Enforce minimum size on initial hash table Greg Kroah-Hartman
2016-01-21 0:44 ` [PATCH 4.3 49/55] gianfar: Dont enable RX Filer if not supported Greg Kroah-Hartman
2016-01-21 0:44 ` [PATCH 4.3 50/55] fou: clean up socket with kfree_rcu Greg Kroah-Hartman
2016-01-21 0:44 ` [PATCH 4.3 51/55] af_unix: Revert lock_interruptible in stream receive code Greg Kroah-Hartman
2016-01-21 0:44 ` [PATCH 4.3 52/55] tcp: restore fastopen with no data in SYN packet Greg Kroah-Hartman
2016-01-21 0:44 ` [PATCH 4.3 53/55] rhashtable: Fix walker list corruption Greg Kroah-Hartman
2016-01-21 0:44 ` [PATCH 4.3 54/55] KEYS: Fix race between read and revoke Greg Kroah-Hartman
2016-01-21 0:44 ` [PATCH 4.3 55/55] KEYS: Fix keyring ref leak in join_session_keyring() Greg Kroah-Hartman
2016-01-21 1:39 ` [PATCH 4.3 00/55] 4.3.4-stable review Shuah Khan
2016-01-22 7:51 ` Greg Kroah-Hartman
2016-01-21 9:42 ` Mel Gorman
2016-01-22 7:54 ` Greg Kroah-Hartman
2016-01-22 8:12 ` Mel Gorman
2016-01-21 12:24 ` Guenter Roeck
2016-01-22 7:51 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20160120232229.323533873@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=davem@davemloft.net \
--cc=linux-kernel@vger.kernel.org \
--cc=sergei.shtylyov@cogentembedded.com \
--cc=stable@vger.kernel.org \
--cc=yashi@atmark-techno.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.