diff for duplicates of <20180313095600.GA5131@kroah.com> diff --git a/a/1.txt b/N1/1.txt index 88ae19b..0b45d58 100644 --- a/a/1.txt +++ b/N1/1.txt @@ -1,6 +1,6 @@ On Tue, Mar 13, 2018 at 12:46:58AM +0000, Ben Hutchings wrote: > On Fri, 2018-03-09 at 16:18 -0800, Greg Kroah-Hartman wrote: -> > 4.4-stable review patch. If anyone has any objections, please let me know. +> > 4.4-stable review patch.��If anyone has any objections, please let me know. > > > > ------------------ > > @@ -13,32 +13,32 @@ On Tue, Mar 13, 2018 at 12:46:58AM +0000, Ben Hutchings wrote: > > can exceed SCTP_MAX_CHUNK_LEN which leads to kernel panic when > > transmitting these packets, e.g. the crash on sending INIT_ACK: > > -> > [ 597.804948] skbuff: skb_over_panic: text:00000000ffae06e4 len:120168 -> > put:120156 head:000000007aa47635 data:00000000d991c2de -> > tail:0x1d640 end:0xfec0 dev:<NULL> +> > [��597.804948] skbuff: skb_over_panic: text:00000000ffae06e4 len:120168 +> > ���������������put:120156 head:000000007aa47635 data:00000000d991c2de +> > ���������������tail:0x1d640 end:0xfec0 dev:<NULL> > > ... -> > [ 597.976970] ------------[ cut here ]------------ -> > [ 598.033408] kernel BUG at net/core/skbuff.c:104! -> > [ 600.314841] Call Trace: -> > [ 600.345829] <IRQ> -> > [ 600.371639] ? sctp_packet_transmit+0x2095/0x26d0 [sctp] -> > [ 600.436934] skb_put+0x16c/0x200 -> > [ 600.477295] sctp_packet_transmit+0x2095/0x26d0 [sctp] -> > [ 600.540630] ? sctp_packet_config+0x890/0x890 [sctp] -> > [ 600.601781] ? __sctp_packet_append_chunk+0x3b4/0xd00 [sctp] -> > [ 600.671356] ? sctp_cmp_addr_exact+0x3f/0x90 [sctp] -> > [ 600.731482] sctp_outq_flush+0x663/0x30d0 [sctp] -> > [ 600.788565] ? sctp_make_init+0xbf0/0xbf0 [sctp] -> > [ 600.845555] ? sctp_check_transmitted+0x18f0/0x18f0 [sctp] -> > [ 600.912945] ? sctp_outq_tail+0x631/0x9d0 [sctp] -> > [ 600.969936] sctp_cmd_interpreter.isra.22+0x3be1/0x5cb0 [sctp] -> > [ 601.041593] ? sctp_sf_do_5_1B_init+0x85f/0xc30 [sctp] -> > [ 601.104837] ? sctp_generate_t1_cookie_event+0x20/0x20 [sctp] -> > [ 601.175436] ? sctp_eat_data+0x1710/0x1710 [sctp] -> > [ 601.233575] sctp_do_sm+0x182/0x560 [sctp] -> > [ 601.284328] ? sctp_has_association+0x70/0x70 [sctp] -> > [ 601.345586] ? sctp_rcv+0xef4/0x32f0 [sctp] -> > [ 601.397478] ? sctp6_rcv+0xa/0x20 [sctp] +> > [��597.976970] ------------[ cut here ]------------ +> > [��598.033408] kernel BUG at net/core/skbuff.c:104! +> > [��600.314841] Call Trace: +> > [��600.345829]��<IRQ> +> > [��600.371639]��? sctp_packet_transmit+0x2095/0x26d0 [sctp] +> > [��600.436934]��skb_put+0x16c/0x200 +> > [��600.477295]��sctp_packet_transmit+0x2095/0x26d0 [sctp] +> > [��600.540630]��? sctp_packet_config+0x890/0x890 [sctp] +> > [��600.601781]��? __sctp_packet_append_chunk+0x3b4/0xd00 [sctp] +> > [��600.671356]��? sctp_cmp_addr_exact+0x3f/0x90 [sctp] +> > [��600.731482]��sctp_outq_flush+0x663/0x30d0 [sctp] +> > [��600.788565]��? sctp_make_init+0xbf0/0xbf0 [sctp] +> > [��600.845555]��? sctp_check_transmitted+0x18f0/0x18f0 [sctp] +> > [��600.912945]��? sctp_outq_tail+0x631/0x9d0 [sctp] +> > [��600.969936]��sctp_cmd_interpreter.isra.22+0x3be1/0x5cb0 [sctp] +> > [��601.041593]��? sctp_sf_do_5_1B_init+0x85f/0xc30 [sctp] +> > [��601.104837]��? sctp_generate_t1_cookie_event+0x20/0x20 [sctp] +> > [��601.175436]��? sctp_eat_data+0x1710/0x1710 [sctp] +> > [��601.233575]��sctp_do_sm+0x182/0x560 [sctp] +> > [��601.284328]��? sctp_has_association+0x70/0x70 [sctp] +> > [��601.345586]��? sctp_rcv+0xef4/0x32f0 [sctp] +> > [��601.397478]��? sctp6_rcv+0xa/0x20 [sctp] > > ... > > > > Here the chunk size for INIT_ACK packet becomes too big, mostly @@ -47,9 +47,9 @@ On Tue, Mar 13, 2018 at 12:46:58AM +0000, Ben Hutchings wrote: > > > > Later this chunk causes the panic in skb_put_data(): > > -> > skb_packet_transmit() -> > sctp_packet_pack() -> > skb_put_data(nskb, chunk->skb->data, chunk->skb->len); +> > � skb_packet_transmit() +> > ������sctp_packet_pack() +> > ����������skb_put_data(nskb, chunk->skb->data, chunk->skb->len); > > > > 'nskb' (head skb) was previously allocated with packet->size > > from u16 'chunk->chunk_hdr->length'. @@ -64,15 +64,15 @@ On Tue, Mar 13, 2018 at 12:46:58AM +0000, Ben Hutchings wrote: > > > Signed-off-by: David S. Miller <davem@davemloft.net> > > > Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> > > --- -> > net/sctp/sm_make_chunk.c | 8 ++++++-- -> > 1 file changed, 6 insertions(+), 2 deletions(-) +> > �net/sctp/sm_make_chunk.c |����8 ++++++-- +> > �1 file changed, 6 insertions(+), 2 deletions(-) > > > > --- a/net/sctp/sm_make_chunk.c > > +++ b/net/sctp/sm_make_chunk.c > > @@ -1367,10 +1367,14 @@ static struct sctp_chunk *_sctp_make_chu -> > sctp_chunkhdr_t *chunk_hdr; -> > struct sk_buff *skb; -> > struct sock *sk; +> > � sctp_chunkhdr_t *chunk_hdr; +> > � struct sk_buff *skb; +> > � struct sock *sk; > > + int chunklen; > > + > > + chunklen = sizeof(*chunk_hdr) + paylen; diff --git a/a/content_digest b/N1/content_digest index 4e4e0eb..6bd7f41 100644 --- a/a/content_digest +++ b/N1/content_digest @@ -15,7 +15,7 @@ "b\0" "On Tue, Mar 13, 2018 at 12:46:58AM +0000, Ben Hutchings wrote:\n" "> On Fri, 2018-03-09 at 16:18 -0800, Greg Kroah-Hartman wrote:\n" - "> > 4.4-stable review patch.\302\240\302\240If anyone has any objections, please let me know.\n" + "> > 4.4-stable review patch.\303\257\302\277\302\275\303\257\302\277\302\275If anyone has any objections, please let me know.\n" "> > \n" "> > ------------------\n" "> > \n" @@ -28,32 +28,32 @@ "> > can exceed SCTP_MAX_CHUNK_LEN which leads to kernel panic when\n" "> > transmitting these packets, e.g. the crash on sending INIT_ACK:\n" "> > \n" - "> > [\302\240\302\240597.804948] skbuff: skb_over_panic: text:00000000ffae06e4 len:120168\n" - "> > \302\240\302\240\302\240\302\240\302\240\302\240\302\240\302\240\302\240\302\240\302\240\302\240\302\240\302\240\302\240put:120156 head:000000007aa47635 data:00000000d991c2de\n" - "> > \302\240\302\240\302\240\302\240\302\240\302\240\302\240\302\240\302\240\302\240\302\240\302\240\302\240\302\240\302\240tail:0x1d640 end:0xfec0 dev:<NULL>\n" + "> > [\303\257\302\277\302\275\303\257\302\277\302\275597.804948] skbuff: skb_over_panic: text:00000000ffae06e4 len:120168\n" + "> > \303\257\302\277\302\275\303\257\302\277\302\275\303\257\302\277\302\275\303\257\302\277\302\275\303\257\302\277\302\275\303\257\302\277\302\275\303\257\302\277\302\275\303\257\302\277\302\275\303\257\302\277\302\275\303\257\302\277\302\275\303\257\302\277\302\275\303\257\302\277\302\275\303\257\302\277\302\275\303\257\302\277\302\275\303\257\302\277\302\275put:120156 head:000000007aa47635 data:00000000d991c2de\n" + "> > \303\257\302\277\302\275\303\257\302\277\302\275\303\257\302\277\302\275\303\257\302\277\302\275\303\257\302\277\302\275\303\257\302\277\302\275\303\257\302\277\302\275\303\257\302\277\302\275\303\257\302\277\302\275\303\257\302\277\302\275\303\257\302\277\302\275\303\257\302\277\302\275\303\257\302\277\302\275\303\257\302\277\302\275\303\257\302\277\302\275tail:0x1d640 end:0xfec0 dev:<NULL>\n" "> > ...\n" - "> > [\302\240\302\240597.976970] ------------[ cut here ]------------\n" - "> > [\302\240\302\240598.033408] kernel BUG at net/core/skbuff.c:104!\n" - "> > [\302\240\302\240600.314841] Call Trace:\n" - "> > [\302\240\302\240600.345829]\302\240\302\240<IRQ>\n" - "> > [\302\240\302\240600.371639]\302\240\302\240? sctp_packet_transmit+0x2095/0x26d0 [sctp]\n" - "> > [\302\240\302\240600.436934]\302\240\302\240skb_put+0x16c/0x200\n" - "> > [\302\240\302\240600.477295]\302\240\302\240sctp_packet_transmit+0x2095/0x26d0 [sctp]\n" - "> > [\302\240\302\240600.540630]\302\240\302\240? sctp_packet_config+0x890/0x890 [sctp]\n" - "> > [\302\240\302\240600.601781]\302\240\302\240? __sctp_packet_append_chunk+0x3b4/0xd00 [sctp]\n" - "> > [\302\240\302\240600.671356]\302\240\302\240? sctp_cmp_addr_exact+0x3f/0x90 [sctp]\n" - "> > [\302\240\302\240600.731482]\302\240\302\240sctp_outq_flush+0x663/0x30d0 [sctp]\n" - "> > [\302\240\302\240600.788565]\302\240\302\240? sctp_make_init+0xbf0/0xbf0 [sctp]\n" - "> > [\302\240\302\240600.845555]\302\240\302\240? sctp_check_transmitted+0x18f0/0x18f0 [sctp]\n" - "> > [\302\240\302\240600.912945]\302\240\302\240? sctp_outq_tail+0x631/0x9d0 [sctp]\n" - "> > [\302\240\302\240600.969936]\302\240\302\240sctp_cmd_interpreter.isra.22+0x3be1/0x5cb0 [sctp]\n" - "> > [\302\240\302\240601.041593]\302\240\302\240? sctp_sf_do_5_1B_init+0x85f/0xc30 [sctp]\n" - "> > [\302\240\302\240601.104837]\302\240\302\240? sctp_generate_t1_cookie_event+0x20/0x20 [sctp]\n" - "> > [\302\240\302\240601.175436]\302\240\302\240? sctp_eat_data+0x1710/0x1710 [sctp]\n" - "> > [\302\240\302\240601.233575]\302\240\302\240sctp_do_sm+0x182/0x560 [sctp]\n" - "> > [\302\240\302\240601.284328]\302\240\302\240? sctp_has_association+0x70/0x70 [sctp]\n" - "> > [\302\240\302\240601.345586]\302\240\302\240? sctp_rcv+0xef4/0x32f0 [sctp]\n" - "> > [\302\240\302\240601.397478]\302\240\302\240? sctp6_rcv+0xa/0x20 [sctp]\n" + "> > [\303\257\302\277\302\275\303\257\302\277\302\275597.976970] ------------[ cut here ]------------\n" + "> > [\303\257\302\277\302\275\303\257\302\277\302\275598.033408] kernel BUG at net/core/skbuff.c:104!\n" + "> > [\303\257\302\277\302\275\303\257\302\277\302\275600.314841] Call Trace:\n" + "> > [\303\257\302\277\302\275\303\257\302\277\302\275600.345829]\303\257\302\277\302\275\303\257\302\277\302\275<IRQ>\n" + "> > [\303\257\302\277\302\275\303\257\302\277\302\275600.371639]\303\257\302\277\302\275\303\257\302\277\302\275? sctp_packet_transmit+0x2095/0x26d0 [sctp]\n" + "> > [\303\257\302\277\302\275\303\257\302\277\302\275600.436934]\303\257\302\277\302\275\303\257\302\277\302\275skb_put+0x16c/0x200\n" + "> > [\303\257\302\277\302\275\303\257\302\277\302\275600.477295]\303\257\302\277\302\275\303\257\302\277\302\275sctp_packet_transmit+0x2095/0x26d0 [sctp]\n" + "> > [\303\257\302\277\302\275\303\257\302\277\302\275600.540630]\303\257\302\277\302\275\303\257\302\277\302\275? sctp_packet_config+0x890/0x890 [sctp]\n" + "> > [\303\257\302\277\302\275\303\257\302\277\302\275600.601781]\303\257\302\277\302\275\303\257\302\277\302\275? __sctp_packet_append_chunk+0x3b4/0xd00 [sctp]\n" + "> > [\303\257\302\277\302\275\303\257\302\277\302\275600.671356]\303\257\302\277\302\275\303\257\302\277\302\275? sctp_cmp_addr_exact+0x3f/0x90 [sctp]\n" + "> > [\303\257\302\277\302\275\303\257\302\277\302\275600.731482]\303\257\302\277\302\275\303\257\302\277\302\275sctp_outq_flush+0x663/0x30d0 [sctp]\n" + "> > [\303\257\302\277\302\275\303\257\302\277\302\275600.788565]\303\257\302\277\302\275\303\257\302\277\302\275? sctp_make_init+0xbf0/0xbf0 [sctp]\n" + "> > [\303\257\302\277\302\275\303\257\302\277\302\275600.845555]\303\257\302\277\302\275\303\257\302\277\302\275? sctp_check_transmitted+0x18f0/0x18f0 [sctp]\n" + "> > [\303\257\302\277\302\275\303\257\302\277\302\275600.912945]\303\257\302\277\302\275\303\257\302\277\302\275? sctp_outq_tail+0x631/0x9d0 [sctp]\n" + "> > [\303\257\302\277\302\275\303\257\302\277\302\275600.969936]\303\257\302\277\302\275\303\257\302\277\302\275sctp_cmd_interpreter.isra.22+0x3be1/0x5cb0 [sctp]\n" + "> > [\303\257\302\277\302\275\303\257\302\277\302\275601.041593]\303\257\302\277\302\275\303\257\302\277\302\275? sctp_sf_do_5_1B_init+0x85f/0xc30 [sctp]\n" + "> > [\303\257\302\277\302\275\303\257\302\277\302\275601.104837]\303\257\302\277\302\275\303\257\302\277\302\275? sctp_generate_t1_cookie_event+0x20/0x20 [sctp]\n" + "> > [\303\257\302\277\302\275\303\257\302\277\302\275601.175436]\303\257\302\277\302\275\303\257\302\277\302\275? sctp_eat_data+0x1710/0x1710 [sctp]\n" + "> > [\303\257\302\277\302\275\303\257\302\277\302\275601.233575]\303\257\302\277\302\275\303\257\302\277\302\275sctp_do_sm+0x182/0x560 [sctp]\n" + "> > [\303\257\302\277\302\275\303\257\302\277\302\275601.284328]\303\257\302\277\302\275\303\257\302\277\302\275? sctp_has_association+0x70/0x70 [sctp]\n" + "> > [\303\257\302\277\302\275\303\257\302\277\302\275601.345586]\303\257\302\277\302\275\303\257\302\277\302\275? sctp_rcv+0xef4/0x32f0 [sctp]\n" + "> > [\303\257\302\277\302\275\303\257\302\277\302\275601.397478]\303\257\302\277\302\275\303\257\302\277\302\275? sctp6_rcv+0xa/0x20 [sctp]\n" "> > ...\n" "> > \n" "> > Here the chunk size for INIT_ACK packet becomes too big, mostly\n" @@ -62,9 +62,9 @@ "> > \n" "> > Later this chunk causes the panic in skb_put_data():\n" "> > \n" - "> > \302\240 skb_packet_transmit()\n" - "> > \302\240\302\240\302\240\302\240\302\240\302\240sctp_packet_pack()\n" - "> > \302\240\302\240\302\240\302\240\302\240\302\240\302\240\302\240\302\240\302\240skb_put_data(nskb, chunk->skb->data, chunk->skb->len);\n" + "> > \303\257\302\277\302\275 skb_packet_transmit()\n" + "> > \303\257\302\277\302\275\303\257\302\277\302\275\303\257\302\277\302\275\303\257\302\277\302\275\303\257\302\277\302\275\303\257\302\277\302\275sctp_packet_pack()\n" + "> > \303\257\302\277\302\275\303\257\302\277\302\275\303\257\302\277\302\275\303\257\302\277\302\275\303\257\302\277\302\275\303\257\302\277\302\275\303\257\302\277\302\275\303\257\302\277\302\275\303\257\302\277\302\275\303\257\302\277\302\275skb_put_data(nskb, chunk->skb->data, chunk->skb->len);\n" "> > \n" "> > 'nskb' (head skb) was previously allocated with packet->size\n" "> > from u16 'chunk->chunk_hdr->length'.\n" @@ -79,15 +79,15 @@ "> > > Signed-off-by: David S. Miller <davem@davemloft.net>\n" "> > > Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n" "> > ---\n" - "> > \302\240net/sctp/sm_make_chunk.c |\302\240\302\240\302\240\302\2408 ++++++--\n" - "> > \302\2401 file changed, 6 insertions(+), 2 deletions(-)\n" + "> > \303\257\302\277\302\275net/sctp/sm_make_chunk.c |\303\257\302\277\302\275\303\257\302\277\302\275\303\257\302\277\302\275\303\257\302\277\302\2758 ++++++--\n" + "> > \303\257\302\277\302\2751 file changed, 6 insertions(+), 2 deletions(-)\n" "> > \n" "> > --- a/net/sctp/sm_make_chunk.c\n" "> > +++ b/net/sctp/sm_make_chunk.c\n" "> > @@ -1367,10 +1367,14 @@ static struct sctp_chunk *_sctp_make_chu\n" - "> > \302\240\tsctp_chunkhdr_t *chunk_hdr;\n" - "> > \302\240\tstruct sk_buff *skb;\n" - "> > \302\240\tstruct sock *sk;\n" + "> > \303\257\302\277\302\275\tsctp_chunkhdr_t *chunk_hdr;\n" + "> > \303\257\302\277\302\275\tstruct sk_buff *skb;\n" + "> > \303\257\302\277\302\275\tstruct sock *sk;\n" "> > +\tint chunklen;\n" "> > +\n" "> > +\tchunklen = sizeof(*chunk_hdr) + paylen;\n" @@ -111,4 +111,4 @@ " \tif (chunklen > SCTP_MAX_CHUNK_LEN)\n" " \t\tgoto nodata;" -9d500bf360bdca4e6504233115ad0195a9c2ef639426a5acf77183898163487f +0297d4c48cec4b0a891003e1ccb9ae6bee920aab91de0b499c3130ebb72aa979
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.