From: Eric Dumazet <eric.dumazet@gmail.com>
To: Tom Parkin <tparkin@katalix.com>
Cc: David Miller <davem@davemloft.net>, netdev@vger.kernel.org
Subject: Re: [RFC PATCH] udp: don't rereference dst_entry dev pointer on rcv
Date: Thu, 11 Apr 2013 15:26:33 -0700 [thread overview]
Message-ID: <1365719193.3887.190.camel@edumazet-glaptop> (raw)
In-Reply-To: <1365702804.3887.180.camel@edumazet-glaptop>
On Thu, 2013-04-11 at 10:53 -0700, Eric Dumazet wrote:
> On Thu, 2013-04-11 at 09:32 -0700, Eric Dumazet wrote:
>
> > Short update : I do not understand yet why this patch is not working.
> >
> > Normally, the reassembled packet should get the dst from the last skb
> > (the one completing the packet)...
> >
> > I have to make more experiments.
>
> OK I think I've nailed it, please try following patch (I tried it on
> net-next, but it should apply on previous kernels)
By the way I am ashamed by commit 64f3b9e203bd068550
(net: ip_expire() must revalidate route)
Reading its changelog now, I understand I should have fixed this the
way we did today...
:(
Commit 4a94445c9a5c (net: Use ip_route_input_noref() in input path)
added a bug in IP defragmentation handling, in case timeout is fired.
When a frame is defragmented, we use last skb dst field when building
final skb. Its dst is valid, since we are in rcu read section.
But if a timeout occurs, we take first queued fragment to build one ICMP
TIME EXCEEDED message. Problem is all queued skb have weak dst pointers,
since we escaped RCU critical section after their queueing. icmp_send()
might dereference a now freed (and possibly reused) part of memory.
Calling skb_dst_drop() and ip_route_input_noref() to revalidate route is
the only possible choice.
next prev parent reply other threads:[~2013-04-11 22:26 UTC|newest]
Thread overview: 21+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-03-07 22:36 [RFC PATCH] prevent oops in udp rcv path Tom Parkin
2013-03-07 22:36 ` [RFC PATCH] udp: don't rereference dst_entry dev pointer on rcv Tom Parkin
2013-03-07 22:47 ` Eric Dumazet
2013-03-07 23:15 ` David Miller
2013-03-13 23:27 ` Tom Parkin
2013-03-14 1:18 ` Eric Dumazet
2013-03-14 14:45 ` Tom Parkin
2013-03-14 15:05 ` Eric Dumazet
2013-03-14 15:29 ` Eric Dumazet
2013-03-14 16:14 ` Tom Parkin
2013-03-23 10:31 ` Damien Wyart
2013-03-23 15:09 ` Eric Dumazet
2013-04-11 16:32 ` Eric Dumazet
2013-04-11 17:53 ` Eric Dumazet
2013-04-11 22:26 ` Eric Dumazet [this message]
2013-04-12 22:32 ` David Miller
2013-04-12 7:04 ` Tom Parkin
2013-04-16 20:20 ` Tom Parkin
2013-04-16 22:55 ` [PATCH] net: drop dst before queueing fragments Eric Dumazet
2013-04-17 5:15 ` David Miller
2013-04-16 22:56 ` [RFC PATCH] udp: don't rereference dst_entry dev pointer on rcv Eric Dumazet
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1365719193.3887.190.camel@edumazet-glaptop \
--to=eric.dumazet@gmail.com \
--cc=davem@davemloft.net \
--cc=netdev@vger.kernel.org \
--cc=tparkin@katalix.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox