From: Alexander Aring <alex.aring@gmail.com>
To: davem@davemloft.net
Cc: kuznet@ms2.inr.ac.ru, jmorris@namei.org, yoshfuji@linux-ipv6.org,
kaber@trash.net, netdev@vger.kernel.org,
Alexander Aring <alex.aring@gmail.com>
Subject: [PATCH/RFC net] ipv6: probably fragmentation bug
Date: Mon, 4 Nov 2013 10:26:13 +0100 [thread overview]
Message-ID: <1383557174-19424-1-git-send-email-alex.aring@gmail.com> (raw)
I currently working for 6lowpan and try to use the fragmentation api like in ipv6.
Maybe I do something wrong with using the api but I don't catch any mistakes and
my sk_buff is already sent to the ipv6 layer correctly.
In a very poor connection with high payload(which is good for testing) I got a nullpointer
dereference when the fragmentation expire timer occurs.
BUG: unable to handle kernel NULL pointer dereference
at 0000000c
IP: [<c0389538>] _decode_session6+0x4f/0x1db
*pde = 00000000
Oops: 0000 [#1] SMP
Modules linked in:
CPU: 0 PID: 0 Comm: swapper/0 Not tainted
3.12.0-rc6-12694-g9ce9a7b-dirty #194
Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
task: c05007e8 ti: c7808000 task.ti: c04f6000
EIP: 0060:[<c0389538>] EFLAGS: 00210246 CPU: 0
EIP is at _decode_session6+0x4f/0x1db
EAX: 00000000 EBX: c5e602e0 ECX: 00000000 EDX: c5e65c3d
ESI: c5e602e0 EDI: c7809ee8 EBP: c7809eac ESP: c7809e70
DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068
CR0: 8005003b CR2: 0000000c CR3: 07b31000 CR4: 00000690
Stack:
00000005 00282c6c 00000001 c05232dc c5e602e0 c0095bc0 c051de00 c0360508
c7809eac c5e602e0 c5e602e0 c037ef65 00000001 c795aa60 c795aa60 00000000
00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
Call Trace:
[<c0360508>] ? __xfrm_decode_session+0x22/0x2f
[<c037ef65>] ? icmpv6_route_lookup+0xa9/0x119
[<c037f396>] ? icmp6_send+0x3c1/0x4bf
[<c037efd5>] ? icmpv6_route_lookup+0x119/0x119
[<c038cea6>] ? icmpv6_send+0x17/0x1a
[<c0382fbd>] ? ip6_expire_frag_queue+0x10a/0x11b
[<c0382fce>] ? ip6_expire_frag_queue+0x11b/0x11b
[<c0127eda>] ? call_timer_fn.isra.28+0x13/0x58
[<c01280bf>] ? run_timer_softirq+0x11a/0x14d
[<c0124097>] ? __do_softirq+0x95/0x13c
Maybe this occurs because I did some mistakes in my current 6lowpan fragmentation
implementation. That's why I sending it to this mailinglist... or maybe I found a bug.
The patch fix this issue you can find the removal of skb_dst_drop(skb) which
was comming in on commit id: 97599dc792b45b1669c3cdb9a4b365aad0232f65
Maybe this wasn't a correct solution. We need the sk_buff sometimes when the expire occurs to call
the icmp6_send function.
Regards Alex
Alexander Aring (1):
ipv6: fix fragmentation bug
net/ipv6/reassembly.c | 1 -
1 file changed, 1 deletion(-)
--
1.8.4.2
next reply other threads:[~2013-11-04 9:26 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-11-04 9:26 Alexander Aring [this message]
2013-11-04 9:26 ` [PATCH/RFC net] ipv6: fix fragmentation bug Alexander Aring
2013-11-04 9:39 ` Fan Du
2013-11-04 9:43 ` Alexander Aring
2013-11-04 9:46 ` Fan Du
2013-11-04 9:51 ` Alexander Aring
2013-11-04 14:25 ` Eric Dumazet
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1383557174-19424-1-git-send-email-alex.aring@gmail.com \
--to=alex.aring@gmail.com \
--cc=davem@davemloft.net \
--cc=jmorris@namei.org \
--cc=kaber@trash.net \
--cc=kuznet@ms2.inr.ac.ru \
--cc=netdev@vger.kernel.org \
--cc=yoshfuji@linux-ipv6.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).