From: Alexey Dobriyan <adobriyan@openvz.org>
To: David Stevens <dlstevens@us.ibm.com>
Cc: davem@davemloft.net, kuznet@ms2.inr.ac.ru,
netdev@vger.kernel.org, netdev-owner@vger.kernel.org
Subject: Re: igmp: possible NULL dereference after GFP_ATOMIC allocation?
Date: Tue, 30 Jan 2007 18:04:27 +0300 [thread overview]
Message-ID: <20070130150427.GB11121@localhost.sw.ru> (raw)
In-Reply-To: <OF52248A96.35A5CA3C-ON88257273.003E5791-88257273.003F9122@us.ibm.com>
On Tue, Jan 30, 2007 at 03:34:18AM -0800, David Stevens wrote:
> I think you're correct-- looks like it needs:
>
> if (!skb)
> return NULL;
>
> just before the skb_put(), since an allocation (and failure)
> could occur in either the igmpv3_newpack() call or in add_grhead().
> Also, similar code in net/ipv6/mcast..c.
>
> Will you be submitting the patch?
One box here can semi-reliably reproduce oops which is attributed to
these allocation failures. I'll tell if patch works or not soon.
BUG: unable to handle kernel NULL pointer dereference at virtual address 00000064
EIP is at add_grec+0x22b/0x372
eax: 00000000 ebx: 00000000 ecx: f567cb20 edx: f567cb20
esi: e91ad540 edi: 00000001 ebp: 00000000 esp: c0787f54
ds: 007b es: 007b ss: 0068
Process swapper (pid: 0, veid: 0, ti=c0787000 task=c0670be0 task.ti=c073e000)
Stack: c0787f80 00000001 00000005 e08a8920 c930a800 00000000 e08a892c 00000000
00000000 00000000 00000000 00000000 e08a8920 e2000ea0 00000000 00000005
c05f1510 00000000 00000001 00000000 c0678580 c07fbb00 00000100 c05f13ac
Call Trace:
[<c05f1510>] igmp_ifc_timer_expire+0x164/0x1db
[<c042cd17>] run_timer_softirq+0x116/0x18d
[<c0427ea8>] __do_softirq+0x84/0x109
[<c0406234>] do_softirq+0x55/0xad
=======================
Code: fa ff ff 89 c3 c7 44 24 1c 00 00 00 00 eb 04 85 ff 74 18 8b 4c 24 08 8d 44 24 2c 8b 54 24 0c 89 04 24 89 d8 e8 66 fc ff ff 89 c3 <83> 7b 64 00 8b bb a0 00 00 00 74 0b 0f 0b 66 b8 5a 03 b8 52 e9
EIP: [<c05f1265>] add_grec+0x22b/0x372 SS:ESP 0068:c0787f54
Kernel panic - not syncing: Fatal exception in interrupt
next prev parent reply other threads:[~2007-01-30 14:58 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2007-01-30 10:57 igmp: possible NULL dereference after GFP_ATOMIC allocation? Alexey Dobriyan
2007-01-30 11:34 ` David Stevens
2007-01-30 15:04 ` Alexey Dobriyan [this message]
2007-01-31 9:39 ` Jarek Poplawski
2007-02-05 15:04 ` [PATCH] igmp: check add_grhead() return value Alexey Dobriyan
2007-02-06 22:35 ` David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20070130150427.GB11121@localhost.sw.ru \
--to=adobriyan@openvz.org \
--cc=davem@davemloft.net \
--cc=dlstevens@us.ibm.com \
--cc=kuznet@ms2.inr.ac.ru \
--cc=netdev-owner@vger.kernel.org \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).