* [PATCH] [Bug 24472] Kernel panic - not syncing: Fatal Exception [not found] <20101210091505.GA7868@ff.dom.local> @ 2010-12-10 14:49 ` Andrej Ota 2010-12-10 15:55 ` Jarek Poplawski 0 siblings, 1 reply; 6+ messages in thread From: Andrej Ota @ 2010-12-10 14:49 UTC (permalink / raw) To: Jarek Poplawski Cc: Paweł Staszewski, Andrew Morton, netdev, Paul Mackerras, bugzilla-daemon, bugme-daemon, pstaszewski, Eric Dumazet, David Miller Move kfree_skb which was causing memory corruption to new location, while still keeping appropriate return value for function __pppoe_xmit. Prevents memory corruption and consequent kernel panic when PPPoE peer terminates the link. Signed-off-by: Andrej Ota [andrej@ota.si] Reported-by: Pawel Staszewski [pstaszewski@artcom.pl] --- drivers/net/pppoe.c | 5 +++-- 1 files changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/net/pppoe.c b/drivers/net/pppoe.c index d72fb05..1a21dce 100644 --- a/drivers/net/pppoe.c +++ b/drivers/net/pppoe.c @@ -924,8 +924,10 @@ static int __pppoe_xmit(struct sock *sk, struct sk_buff *skb) /* Copy the data if there is no space for the header or if it's * read-only. */ - if (skb_cow_head(skb, sizeof(*ph) + dev->hard_header_len)) + if (skb_cow_head(skb, sizeof(*ph) + dev->hard_header_len)) { + kfree_skb(skb); goto abort; + } __skb_push(skb, sizeof(*ph)); skb_reset_network_header(skb); @@ -947,7 +949,6 @@ static int __pppoe_xmit(struct sock *sk, struct sk_buff *skb) return 1; abort: - kfree_skb(skb); return 0; } --- Andrej Ota. ^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH] [Bug 24472] Kernel panic - not syncing: Fatal Exception 2010-12-10 14:49 ` [PATCH] [Bug 24472] Kernel panic - not syncing: Fatal Exception Andrej Ota @ 2010-12-10 15:55 ` Jarek Poplawski [not found] ` <4D037236.4080903@ota.si> 0 siblings, 1 reply; 6+ messages in thread From: Jarek Poplawski @ 2010-12-10 15:55 UTC (permalink / raw) To: Andrej Ota Cc: Paweł Staszewski, Andrew Morton, netdev, Paul Mackerras, bugzilla-daemon, bugme-daemon, pstaszewski, Eric Dumazet, David Miller On Fri, Dec 10, 2010 at 03:49:08PM +0100, Andrej Ota wrote: > Move kfree_skb which was causing memory corruption to new location, while still keeping appropriate return value for function __pppoe_xmit. Prevents memory corruption and consequent kernel panic when PPPoE peer terminates the link. Andrej, a slight misunderstanding - probably I should be more explicit. I sent this link, which explains why return shouldn't be zero: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=db7bf6d97c6956b7eb0f22131cb5c37bd41f33c0 So the simplest fix is to revert this one change only. If you disagree with this let me know. You should also fix the subject to something more meaningful, e.g.: [PATCH] pppoe: Fix kernel panic caused by __pppoe_xmit Please, break lines in the changelog around 70 lines and add it fixes commit 55c95e738da85373965cb03b4f975d0fd559865b. Thanks, Jarek P. > > Signed-off-by: Andrej Ota [andrej@ota.si] > Reported-by: Pawel Staszewski [pstaszewski@artcom.pl] > --- > drivers/net/pppoe.c | 5 +++-- > 1 files changed, 3 insertions(+), 2 deletions(-) > > diff --git a/drivers/net/pppoe.c b/drivers/net/pppoe.c > index d72fb05..1a21dce 100644 > --- a/drivers/net/pppoe.c > +++ b/drivers/net/pppoe.c > @@ -924,8 +924,10 @@ static int __pppoe_xmit(struct sock *sk, struct sk_buff *skb) > /* Copy the data if there is no space for the header or if it's > * read-only. > */ > - if (skb_cow_head(skb, sizeof(*ph) + dev->hard_header_len)) > + if (skb_cow_head(skb, sizeof(*ph) + dev->hard_header_len)) { > + kfree_skb(skb); > goto abort; > + } > > __skb_push(skb, sizeof(*ph)); > skb_reset_network_header(skb); > @@ -947,7 +949,6 @@ static int __pppoe_xmit(struct sock *sk, struct sk_buff *skb) > return 1; > > abort: > - kfree_skb(skb); > return 0; > } > > --- > > Andrej Ota. ^ permalink raw reply [flat|nested] 6+ messages in thread
[parent not found: <4D037236.4080903@ota.si>]
* Re: [PATCH] pppoe.c: Fix kernel panic caused by __pppoe_xmit [not found] ` <4D037236.4080903@ota.si> @ 2010-12-11 20:08 ` Jarek Poplawski 2010-12-11 23:23 ` Andrej Ota 2010-12-12 21:02 ` Denys Fedoryshchenko 0 siblings, 2 replies; 6+ messages in thread From: Jarek Poplawski @ 2010-12-11 20:08 UTC (permalink / raw) To: Andrej Ota Cc: Paweł Staszewski, Andrew Morton, netdev, Paul Mackerras, bugzilla-daemon, bugme-daemon, pstaszewski, Eric Dumazet, David Miller, Gorik Van Steenberge, Daniel Kenzelmann, Denys Fedoryshchenko On Sat, Dec 11, 2010 at 01:44:38PM +0100, Andrej Ota wrote: > __pppoe_xmit function return value was invalid resulting in > additional call to kfree_skb on already freed skb. This resulted in > memory corruption and consequent kernel panic after PPPoE peer > terminated the link. > > This fixes commit 55c95e738da85373965cb03b4f975d0fd559865b. > > Signed-off-by: Jarek Poplawski [jarkao2@gmail.com] > Signed-off-by: Andrej Ota [andrej@ota.si] > Reported-by: Pawel Staszewski [pstaszewski@artcom.pl] Thanks Andrej! I've only updated emails a bit. Jarek P. Reported-by: Gorik Van Steenberge <gvs@zemos.net> Reported-by: Daniel Kenzelmann <kernel.bugzilla@kenzelmann.dyndns.info> Reported-by: Denys Fedoryshchenko <nuclearcat@nuclearcat.com> Reported-by: Pawel Staszewski <pstaszewski@artcom.pl> Diagnosed-by: Andrej Ota <andrej@ota.si> Diagnosed-by: Eric Dumazet <eric.dumazet@gmail.com> Tested-by: Denys Fedoryshchenko <nuclearcat@nuclearcat.com> Tested-by: Pawel Staszewski <pstaszewski@artcom.pl> Signed-off-by: Jarek Poplawski <jarkao2@gmail.com> Signed-off-by: Andrej Ota <andrej@ota.si> ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] pppoe.c: Fix kernel panic caused by __pppoe_xmit 2010-12-11 20:08 ` [PATCH] pppoe.c: Fix kernel panic caused by __pppoe_xmit Jarek Poplawski @ 2010-12-11 23:23 ` Andrej Ota 2010-12-12 23:06 ` David Miller 2010-12-12 21:02 ` Denys Fedoryshchenko 1 sibling, 1 reply; 6+ messages in thread From: Andrej Ota @ 2010-12-11 23:23 UTC (permalink / raw) To: Jarek Poplawski; +Cc: netdev > Thanks Andrej! I've only updated emails a bit. Thank you for your help and support in submitting this patch. Andrej Ota. ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] pppoe.c: Fix kernel panic caused by __pppoe_xmit 2010-12-11 23:23 ` Andrej Ota @ 2010-12-12 23:06 ` David Miller 0 siblings, 0 replies; 6+ messages in thread From: David Miller @ 2010-12-12 23:06 UTC (permalink / raw) To: andrej; +Cc: jarkao2, netdev From: Andrej Ota <andrej@ota.si> Date: Sun, 12 Dec 2010 00:23:16 +0100 >> Thanks Andrej! I've only updated emails a bit. > > Thank you for your help and support in submitting this patch. Applied, thanks everyone. ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] pppoe.c: Fix kernel panic caused by __pppoe_xmit 2010-12-11 20:08 ` [PATCH] pppoe.c: Fix kernel panic caused by __pppoe_xmit Jarek Poplawski 2010-12-11 23:23 ` Andrej Ota @ 2010-12-12 21:02 ` Denys Fedoryshchenko 1 sibling, 0 replies; 6+ messages in thread From: Denys Fedoryshchenko @ 2010-12-12 21:02 UTC (permalink / raw) To: Jarek Poplawski Cc: Andrej Ota, Paweł Staszewski, Andrew Morton, netdev, Paul Mackerras, bugzilla-daemon, bugme-daemon, pstaszewski, Eric Dumazet, David Miller, Gorik Van Steenberge, Daniel Kenzelmann On Saturday 11 December 2010 22:08:23 Jarek Poplawski wrote: > On Sat, Dec 11, 2010 at 01:44:38PM +0100, Andrej Ota wrote: > > __pppoe_xmit function return value was invalid resulting in > > additional call to kfree_skb on already freed skb. This resulted in > > memory corruption and consequent kernel panic after PPPoE peer > > terminated the link. > > > > This fixes commit 55c95e738da85373965cb03b4f975d0fd559865b. > > > > Signed-off-by: Jarek Poplawski [jarkao2@gmail.com] > > Signed-off-by: Andrej Ota [andrej@ota.si] > > Reported-by: Pawel Staszewski [pstaszewski@artcom.pl] > > Thanks Andrej! I've only updated emails a bit. > Jarek P. > > Reported-by: Gorik Van Steenberge <gvs@zemos.net> > Reported-by: Daniel Kenzelmann <kernel.bugzilla@kenzelmann.dyndns.info> > Reported-by: Denys Fedoryshchenko <nuclearcat@nuclearcat.com> > Reported-by: Pawel Staszewski <pstaszewski@artcom.pl> > Diagnosed-by: Andrej Ota <andrej@ota.si> > Diagnosed-by: Eric Dumazet <eric.dumazet@gmail.com> > Tested-by: Denys Fedoryshchenko <nuclearcat@nuclearcat.com> > Tested-by: Pawel Staszewski <pstaszewski@artcom.pl> > Signed-off-by: Jarek Poplawski <jarkao2@gmail.com> > Signed-off-by: Andrej Ota <andrej@ota.si> Thanks a lot! ^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2010-12-12 23:06 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <20101210091505.GA7868@ff.dom.local>
2010-12-10 14:49 ` [PATCH] [Bug 24472] Kernel panic - not syncing: Fatal Exception Andrej Ota
2010-12-10 15:55 ` Jarek Poplawski
[not found] ` <4D037236.4080903@ota.si>
2010-12-11 20:08 ` [PATCH] pppoe.c: Fix kernel panic caused by __pppoe_xmit Jarek Poplawski
2010-12-11 23:23 ` Andrej Ota
2010-12-12 23:06 ` David Miller
2010-12-12 21:02 ` Denys Fedoryshchenko
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).