From mboxrd@z Thu Jan 1 00:00:00 1970 From: Dave Jones Subject: ipqueue allocation failure. Date: Tue, 19 Apr 2011 21:42:22 -0400 Message-ID: <20110420014221.GC26949@redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii To: netdev@vger.kernel.org Return-path: Received: from mx1.redhat.com ([209.132.183.28]:49648 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752690Ab1DTBmY (ORCPT ); Tue, 19 Apr 2011 21:42:24 -0400 Received: from int-mx01.intmail.prod.int.phx2.redhat.com (int-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.11]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id p3K1gO4g012883 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK) for ; Tue, 19 Apr 2011 21:42:24 -0400 Received: from gelk.kernelslacker.org (ovpn-113-123.phx2.redhat.com [10.3.113.123]) by int-mx01.intmail.prod.int.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id p3K1gN05001976 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Tue, 19 Apr 2011 21:42:24 -0400 Received: from gelk.kernelslacker.org (gelk [127.0.0.1]) by gelk.kernelslacker.org (8.14.4/8.14.4) with ESMTP id p3K1gMZd029350 for ; Tue, 19 Apr 2011 21:42:22 -0400 Received: (from davej@localhost) by gelk.kernelslacker.org (8.14.4/8.14.4/Submit) id p3K1gMiA029348 for netdev@vger.kernel.org; Tue, 19 Apr 2011 21:42:22 -0400 Content-Disposition: inline Sender: netdev-owner@vger.kernel.org List-ID: Not catastrophic, but ipqueue seems to be too trusting of what it gets passed from userspace, and passes it on down to the page allocator, where it will spew warnings if the page order is too high. __ipq_rcv_skb has several checks for lengths too small, but doesn't seem to have any for oversized ones. I'm not sure what the maximum we should check for is. I'll code up a diff if anyone has any ideas on a sane maximum. Dave ------------[ cut here ]------------ WARNING: at mm/page_alloc.c:2032 __alloc_pages_nodemask+0x17d/0x7e6() Hardware name: GA-MA78GM-S2H Modules linked in: rfcomm hidp can_raw can_bcm sctp libcrc32c ip_queue decnet pppoe pppox ppp_generic slhc can ipx p8022 p8023 phonet bluetooth rfkill a] Pid: 20393, comm: trinity Not tainted 2.6.39-rc4+ #6 Call Trace: [] warn_slowpath_common+0x83/0x9b [] warn_slowpath_null+0x1a/0x1c [] __alloc_pages_nodemask+0x17d/0x7e6 [] ? check_object+0x174/0x1ae [] ? check_slab+0xc7/0xd5 [] ? __alloc_skb+0x40/0x133 [] ? __alloc_skb+0x40/0x133 [] kmalloc_large_node+0x56/0x95 [] __kmalloc_node_track_caller+0x32/0x139 [] ? netlink_ack+0x4a/0xe8 [] ? ipq_rcv_skb+0x27/0x340 [ip_queue] [] __alloc_skb+0x75/0x133 [] netlink_ack+0x4a/0xe8 [] ipq_rcv_skb+0x31c/0x340 [ip_queue] [] netlink_unicast+0xec/0x156 [] netlink_sendmsg+0x27f/0x2c0 [] __sock_sendmsg+0x69/0x75 [] sock_aio_write+0xbc/0xcc [] do_sync_write+0xbf/0xff [] ? security_file_permission+0x2e/0x33 [] ? rw_verify_area+0xb6/0xd3 [] vfs_write+0xb6/0xf6 [] ? fget_light+0x3a/0xa1 [] sys_write+0x4d/0x74 [] system_call_fastpath+0x16/0x1b ---[ end trace cd56dc75cfeab436 ]---