From: David Miller <davem@davemloft.net>
To: fw@strlen.de
Cc: netdev@vger.kernel.org, eric.dumazet@gmail.com
Subject: Re: [PATCH net] atl1c: reserve min skb headroom
Date: Sun, 22 Jul 2018 10:29:13 -0700 (PDT) [thread overview]
Message-ID: <20180722.102913.887487081837325460.davem@davemloft.net> (raw)
In-Reply-To: <20180720173057.11365-1-fw@strlen.de>
From: Florian Westphal <fw@strlen.de>
Date: Fri, 20 Jul 2018 19:30:57 +0200
> Got crash report with following backtrace:
> BUG: unable to handle kernel paging request at ffff8801869daffe
> RIP: 0010:[<ffffffff816429c4>] [<ffffffff816429c4>] ip6_finish_output2+0x394/0x4c0
> RSP: 0018:ffff880186c83a98 EFLAGS: 00010283
> RAX: ffff8801869db00e ...
> [<ffffffff81644cdc>] ip6_finish_output+0x8c/0xf0
> [<ffffffff81644d97>] ip6_output+0x57/0x100
> [<ffffffff81643dc9>] ip6_forward+0x4b9/0x840
> [<ffffffff81645566>] ip6_rcv_finish+0x66/0xc0
> [<ffffffff81645db9>] ipv6_rcv+0x319/0x530
> [<ffffffff815892ac>] netif_receive_skb+0x1c/0x70
> [<ffffffffc0060bec>] atl1c_clean+0x1ec/0x310 [atl1c]
> ...
>
> The bad access is in neigh_hh_output(), at skb->data - 16 (HH_DATA_MOD).
> atl1c driver provided skb with no headroom, so 14 bytes (ethernet
> header) got pulled, but then 16 are copied.
>
> Reserve NET_SKB_PAD bytes headroom, like netdev_alloc_skb().
>
> Compile tested only; I lack hardware.
>
> Fixes: 7b7017642199 ("atl1c: Fix misuse of netdev_alloc_skb in refilling rx ring")
> Signed-off-by: Florian Westphal <fw@strlen.de>
Ancient bug :-/
Applied and queued up for -stable, thanks Florian.
prev parent reply other threads:[~2018-07-22 18:26 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-07-20 17:30 [PATCH net] atl1c: reserve min skb headroom Florian Westphal
2018-07-20 17:48 ` Eric Dumazet
2018-07-22 17:29 ` David Miller [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180722.102913.887487081837325460.davem@davemloft.net \
--to=davem@davemloft.net \
--cc=eric.dumazet@gmail.com \
--cc=fw@strlen.de \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).