From mboxrd@z Thu Jan  1 00:00:00 1970
From: David Miller <davem@davemloft.net>
Subject: Re: [PATCH net] atl1c: reserve min skb headroom
Date: Sun, 22 Jul 2018 10:29:13 -0700 (PDT)
Message-ID: <20180722.102913.887487081837325460.davem@davemloft.net>
References: <20180720173057.11365-1-fw@strlen.de>
Mime-Version: 1.0
Content-Type: Text/Plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Cc: netdev@vger.kernel.org, eric.dumazet@gmail.com
To: fw@strlen.de
Return-path: <netdev-owner@vger.kernel.org>
Received: from shards.monkeyblade.net ([23.128.96.9]:57206 "EHLO
        shards.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
        with ESMTP id S1730078AbeGVS0i (ORCPT
        <rfc822;netdev@vger.kernel.org>); Sun, 22 Jul 2018 14:26:38 -0400
In-Reply-To: <20180720173057.11365-1-fw@strlen.de>
Sender: netdev-owner@vger.kernel.org
List-ID: <netdev.vger.kernel.org>

From: Florian Westphal <fw@strlen.de>
Date: Fri, 20 Jul 2018 19:30:57 +0200

> Got crash report with following backtrace:
> BUG: unable to handle kernel paging request at ffff8801869daffe
> RIP: 0010:[<ffffffff816429c4>]  [<ffffffff816429c4>] ip6_finish_output2+0x394/0x4c0
> RSP: 0018:ffff880186c83a98  EFLAGS: 00010283
> RAX: ffff8801869db00e ...
>   [<ffffffff81644cdc>] ip6_finish_output+0x8c/0xf0
>   [<ffffffff81644d97>] ip6_output+0x57/0x100
>   [<ffffffff81643dc9>] ip6_forward+0x4b9/0x840
>   [<ffffffff81645566>] ip6_rcv_finish+0x66/0xc0
>   [<ffffffff81645db9>] ipv6_rcv+0x319/0x530
>   [<ffffffff815892ac>] netif_receive_skb+0x1c/0x70
>   [<ffffffffc0060bec>] atl1c_clean+0x1ec/0x310 [atl1c]
>   ...
> 
> The bad access is in neigh_hh_output(), at skb->data - 16 (HH_DATA_MOD).
> atl1c driver provided skb with no headroom, so 14 bytes (ethernet
> header) got pulled, but then 16 are copied.
> 
> Reserve NET_SKB_PAD bytes headroom, like netdev_alloc_skb().
> 
> Compile tested only; I lack hardware.
> 
> Fixes: 7b7017642199 ("atl1c: Fix misuse of netdev_alloc_skb in refilling rx ring")
> Signed-off-by: Florian Westphal <fw@strlen.de>

Ancient bug :-/

Applied and queued up for -stable, thanks Florian.