From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Dave Jones <davej@redhat.com>,
Eric Dumazet <edumazet@google.com>,
"David S. Miller" <davem@davemloft.net>
Subject: [ 41/48] tun: add a missing nf_reset() in tun_net_xmit()
Date: Mon, 18 Mar 2013 14:08:49 -0700 [thread overview]
Message-ID: <20130318210813.158043808@linuxfoundation.org> (raw)
In-Reply-To: <20130318210810.247845918@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit f8af75f3517a24838a36eb5797a1a3e60bf9e276 ]
Dave reported following crash :
general protection fault: 0000 [#1] SMP
CPU 2
Pid: 25407, comm: qemu-kvm Not tainted 3.7.9-205.fc18.x86_64 #1 Hewlett-Packard HP Z400 Workstation/0B4Ch
RIP: 0010:[<ffffffffa0399bd5>] [<ffffffffa0399bd5>] destroy_conntrack+0x35/0x120 [nf_conntrack]
RSP: 0018:ffff880276913d78 EFLAGS: 00010206
RAX: 50626b6b7876376c RBX: ffff88026e530d68 RCX: ffff88028d158e00
RDX: ffff88026d0d5470 RSI: 0000000000000011 RDI: 0000000000000002
RBP: ffff880276913d88 R08: 0000000000000000 R09: ffff880295002900
R10: 0000000000000000 R11: 0000000000000003 R12: ffffffff81ca3b40
R13: ffffffff8151a8e0 R14: ffff880270875000 R15: 0000000000000002
FS: 00007ff3bce38a00(0000) GS:ffff88029fc40000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: 00007fd1430bd000 CR3: 000000027042b000 CR4: 00000000000027e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process qemu-kvm (pid: 25407, threadinfo ffff880276912000, task ffff88028c369720)
Stack:
ffff880156f59100 ffff880156f59100 ffff880276913d98 ffffffff815534f7
ffff880276913db8 ffffffff8151a74b ffff880270875000 ffff880156f59100
ffff880276913dd8 ffffffff8151a5a6 ffff880276913dd8 ffff88026d0d5470
Call Trace:
[<ffffffff815534f7>] nf_conntrack_destroy+0x17/0x20
[<ffffffff8151a74b>] skb_release_head_state+0x7b/0x100
[<ffffffff8151a5a6>] __kfree_skb+0x16/0xa0
[<ffffffff8151a666>] kfree_skb+0x36/0xa0
[<ffffffff8151a8e0>] skb_queue_purge+0x20/0x40
[<ffffffffa02205f7>] __tun_detach+0x117/0x140 [tun]
[<ffffffffa022184c>] tun_chr_close+0x3c/0xd0 [tun]
[<ffffffff8119669c>] __fput+0xec/0x240
[<ffffffff811967fe>] ____fput+0xe/0x10
[<ffffffff8107eb27>] task_work_run+0xa7/0xe0
[<ffffffff810149e1>] do_notify_resume+0x71/0xb0
[<ffffffff81640152>] int_signal+0x12/0x17
Code: 00 00 04 48 89 e5 41 54 53 48 89 fb 4c 8b a7 e8 00 00 00 0f 85 de 00 00 00 0f b6 73 3e 0f b7 7b 2a e8 10 40 00 00 48 85 c0 74 0e <48> 8b 40 28 48 85 c0 74 05 48 89 df ff d0 48 c7 c7 08 6a 3a a0
RIP [<ffffffffa0399bd5>] destroy_conntrack+0x35/0x120 [nf_conntrack]
RSP <ffff880276913d78>
This is because tun_net_xmit() needs to call nf_reset()
before queuing skb into receive_queue
Reported-by: Dave Jones <davej@redhat.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/tun.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -417,6 +417,8 @@ static netdev_tx_t tun_net_xmit(struct s
* for indefinite time. */
skb_orphan(skb);
+ nf_reset(skb);
+
/* Enqueue packet */
skb_queue_tail(&tun->socket.sk->sk_receive_queue, skb);
next prev parent reply other threads:[~2013-03-18 21:08 UTC|newest]
Thread overview: 51+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-03-18 21:08 [ 00/48] 3.4.37-stable review Greg Kroah-Hartman
2013-03-18 21:08 ` [ 01/48] qcaux: add Franklin U600 Greg Kroah-Hartman
2013-03-18 21:08 ` [ 02/48] xen/pciback: Dont disable a PCI device that is already disabled Greg Kroah-Hartman
2013-03-18 21:08 ` [ 03/48] virtio: rng: disallow multiple device registrations, fixes crashes Greg Kroah-Hartman
2013-03-18 21:08 ` [ 04/48] USB: option: add Huawei E5331 Greg Kroah-Hartman
2013-03-18 21:08 ` [ 05/48] USB: cdc-wdm: fix buffer overflow Greg Kroah-Hartman
2013-03-18 21:08 ` [ 06/48] usb: cp210x new Vendor/Device IDs Greg Kroah-Hartman
2013-03-18 21:08 ` [ 07/48] USB: added support for Cinterions products AH6 and PLS8 Greg Kroah-Hartman
2013-03-18 21:08 ` [ 08/48] usb: serial: Add Rigblaster Advantage to device table Greg Kroah-Hartman
2013-03-18 21:08 ` [ 09/48] USB: storage: fix Huawei mode switching regression Greg Kroah-Hartman
2013-03-18 21:08 ` [ 10/48] USB: EHCI: dont check DMA values in QH overlays Greg Kroah-Hartman
2013-03-18 21:08 ` [ 11/48] staging: vt6656: Fix oops on resume from suspend Greg Kroah-Hartman
2013-03-18 21:08 ` [ 12/48] signal: always clear sa_restorer on execve Greg Kroah-Hartman
2013-03-18 21:08 ` [ 13/48] ext3: Fix format string issues Greg Kroah-Hartman
2013-03-18 21:08 ` [ 14/48] serial: 8250_pci: add support for another kind of NetMos Technology PCI 9835 Multi-I/O Controller Greg Kroah-Hartman
2013-03-18 21:08 ` [ 15/48] tty: serial: fix typo "ARCH_S5P6450" Greg Kroah-Hartman
2013-03-18 21:08 ` [ 16/48] TTY: do not reset masters packet mode Greg Kroah-Hartman
2013-03-18 21:08 ` [ 17/48] perf,x86: fix kernel crash with PEBS/BTS after suspend/resume Greg Kroah-Hartman
2013-03-18 21:08 ` [ 18/48] ALSA: seq: Fix missing error handling in snd_seq_timer_open() Greg Kroah-Hartman
2013-03-18 21:08 ` [ 19/48] hwmon: (pmbus/ltc2978) Fix temperature reporting Greg Kroah-Hartman
2013-03-18 21:08 ` [ 20/48] hwmon: (lineage-pem) Add missing terminating entry for pem_[input|fan]_attributes Greg Kroah-Hartman
2013-03-18 21:08 ` [ 21/48] w1: fix oops when w1_search is called from netlink connector Greg Kroah-Hartman
2013-03-18 21:08 ` [ 22/48] powerpc: Fix STAB initialization Greg Kroah-Hartman
2013-03-18 21:08 ` [ 23/48] powerpc: Fix cputable entry for 970MP rev 1.0 Greg Kroah-Hartman
2013-03-18 21:08 ` [ 24/48] selinux: use GFP_ATOMIC under spin_lock Greg Kroah-Hartman
2013-03-18 21:08 ` [ 25/48] perf,x86: fix wrmsr_on_cpu() warning on suspend/resume Greg Kroah-Hartman
2013-03-18 21:08 ` [ 26/48] perf,x86: fix link failure for non-Intel configs Greg Kroah-Hartman
2013-03-18 21:08 ` [ 27/48] s390: critical section cleanup vs. machine checks Greg Kroah-Hartman
2013-03-18 21:08 ` [ 28/48] s390/mm: fix flush_tlb_kernel_range() Greg Kroah-Hartman
2013-03-18 21:08 ` [ 29/48] btrfs: use rcu_barrier() to wait for bdev puts at unmount Greg Kroah-Hartman
2013-03-18 21:08 ` [ 30/48] atmel_lcdfb: fix 16-bpp modes on older SOCs Greg Kroah-Hartman
2013-03-18 21:08 ` [ 31/48] drm/i915: EBUSY status handling added to i915_gem_fault() Greg Kroah-Hartman
2013-03-18 21:08 ` [ 32/48] hwmon: (sht15) Fix memory leak if regulator_enable() fails Greg Kroah-Hartman
2013-03-18 21:08 ` [ 33/48] block: use i_size_write() in bd_set_size() Greg Kroah-Hartman
2013-03-18 21:08 ` [ 34/48] loopdev: fix a deadlock Greg Kroah-Hartman
2013-03-18 21:08 ` [ 35/48] loopdev: remove an user triggerable oops Greg Kroah-Hartman
2013-03-18 21:08 ` [ 36/48] drm/i915: Increase the RC6p threshold Greg Kroah-Hartman
2013-03-18 21:08 ` [ 37/48] l2tp: Restore socket refcount when sendmsg succeeds Greg Kroah-Hartman
2013-03-18 21:08 ` [ 38/48] rds: limit the size allocated by rds_message_alloc() Greg Kroah-Hartman
2013-03-18 21:08 ` [ 39/48] net: ipv6: Dont purge default router if accept_ra=2 Greg Kroah-Hartman
2013-03-18 21:08 ` [ 40/48] tcp: fix double-counted receiver RTT when leaving receiver fast path Greg Kroah-Hartman
2013-03-18 21:08 ` Greg Kroah-Hartman [this message]
2013-03-18 21:08 ` [ 42/48] macvlan: Set IFF_UNICAST_FLT flag to prevent unnecessary promisc mode Greg Kroah-Hartman
2013-03-18 21:08 ` [ 43/48] netlabel: correctly list all the static label mappings Greg Kroah-Hartman
2013-03-18 21:08 ` [ 44/48] bridging: fix rx_handlers return code Greg Kroah-Hartman
2013-03-18 21:08 ` [ 45/48] ipv6: stop multicast forwarding to process interface scoped addresses Greg Kroah-Hartman
2013-03-18 21:08 ` [ 46/48] rtnl: fix info leak on RTM_GETLINK request for VF devices Greg Kroah-Hartman
2013-03-18 21:08 ` [ 47/48] dcbnl: fix various netlink info leaks Greg Kroah-Hartman
2013-03-18 21:08 ` [ 48/48] 6lowpan: Fix endianness issue in is_addr_link_local() Greg Kroah-Hartman
2013-03-19 0:50 ` [ 00/48] 3.4.37-stable review Shuah Khan
2013-03-19 0:57 ` Parag Warudkar
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20130318210813.158043808@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=davej@redhat.com \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).