Re: [BUG] skb corruption and kernel panic at forwarding with fragmentation

Path	csiph.com!news.mixmin.net!aioe.org!bofh.it!news.nic.it!robomod
From	Cong Wang <xiyou.wangcong@gmail.com>
Newsgroups	linux.kernel
Subject	Re: [BUG] skb corruption and kernel panic at forwarding with fragmentation
Date	Wed, 06 Jan 2016 21:00:03 +0100
Message-ID	<qO2pt-5zb-23@gated-at.bofh.it> (permalink)
References	<qO1ML-5kj-25@gated-at.bofh.it>
Dkim-Signature	v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=9i2qwKyjvSYz/G+5+Bb14zrBQlailG1hJ2b5Y3lyBdg=; b=l+FoGaqo4GcOrkUNSGNvDoUY/MOIoMcLnwmod9sgCTGvG/jqWzCqZ+/ny0Oi/KCdCs 0yqTInPyIM1N/m5AfUeQZvCdW8eosXl5NYsXjGO5vWAGKzbiodk5H/2MGqznkBHMoGyn VbF1Cf4/gSNnOFuoqCL8qyiur3YWt0Fc1pUvBm+F/q6v66dFU1z3hQnr2VbV2JlDvNSs 8RzSm2iQmmMOdK6Q4yTUAvuYxRALekdsj1mRV110NNYlnUBnDHLdWFloI8578TBYEeUS mp/2xoJnG3iDeZCuUkNE8UXsVfBXVtVIuv7Dzxnaxz7SM2uiFnYPiZz887e5asZx1AyY lNHg==
MIME-Version	1.0
X-Received	by 10.129.86.4 with SMTP id k4mr65186477ywb.36.1452110364000; Wed, 06 Jan 2016 11:59:24 -0800 (PST)
Content-Type	text/plain; charset=UTF-8
Sender	robomod@news.nic.it
List-ID	<linux-kernel.vger.kernel.org>
X-Mailing-List	linux-kernel@vger.kernel.org
Approved	robomod@news.nic.it
Lines	21
Organization	linux.* mail to news gateway
X-Original-Cc	Linux Kernel Network Developers <netdev@vger.kernel.org>, David Miller <davem@davemloft.net>, Eric Dumazet <edumazet@google.com>, Linux Kernel Mailing List <linux-kernel@vger.kernel.org>
X-Original-Date	Wed, 6 Jan 2016 11:59:23 -0800
X-Original-Message-ID	<CAM_iQpWsx6w2tFvSAy66M69FNi5iSp===EFCrO=4EPjy7y3iSg@mail.gmail.com>
X-Original-References	<CALYGNiP-0MZ-FExV2HutTvE9U-QQtkKSoE--KN=JQE5STYsjAA@mail.gmail.com>
X-Original-Sender	linux-kernel-owner@vger.kernel.org
Xref	csiph.com linux.kernel:1303033

Show key headers only | View raw

On Wed, Jan 6, 2016 at 11:15 AM, Konstantin Khlebnikov <koct9i@gmail.com> wrote:
> Looks like this happens because ip_options_fragment() relies on
> correct ip options length in ip control block in skb. But in
> ip_finish_output_gso() control block in segments is reused by
> skb_gso_segment(). following ip_fragment() sees some garbage.
>
> In my case there was no ip options but length becomes non-zero and
> ip_options_fragment() picked some bytes from payload and decides to
> fill huge range with IPOPT_NOOP (1). One of that ones flipped nr_frags
> in skb_shared_info at the end of data =)
>

Hmm, it looks like SKB_GSO_CB should be cleared after skb_gso_segment()
since all the gso information should be saved in shared_info after it finishes.

Does a memset(0) on SKB_GSO_CB after skb_gso_segment() work as well?
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Thread

[BUG] skb corruption and kernel panic at forwarding with fragmentation Konstantin Khlebnikov <koct9i@gmail.com> - 2016-01-06 20:20 +0100
  Re: [BUG] skb corruption and kernel panic at forwarding with fragmentation Cong Wang <xiyou.wangcong@gmail.com> - 2016-01-06 21:00 +0100
    Re: [BUG] skb corruption and kernel panic at forwarding with fragmentation Konstantin Khlebnikov <koct9i@gmail.com> - 2016-01-06 21:20 +0100
      Re: [BUG] skb corruption and kernel panic at forwarding with  fragmentation Thadeu Lima de Souza Cascardo <cascardo@redhat.com> - 2016-01-06 22:10 +0100
        Re: [BUG] skb corruption and kernel panic at forwarding with  fragmentation Florian Westphal <fw@strlen.de> - 2016-01-06 23:10 +0100
          Re: [BUG] skb corruption and kernel panic at forwarding with  fragmentation Florian Westphal <fw@strlen.de> - 2016-01-07 01:00 +0100
            Re: [BUG] skb corruption and kernel panic at forwarding with fragmentation Konstantin Khlebnikov <koct9i@gmail.com> - 2016-01-07 12:10 +0100
              Re: [BUG] skb corruption and kernel panic at forwarding with fragmentation Konstantin Khlebnikov <koct9i@gmail.com> - 2016-01-07 12:40 +0100
                Re: [BUG] skb corruption and kernel panic at forwarding with fragmentation Eric Dumazet <edumazet@google.com> - 2016-01-07 13:00 +0100
                Re: [BUG] skb corruption and kernel panic at forwarding with fragmentation Konstantin Khlebnikov <koct9i@gmail.com> - 2016-01-07 13:10 +0100
                Re: [BUG] skb corruption and kernel panic at forwarding with fragmentation Eric Dumazet <edumazet@google.com> - 2016-01-07 14:00 +0100
                Re: [BUG] skb corruption and kernel panic at forwarding with fragmentation Konstantin Khlebnikov <koct9i@gmail.com> - 2016-01-07 20:40 +0100
                Re: [BUG] skb corruption and kernel panic at forwarding with fragmentation Eric Dumazet <edumazet@google.com> - 2016-01-07 20:50 +0100
              Re: [BUG] skb corruption and kernel panic at forwarding with  fragmentation Florian Westphal <fw@strlen.de> - 2016-01-07 13:10 +0100
            [PATCH] net: prevent corruption of skb when using skb_gso_segment Thadeu Lima de Souza Cascardo <cascardo@redhat.com> - 2016-01-07 19:50 +0100
              Re: [PATCH] net: prevent corruption of skb when using skb_gso_segment Florian Westphal <fw@strlen.de> - 2016-01-07 20:40 +0100
                [PATCH v2] net: prevent corruption of skb when using skb_gso_segment Thadeu Lima de Souza Cascardo <cascardo@redhat.com> - 2016-01-07 22:20 +0100

csiph-web