Gui Jianfeng 6edafaaf6f tcp: Fix kernel panic when calling tcp_v(4/6)_md5_do_lookup ... If the following packet flow happen, kernel will panic. MathineA MathineB SYN ----------------------> SYN+ACK <---------------------- ACK(bad seq) ----------------------> When a bad seq ACK is received, tcp_v4_md5_do_lookup(skb->sk, ip_hdr(skb)->daddr)) is finally called by tcp_v4_reqsk_send_ack(), but the first parameter(skb->sk) is NULL at that moment, so kernel panic happens. This patch fixes this bug. OOPS output is as following: [ 302.812793] IP: [<c05cfaa6>] tcp_v4_md5_do_lookup+0x12/0x42 [ 302.817075] Oops: 0000 [#1] SMP [ 302.819815] Modules linked in: ipv6 loop dm_multipath rtc_cmos rtc_core rtc_lib pcspkr pcnet32 mii i2c_piix4 parport_pc i2c_core parport ac button ata_piix libata dm_mod mptspi mptscsih mptbase scsi_transport_spi sd_mod scsi_mod crc_t10dif ext3 jbd mbcache uhci_hcd ohci_hcd ehci_hcd [last unloaded: scsi_wait_scan] [ 302.849946] [ 302.851198] Pid: 0, comm: swapper Not tainted (2.6.27-rc1-guijf #5) [ 302.855184] EIP: 0060:[<c05cfaa6>] EFLAGS: 00010296 CPU: 0 [ 302.858296] EIP is at tcp_v4_md5_do_lookup+0x12/0x42 [ 302.861027] EAX: 0000001e EBX: 00000000 ECX: 00000046 EDX: 00000046 [ 302.864867] ESI: ceb69e00 EDI: 1467a8c0 EBP: cf75f180 ESP: c0792e54 [ 302.868333] DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068 [ 302.871287] Process swapper (pid: 0, ti=c0792000 task=c0712340 task.ti=c0746000) [ 302.875592] Stack: c06f413a 00000000 cf75f180 ceb69e00 00000000 c05d0d86 000016d0 ceac5400 [ 302.883275] c05d28f8 000016d0 ceb69e00 ceb69e20 681bf6e3 00001000 00000000 0a67a8c0 [ 302.890971] ceac5400 c04250a3 c06f413a c0792eb0 c0792edc cf59a620 cf59a620 cf59a634 [ 302.900140] Call Trace: [ 302.902392] [<c05d0d86>] tcp_v4_reqsk_send_ack+0x17/0x35 [ 302.907060] [<c05d28f8>] tcp_check_req+0x156/0x372 [ 302.910082] [<c04250a3>] printk+0x14/0x18 [ 302.912868] [<c05d0aa1>] tcp_v4_do_rcv+0x1d3/0x2bf [ 302.917423] [<c05d26be>] tcp_v4_rcv+0x563/0x5b9 [ 302.920453] [<c05bb20f>] ip_local_deliver_finish+0xe8/0x183 [ 302.923865] [<c05bb10a>] ip_rcv_finish+0x286/0x2a3 [ 302.928569] [<c059e438>] dev_alloc_skb+0x11/0x25 [ 302.931563] [<c05a211f>] netif_receive_skb+0x2d6/0x33a [ 302.934914] [<d0917941>] pcnet32_poll+0x333/0x680 [pcnet32] [ 302.938735] [<c05a3b48>] net_rx_action+0x5c/0xfe [ 302.941792] [<c042856b>] __do_softirq+0x5d/0xc1 [ 302.944788] [<c042850e>] __do_softirq+0x0/0xc1 [ 302.948999] [<c040564b>] do_softirq+0x55/0x88 [ 302.951870] [<c04501b1>] handle_fasteoi_irq+0x0/0xa4 [ 302.954986] [<c04284da>] irq_exit+0x35/0x69 [ 302.959081] [<c0405717>] do_IRQ+0x99/0xae [ 302.961896] [<c040422b>] common_interrupt+0x23/0x28 [ 302.966279] [<c040819d>] default_idle+0x2a/0x3d [ 302.969212] [<c0402552>] cpu_idle+0xb2/0xd2 [ 302.972169] ======================= [ 302.974274] Code: fc ff 84 d2 0f 84 df fd ff ff e9 34 fe ff ff 83 c4 0c 5b 5e 5f 5d c3 90 90 57 89 d7 56 53 89 c3 50 68 3a 41 6f c0 e8 e9 55 e5 ff <8b> 93 9c 04 00 00 58 85 d2 59 74 1e 8b 72 10 31 db 31 c9 85 f6 [ 303.011610] EIP: [<c05cfaa6>] tcp_v4_md5_do_lookup+0x12/0x42 SS:ESP 0068:c0792e54 [ 303.018360] Kernel panic - not syncing: Fatal exception in interrupt Signed-off-by: Gui Jianfeng <guijianfeng@cn.fujitsu.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2008-08-06 23:50:04 -07:00
..
netfilter	netfilter: ip{,6}tables_security: fix future section mismatch	2008-07-26 17:48:38 -07:00
addrconf.c	net: convert BUG_TRAP to generic WARN_ON	2008-07-25 21:43:18 -07:00
addrconf_core.c	[IPV6]: ipv6_addr_type() doesn't know about RFC4193 addresses.	2007-07-31 02:28:21 -07:00
addrlabel.c	ipv6 netns: Address labels per namespace	2008-06-12 02:38:15 +09:00
af_inet6.c	net: missing bits of net-namespace / sysctl	2008-07-27 04:40:51 -07:00
ah6.c	[IPSEC]: Fix bogus usage of u64 on input sequence number	2008-02-12 22:50:35 -08:00
anycast.c	ipv6 netns: Make several "global" sysctl variables namespace aware.	2008-07-19 22:35:03 -07:00
datagram.c	IPv6: datagram_send_ctl() should exit immediately when an error occured	2008-07-29 23:57:58 -07:00
esp6.c	ipsec: Interfamily IPSec BEET, ipv4-inner ipv6-outer	2008-08-06 02:40:25 -07:00
exthdrs.c	ipv6 netns: Make several "global" sysctl variables namespace aware.	2008-07-19 22:35:03 -07:00
exthdrs_core.c	[NET] IPV6: Fix whitespace errors.	2007-02-10 23:19:42 -08:00
fib6_rules.c	[IPV6] FIB_RULE: Sparse: fib6_rules_cleanup() is of void.	2008-04-11 19:47:53 +09:00
icmp.c	icmp: fix units for ratelimit	2008-07-01 19:29:07 -07:00
inet6_connection_sock.c	net: convert BUG_TRAP to generic WARN_ON	2008-07-25 21:43:18 -07:00
inet6_hashtables.c	net: convert BUG_TRAP to generic WARN_ON	2008-07-25 21:43:18 -07:00
ip6_fib.c	net: convert BUG_TRAP to generic WARN_ON	2008-07-25 21:43:18 -07:00
ip6_flowlabel.c	[IPV6] NETNS: Handle ancillary data in appropriate namespace.	2008-06-05 04:02:36 +09:00
ip6_input.c	ipv6 netns: Make several "global" sysctl variables namespace aware.	2008-07-19 22:35:03 -07:00
ip6_output.c	ipv6: Do not drop packet if skb->local_df is set to true	2008-08-03 21:15:59 -07:00
ip6_tunnel.c	net: remove CVS keywords	2008-06-11 21:00:38 -07:00
ip6mr.c	netns: Use net_eq() to compare net-namespaces for optimization.	2008-07-19 22:34:43 -07:00
ipcomp6.c	ipcomp: Fix warnings after ipcomp consolidation.	2008-07-27 03:59:24 -07:00
ipv6_sockglue.c	ipv6: Fix the return value of Set Hop-by-Hop options header with NULL data pointer	2008-08-03 18:16:15 -07:00
Kconfig	ipsec: ipcomp - Merge IPComp implementations	2008-07-25 02:54:40 -07:00
Makefile	[IPV6] MROUTE: Support multicast forwarding.	2008-04-05 22:33:38 +09:00
mcast.c	ipv6 mcast: Omit redundant address family checks in ip6_mc_source().	2008-07-19 22:36:07 -07:00
mip6.c	net: convert BUG_TRAP to generic WARN_ON	2008-07-25 21:43:18 -07:00
ndisc.c	ipv6 netns: Make several "global" sysctl variables namespace aware.	2008-07-19 22:35:03 -07:00
netfilter.c	[NETFILTER]: Add partial checksum validation helper	2008-04-14 11:15:49 +02:00
proc.c	ipv6: Fix useless proc net sockstat6 removal	2008-07-30 03:27:52 -07:00
protocol.c	net: remove CVS keywords	2008-06-11 21:00:38 -07:00
raw.c	ipv6: remove unused parameter from ip6_ra_control	2008-07-19 00:28:58 -07:00
reassembly.c	net: convert BUG_TRAP to generic WARN_ON	2008-07-25 21:43:18 -07:00
route.c	ipv6: replace dst_metric() with dst_mtu() in net/ipv6/route.c.	2008-08-06 02:34:21 -07:00
sit.c	Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6	2008-06-16 18:25:48 -07:00
syncookies.c	ipv6: syncookies: free reqsk on xfrm_lookup error	2008-08-03 18:13:44 -07:00
sysctl_net_ipv6.c	net: missing bits of net-namespace / sysctl	2008-07-27 04:40:51 -07:00
tcp_ipv6.c	tcp: Fix kernel panic when calling tcp_v(4/6)_md5_do_lookup	2008-08-06 23:50:04 -07:00
tunnel6.c	[IPV6] TUNNEL6: Fix incoming packet length check for inter-protocol tunnel.	2008-06-05 04:02:32 +09:00
udp.c	MIB: add struct net to UDP6_INC_STATS_BH	2008-07-05 21:19:40 -07:00
udp_impl.h	net: change proto destroy method to return void	2008-06-14 17:04:49 -07:00
udplite.c	net: remove CVS keywords	2008-06-11 21:00:38 -07:00
xfrm6_input.c	[XFRM] IPV6: Optimize xfrm6_input_addr().	2008-03-25 10:23:56 +09:00
xfrm6_mode_beet.c	ipsec: Interfamily IPSec BEET, ipv4-inner ipv6-outer	2008-08-06 02:40:25 -07:00
xfrm6_mode_ro.c	[IPSEC]: Make x->lastused an unsigned long	2008-01-28 14:53:52 -08:00
xfrm6_mode_transport.c	[IPSEC]: Use IPv6 calling convention as the convention for x->mode->output	2007-10-10 16:55:54 -07:00
xfrm6_mode_tunnel.c	[IPSEC]: Fix inter address family IPsec tunnel handling.	2008-03-24 14:51:51 -07:00
xfrm6_output.c	[IPSEC]: Fix inter address family IPsec tunnel handling.	2008-03-24 14:51:51 -07:00
xfrm6_policy.c	[NET] NETNS: Omit net_device->nd_net without CONFIG_NET_NS.	2008-03-26 04:39:53 +09:00
xfrm6_state.c	Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6	2008-03-27 18:48:56 -07:00
xfrm6_tunnel.c	[XFRM] IPV6: Optimize __xfrm_tunnel_alloc_spi().	2008-03-25 10:23:57 +09:00