Wei Yongjun 8984e41d18 [IPV6]: Fix kernel panic while send SCTP data with IP fragments ... If ICMP6 message with "Packet Too Big" is received after send SCTP DATA, kernel panic will occur when SCTP DATA is send again. This is because of a bad dest address when call to skb_copy_bits(). The messages sequence is like this: Endpoint A Endpoint B <------- SCTP DATA (size=1432) ICMP6 message -------> (Packet Too Big pmtu=1280) <------- Resend SCTP DATA (size=1432) ------------kernel panic--------------- printing eip: c05be62a *pde = 00000000 Oops: 0002 [#1] SMP Modules linked in: scomm l2cap bluetooth ipv6 dm_mirror dm_mod video output sbs battery lp floppy sg i2c_piix4 i2c_core pcnet32 mii button ac parport_pc parport ide_cd cdrom serio_raw mptspi mptscsih mptbase scsi_transport_spi sd_mod scsi_mod ext3 jbd ehci_hcd ohci_hcd uhci_hcd CPU: 0 EIP: 0060:[<c05be62a>] Not tainted VLI EFLAGS: 00010282 (2.6.23-rc2 #1) EIP is at skb_copy_bits+0x4f/0x1ef eax: 000004d0 ebx: ce12a980 ecx: 00000134 edx: cfd5a880 esi: c8246858 edi: 00000000 ebp: c0759b14 esp: c0759adc ds: 007b es: 007b fs: 00d8 gs: 0000 ss: 0068 Process swapper (pid: 0, ti=c0759000 task=c06d0340 task.ti=c0713000) Stack: c0759b88 c0405867 ce12a980 c8bff838 c789c084 00000000 00000028 cfd5a880 d09f1890 000005dc 0000007b ce12a980 cfd5a880 c8bff838 c0759b88 d09bc521 000004d0 fffff96c 00000200 00000100 c0759b50 cfd5a880 00000246 c0759bd4 Call Trace: [<c0405e1d>] show_trace_log_lvl+0x1a/0x2f [<c0405ecd>] show_stack_log_lvl+0x9b/0xa3 [<c040608d>] show_registers+0x1b8/0x289 [<c0406271>] die+0x113/0x246 [<c0625dbc>] do_page_fault+0x4ad/0x57e [<c0624642>] error_code+0x72/0x78 [<d09bc521>] ip6_output+0x8e5/0xab2 [ipv6] [<d09bcec1>] ip6_xmit+0x2ea/0x3a3 [ipv6] [<d0a3f2ca>] sctp_v6_xmit+0x248/0x253 [sctp] [<d0a3c934>] sctp_packet_transmit+0x53f/0x5ae [sctp] [<d0a34bf8>] sctp_outq_flush+0x555/0x587 [sctp] [<d0a34d3c>] sctp_retransmit+0xf8/0x10f [sctp] [<d0a3d183>] sctp_icmp_frag_needed+0x57/0x5b [sctp] [<d0a3ece2>] sctp_v6_err+0xcd/0x148 [sctp] [<d09cf1ce>] icmpv6_notify+0xe6/0x167 [ipv6] [<d09d009a>] icmpv6_rcv+0x7d7/0x849 [ipv6] [<d09be240>] ip6_input+0x1dc/0x310 [ipv6] [<d09be965>] ipv6_rcv+0x294/0x2df [ipv6] [<c05c3789>] netif_receive_skb+0x2d2/0x335 [<c05c5733>] process_backlog+0x7f/0xd0 [<c05c58f6>] net_rx_action+0x96/0x17e [<c042e722>] __do_softirq+0x64/0xcd [<c0406f37>] do_softirq+0x5c/0xac ======================= Code: 00 00 29 ca 89 d0 2b 45 e0 89 55 ec 85 c0 7e 35 39 45 08 8b 55 e4 0f 4e 45 08 8b 75 e0 8b 7d dc 89 c1 c1 e9 02 03 b2 a0 00 00 00 <f3> a5 89 c1 83 e1 03 74 02 f3 a4 29 45 08 0f 84 7b 01 00 00 01 EIP: [<c05be62a>] skb_copy_bits+0x4f/0x1ef SS:ESP 0068:c0759adc Kernel panic - not syncing: Fatal exception in interrupt Arnaldo says: ==================== Thanks! I'm to blame for this one, problem was introduced in: b0e380b1d8 @@ -761,7 +762,7 @@ slow_path: /* * Copy a block of the IP datagram. */ - if (skb_copy_bits(skb, ptr, frag->h.raw, len)) + if (skb_copy_bits(skb, ptr, skb_transport_header(skb), len)) BUG(); left -= len; ==================== Signed-off-by: Wei Yongjun <yjwei@cn.fujitsu.com> Acked-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> Signed-off-by: Arnaldo Carvalho de Melo <acme@ghostprotocols.net> Signed-off-by: David S. Miller <davem@davemloft.net>		2007-08-21 20:59:08 -07:00
..
9p	fs: 9p/conv.c error path fix	2007-07-31 15:39:42 -07:00
802	[SNAP]: Check packet length before reading	2007-08-21 20:58:13 -07:00
8021q	[VLAN] net/8021q/vlanproc.c: fix check-after-use	2007-08-14 17:39:43 -07:00
appletalk	[NET]: Make all initialized struct seq_operations const.	2007-07-10 23:07:31 -07:00
atm	[ATM]: Clean up duplicate includes in net/atm/	2007-08-13 22:52:01 -07:00
ax25	[AX25]: don't free pointers to statically allocated data	2007-08-14 17:24:05 -07:00
bluetooth	[BLUETOOTH] l2cap: don't mangle cmd.len	2007-07-31 02:28:09 -07:00
bridge	missing return in bridge sysfs code	2007-08-19 10:32:31 -07:00
core	[NET]: Unexport dev_ethtool	2007-08-14 17:38:44 -07:00
dccp	[DCCP]: Allocation in atomic context	2007-08-21 20:58:06 -07:00
decnet	[DECNET]: kmalloc + memset conversion to kzalloc	2007-07-31 14:05:56 -07:00
econet	[ECONET]: remove econet_packet_type on unload	2007-08-14 17:25:20 -07:00
ethernet	[ETH]: Validate address in eth_mac_addr	2007-07-11 19:41:18 -07:00
ieee80211	[PATCH] softmac: Fix deadlock of wx_set_essid with assoc work	2007-08-06 15:06:03 -04:00
ipv4	[NETFILTER]: nf_nat_sip: don't drop short packets	2007-08-14 13:14:58 -07:00
ipv6	[IPV6]: Fix kernel panic while send SCTP data with IP fragments	2007-08-21 20:59:08 -07:00
ipx	[NET]: Make all initialized struct seq_operations const.	2007-07-10 23:07:31 -07:00
irda	[IrDA] Typo fix in irnetlink.c copyright	2007-07-21 19:06:53 -07:00
iucv	[S390] Convert to smp_call_function_single.	2007-07-27 12:29:17 +02:00
key	[PF_KEY]: Fix ipsec not working in 2.6.23-rc1-git10	2007-08-02 19:42:29 -07:00
lapb	[PATCH] remove many unneeded #includes of sched.h	2007-02-14 08:09:54 -08:00
llc	[NET]: Make all initialized struct seq_operations const.	2007-07-10 23:07:31 -07:00
mac80211	[PATCH] mac80211: probe for hidden SSIDs in pre-auth scan	2007-08-14 16:48:23 -04:00
netfilter	[NETFILTER]: nf_conntrack_sip: fix SIP-URI parsing	2007-08-14 13:14:35 -07:00
netlabel	[NetLabel]: add missing rcu_dereference() calls in the LSM domain mapping hash table	2007-08-07 17:53:10 -07:00
netlink	[GENETLINK]: Correctly report errors while registering a multicast group	2007-07-24 15:34:53 -07:00
netrom	[NET] NETROM: Fix whitespace errors.	2007-07-19 10:44:32 +09:00
packet	[NET] PACKET: Fix whitespace errors.	2007-07-19 10:44:35 +09:00
rfkill	[NET] RFKILL: Fix whitespace errors.	2007-07-19 10:44:38 +09:00
rose	[NET] ROSE: Fix whitespace errors.	2007-07-19 10:44:40 +09:00
rxrpc	net/* misc endianness annotations	2007-07-26 11:11:56 -07:00
sched	[PKT_SCHED]: Clean up duplicate includes in net/sched/	2007-08-13 22:52:04 -07:00
sctp	SCTP: remove useless code in function sctp_init_cause	2007-08-02 10:56:07 -04:00
sunrpc	[SUNRPC]: Clean up duplicate includes in net/sunrpc/	2007-08-13 22:52:05 -07:00
tipc	[TIPC]: Clean up duplicate includes in net/tipc/	2007-08-13 22:52:07 -07:00
unix	[AF_UNIX]: Make code static.	2007-07-31 02:28:27 -07:00
wanrouter	[NET]: Removal of duplicated include net/wanrouter/wanmain.c	2007-08-02 19:42:22 -07:00
wireless	[PATCH] cfg80211: Radiotap parser	2007-07-12 16:07:24 -04:00
x25	[NET]: Make all initialized struct seq_operations const.	2007-07-10 23:07:31 -07:00
xfrm	[XFRM]: Clean up duplicate includes in net/xfrm/	2007-08-13 22:52:08 -07:00
compat.c	O_CLOEXEC for SCM_RIGHTS	2007-07-16 09:05:45 -07:00
Kconfig	9p: Reorganization of 9p file system code	2007-07-14 15:13:40 -05:00
Makefile	9p: Reorganization of 9p file system code	2007-07-14 15:13:40 -05:00
nonet.c	[PATCH] Make most file operations structs in fs/ const	2006-03-28 09:16:06 -08:00
socket.c	[NET]: Fix unbalanced rcu_read_unlock in __sock_create	2007-08-15 14:46:02 -07:00
sysctl_net.c	Remove obsolete #include <linux/config.h>	2006-06-30 19:25:36 +02:00
TUNABLE	Linux-2.6.12-rc2	2005-04-16 15:20:36 -07:00