kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-22 19:14:51 +00:00
Code Issues Releases Packages Activity
linux/net/core
History
Alexey Kodanev a1d55b36de net: sysctl_net_core: check SNDBUF and RCVBUF for min length 
[ Upstream commit b1cb59cf2e ]

sysctl has sysctl.net.core.rmem_*/wmem_* parameters which can be
set to incorrect values. Given that 'struct sk_buff' allocates from
rcvbuf, incorrectly set buffer length could result to memory
allocation failures. For example, set them as follows:

    # sysctl net.core.rmem_default=64
      net.core.wmem_default = 64
    # sysctl net.core.wmem_default=64
      net.core.wmem_default = 64
    # ping localhost -s 1024 -i 0 > /dev/null

This could result to the following failure:

skbuff: skb_over_panic: text:ffffffff81628db4 len:-32 put:-32
head:ffff88003a1cc200 data:ffff88003a1cc200 tail:0xffffffe0 end:0xc0 dev:<NULL>
kernel BUG at net/core/skbuff.c:102!
invalid opcode: 0000 [#1] SMP
...
task: ffff88003b7f5550 ti: ffff88003ae88000 task.ti: ffff88003ae88000
RIP: 0010:[<ffffffff8155fbd1>]  [<ffffffff8155fbd1>] skb_put+0xa1/0xb0
RSP: 0018:ffff88003ae8bc68  EFLAGS: 00010296
RAX: 000000000000008d RBX: 00000000ffffffe0 RCX: 0000000000000000
RDX: ffff88003fdcf598 RSI: ffff88003fdcd9c8 RDI: ffff88003fdcd9c8
RBP: ffff88003ae8bc88 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 00000000000002b2 R12: 0000000000000000
R13: 0000000000000000 R14: ffff88003d3f7300 R15: ffff88000012a900
FS:  00007fa0e2b4a840(0000) GS:ffff88003fc00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000d0f7e0 CR3: 000000003b8fb000 CR4: 00000000000006f0
Stack:
 ffff88003a1cc200 00000000ffffffe0 00000000000000c0 ffffffff818cab1d
 ffff88003ae8bd68 ffffffff81628db4 ffff88003ae8bd48 ffff88003b7f5550
 ffff880031a09408 ffff88003b7f5550 ffff88000012aa48 ffff88000012ab00
Call Trace:
 [<ffffffff81628db4>] unix_stream_sendmsg+0x2c4/0x470
 [<ffffffff81556f56>] sock_write_iter+0x146/0x160
 [<ffffffff811d9612>] new_sync_write+0x92/0xd0
 [<ffffffff811d9cd6>] vfs_write+0xd6/0x180
 [<ffffffff811da499>] SyS_write+0x59/0xd0
 [<ffffffff81651532>] system_call_fastpath+0x12/0x17
Code: 00 00 48 89 44 24 10 8b 87 c8 00 00 00 48 89 44 24 08 48 8b 87 d8 00
      00 00 48 c7 c7 30 db 91 81 48 89 04 24 31 c0 e8 4f a8 0e 00 <0f> 0b
      eb fe 66 66 2e 0f 1f 84 00 00 00 00 00 55 48 89 e5 48 83
RIP  [<ffffffff8155fbd1>] skb_put+0xa1/0xb0
RSP <ffff88003ae8bc68>
Kernel panic - not syncing: Fatal exception

Moreover, the possible minimum is 1, so we can get another kernel panic:
...
BUG: unable to handle kernel paging request at ffff88013caee5c0
IP: [<ffffffff815604cf>] __alloc_skb+0x12f/0x1f0
...

Signed-off-by: Alexey Kodanev <alexey.kodanev@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2015-03-26 15:06:50 +01:00
..
datagram.c net, datagram: fix the incorrect comment in zerocopy_sg_from_iovec() 2013-10-29 00:19:04 -04:00
dev.c net: reject creation of netdev names with colons 2015-03-18 13:31:22 +01:00
dev_addr_lists.c net: Correctly sync addresses from multiple sources to single device 2014-01-23 13:06:34 -08:00
dev_ioctl.c net_tstamp: Add SIOCGHWTSTAMP ioctl to match SIOCSHWTSTAMP 2013-11-19 19:07:21 +00:00
drop_monitor.c net: drop_monitor: fix the value of maxattr 2013-12-09 21:10:38 -05:00
dst.c ipv4: fix dst race in sk_dst_get() 2014-07-28 08:05:59 -07:00
ethtool.c net: Add layer 2 hardware acceleration operations for macvlan devices 2013-11-07 19:11:41 -05:00
fib_rules.c net: fix 'ip rule' iif/oif device rename 2014-02-09 19:02:52 -08:00
filter.c filter: prevent nla extensions to peek beyond the end of the message 2014-05-31 13:20:33 -07:00
flow.c net: delete __cpuinit usage from all net files 2013-07-14 19:36:58 -04:00
flow_dissector.c netdevice: move netdev_cap_txqueue for shared usage to header 2014-02-17 00:36:34 -05:00
gen_estimator.c net_sched: add 64bit rate estimators 2013-06-11 02:51:03 -07:00
gen_stats.c gen_stats.c: Duplicate xstats buffer for later use 2015-03-18 13:31:21 +01:00
iovec.c iovec: make sure the caller actually wants anything in memcpy_fromiovecend 2014-08-14 09:38:24 +08:00
link_watch.c net: make all team port device link events urgent 2013-06-13 02:31:41 -07:00
Makefile net: netprio: rename config to be more consistent with cgroup configs 2014-01-03 23:41:42 +01:00
neighbour.c neigh: set nud_state to NUD_INCOMPLETE when probing router reachability 2014-05-31 13:20:37 -07:00
net-procfs.c rps: selective flow shedding during softnet overflow 2013-05-20 13:48:04 -07:00
net-sysfs.c net: fix "queues" uevent between network namespaces 2014-01-19 20:02:02 -08:00
net-sysfs.h net: netdev_kobject_init: annotate with __init 2014-01-05 20:27:54 -05:00
net-traces.c net: Add export.h for EXPORT_SYMBOL/THIS_MODULE to non-modules 2011-10-31 19:30:30 -04:00
net_namespace.c rtnetlink: wait for unregistering devices in rtnl_link_unregister() 2014-05-31 13:20:38 -07:00
netclassid_cgroup.c net: net_cls: move cgroupfs classid handling into core 2014-01-03 23:41:41 +01:00
netevent.c net: Add export.h for EXPORT_SYMBOL/THIS_MODULE to non-modules 2011-10-31 19:30:30 -04:00
netpoll.c net: Always untag vlan-tagged traffic on input. 2014-10-15 08:36:40 +02:00
netprio_cgroup.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next 2014-01-25 11:17:34 -08:00
pktgen.c pktgen: fix UDP checksum computation 2015-03-18 13:31:21 +01:00
request_sock.c tcp: fix a panic on UP machines in reqsk_fastopen_remove 2013-01-14 18:10:05 -05:00
rtnetlink.c rtnetlink: call ->dellink on failure when ->newlink exists 2015-03-18 13:31:21 +01:00
scm.c Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace 2013-09-07 14:35:32 -07:00
secure_seq.c inetpeer: get rid of ip_id_count 2014-08-14 09:38:23 +08:00
skbuff.c net: Reset secmark when scrubbing packet 2015-01-27 08:18:53 -08:00
sock.c net: Add variants of capable for use on on sockets 2014-06-26 15:15:38 -04:00
sock_diag.c net: Move the permission check in sock_diag_put_filterinfo to packet_diag_dump 2014-06-26 15:15:38 -04:00
stream.c net: replace macros net_random and net_srandom with direct calls to prandom 2014-01-14 15:15:25 -08:00
sysctl_net_core.c net: sysctl_net_core: check SNDBUF and RCVBUF for min length 2015-03-26 15:06:50 +01:00
timestamping.c net: Add export.h for EXPORT_SYMBOL/THIS_MODULE to non-modules 2011-10-31 19:30:30 -04:00
user_dma.c net: Add export.h for EXPORT_SYMBOL/THIS_MODULE to non-modules 2011-10-31 19:30:30 -04:00
utils.c net: avoid dependency of net_get_random_once on nop patching 2014-05-31 13:20:38 -07:00