Commit:     8984e41d18a545320201950b8721e7ce3ac2a5e7
Parent:     d92a7db710c32db826a00ba9bc7a22e741d5041e
Author:     Wei Yongjun <[EMAIL PROTECTED]>
AuthorDate: Tue Aug 21 20:59:08 2007 -0700
Committer:  David S. Miller <[EMAIL PROTECTED]>
CommitDate: Tue Aug 21 20:59:08 2007 -0700

    [IPV6]: Fix kernel panic while send SCTP data with IP fragments
    If ICMP6 message with "Packet Too Big" is received after send SCTP DATA,
    kernel panic will occur when SCTP DATA is send again.
    This is because of a bad dest address when call to skb_copy_bits().
    The messages sequence is like this:
    Endpoint A                             Endpoint B
                                   <-------  SCTP DATA (size=1432)
    ICMP6 message ------->
    (Packet Too Big pmtu=1280)
                                   <-------  Resend SCTP DATA (size=1432)
    ------------kernel panic---------------
     printing eip:
    *pde = 00000000
    Oops: 0002 [#1]
    Modules linked in: scomm l2cap bluetooth ipv6 dm_mirror dm_mod video output 
sbs battery lp floppy sg i2c_piix4 i2c_core pcnet32 mii button ac parport_pc 
parport ide_cd cdrom serio_raw mptspi mptscsih mptbase scsi_transport_spi 
sd_mod scsi_mod ext3 jbd ehci_hcd ohci_hcd uhci_hcd
    CPU:    0
    EIP:    0060:[<c05be62a>]    Not tainted VLI
    EFLAGS: 00010282   (2.6.23-rc2 #1)
    EIP is at skb_copy_bits+0x4f/0x1ef
    eax: 000004d0   ebx: ce12a980   ecx: 00000134   edx: cfd5a880
    esi: c8246858   edi: 00000000   ebp: c0759b14   esp: c0759adc
    ds: 007b   es: 007b   fs: 00d8  gs: 0000  ss: 0068
    Process swapper (pid: 0, ti=c0759000 task=c06d0340 task.ti=c0713000)
    Stack: c0759b88 c0405867 ce12a980 c8bff838 c789c084 00000000 00000028 
           d09f1890 000005dc 0000007b ce12a980 cfd5a880 c8bff838 c0759b88 
           000004d0 fffff96c 00000200 00000100 c0759b50 cfd5a880 00000246 
    Call Trace:
     [<c0405e1d>] show_trace_log_lvl+0x1a/0x2f
     [<c0405ecd>] show_stack_log_lvl+0x9b/0xa3
     [<c040608d>] show_registers+0x1b8/0x289
     [<c0406271>] die+0x113/0x246
     [<c0625dbc>] do_page_fault+0x4ad/0x57e
     [<c0624642>] error_code+0x72/0x78
     [<d09bc521>] ip6_output+0x8e5/0xab2 [ipv6]
     [<d09bcec1>] ip6_xmit+0x2ea/0x3a3 [ipv6]
     [<d0a3f2ca>] sctp_v6_xmit+0x248/0x253 [sctp]
     [<d0a3c934>] sctp_packet_transmit+0x53f/0x5ae [sctp]
     [<d0a34bf8>] sctp_outq_flush+0x555/0x587 [sctp]
     [<d0a34d3c>] sctp_retransmit+0xf8/0x10f [sctp]
     [<d0a3d183>] sctp_icmp_frag_needed+0x57/0x5b [sctp]
     [<d0a3ece2>] sctp_v6_err+0xcd/0x148 [sctp]
     [<d09cf1ce>] icmpv6_notify+0xe6/0x167 [ipv6]
     [<d09d009a>] icmpv6_rcv+0x7d7/0x849 [ipv6]
     [<d09be240>] ip6_input+0x1dc/0x310 [ipv6]
     [<d09be965>] ipv6_rcv+0x294/0x2df [ipv6]
     [<c05c3789>] netif_receive_skb+0x2d2/0x335
     [<c05c5733>] process_backlog+0x7f/0xd0
     [<c05c58f6>] net_rx_action+0x96/0x17e
     [<c042e722>] __do_softirq+0x64/0xcd
     [<c0406f37>] do_softirq+0x5c/0xac
    Code: 00 00 29 ca 89 d0 2b 45 e0 89 55 ec 85 c0 7e 35 39 45 08 8b 55 e4 0f 
4e 45 08 8b 75 e0 8b 7d dc 89 c1 c1 e9 02 03 b2 a0 00 00 00 <f3> a5 89 c1 83 e1 
03 74 02 f3 a4 29 45 08 0f 84 7b 01 00 00 01
    EIP: [<c05be62a>] skb_copy_bits+0x4f/0x1ef SS:ESP 0068:c0759adc
    Kernel panic - not syncing: Fatal exception in interrupt
    Arnaldo says:
    Thanks! I'm to blame for this one, problem was introduced in:
    @@ -761,7 +762,7 @@ slow_path:
                     *      Copy a block of the IP datagram.
    -               if (skb_copy_bits(skb, ptr, frag->h.raw, len))
    +               if (skb_copy_bits(skb, ptr, skb_transport_header(skb),
                    left -= len;
    Signed-off-by: Wei Yongjun <[EMAIL PROTECTED]>
    Acked-by: YOSHIFUJI Hideaki <[EMAIL PROTECTED]>
    Signed-off-by: Arnaldo Carvalho de Melo <[EMAIL PROTECTED]>
    Signed-off-by: David S. Miller <[EMAIL PROTECTED]>
 net/ipv6/ip6_output.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 50d86e9..5dead39 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -794,7 +794,7 @@ slow_path:
                 *      Copy a block of the IP datagram.
-               if (skb_copy_bits(skb, ptr, skb_transport_header(skb), len))
+               if (skb_copy_bits(skb, ptr, skb_transport_header(frag), len))
                left -= len;
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at

Reply via email to