This is a note to let you know that I've just added the patch titled
ip_tunnel: fix kernel panic with icmp_dest_unreach
to the 3.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
ip_tunnel-fix-kernel-panic-with-icmp_dest_unreach.patch
and it can be found in the queue-3.9 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <[email protected]> know about it.
>From c45feaee5a78ec4e95b52081a3ea1f840a8ce3e8 Mon Sep 17 00:00:00 2001
From: Eric Dumazet <[email protected]>
Date: Fri, 24 May 2013 05:49:58 +0000
Subject: ip_tunnel: fix kernel panic with icmp_dest_unreach
From: Eric Dumazet <[email protected]>
[ Upstream commit a622260254ee481747cceaaa8609985b29a31565 ]
Daniel Petre reported crashes in icmp_dst_unreach() with following call
graph:
Daniel found a similar problem mentioned in
http://lkml.indiana.edu/hypermail/linux/kernel/1007.0/00961.html
And indeed this is the root cause : skb->cb[] contains data fooling IP
stack.
We must clear IPCB in ip_tunnel_xmit() sooner in case dst_link_failure()
is called. Or else skb->cb[] might contain garbage from GSO segmentation
layer.
A similar fix was tested on linux-3.9, but gre code was refactored in
linux-3.10. I'll send patches for stable kernels as well.
Many thanks to Daniel for providing reports, patches and testing !
Reported-by: Daniel Petre <[email protected]>
Signed-off-by: Eric Dumazet <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
net/ipv4/ip_gre.c | 2 +-
net/ipv4/ipip.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -804,6 +804,7 @@ static netdev_tx_t ipgre_tunnel_xmit(str
tiph = &tunnel->parms.iph;
}
+ memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
if ((dst = tiph->daddr) == 0) {
/* NBMA tunnel */
@@ -952,7 +953,6 @@ static netdev_tx_t ipgre_tunnel_xmit(str
skb_push(skb, gre_hlen);
skb_reset_network_header(skb);
skb_set_transport_header(skb, sizeof(*iph));
- memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
IPCB(skb)->flags &= ~(IPSKB_XFRM_TUNNEL_SIZE | IPSKB_XFRM_TRANSFORMED |
IPSKB_REROUTED);
skb_dst_drop(skb);
--- a/net/ipv4/ipip.c
+++ b/net/ipv4/ipip.c
@@ -491,6 +491,7 @@ static netdev_tx_t ipip_tunnel_xmit(stru
if (tos & 1)
tos = old_iph->tos;
+ memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
if (!dst) {
/* NBMA tunnel */
if ((rt = skb_rtable(skb)) == NULL) {
@@ -573,7 +574,6 @@ static netdev_tx_t ipip_tunnel_xmit(stru
skb->transport_header = skb->network_header;
skb_push(skb, sizeof(struct iphdr));
skb_reset_network_header(skb);
- memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
IPCB(skb)->flags &= ~(IPSKB_XFRM_TUNNEL_SIZE | IPSKB_XFRM_TRANSFORMED |
IPSKB_REROUTED);
skb_dst_drop(skb);
Patches currently in stable-queue which might be from [email protected] are
queue-3.9/packet-set-transport-header-before-doing-xmit.patch
queue-3.9/ipv6-fix-possible-crashes-in-ip6_cork_release.patch
queue-3.9/netback-set-transport-header-before-passing-it-to-kernel.patch
queue-3.9/tcp-xps-fix-reordering-issues.patch
queue-3.9/net_sched-restore-overhead-xxx-handling.patch
queue-3.9/net_sched-better-precise-estimation-on-packet-length-for-untrusted-packets.patch
queue-3.9/ip_tunnel-fix-kernel-panic-with-icmp_dest_unreach.patch
queue-3.9/tcp-fix-tcp_md5_hash_skb_data.patch
queue-3.9/net_sched-htb-do-not-mix-1ns-and-64ns-time-units.patch
queue-3.9/tuntap-set-transport-header-before-passing-it-to-kernel.patch
queue-3.9/tuntap-correct-the-return-value-in-tun_set_iff.patch
queue-3.9/net-force-a-reload-of-first-item-in-hlist_nulls_for_each_entry_rcu.patch
queue-3.9/macvtap-set-transport-header-before-passing-skb-to-lower-device.patch
queue-3.9/net-802-mrp-fix-lockdep-splat.patch
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
