superrob1500
/
mirror-linux
mirror of https://github.com/torvalds/linux
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
mirror-linux/net/ipv6
History
Jibin Zhang f920436a44 net: use sock_gen_put() when sk_state is TCP_TIME_WAIT 
It is possible for a pointer of type struct inet_timewait_sock to be
returned from the functions __inet_lookup_established() and
__inet6_lookup_established(). This can cause a crash when the
returned pointer is of type struct inet_timewait_sock and
sock_put() is called on it. The following is a crash call stack that
shows sk->sk_wmem_alloc being accessed in sk_free() during the call to
sock_put() on a struct inet_timewait_sock pointer. To avoid this issue,
use sock_gen_put() instead of sock_put() when sk->sk_state
is TCP_TIME_WAIT.

mrdump.ko        ipanic() + 120
vmlinux          notifier_call_chain(nr_to_call=-1, nr_calls=0) + 132
vmlinux          atomic_notifier_call_chain(val=0) + 56
vmlinux          panic() + 344
vmlinux          add_taint() + 164
vmlinux          end_report() + 136
vmlinux          kasan_report(size=0) + 236
vmlinux          report_tag_fault() + 16
vmlinux          do_tag_recovery() + 16
vmlinux          __do_kernel_fault() + 88
vmlinux          do_bad_area() + 28
vmlinux          do_tag_check_fault() + 60
vmlinux          do_mem_abort() + 80
vmlinux          el1_abort() + 56
vmlinux          el1h_64_sync_handler() + 124
vmlinux        > 0xFFFFFFC080011294()
vmlinux          __lse_atomic_fetch_add_release(v=0xF2FFFF82A896087C)
vmlinux          __lse_atomic_fetch_sub_release(v=0xF2FFFF82A896087C)
vmlinux          arch_atomic_fetch_sub_release(i=1, v=0xF2FFFF82A896087C)
+ 8
vmlinux          raw_atomic_fetch_sub_release(i=1, v=0xF2FFFF82A896087C)
+ 8
vmlinux          atomic_fetch_sub_release(i=1, v=0xF2FFFF82A896087C) + 8
vmlinux          __refcount_sub_and_test(i=1, r=0xF2FFFF82A896087C,
oldp=0) + 8
vmlinux          __refcount_dec_and_test(r=0xF2FFFF82A896087C, oldp=0) + 8
vmlinux          refcount_dec_and_test(r=0xF2FFFF82A896087C) + 8
vmlinux          sk_free(sk=0xF2FFFF82A8960700) + 28
vmlinux          sock_put() + 48
vmlinux          tcp6_check_fraglist_gro() + 236
vmlinux          tcp6_gro_receive() + 624
vmlinux          ipv6_gro_receive() + 912
vmlinux          dev_gro_receive() + 1116
vmlinux          napi_gro_receive() + 196
ccmni.ko         ccmni_rx_callback() + 208
ccmni.ko         ccmni_queue_recv_skb() + 388
ccci_dpmaif.ko   dpmaif_rxq_push_thread() + 1088
vmlinux          kthread() + 268
vmlinux          0xFFFFFFC08001F30C()

Fixes: c9d1d23e52 ("net: add heuristic for enabling TCP fraglist GRO")
Signed-off-by: Jibin Zhang <jibin.zhang@mediatek.com>
Signed-off-by: Shiming Cheng <shiming.cheng@mediatek.com>
Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
Link: https://patch.msgid.link/20250429020412.14163-1-shiming.cheng@mediatek.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 		2025-05-01 07:00:19 -07:00
..
ila net: ipv6: fix missing dst ref drop in ila lwtunnel 2025-03-06 11:08:45 +01:00
netfilter netfilter pull request 25-03-23 2025-03-25 08:29:13 -07:00
Kconfig net: ipv6: select DST_CACHE from IPV6_RPL_LWTUNNEL 2024-09-22 19:52:07 +01:00
Makefile
…
addrconf.c Including fixes from netfilter. 2025-04-10 08:52:18 -07:00
addrconf_core.c ipv6: Ensure natural alignment of const ipv6 loopback and router addresses 2024-01-30 12:43:18 +01:00
addrlabel.c ipv6: Use rtnl_register_many(). 2024-10-15 18:52:26 -07:00
af_inet6.c net: inet6: do not leave a dangling sk pointer in inet6_create() 2024-10-15 18:43:08 -07:00
ah6.c net: fill in MODULE_DESCRIPTION()s for ipv6 modules 2024-02-09 14:12:01 -08:00
anycast.c netlink: add IPv6 anycast join/leave notifications 2025-01-09 12:54:45 +01:00
calipso.c netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets 2025-04-02 16:01:04 -07:00
datagram.c
…
esp6.c ipsec-2025-01-27 2025-01-27 15:15:12 -08:00
esp6_offload.c xfrm: Add an inbound percpu state cache. 2024-10-29 11:56:18 +01:00
exthdrs.c net: use sock_kmemdup for ip_options 2025-03-03 17:16:34 -08:00
exthdrs_core.c
…
exthdrs_offload.c
…
fib6_notifier.c net: do not acquire rtnl in fib_seq_sum() 2024-10-11 15:35:05 -07:00
fib6_rules.c ipv6: fib_rules: Add DSCP mask matching 2025-02-21 16:08:48 -08:00
fou6.c
…
icmp.c inet: ping: avoid skb_clone() dance in ping_rcv() 2025-02-28 14:41:33 -08:00
inet6_connection_sock.c tcp/dccp: Remove inet_connection_sock_af_ops.addr2sockaddr(). 2025-03-24 12:10:13 -07:00
inet6_hashtables.c inet: call inet6_ehashfn() once from inet6_hash_connect() 2025-03-06 15:26:02 -08:00
ioam6.c net: convert to nla_get_*_default() 2024-11-11 10:32:06 -08:00
ioam6_iptunnel.c net: ipv6: ioam6: fix lwtunnel_output() loop 2025-03-20 11:25:52 +01:00
ip6_checksum.c
…
ip6_fib.c treewide: Switch/rename to timer_delete[_sync]() 2025-04-05 10:30:12 +02:00
ip6_flowlabel.c treewide: Switch/rename to timer_delete[_sync]() 2025-04-05 10:30:12 +02:00
ip6_gre.c net: move misc netdev_lock flavors to a separate header 2025-03-08 09:06:50 -08:00
ip6_icmp.c
…
ip6_input.c ipv6: Use RCU in ip6_input() 2025-02-06 16:14:15 -08:00
ip6_offload.c net: gro: initialize network_offset in network layer 2024-05-27 16:46:59 -07:00
ip6_offload.h
…
ip6_output.c ipv6: save dontfrag in cork 2025-03-10 13:13:04 -07:00
ip6_tunnel.c net: move misc netdev_lock flavors to a separate header 2025-03-08 09:06:50 -08:00
ip6_udp_tunnel.c net: fill in MODULE_DESCRIPTION()s for ipv6 modules 2024-02-09 14:12:01 -08:00
ip6_vti.c net: move misc netdev_lock flavors to a separate header 2025-03-08 09:06:50 -08:00
ip6mr.c treewide: Switch/rename to timer_delete[_sync]() 2025-04-05 10:30:12 +02:00
ipcomp6.c
…
ipv6_sockglue.c ipv6: avoid indirect calls for SOL_IP socket options 2024-08-26 14:53:50 -07:00
mcast.c ipv6: mcast: add RCU protection to mld_newpack() 2025-02-13 08:37:21 -08:00
mcast_snoop.c
…
mip6.c net: fill in MODULE_DESCRIPTION()s for ipv6 modules 2024-02-09 14:12:01 -08:00
ndisc.c ndisc: ndisc_send_redirect() cleanup 2025-02-15 09:08:46 -08:00
netfilter.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2024-06-13 13:13:46 -07:00
output_core.c ipv6: annotate data-races around cnf.hop_limit 2024-03-01 08:42:31 +00:00
ping.c ipv6: initialize inet socket cookies with sockcm_init 2025-02-18 18:27:20 -08:00
proc.c minmax: add a few more MIN_T/MAX_T users 2024-07-28 13:41:14 -07:00
protocol.c
…
raw.c ipv6: initialize inet socket cookies with sockcm_init 2025-02-18 18:27:20 -08:00
reassembly.c inet: frags: save a pair of atomic operations in reassembly 2025-03-18 13:18:36 +01:00
route.c ipv6: add exception routes to GC list in rt6_insert_exception 2025-04-10 20:09:05 -07:00
rpl.c
…
rpl_iptunnel.c net: ipv6: fix dst ref loop on input in rpl lwt 2025-02-27 14:18:22 +01:00
seg6.c ipv6: sr: restruct ifdefines 2024-05-30 18:29:38 -07:00
seg6_hmac.c ipv6: sr: fix memleak in seg6_hmac_init_algo 2024-05-21 13:16:25 +02:00
seg6_iptunnel.c net: ipv6: fix dst ref loop on input in seg6 lwt 2025-02-27 14:18:21 +01:00
seg6_local.c net: ip: make ip_route_input() return drop reasons 2024-11-12 11:24:51 +01:00
sit.c net: move misc netdev_lock flavors to a separate header 2025-03-08 09:06:50 -08:00
syncookies.c tcp: use sk_skb_reason_drop to free rx packets 2024-06-19 12:44:22 +01:00
sysctl_net_ipv6.c sysctl: treewide: constify the ctl_table argument of proc_handlers 2024-07-24 20:59:29 +02:00
tcp_ao.c
…
tcp_ipv6.c tcp/dccp: remove icsk->icsk_timeout 2025-03-25 10:34:33 -07:00
tcpv6_offload.c net: use sock_gen_put() when sk_state is TCP_TIME_WAIT 2025-05-01 07:00:19 -07:00
tunnel6.c net: fill in MODULE_DESCRIPTION()s for ipv6 modules 2024-02-09 14:12:01 -08:00
udp.c Revert "udp_tunnel: GRO optimizations" 2025-03-25 09:15:07 -07:00
udp_impl.h
…
udp_offload.c Revert "udp_tunnel: GRO optimizations" 2025-03-25 09:15:07 -07:00
udplite.c
…
xfrm6_input.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2024-05-09 10:01:01 -07:00
xfrm6_output.c xfrm: Fix the usage of skb->sk 2025-01-20 07:06:53 +01:00
xfrm6_policy.c xfrm: respect ip protocols rules criteria when performing dst lookups 2024-09-23 07:02:07 +02:00
xfrm6_protocol.c
…
xfrm6_state.c
…
xfrm6_tunnel.c ipsec-next-2024-03-06 2024-03-08 10:56:05 +00:00