lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Fri, 02 Dec 2011 21:22:49 +0100 From: Eric Dumazet <eric.dumazet@...il.com> To: David Miller <davem@...emloft.net> Cc: subramanian.vijay@...il.com, therbert@...gle.com, netdev@...r.kernel.org Subject: Re: Bug in computing data_len in tcp_sendmsg? Le vendredi 02 décembre 2011 à 13:40 -0500, David Miller a écrit : > Yes, for non-SG this always was technically possible. > Yes this can, I reproduced it very easily. I find this hard to believe... [ 2179.697991] ------------[ cut here ]------------ [ 2179.698000] WARNING: at net/ipv4/tcp_output.c:850 tcp_transmit_skb+0x846/0x8f0() [ 2179.698001] Hardware name: ProLiant BL460c G6 [ 2179.698011] Pid: 0, comm: swapper Tainted: G W 3.2.0-rc2+ #187 [ 2179.698012] Call Trace: [ 2179.698014] <IRQ> [<ffffffff8104715f>] warn_slowpath_common+0x7f/0xc0 [ 2179.698020] [<ffffffff810471ba>] warn_slowpath_null+0x1a/0x20 [ 2179.698022] [<ffffffff815d8386>] tcp_transmit_skb+0x846/0x8f0 [ 2179.698025] [<ffffffff815d9621>] tcp_retransmit_skb+0x1a1/0x5f0 [ 2179.698027] [<ffffffff815daf5d>] tcp_retransmit_timer+0x1bd/0x640 [ 2179.698030] [<ffffffff815db578>] tcp_write_timer+0x198/0x200 [ 2179.698034] [<ffffffff810579bf>] run_timer_softirq+0x12f/0x3e0 [ 2179.698039] [<ffffffff81295924>] ? timerqueue_add+0x74/0xc0 [ 2179.698041] [<ffffffff815db3e0>] ? tcp_retransmit_timer+0x640/0x640 [ 2179.698045] [<ffffffff810753b5>] ? ktime_get+0x65/0xe0 [ 2179.698047] [<ffffffff8104e929>] __do_softirq+0xa9/0x240 [ 2179.698050] [<ffffffff81075b76>] ? do_timer+0x2b6/0x480 [ 2179.698053] [<ffffffff8106fb90>] ? hrtimer_interrupt+0x130/0x220 [ 2179.698057] [<ffffffff816d526c>] call_softirq+0x1c/0x30 [ 2179.698061] [<ffffffff81004115>] do_softirq+0x55/0x90 [ 2179.698063] [<ffffffff8104edde>] irq_exit+0x9e/0xc0 [ 2179.698066] [<ffffffff816d5a3e>] smp_apic_timer_interrupt+0x6e/0x99 [ 2179.698068] [<ffffffff816d3d8b>] apic_timer_interrupt+0x6b/0x70 diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c index 58f69ac..92ce7c3 100644 --- a/net/ipv4/tcp_output.c +++ b/net/ipv4/tcp_output.c @@ -847,6 +847,7 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it, /* Build TCP header and checksum it. */ th = tcp_hdr(skb); + WARN_ON((((unsigned long)th) & 3) != 0); th->source = inet->inet_sport; th->dest = inet->inet_dport; th->seq = htonl(tcb->seq); -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists