netdev - Re: ppp/l2tp doing oversized allocations ?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20120519.004652.2261671316587735315.davem@davemloft.net>
Date:	Sat, 19 May 2012 00:46:52 -0400 (EDT)
From:	David Miller <davem@...emloft.net>
To:	davej@...hat.com
Cc:	netdev@...r.kernel.org, kernel-team@...oraproject.org,
	edumazet@...gle.com
Subject: Re: ppp/l2tp doing oversized allocations ?

From: Dave Jones <davej@...hat.com>
Date: Mon, 14 May 2012 12:29:23 -0400

> We just got this trace from reported by a Fedora user running 3.3.4
> 
> :WARNING: at mm/page_alloc.c:2204 __alloc_pages_nodemask+0x231/0x8f0()
> :Call Trace:
> : [<ffffffff81057abf>] warn_slowpath_common+0x7f/0xc0
> : [<ffffffff81057b1a>] warn_slowpath_null+0x1a/0x20
> : [<ffffffff81129671>] __alloc_pages_nodemask+0x231/0x8f0
> : [<ffffffff814e84db>] ? dev_queue_xmit+0x1db/0x640
> : [<ffffffff8151f210>] ? ip_forward_options+0x1f0/0x1f0
> : [<ffffffff814ef7a1>] ? neigh_direct_output+0x11/0x20
> : [<ffffffff81520dee>] ? ip_finish_output+0x17e/0x2f0
> : [<ffffffff8151f210>] ? ip_forward_options+0x1f0/0x1f0
> : [<ffffffff811608d3>] alloc_pages_current+0xa3/0x110
> : [<ffffffff811254b4>] __get_free_pages+0x14/0x50
> : [<ffffffff8116b99f>] kmalloc_order_trace+0x3f/0xd0
> : [<ffffffff8156d137>] ? xfrm4_output_finish+0x27/0x40
> : [<ffffffff8116c8c7>] __kmalloc+0x177/0x1a0
> : [<ffffffff81521196>] ? ip_queue_xmit+0x156/0x400
> : [<ffffffff814dab07>] pskb_expand_head+0x87/0x310
> : [<ffffffff8113dbf9>] ? __mod_zone_page_state+0x49/0x50
> : [<ffffffffa05e84dd>] pppol2tp_xmit+0x1ed/0x220 [l2tp_ppp]

So it's ESP encapsulated IPSEC over L2tp.

Eric, I wonder if session->hdr_len can take on undesirable values and
thus trip up the skb COW'ing calculations you added?

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html