netdev - Re: [PATCH] net: deal wrong skb and failure ret from __tcp_retransmit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 19 Apr 2018 06:40:06 -0700
From:   Eric Dumazet <eric.dumazet@...il.com>
To:     "Liu, Changcheng" <changcheng.liu@...el.com>, davem@...emloft.net,
        kuznet@....inr.ac.ru, yoshfuji@...ux-ipv6.org
Cc:     netdev@...r.kernel.org, akpm@...ux-foundation.org
Subject: Re: [PATCH] net: deal wrong skb and failure ret from
 __tcp_retransmit_skb



On 04/19/2018 04:26 AM, Liu, Changcheng wrote:
> Hit below panic due to skb is NULL, WARN wrong skb first.
> if __tcp_retransmit_skb return failure e.g. -EAGAIN, it
> needn't do further action in tcp_retransmit_skb.
> 
> gdb vmlinux
> Reading symbols from vmlinux...done.
> (gdb) p &((struct tcp_skb_cb *) \
> &(((struct sk_buff *)0)->cb[0]))->tcp_gso_segs
> $1 = (u16 *) 0x30 <irq_stack_union+48>
> 
> [ 9040.917533] BUG: unable to handle kernel NULL pointer dereference at 0000000000000030
> [ 9040.926279] IP: tcp_retransmit_skb+0x5c/0xc0
> [ 9040.931043] PGD 0 P4D 0
> [ 9040.933865] Oops: 0000 [#1] PREEMPT SMP PTI
> [ 9040.972151] RIP: 0010:tcp_retransmit_skb+0x5c/0xc0
> [ 9040.977496] RSP: 0018:ffff8802bec83e40 EFLAGS: 00010202
> [ 9041.062527] Call Trace:
> [ 9041.065250]  <IRQ>
> [ 9041.067489]  tcp_retransmit_timer+0x481/0x820
> [ 9041.077697]  tcp_write_timer_handler+0xe9/0x230
> [ 9041.082751]  tcp_write_timer+0x75/0x80
> [ 9041.086932]  call_timer_fn+0x29/0x150
> [ 9041.091018]  run_timer_softirq+0x411/0x460
> [ 9041.105017]  __do_softirq+0x115/0x311
> [ 9041.109103]  irq_exit+0xb0/0xc0
> [ 9041.112605]  smp_apic_timer_interrupt+0x67/0x140
> 
> Signed-off-by: Liu Changcheng <changcheng.liu@...el.com>
> 

On which kernel have you seen this problem ?

In networking, we want patches with a 'Fixes:' tag to clearly identify which patch
added a regression.


Anyway your patch comes too late I guess

https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=bffd168c3fc5cc7d2bad4c668fa90e7a9010db4b