kevin/linux
1
Fork 0
Code
9e4859ef54
linux/net/ipv4
History
Patrick McHardy 0a9c730144 [INET_DIAG]: Fix oops in netlink_rcv_skb 
netlink_run_queue() doesn't handle multiple processes processing the
queue concurrently. Serialize queue processing in inet_diag to fix
a oops in netlink_rcv_skb caused by netlink_run_queue passing a
NULL for the skb.

BUG: unable to handle kernel NULL pointer dereference at virtual address 00000054
[349587.500454]  printing eip:
[349587.500457] c03318ae
[349587.500459] *pde = 00000000
[349587.500464] Oops: 0000 [#1]
[349587.500466] PREEMPT SMP
[349587.500474] Modules linked in: w83627hf hwmon_vid i2c_isa
[349587.500483] CPU:    0
[349587.500485] EIP:    0060:[<c03318ae>]    Not tainted VLI
[349587.500487] EFLAGS: 00010246   (2.6.22.3 #1)
[349587.500499] EIP is at netlink_rcv_skb+0xa/0x7e
[349587.500506] eax: 00000000   ebx: 00000000   ecx: c148d2a0   edx: c0398819
[349587.500510] esi: 00000000   edi: c0398819   ebp: c7a21c8c   esp: c7a21c80
[349587.500517] ds: 007b   es: 007b   fs: 00d8  gs: 0033  ss: 0068
[349587.500521] Process oidentd (pid: 17943, ti=c7a20000 task=cee231c0 task.ti=c7a20000)
[349587.500527] Stack: 00000000 c7a21cac f7c8ba78 c7a21ca4 c0331962 c0398819 f7c8ba00 0000004c
[349587.500542]        f736f000 c7a21cb4 c03988e3 00000001 f7c8ba00 c7a21cc4 c03312a5 0000004c
[349587.500558]        f7c8ba00 c7a21cd4 c0330681 f7c8ba00 e4695280 c7a21d00 c03307c6 7fffffff
[349587.500578] Call Trace:
[349587.500581]  [<c010361a>] show_trace_log_lvl+0x1c/0x33
[349587.500591]  [<c01036d4>] show_stack_log_lvl+0x8d/0xaa
[349587.500595]  [<c010390e>] show_registers+0x1cb/0x321
[349587.500604]  [<c0103bff>] die+0x112/0x1e1
[349587.500607]  [<c01132d2>] do_page_fault+0x229/0x565
[349587.500618]  [<c03c8d3a>] error_code+0x72/0x78
[349587.500625]  [<c0331962>] netlink_run_queue+0x40/0x76
[349587.500632]  [<c03988e3>] inet_diag_rcv+0x1f/0x2c
[349587.500639]  [<c03312a5>] netlink_data_ready+0x57/0x59
[349587.500643]  [<c0330681>] netlink_sendskb+0x24/0x45
[349587.500651]  [<c03307c6>] netlink_unicast+0x100/0x116
[349587.500656]  [<c0330f83>] netlink_sendmsg+0x1c2/0x280
[349587.500664]  [<c02fcce9>] sock_sendmsg+0xba/0xd5
[349587.500671]  [<c02fe4d1>] sys_sendmsg+0x17b/0x1e8
[349587.500676]  [<c02fe92d>] sys_socketcall+0x230/0x24d
[349587.500684]  [<c01028d2>] syscall_call+0x7/0xb
[349587.500691]  =======================
[349587.500693] Code: f0 ff 4e 18 0f 94 c0 84 c0 0f 84 66 ff ff ff 89 f0 e8 86 e2 fc ff e9 5a ff ff ff f0 ff 40 10 eb be 55 89 e5 57 89 d7 56 89 c6 53 <8b> 50 54 83 fa 10 72 55 8b 9e 9c 00 00 00 31 c9 8b 03 83 f8 0f

Reported by Athanasius <link@miggy.org>

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
2007-09-11 11:33:28 +02:00
..
ipvs [NETFILTER]: Fix/improve deadlock condition on module removal netfilter 2007-09-11 11:28:26 +02:00
netfilter [NETFILTER]: Fix/improve deadlock condition on module removal netfilter 2007-09-11 11:28:26 +02:00
af_inet.c [TCP]: Invoke tcp_sendmsg() directly, do not use inet_sendmsg(). 2007-08-02 19:42:28 -07:00
ah4.c [IPSEC] AH4: Update IPv4 options handling to conform to RFC 4302. 2007-08-26 18:35:33 -07:00
arp.c [IPV4]: Cleanup call to __neigh_lookup() 2007-07-14 20:51:44 -07:00
cipso_ipv4.c
datagram.c
devinet.c [IPV4] devinet: show all addresses assigned to interface 2007-09-11 10:41:04 +02:00
esp4.c
fib_frontend.c [NET] IPV4: Fix whitespace errors. 2007-07-19 10:43:47 +09:00
fib_hash.c mm: Remove slab destructors from kmem_cache_create(). 2007-07-20 10:11:58 +09:00
fib_lookup.h
fib_rules.c
fib_semantics.c
fib_trie.c mm: Remove slab destructors from kmem_cache_create(). 2007-07-20 10:11:58 +09:00
icmp.c
igmp.c
inet_connection_sock.c
inet_diag.c [INET_DIAG]: Fix oops in netlink_rcv_skb 2007-09-11 11:33:28 +02:00
inet_hashtables.c
inet_timewait_sock.c [INET_SOCK]: make net/ipv4/inet_timewait_sock.c:__inet_twsk_kill() static 2007-07-14 19:00:59 -07:00
inetpeer.c [IPV4]: Fix inetpeer gcc-4.2 warnings 2007-07-20 19:39:17 -07:00
ip_forward.c [NET] IPV4: Fix whitespace errors. 2007-07-19 10:43:47 +09:00
ip_fragment.c
ip_gre.c [NET]: Avoid copying writable clones in tunnel drivers 2007-07-10 22:19:05 -07:00
ip_input.c
ip_options.c [IPV4] ip_options.c: kmalloc + memset conversion to kzalloc 2007-07-31 14:06:45 -07:00
ip_output.c [IPV4]: Clean up duplicate includes in net/ipv4/ 2007-08-13 22:52:02 -07:00
ip_sockglue.c [NET]: Fix IP_ADD/DROP_MEMBERSHIP to handle only connectionless 2007-08-26 18:35:35 -07:00
ipcomp.c
ipconfig.c [IPCONFIG]: ip_auto_config fix 2007-08-13 22:51:59 -07:00
ipip.c [NET]: Avoid copying writable clones in tunnel drivers 2007-07-10 22:19:05 -07:00
ipmr.c mm: Remove slab destructors from kmem_cache_create(). 2007-07-20 10:11:58 +09:00
Kconfig
Makefile
netfilter.c
proc.c
protocol.c
raw.c [IPV4] raw.c: kmalloc + memset conversion to kzalloc 2007-08-02 19:42:26 -07:00
route.c [IPV4] route.c: mostly kmalloc + memset conversion to k[cz]alloc 2007-08-02 19:42:27 -07:00
syncookies.c
sysctl_net_ipv4.c
tcp_bic.c [TCP]: congestion control API pass RTT in microseconds 2007-07-31 02:27:57 -07:00
tcp_cong.c [TCP]: remove unused argument to cong_avoid op 2007-07-18 01:46:58 -07:00
tcp_cubic.c [TCP]: cubic - eliminate use of receive time stamp 2007-07-31 02:27:58 -07:00
tcp_diag.c
tcp_highspeed.c [TCP]: remove unused argument to cong_avoid op 2007-07-18 01:46:58 -07:00
tcp_htcp.c [TCP]: H-TCP maxRTT estimation at startup 2007-08-07 18:29:05 -07:00
tcp_hybla.c [TCP]: remove unused argument to cong_avoid op 2007-07-18 01:46:58 -07:00
tcp_illinois.c [TCP]: congestion control API pass RTT in microseconds 2007-07-31 02:27:57 -07:00
tcp_input.c [TCP]: 'dst' can be NULL in tcp_rto_min() 2007-08-31 14:39:44 -07:00
tcp_ipv4.c [TCP]: Invoke tcp_sendmsg() directly, do not use inet_sendmsg(). 2007-08-02 19:42:28 -07:00
tcp_lp.c [TCP]: congestion control API pass RTT in microseconds 2007-07-31 02:27:57 -07:00
tcp_minisocks.c
tcp_output.c [NET] IPV4: Fix whitespace errors. 2007-07-19 10:43:47 +09:00
tcp_probe.c jprobes: remove JPROBE_ENTRY() 2007-07-19 10:04:44 -07:00
tcp_scalable.c [TCP]: remove unused argument to cong_avoid op 2007-07-18 01:46:58 -07:00
tcp_timer.c
tcp_vegas.c [TCP]: congestion control API pass RTT in microseconds 2007-07-31 02:27:57 -07:00
tcp_vegas.h [TCP]: congestion control API pass RTT in microseconds 2007-07-31 02:27:57 -07:00
tcp_veno.c [TCP]: congestion control API pass RTT in microseconds 2007-07-31 02:27:57 -07:00
tcp_westwood.c [TCP]: congestion control API pass RTT in microseconds 2007-07-31 02:27:57 -07:00
tcp_yeah.c [TCP]: congestion control API pass RTT in microseconds 2007-07-31 02:27:57 -07:00
tcp.c [TCP]: Invoke tcp_sendmsg() directly, do not use inet_sendmsg(). 2007-08-02 19:42:28 -07:00
tunnel4.c
udp_impl.h
udp.c [UDP]: Fix length check. 2007-07-10 23:06:43 -07:00
udplite.c
xfrm4_input.c [UDP]: Cleanup UDP encapsulation code 2007-07-10 22:16:53 -07:00
xfrm4_mode_beet.c
xfrm4_mode_transport.c
xfrm4_mode_tunnel.c
xfrm4_output.c
xfrm4_policy.c
xfrm4_state.c
xfrm4_tunnel.c