Yue Haibing
0438e60a00
ip6mr: Fix skb_under_panic in ip6mr_cache_report() ...
[ Upstream commit 30e0191b16e8a58e4620fa3e2839ddc7b9d4281c ]
skbuff: skb_under_panic: text:ffffffff88771f69 len:56 put:-4
head:ffff88805f86a800 data:ffff887f5f86a850 tail:0x88 end:0x2c0 dev:pim6reg
------------[ cut here ]------------
kernel BUG at net/core/skbuff.c:192!
invalid opcode: 0000 [#1 ] PREEMPT SMP KASAN
CPU: 2 PID: 22968 Comm: kworker/2:11 Not tainted 6.5.0-rc3-00044-g0a8db05b571a #236
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
Workqueue: ipv6_addrconf addrconf_dad_work
RIP: 0010:skb_panic+0x152/0x1d0
Call Trace:
<TASK>
skb_push+0xc4/0xe0
ip6mr_cache_report+0xd69/0x19b0
reg_vif_xmit+0x406/0x690
dev_hard_start_xmit+0x17e/0x6e0
__dev_queue_xmit+0x2d6a/0x3d20
vlan_dev_hard_start_xmit+0x3ab/0x5c0
dev_hard_start_xmit+0x17e/0x6e0
__dev_queue_xmit+0x2d6a/0x3d20
neigh_connected_output+0x3ed/0x570
ip6_finish_output2+0x5b5/0x1950
ip6_finish_output+0x693/0x11c0
ip6_output+0x24b/0x880
NF_HOOK.constprop.0+0xfd/0x530
ndisc_send_skb+0x9db/0x1400
ndisc_send_rs+0x12a/0x6c0
addrconf_dad_completed+0x3c9/0xea0
addrconf_dad_work+0x849/0x1420
process_one_work+0xa22/0x16e0
worker_thread+0x679/0x10c0
ret_from_fork+0x28/0x60
ret_from_fork_asm+0x11/0x20
When setup a vlan device on dev pim6reg, DAD ns packet may sent on reg_vif_xmit().
reg_vif_xmit()
ip6mr_cache_report()
skb_push(skb, -skb_network_offset(pkt));//skb_network_offset(pkt) is 4
And skb_push declared as:
void *skb_push(struct sk_buff *skb, unsigned int len);
skb->data -= len;
//0xffff88805f86a84c - 0xfffffffc = 0xffff887f5f86a850
skb->data is set to 0xffff887f5f86a850, which is invalid mem addr, lead to skb_push() fails.
Fixes: 14fb64e1f449 ("[IPV6] MROUTE: Support PIM-SM (SSM).")
Signed-off-by: Yue Haibing <yuehaibing@huawei.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-08-11 11:53:57 +02:00
2021-09-15 09:47:31 +02:00
2023-04-20 12:07:36 +02:00
2023-01-18 11:41:37 +01:00
2023-05-30 12:44:06 +01:00
2021-04-07 14:47:41 +02:00
2023-06-09 10:28:59 +02:00
2022-04-20 09:19:40 +02:00
2023-06-14 10:59:56 +02:00
2023-06-14 10:59:58 +02:00
2023-01-18 11:41:04 +01:00
2021-07-14 16:53:33 +02:00
2023-07-27 08:37:23 +02:00
2023-03-17 08:32:51 +01:00
2023-07-27 08:37:40 +02:00
2020-11-05 11:43:34 +01:00
2023-08-11 11:53:57 +02:00
2023-08-11 11:53:57 +02:00
2023-06-09 10:29:01 +02:00
2023-06-21 15:44:10 +02:00
2020-04-23 10:36:45 +02:00
2023-07-27 08:37:24 +02:00
2020-01-09 10:20:06 +01:00
2023-01-18 11:41:09 +01:00
2022-11-03 23:56:54 +09:00
2023-07-27 08:37:45 +02:00
2023-08-11 11:53:57 +02:00
2023-04-20 12:07:32 +02:00
2022-11-25 17:42:21 +01:00
2023-05-30 12:44:05 +01:00
2023-04-26 11:24:05 +02:00
2022-04-27 13:50:47 +02:00
2021-02-10 09:25:28 +01:00
2023-07-27 08:37:44 +02:00
2023-04-20 12:07:33 +02:00
2022-12-14 11:30:45 +01:00
2023-02-22 12:50:41 +01:00
2023-05-17 11:35:58 +02:00
2023-07-27 08:37:44 +02:00
2022-04-15 14:18:35 +02:00
2023-07-27 08:37:12 +02:00
2023-06-09 10:28:52 +02:00
2023-07-27 08:37:11 +02:00
2023-05-30 12:44:05 +01:00
2023-02-22 12:50:25 +01:00
2023-06-09 10:28:53 +02:00
2022-01-11 15:23:33 +01:00
2021-09-03 10:08:12 +02:00
2023-03-11 16:43:41 +01:00
2020-11-24 13:29:05 +01:00
2023-02-22 12:50:34 +01:00
2023-05-17 11:35:59 +02:00
2023-08-11 11:53:56 +02:00
2023-07-27 08:37:22 +02:00
2023-03-17 08:32:51 +01:00
2021-11-17 09:48:48 +01:00
2023-07-27 08:37:35 +02:00
2021-10-27 09:54:24 +02:00
2023-06-21 15:44:12 +02:00
2023-06-09 10:29:01 +02:00
2023-08-11 11:53:56 +02:00
2023-05-30 12:44:05 +01:00
2023-07-27 08:37:42 +02:00
2023-02-22 12:50:26 +01:00
2023-07-27 08:37:23 +02:00
2023-06-09 10:28:56 +02:00
2021-06-18 09:59:00 +02:00
2023-06-21 15:44:10 +02:00
2023-06-21 15:44:10 +02:00
2023-05-30 12:44:01 +01:00
0438e60a00