Gui Jianfeng 6edafaaf6f tcp: Fix kernel panic when calling tcp_v(4/6)_md5_do_lookup ... If the following packet flow happen, kernel will panic. MathineA MathineB SYN ----------------------> SYN+ACK <---------------------- ACK(bad seq) ----------------------> When a bad seq ACK is received, tcp_v4_md5_do_lookup(skb->sk, ip_hdr(skb)->daddr)) is finally called by tcp_v4_reqsk_send_ack(), but the first parameter(skb->sk) is NULL at that moment, so kernel panic happens. This patch fixes this bug. OOPS output is as following: [ 302.812793] IP: [<c05cfaa6>] tcp_v4_md5_do_lookup+0x12/0x42 [ 302.817075] Oops: 0000 [#1] SMP [ 302.819815] Modules linked in: ipv6 loop dm_multipath rtc_cmos rtc_core rtc_lib pcspkr pcnet32 mii i2c_piix4 parport_pc i2c_core parport ac button ata_piix libata dm_mod mptspi mptscsih mptbase scsi_transport_spi sd_mod scsi_mod crc_t10dif ext3 jbd mbcache uhci_hcd ohci_hcd ehci_hcd [last unloaded: scsi_wait_scan] [ 302.849946] [ 302.851198] Pid: 0, comm: swapper Not tainted (2.6.27-rc1-guijf #5) [ 302.855184] EIP: 0060:[<c05cfaa6>] EFLAGS: 00010296 CPU: 0 [ 302.858296] EIP is at tcp_v4_md5_do_lookup+0x12/0x42 [ 302.861027] EAX: 0000001e EBX: 00000000 ECX: 00000046 EDX: 00000046 [ 302.864867] ESI: ceb69e00 EDI: 1467a8c0 EBP: cf75f180 ESP: c0792e54 [ 302.868333] DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068 [ 302.871287] Process swapper (pid: 0, ti=c0792000 task=c0712340 task.ti=c0746000) [ 302.875592] Stack: c06f413a 00000000 cf75f180 ceb69e00 00000000 c05d0d86 000016d0 ceac5400 [ 302.883275] c05d28f8 000016d0 ceb69e00 ceb69e20 681bf6e3 00001000 00000000 0a67a8c0 [ 302.890971] ceac5400 c04250a3 c06f413a c0792eb0 c0792edc cf59a620 cf59a620 cf59a634 [ 302.900140] Call Trace: [ 302.902392] [<c05d0d86>] tcp_v4_reqsk_send_ack+0x17/0x35 [ 302.907060] [<c05d28f8>] tcp_check_req+0x156/0x372 [ 302.910082] [<c04250a3>] printk+0x14/0x18 [ 302.912868] [<c05d0aa1>] tcp_v4_do_rcv+0x1d3/0x2bf [ 302.917423] [<c05d26be>] tcp_v4_rcv+0x563/0x5b9 [ 302.920453] [<c05bb20f>] ip_local_deliver_finish+0xe8/0x183 [ 302.923865] [<c05bb10a>] ip_rcv_finish+0x286/0x2a3 [ 302.928569] [<c059e438>] dev_alloc_skb+0x11/0x25 [ 302.931563] [<c05a211f>] netif_receive_skb+0x2d6/0x33a [ 302.934914] [<d0917941>] pcnet32_poll+0x333/0x680 [pcnet32] [ 302.938735] [<c05a3b48>] net_rx_action+0x5c/0xfe [ 302.941792] [<c042856b>] __do_softirq+0x5d/0xc1 [ 302.944788] [<c042850e>] __do_softirq+0x0/0xc1 [ 302.948999] [<c040564b>] do_softirq+0x55/0x88 [ 302.951870] [<c04501b1>] handle_fasteoi_irq+0x0/0xa4 [ 302.954986] [<c04284da>] irq_exit+0x35/0x69 [ 302.959081] [<c0405717>] do_IRQ+0x99/0xae [ 302.961896] [<c040422b>] common_interrupt+0x23/0x28 [ 302.966279] [<c040819d>] default_idle+0x2a/0x3d [ 302.969212] [<c0402552>] cpu_idle+0xb2/0xd2 [ 302.972169] ======================= [ 302.974274] Code: fc ff 84 d2 0f 84 df fd ff ff e9 34 fe ff ff 83 c4 0c 5b 5e 5f 5d c3 90 90 57 89 d7 56 53 89 c3 50 68 3a 41 6f c0 e8 e9 55 e5 ff <8b> 93 9c 04 00 00 58 85 d2 59 74 1e 8b 72 10 31 db 31 c9 85 f6 [ 303.011610] EIP: [<c05cfaa6>] tcp_v4_md5_do_lookup+0x12/0x42 SS:ESP 0068:c0792e54 [ 303.018360] Kernel panic - not syncing: Fatal exception in interrupt Signed-off-by: Gui Jianfeng <guijianfeng@cn.fujitsu.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2008-08-06 23:50:04 -07:00
..
9p	9p: fix error path during early mount	2008-05-14 19:23:27 -05:00
bluetooth	[Bluetooth] Store remote modem status for RFCOMM TTY	2008-07-14 20:13:52 +02:00
irda	pkt_sched: Add qdisc_all_tx_empty()	2008-07-08 23:00:25 -07:00
iucv
netfilter	netfilter: accounting rework: ct_extend + 64bit counters (v4)	2008-07-21 10:10:58 -07:00
netns	netns: dont alloc ipv6 fib timer list	2008-07-22 14:33:45 -07:00
sctp	sctp: Drop ipfargok in sctp_xmit function	2008-08-03 21:15:08 -07:00
tc_act
tipc	tipc: Remove unneeded parameter to tipc_createport_raw()	2008-07-14 22:42:19 -07:00
act_api.h
addrconf.h	ipv6 netns: Address labels per namespace	2008-06-12 02:38:15 +09:00
af_rxrpc.h
af_unix.h	[PATCH] f_count may wrap around	2008-07-26 20:53:40 -04:00
ah.h
arp.h
atmclip.h
ax25.h	[AX25] ax25_ds_timer: use mod_timer instead of add_timer	2008-02-12 17:53:34 -08:00
ax88796.h
cfg80211.h	nl80211/cfg80211: support for mesh, sta dumping	2008-03-06 15:30:41 -05:00
checksum.h
cipso_ipv4.h
compat.h	net: Use standard structures for generic socket address structures.	2008-07-19 22:35:47 -07:00
datalink.h
dn_dev.h
dn_fib.h
dn_neigh.h
dn_nsp.h
dn_route.h
dn.h
dsfield.h
dst.h	net: Kill plain NET_XMIT_BYPASS.	2008-08-04 23:04:08 -07:00
esp.h
fib_rules.h	net: add fib_rules_ops to flush_cache method	2008-07-05 19:01:28 -07:00
flow.h	ipv4: remove unused field in struct flowi (include/net/flow.h).	2008-08-05 01:19:50 -07:00
garp.h	vlan: Add GVRP support	2008-07-05 21:26:57 -07:00
gen_stats.h
genetlink.h	netlink: Improve returned error codes	2008-06-03 16:36:54 -07:00
icmp.h	mib: put icmpmsg statistics on struct net	2008-07-18 04:04:22 -07:00
ieee80211_crypt.h
ieee80211_radiotap.h	include: use get/put_unaligned_* helpers	2008-07-25 10:53:26 -07:00
ieee80211.h	remove ieee80211_wx_{get,set}_auth()	2008-05-07 15:02:14 -04:00
if_inet6.h	ipv6: make struct ipv6_devconf static	2008-07-22 14:21:58 -07:00
inet6_connection_sock.h
inet6_hashtables.h	netns: introduce the net_hash_mix "salt" for hashes	2008-06-16 17:14:11 -07:00
inet_common.h	[NETNS]: Inet control socket should not hold a namespace.	2008-04-03 14:28:30 -07:00
inet_connection_sock.h	[INET]: Rename inet_csk_ctl_sock_create to inet_ctl_sock_create.	2008-04-03 14:22:32 -07:00
inet_ecn.h	[IPV6]: Use appropriate sock tclass setting for routing lookup.	2008-04-13 23:40:51 -07:00
inet_frag.h	[NET]: Rename inet_frag.h identifiers COMPLETE, FIRST_IN, LAST_IN to INET_FRAG_*	2008-03-28 16:35:27 -07:00
inet_hashtables.h	netns: introduce the net_hash_mix "salt" for hashes	2008-06-16 17:14:11 -07:00
inet_sock.h	netns: introduce the net_hash_mix "salt" for hashes	2008-06-16 17:14:11 -07:00
inet_timewait_sock.h	[NETNS]: Compilation warnings under CONFIG_NET_NS.	2008-03-26 00:48:17 -07:00
inetpeer.h	net: remove CVS keywords	2008-06-11 21:00:38 -07:00
ip6_checksum.h
ip6_fib.h	[NETNS][IPV6] rt6_info - move rt6_info structure inside the namespace	2008-03-04 13:48:30 -08:00
ip6_route.h	ipv6: icmp6_dst_gc return change	2008-07-22 14:35:50 -07:00
ip6_tunnel.h	net: remove CVS keywords	2008-06-11 21:00:38 -07:00
ip_fib.h
ip_vs.h	ipvs: Move userspace definitions to include/linux/ip_vs.h	2008-07-31 20:45:24 -07:00
ip.h	[PATCH] sysctl: make sure that /proc/sys/net/ipv4 appears before per-ns ones	2008-07-26 20:53:10 -04:00
ipcomp.h	ipsec: ipcomp - Merge IPComp implementations	2008-07-25 02:54:40 -07:00
ipconfig.h	net: remove CVS keywords	2008-06-11 21:00:38 -07:00
ipip.h	tunnels: Remove stat member from ip_tunnel struct.	2008-05-21 14:16:36 -07:00
ipv6.h	net: missing bits of net-namespace / sysctl	2008-07-27 04:40:51 -07:00
ipx.h
iw_handler.h	wext: Emit event stream entries correctly when compat.	2008-06-16 18:50:49 -07:00
lapb.h
llc_c_ac.h
llc_c_ev.h
llc_c_st.h
llc_conn.h
llc_if.h	[LLC]: Kill static inline llc_addrany	2008-02-29 11:46:17 -08:00
llc_pdu.h	[LLC]: skb allocation size for responses	2008-03-31 21:02:47 -07:00
llc_s_ac.h
llc_s_ev.h
llc_s_st.h
llc_sap.h	[LLC]: skb allocation size for responses	2008-03-31 21:02:47 -07:00
llc.h	[LLC]: station source mac address	2008-03-28 16:28:36 -07:00
mac80211.h	mac80211: make listen_interval be limited by low level driver	2008-08-04 15:09:07 -04:00
mip6.h	[IPV6] MIP6: Use our standard definitions for paddings.	2008-04-12 13:43:22 +09:00
ndisc.h	ndisc: Add missing strategies for per-device retrans timer/reachable time settings.	2008-05-19 16:25:42 -07:00
neighbour.h	core: add stat to track unresolved discards in neighbor cache	2008-07-16 20:50:49 -07:00
net_namespace.h	[PATCH] beginning of sysctl cleanup - ctl_table_set	2008-07-26 20:53:08 -04:00
netdma.h
netevent.h
netlabel.h	Audit: collect sessionid in netlink messages	2008-04-28 06:18:03 -04:00
netlink.h	netlink: add NLA_PUT_BE64 macro	2008-07-21 10:10:58 -07:00
netrom.h
nexthop.h
p8022.h
pkt_cls.h	[PKT_SCHED]: Pass real namespace in net scheduler classifiers.	2008-03-27 16:53:37 -07:00
pkt_sched.h	net_sched: Add size table for qdiscs	2008-07-20 00:08:47 -07:00
protocol.h	[NETNS]: Drop packets in the non-initial namespace on the per/protocol basis.	2008-03-24 15:33:00 -07:00
psnap.h
raw.h	[RAW]: Add raw_hashinfo member on struct proto.	2008-03-22 16:56:51 -07:00
rawv6.h
red.h
request_sock.h	tcp: Fix kernel panic when calling tcp_v(4/6)_md5_do_lookup	2008-08-06 23:50:04 -07:00
rose.h	rose: improving AX25 routing frames via ROSE network	2008-06-17 17:08:32 -07:00
route.h	net: missing bits of net-namespace / sysctl	2008-07-27 04:40:51 -07:00
rtnetlink.h	[RTNL]: Introduce the rtnl_kill_links helper.	2008-04-16 00:46:52 -07:00
sch_generic.h	net_sched: Add qdisc __NET_XMIT_BYPASS flag	2008-08-04 22:39:11 -07:00
scm.h
slhc_vj.h
snmp.h	net: remove CVS keywords	2008-06-11 21:00:38 -07:00
sock.h	sock: add net to prot->enter_memory_pressure callback	2008-07-16 20:28:10 -07:00
stp.h	net: Add STP demux layer	2008-07-05 21:25:39 -07:00
syncppp.h	syncppp: Fix crashes.	2008-05-12 03:29:11 -07:00
tcp_states.h
tcp.h	tcp: options clean up	2008-07-19 00:04:31 -07:00
timewait_sock.h
transp_v6.h	net: change proto destroy method to return void	2008-06-14 17:04:49 -07:00
udp.h	mib: put udplite statistics on struct net	2008-07-18 04:03:45 -07:00
udplite.h	[UDP]: Revert udplite and code split.	2008-03-06 16:22:02 -08:00
wext.h	wext: Dispatch and handle compat ioctls entirely in net/wireless/wext.c	2008-06-16 18:32:46 -07:00
wireless.h	mac80211: allow disable FAT in specific configurations	2008-06-03 15:00:26 -04:00
x25.h
x25device.h
xfrm.h	xfrm: convert empty xfrm_audit_* macros to functions	2008-05-03 21:03:01 -07:00