Linux network development

Fengguang Wu | 10 Aug 2012 18:31

NULL pointer dereference BUG in ip_send_skb()

Hi Eric,

This line triggers a NULL deference since commit 3a7c384 ("ipv4: tcp:
unicast_sock should not land outside of TCP stack").

        int ip_send_skb(struct sk_buff *skb)
        {       
==>             struct net *net = sock_net(skb->sk);

[   77.914805] md: autorun ...
[   77.915703] md: ... autorun DONE.
[   77.926545] BUG: unable to handle kernel NULL pointer dereference at 0000000000000030
[   77.928884] IP: [<ffffffff8250e980>] ip_send_skb+0xf/0x3d
[   77.929523] PGD 0 
[   77.929523] Oops: 0000 [#1] SMP DEBUG_PAGEALLOC
[   77.929523] Modules linked in:
[   77.929523] CPU 0 
[   77.929523] Pid: 171, comm: kworker/0:2 Not tainted 3.6.0-rc1+ #1720 Bochs Bochs
[   77.929523] RIP: 0010:[<ffffffff8250e980>]  [<ffffffff8250e980>] ip_send_skb+0xf/0x3d
[   77.929523] RSP: 0018:ffff88001f203938  EFLAGS: 00010286
[   77.929523] RAX: 0000000000000000 RBX: ffff88001f3d2580 RCX: ffff880012e75eb8
[   77.929523] RDX: ffff88001f2039b8 RSI: ffff880012e9dd28 RDI: ffff880012903f00
[   77.929523] RBP: ffff88001f203948 R08: 0000000000000000 R09: 0000000000000000
[   77.929523] R10: ffff88001f3d2810 R11: ffff880012e75e00 R12: ffff880012e5cf00
[   77.929523] R13: ffff880012903f00 R14: ffff88001f203a88 R15: ffff88001f3d2820
[   77.929523] FS:  0000000000000000(0000) GS:ffff88001f200000(0000) knlGS:0000000000000000
[   77.929523] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[   77.929523] CR2: 0000000000000030 CR3: 0000000003614000 CR4: 00000000000006f0
[   77.929523] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   77.929523] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400

(Continue reading)

headers

Eric Dumazet | 10 Aug 2012 18:45

Re: NULL pointer dereference BUG in ip_send_skb()

On Sat, 2012-08-11 at 00:31 +0800, Fengguang Wu wrote:
> Hi Eric,
> 
> This line triggers a NULL deference since commit 3a7c384 ("ipv4: tcp:
> unicast_sock should not land outside of TCP stack").
> 
>         int ip_send_skb(struct sk_buff *skb)
>         {       
> ==>             struct net *net = sock_net(skb->sk);

Hi Fengguang

Fix was sent some hours ago, on netdev list.

http://patchwork.ozlabs.org/patch/176483/

Thanks