From patchwork Sun Dec 18 02:16:19 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mahesh Bandewar X-Patchwork-Id: 706777 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 3th7JX2PkKz9t2D for ; Sun, 18 Dec 2016 13:28:27 +1100 (AEDT) Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=bandewar-net.20150623.gappssmtp.com header.i=@bandewar-net.20150623.gappssmtp.com header.b="FWILqTRd"; dkim-atps=neutral Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1758281AbcLRCQ1 (ORCPT ); Sat, 17 Dec 2016 21:16:27 -0500 Received: from mail-pg0-f66.google.com ([74.125.83.66]:35890 "EHLO mail-pg0-f66.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752059AbcLRCQ0 (ORCPT ); Sat, 17 Dec 2016 21:16:26 -0500 Received: by mail-pg0-f66.google.com with SMTP id a1so7150502pgf.3 for ; Sat, 17 Dec 2016 18:16:26 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bandewar-net.20150623.gappssmtp.com; s=20150623; h=from:to:cc:subject:date:message-id; bh=uTnFy4hc7PwAARS+E7QeTqwNxNvlePkZQSYH9v9nlpY=; b=FWILqTRd4PJEqEehvDDt0EY6T0HjQFtTHrFGeve8zWAuZKPBSNAzwBfsQaNvkr+NIr UJgBIV00eWYGRND3NfqrgkKNdIPoTh8DV97Ad2TDoUCVk0tBSixVkWsdtQvJ4YdFrbCL UiXeeBhVa28fTXBdOBfJ7xdxWuw8fNW25kkoUpKn7+daglAQItPAbqmZCtt8pHCNu8kG bTGy9UQ+IVlnda34yEw6ISpfTHiEmmmC5V7aVkyHIO+BB//t4UGZ4U96E/mXzviXsZqz 4m6fjoq0UxdwUeAlaKexLvX8QoUFaIOE95bhVzezcD9Ipw1raJA74Dcj3kFwlwqD1n7X NAEQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=uTnFy4hc7PwAARS+E7QeTqwNxNvlePkZQSYH9v9nlpY=; b=SViegoZqE0eHOUMJVoiOeFvXkjd8SRjdYuYP2/u1BaS260JHUACOidCD1Aq3d+/6s2 cZaYtuJpOWmyVm2ehXk7djlPpf5h0GkJ1n3hajNUWmx/olPlFLKvMOoQa7ns15pVxTq3 tL5mVW5Osc6ywheZlBqzQI13j6raaM6IJVDJ4H0wCU0kLlWumc/iHJAXC/i1/4oSZIoh AQ9OAW4V+WvW8nXhMwDosjV+tm+L5YaRtmYbn2Af2tbwU/r8bjBquMCR3OOPGhsrfrqk UteUYO/s54ATAJzkxnfEKU4dsdp/KAXDlM1SJIB/DGTGom2SrX3Rk9WT6Ekcw2+aFf8u yQ1g== X-Gm-Message-State: AIkVDXKO3ZD5sQCrWO0KUdXur84cDAOzdhji4DvftXt/YxXVK/EcW/rNcDeodPIKskuzYQ== X-Received: by 10.84.214.150 with SMTP id j22mr7303442pli.81.1482027385811; Sat, 17 Dec 2016 18:16:25 -0800 (PST) Received: from localhost ([2620:0:1000:3012:696f:d965:9068:8673]) by smtp.gmail.com with ESMTPSA id b12sm21425775pfb.78.2016.12.17.18.16.23 (version=TLS1_2 cipher=AES128-SHA bits=128/128); Sat, 17 Dec 2016 18:16:24 -0800 (PST) From: Mahesh Bandewar To: netdev , Eric Dumazet , David Miller Cc: Mahesh Bandewar Subject: [PATCH net] ipvlan: fix crash Date: Sat, 17 Dec 2016 18:16:19 -0800 Message-Id: <1482027379-30785-1-git-send-email-mahesh@bandewar.net> X-Mailer: git-send-email 2.8.0.rc3.226.g39d4020 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org From: Mahesh Bandewar ------------[ cut here ]------------ kernel BUG at include/linux/skbuff.h:1737! Call Trace: [] dev_forward_skb+0x92/0xd0 [] ipvlan_process_multicast+0x395/0x4c0 [ipvlan] [] ? ipvlan_process_multicast+0xd7/0x4c0 [ipvlan] [] ? process_one_work+0x147/0x660 [] process_one_work+0x1a9/0x660 [] ? process_one_work+0x147/0x660 [] worker_thread+0x11d/0x360 [] ? rescuer_thread+0x350/0x350 [] kthread+0xdb/0xe0 [] ? _raw_spin_unlock_irq+0x30/0x50 [] ? flush_kthread_worker+0xc0/0xc0 [] ret_from_fork+0x9a/0xd0 [] ? flush_kthread_worker+0xc0/0xc0 Signed-off-by: Mahesh Bandewar --- drivers/net/ipvlan/ipvlan_core.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/net/ipvlan/ipvlan_core.c b/drivers/net/ipvlan/ipvlan_core.c index b4e990743e1d..4294fc1f5564 100644 --- a/drivers/net/ipvlan/ipvlan_core.c +++ b/drivers/net/ipvlan/ipvlan_core.c @@ -660,6 +660,9 @@ rx_handler_result_t ipvlan_handle_frame(struct sk_buff **pskb) if (!port) return RX_HANDLER_PASS; + if (unlikely(!pskb_may_pull(skb, sizeof(struct ethhdr)))) + goto out; + switch (port->mode) { case IPVLAN_MODE_L2: return ipvlan_handle_mode_l2(pskb, port); @@ -672,6 +675,8 @@ rx_handler_result_t ipvlan_handle_frame(struct sk_buff **pskb) /* Should not reach here */ WARN_ONCE(true, "ipvlan_handle_frame() called for mode = [%hx]\n", port->mode); + +out: kfree_skb(skb); return RX_HANDLER_CONSUMED; }