From patchwork Wed May 26 01:48:02 2010 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Arce, Abraham" X-Patchwork-Id: 53583 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 72045B7D19 for ; Wed, 26 May 2010 11:48:36 +1000 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933885Ab0EZBsI (ORCPT ); Tue, 25 May 2010 21:48:08 -0400 Received: from arroyo.ext.ti.com ([192.94.94.40]:51858 "EHLO arroyo.ext.ti.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S933412Ab0EZBsG convert rfc822-to-8bit (ORCPT ); Tue, 25 May 2010 21:48:06 -0400 Received: from dlep35.itg.ti.com ([157.170.170.118]) by arroyo.ext.ti.com (8.13.7/8.13.7) with ESMTP id o4Q1m4Rb016258 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Tue, 25 May 2010 20:48:04 -0500 Received: from dlep26.itg.ti.com (localhost [127.0.0.1]) by dlep35.itg.ti.com (8.13.7/8.13.7) with ESMTP id o4Q1m3qV011545; Tue, 25 May 2010 20:48:03 -0500 (CDT) Received: from dlee75.ent.ti.com (localhost [127.0.0.1]) by dlep26.itg.ti.com (8.13.8/8.13.8) with ESMTP id o4Q1m30b006558; Tue, 25 May 2010 20:48:03 -0500 (CDT) Received: from dlee03.ent.ti.com ([157.170.170.18]) by dlee75.ent.ti.com ([157.170.170.72]) with mapi; Tue, 25 May 2010 20:48:03 -0500 From: "Arce, Abraham" To: "netdev@vger.kernel.org" , David Miller CC: "linux-kernel@vger.kernel.org" , "linux-nfs@vger.kernel.org" , "linux-omap@vger.kernel.org" , Tony Lindgren , "Shilimkar, Santosh" Date: Tue, 25 May 2010 20:48:02 -0500 Subject: RE: NULL Pointer Deference: NFS & Telnet Thread-Topic: NULL Pointer Deference: NFS & Telnet Thread-Index: Acr7sMEhWAICO9I8TUCo7EaT0RzjBwAwoBPg Message-ID: <27F9C60D11D683428E133F85D2BB4A53043E3EDFE6@dlee03.ent.ti.com> References: <27F9C60D11D683428E133F85D2BB4A53043E33A997@dlee03.ent.ti.com> In-Reply-To: <27F9C60D11D683428E133F85D2BB4A53043E33A997@dlee03.ent.ti.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US MIME-Version: 1.0 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org Hi, I am able to avoid the NULL pointer dereference but not sure if the handling is the correct one... find the patch below... > I have 2 scenarios in which I am getting a NULL pointer dereference: > > 1) root filesystem over nfs > 2) telnet connection > > The issue appeared on this commit > > http://git.kernel.org/?p=linux/kernel/git/torvalds/linux- > 2.6.git;a=commit;h=f8965467f366fd18f01feafb5db10512d7b4422c > > The driver I am working with is drivers/net/ks8851.c > Any help will be highly appreciated... > > --- > > Scenario 1 | root filesystem over nfs > > Looking up port of RPC 100005/1 on 10.87.231.229 > VFS: Mounted root (nfs filesystem) on device 0:10. > Freeing init memory: 128K > Unable to handle kernel NULL pointer dereference at virtual address 00000000 > [..] > PC is at put_page+0xc/0x120 > LR is at skb_release_data+0x74/0xb8 > [..] > Backtrace: > [] (put_page+0x0/0x120) > [] (skb_release_data+0x0/0xb8) > [] (skb_release_all+0x0/0x20) > [] (__kfree_skb+0x0/0xbc) > [] (consume_skb+0x0/0x58) > [] (skb_free_datagram+0x0/0x40) > [] (xs_udp_data_ready+0x0/0x1e8) > [] (sock_queue_rcv_skb+0x0/0x1c0) > [] (ip_queue_rcv_skb+0x0/0x58) > [] (__udp_queue_rcv_skb+0x0/0x18c) > [] (udp_queue_rcv_skb+0x0/0x348) > [] (__udp4_lib_rcv+0x0/0x564) > [] (udp_rcv+0x0/0x20) > [] (ip_local_deliver+0x0/0x264) > [] (ip_rcv+0x0/0x6c8) > [] (__netif_receive_skb+0x0/0x2d0) > [] (process_backlog+0x0/0x16c) > [] (net_rx_action+0x0/0x18c) > [] (__do_softirq+0x0/0x12c) > [] (irq_exit+0x0/0x70) > [] (asm_do_IRQ+0x0/0xc8) > > Complete log at http://pastebin.mozilla.org/728027 > > --- > > Scenario 2 > > 1. Root filesystem booted in ram > 2. eth0 brought up > 3. telnetd daemon started > 4. tried to connect through telnet > > # Unable to handle kernel NULL pointer dereference at virtual address 00000000 > pgd = d98e8000 > [..] > PC is at put_page+0xc/0x120 > LR is at skb_release_data+0x74/0xb8 > [..] > Backtrace: > [] (put_page+0x0/0x120) > [] (skb_release_data+0x0/0xb8) > [] (skb_release_all+0x0/0x20) > [] (__kfree_skb+0x0/0xbc) > [] (tcp_recvmsg+0x0/0x93c) > [] (inet_recvmsg+0x0/0xec) > [] (sock_aio_read+0x0/0xf8) > [] (do_sync_read+0x0/0xec) > [] (vfs_read+0x0/0x164) > [] (sys_read+0x0/0x70) > [] (ret_fast_syscall+0x0/0x30) > > Complete log at http://pastebin.mozilla.org/728028 > Check for NULL data in sk_buff before sending to put_page Signed-off-by: Abraham Arce --- net/core/skbuff.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/net/core/skbuff.c b/net/core/skbuff.c index f8abf68..eb81f76 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -334,7 +334,7 @@ static void skb_release_data(struct sk_buff *skb) if (!skb->cloned || !atomic_sub_return(skb->nohdr ? (1 << SKB_DATAREF_SHIFT) + 1 : 1, &skb_shinfo(skb)->dataref)) { - if (skb_shinfo(skb)->nr_frags) { + if (skb_shinfo(skb)->nr_frags && skb_has_frags(skb)) { int i; for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) put_page(skb_shinfo(skb)->frags[i].page);