| Message ID | 1372245307.3301.171.camel@edumazet-glaptop |
|---|---|
| State | Accepted, archived |
| Delegated to: | David Miller |
| Headers | show |
On Wed, Jun 26, 2013 at 04:15:07AM -0700, Eric Dumazet wrote: > Following patch fixes the problem for me : Cool, thanks Eric! > [PATCH] ipv6: ip6_sk_dst_check() must not assume ipv6 dst > > It's possible to use AF_INET6 sockets and to connect to an IPv4 > destination. After this, socket dst cache is a pointer to a rtable, > not rt6_info. That was my hunch, too. I was unsure where we should destroy the lingering dst. > ip6_sk_dst_check() should check the socket dst cache is IPv6, or else > various corruptions/crashes can happen. > > Dave Jones can reproduce immediate crash with > trinity -q -l off -n -c sendmsg -c connect > > With help from Hannes Frederic Sowa > > Reported-by: Dave Jones <davej@redhat.com> > Reported-by: Hannes Frederic Sowa <hannes@stressinduktion.org> > Signed-off-by: Eric Dumazet <edumazet@google.com> Patch looks good. It also fixes some panics I have seen down lower in the netfilter ipv6 code I saw while testing, which I thought may be a different issue. Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org> Thanks, Hannes -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
From: Hannes Frederic Sowa <hannes@stressinduktion.org> Date: Wed, 26 Jun 2013 15:07:48 +0200 > On Wed, Jun 26, 2013 at 04:15:07AM -0700, Eric Dumazet wrote: >> Following patch fixes the problem for me : > > Cool, thanks Eric! > >> [PATCH] ipv6: ip6_sk_dst_check() must not assume ipv6 dst >> >> It's possible to use AF_INET6 sockets and to connect to an IPv4 >> destination. After this, socket dst cache is a pointer to a rtable, >> not rt6_info. > > That was my hunch, too. I was unsure where we should destroy the lingering dst. > >> ip6_sk_dst_check() should check the socket dst cache is IPv6, or else >> various corruptions/crashes can happen. >> >> Dave Jones can reproduce immediate crash with >> trinity -q -l off -n -c sendmsg -c connect >> >> With help from Hannes Frederic Sowa >> >> Reported-by: Dave Jones <davej@redhat.com> >> Reported-by: Hannes Frederic Sowa <hannes@stressinduktion.org> >> Signed-off-by: Eric Dumazet <edumazet@google.com> > > Patch looks good. It also fixes some panics I have seen down lower in > the netfilter ipv6 code I saw while testing, which I thought may be a > different issue. > > Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org> Ok, so the issue can only happen if we switch between using an ipv4 and an ipv6 binding on an ipv6 socket. Usually if the sockaddr specified for udp6_sendmsg() is ipv4, we'd go straight to udp_sendmsg(). But if it's ipv4 bound initially, then we get a udp6_sendmsg() with an ipv6 address, we hit this problem. Applied and queued up for -stable, thanks! -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c index 95703ba..d5d20cd 100644 --- a/net/ipv6/ip6_output.c +++ b/net/ipv6/ip6_output.c @@ -821,11 +821,17 @@ static struct dst_entry *ip6_sk_dst_check(struct sock *sk, const struct flowi6 *fl6) { struct ipv6_pinfo *np = inet6_sk(sk); - struct rt6_info *rt = (struct rt6_info *)dst; + struct rt6_info *rt; if (!dst) goto out; + if (dst->ops->family != AF_INET6) { + dst_release(dst); + return NULL; + } + + rt = (struct rt6_info *)dst; /* Yes, checking route validity in not connected * case is not very simple. Take into account, * that we do not support routing by source, TOS,