Petr Machata 5691484df9 net: ip6_gre: Fix headroom request in ip6erspan_tunnel_xmit() ... dev->needed_headroom is not primed until ip6_tnl_xmit(), so it starts out zero. Thus the call to skb_cow_head() fails to actually make sure there's enough headroom to push the ERSPAN headers to. That can lead to the panic cited below. (Reproducer below that). Fix by requesting either needed_headroom if already primed, or just the bare minimum needed for the header otherwise. [ 190.703567] kernel BUG at net/core/skbuff.c:104! [ 190.708384] invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI [ 190.714007] Modules linked in: act_mirred cls_matchall ip6_gre ip6_tunnel tunnel6 gre sch_ingress vrf veth x86_pkg_temp_thermal mlx_platform nfsd e1000e leds_mlxcpld [ 190.728975] CPU: 1 PID: 959 Comm: kworker/1:2 Not tainted 4.17.0-rc4-net_master-custom-139 #10 [ 190.737647] Hardware name: Mellanox Technologies Ltd. "MSN2410-CB2F"/"SA000874", BIOS 4.6.5 03/08/2016 [ 190.747006] Workqueue: ipv6_addrconf addrconf_dad_work [ 190.752222] RIP: 0010:skb_panic+0xc3/0x100 [ 190.756358] RSP: 0018:ffff8801d54072f0 EFLAGS: 00010282 [ 190.761629] RAX: 0000000000000085 RBX: ffff8801c1a8ecc0 RCX: 0000000000000000 [ 190.768830] RDX: 0000000000000085 RSI: dffffc0000000000 RDI: ffffed003aa80e54 [ 190.776025] RBP: ffff8801bd1ec5a0 R08: ffffed003aabce19 R09: ffffed003aabce19 [ 190.783226] R10: 0000000000000001 R11: ffffed003aabce18 R12: ffff8801bf695dbe [ 190.790418] R13: 0000000000000084 R14: 00000000000006c0 R15: ffff8801bf695dc8 [ 190.797621] FS: 0000000000000000(0000) GS:ffff8801d5400000(0000) knlGS:0000000000000000 [ 190.805786] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 190.811582] CR2: 000055fa929aced0 CR3: 0000000003228004 CR4: 00000000001606e0 [ 190.818790] Call Trace: [ 190.821264] <IRQ> [ 190.823314] ? ip6erspan_tunnel_xmit+0x5e4/0x1982 [ip6_gre] [ 190.828940] ? ip6erspan_tunnel_xmit+0x5e4/0x1982 [ip6_gre] [ 190.834562] skb_push+0x78/0x90 [ 190.837749] ip6erspan_tunnel_xmit+0x5e4/0x1982 [ip6_gre] [ 190.843219] ? ip6gre_tunnel_ioctl+0xd90/0xd90 [ip6_gre] [ 190.848577] ? debug_check_no_locks_freed+0x210/0x210 [ 190.853679] ? debug_check_no_locks_freed+0x210/0x210 [ 190.858783] ? print_irqtrace_events+0x120/0x120 [ 190.863451] ? sched_clock_cpu+0x18/0x210 [ 190.867496] ? cyc2ns_read_end+0x10/0x10 [ 190.871474] ? skb_network_protocol+0x76/0x200 [ 190.875977] dev_hard_start_xmit+0x137/0x770 [ 190.880317] ? do_raw_spin_trylock+0x6d/0xa0 [ 190.884624] sch_direct_xmit+0x2ef/0x5d0 [ 190.888589] ? pfifo_fast_dequeue+0x3fa/0x670 [ 190.892994] ? pfifo_fast_change_tx_queue_len+0x810/0x810 [ 190.898455] ? __lock_is_held+0xa0/0x160 [ 190.902422] __qdisc_run+0x39e/0xfc0 [ 190.906041] ? _raw_spin_unlock+0x29/0x40 [ 190.910090] ? pfifo_fast_enqueue+0x24b/0x3e0 [ 190.914501] ? sch_direct_xmit+0x5d0/0x5d0 [ 190.918658] ? pfifo_fast_dequeue+0x670/0x670 [ 190.923047] ? __dev_queue_xmit+0x172/0x1770 [ 190.927365] ? preempt_count_sub+0xf/0xd0 [ 190.931421] __dev_queue_xmit+0x410/0x1770 [ 190.935553] ? ___slab_alloc+0x605/0x930 [ 190.939524] ? print_irqtrace_events+0x120/0x120 [ 190.944186] ? memcpy+0x34/0x50 [ 190.947364] ? netdev_pick_tx+0x1c0/0x1c0 [ 190.951428] ? __skb_clone+0x2fd/0x3d0 [ 190.955218] ? __copy_skb_header+0x270/0x270 [ 190.959537] ? rcu_read_lock_sched_held+0x93/0xa0 [ 190.964282] ? kmem_cache_alloc+0x344/0x4d0 [ 190.968520] ? cyc2ns_read_end+0x10/0x10 [ 190.972495] ? skb_clone+0x123/0x230 [ 190.976112] ? skb_split+0x820/0x820 [ 190.979747] ? tcf_mirred+0x554/0x930 [act_mirred] [ 190.984582] tcf_mirred+0x554/0x930 [act_mirred] [ 190.989252] ? tcf_mirred_act_wants_ingress.part.2+0x10/0x10 [act_mirred] [ 190.996109] ? __lock_acquire+0x706/0x26e0 [ 191.000239] ? sched_clock_cpu+0x18/0x210 [ 191.004294] tcf_action_exec+0xcf/0x2a0 [ 191.008179] tcf_classify+0xfa/0x340 [ 191.011794] __netif_receive_skb_core+0x8e1/0x1c60 [ 191.016630] ? debug_check_no_locks_freed+0x210/0x210 [ 191.021732] ? nf_ingress+0x500/0x500 [ 191.025458] ? process_backlog+0x347/0x4b0 [ 191.029619] ? print_irqtrace_events+0x120/0x120 [ 191.034302] ? lock_acquire+0xd8/0x320 [ 191.038089] ? process_backlog+0x1b6/0x4b0 [ 191.042246] ? process_backlog+0xc2/0x4b0 [ 191.046303] process_backlog+0xc2/0x4b0 [ 191.050189] net_rx_action+0x5cc/0x980 [ 191.053991] ? napi_complete_done+0x2c0/0x2c0 [ 191.058386] ? mark_lock+0x13d/0xb40 [ 191.062001] ? clockevents_program_event+0x6b/0x1d0 [ 191.066922] ? print_irqtrace_events+0x120/0x120 [ 191.071593] ? __lock_is_held+0xa0/0x160 [ 191.075566] __do_softirq+0x1d4/0x9d2 [ 191.079282] ? ip6_finish_output2+0x524/0x1460 [ 191.083771] do_softirq_own_stack+0x2a/0x40 [ 191.087994] </IRQ> [ 191.090130] do_softirq.part.13+0x38/0x40 [ 191.094178] __local_bh_enable_ip+0x135/0x190 [ 191.098591] ip6_finish_output2+0x54d/0x1460 [ 191.102916] ? ip6_forward_finish+0x2f0/0x2f0 [ 191.107314] ? ip6_mtu+0x3c/0x2c0 [ 191.110674] ? ip6_finish_output+0x2f8/0x650 [ 191.114992] ? ip6_output+0x12a/0x500 [ 191.118696] ip6_output+0x12a/0x500 [ 191.122223] ? ip6_route_dev_notify+0x5b0/0x5b0 [ 191.126807] ? ip6_finish_output+0x650/0x650 [ 191.131120] ? ip6_fragment+0x1a60/0x1a60 [ 191.135182] ? icmp6_dst_alloc+0x26e/0x470 [ 191.139317] mld_sendpack+0x672/0x830 [ 191.143021] ? igmp6_mcf_seq_next+0x2f0/0x2f0 [ 191.147429] ? __local_bh_enable_ip+0x77/0x190 [ 191.151913] ipv6_mc_dad_complete+0x47/0x90 [ 191.156144] addrconf_dad_completed+0x561/0x720 [ 191.160731] ? addrconf_rs_timer+0x3a0/0x3a0 [ 191.165036] ? mark_held_locks+0xc9/0x140 [ 191.169095] ? __local_bh_enable_ip+0x77/0x190 [ 191.173570] ? addrconf_dad_work+0x50d/0xa20 [ 191.177886] ? addrconf_dad_work+0x529/0xa20 [ 191.182194] addrconf_dad_work+0x529/0xa20 [ 191.186342] ? addrconf_dad_completed+0x720/0x720 [ 191.191088] ? __lock_is_held+0xa0/0x160 [ 191.195059] ? process_one_work+0x45d/0xe20 [ 191.199302] ? process_one_work+0x51e/0xe20 [ 191.203531] ? rcu_read_lock_sched_held+0x93/0xa0 [ 191.208279] process_one_work+0x51e/0xe20 [ 191.212340] ? pwq_dec_nr_in_flight+0x200/0x200 [ 191.216912] ? get_lock_stats+0x4b/0xf0 [ 191.220788] ? preempt_count_sub+0xf/0xd0 [ 191.224844] ? worker_thread+0x219/0x860 [ 191.228823] ? do_raw_spin_trylock+0x6d/0xa0 [ 191.233142] worker_thread+0xeb/0x860 [ 191.236848] ? process_one_work+0xe20/0xe20 [ 191.241095] kthread+0x206/0x300 [ 191.244352] ? process_one_work+0xe20/0xe20 [ 191.248587] ? kthread_stop+0x570/0x570 [ 191.252459] ret_from_fork+0x3a/0x50 [ 191.256082] Code: 14 3e ff 8b 4b 78 55 4d 89 f9 41 56 41 55 48 c7 c7 a0 cf db 82 41 54 44 8b 44 24 2c 48 8b 54 24 30 48 8b 74 24 20 e8 16 94 13 ff <0f> 0b 48 c7 c7 60 8e 1f 85 48 83 c4 20 e8 55 ef a6 ff 89 74 24 [ 191.275327] RIP: skb_panic+0xc3/0x100 RSP: ffff8801d54072f0 [ 191.281024] ---[ end trace 7ea51094e099e006 ]--- [ 191.285724] Kernel panic - not syncing: Fatal exception in interrupt [ 191.292168] Kernel Offset: disabled [ 191.295697] ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]--- Reproducer: ip link add h1 type veth peer name swp1 ip link add h3 type veth peer name swp3 ip link set dev h1 up ip address add 192.0.2.1/28 dev h1 ip link add dev vh3 type vrf table 20 ip link set dev h3 master vh3 ip link set dev vh3 up ip link set dev h3 up ip link set dev swp3 up ip address add dev swp3 2001:db8:2::1/64 ip link set dev swp1 up tc qdisc add dev swp1 clsact ip link add name gt6 type ip6erspan \ local 2001:db8:2::1 remote 2001:db8:2::2 oseq okey 123 ip link set dev gt6 up sleep 1 tc filter add dev swp1 ingress pref 1000 matchall skip_hw \ action mirred egress mirror dev gt6 ping -I h1 192.0.2.2 Fixes: e41c7c68ea ("ip6erspan: make sure enough headroom at xmit.") Signed-off-by: Petr Machata <petrm@mellanox.com> Acked-by: William Tu <u9012063@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2018-05-17 16:50:06 -04:00
..
6lowpan	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
9p	net/9p: fix spelling mistake: "suspsend" -> "suspend"	2018-05-10 15:23:50 -04:00
802	treewide: setup_timer() -> timer_setup()	2017-11-21 15:57:07 -08:00
8021q	vlan: also check phy_driver ts_info for vlan's real device	2018-04-01 20:53:50 -04:00
appletalk	net: Use octal not symbolic permissions	2018-03-26 12:07:48 -04:00
atm	net: atm: Fix potential Spectre v1	2018-05-04 12:52:47 -04:00
ax25	net: Use octal not symbolic permissions	2018-03-26 12:07:48 -04:00
batman-adv	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2018-04-01 19:49:34 -04:00
bluetooth	Merge branch 'for-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth	2018-04-08 17:19:15 -04:00
bpf	bpf: fix null pointer deref in bpf_prog_test_run_xdp	2018-02-01 07:43:56 -08:00
bridge	Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf	2018-05-13 20:28:47 -04:00
caif	net: caif: fix spelling mistake "UKNOWN" -> "UNKNOWN"	2018-04-19 13:37:10 -04:00
can	net: Drop pernet_operations::async	2018-03-27 13:18:09 -04:00
ceph	libceph: add osd_req_op_extent_osd_data_bvecs()	2018-05-10 10:15:05 +02:00
core	ethtool: fix a potential missing-check bug	2018-05-01 14:18:47 -04:00
dcb	rtnetlink: make rtnl_register accept a flags parameter	2017-08-09 16:57:38 -07:00
dccp	dccp: fix tasklet usage	2018-05-03 15:14:57 -04:00
decnet	net: Use octal not symbolic permissions	2018-03-26 12:07:48 -04:00
dns_resolver	KEYS: DNS: limit the length of option strings	2018-04-17 15:17:41 -04:00
dsa	net: dsa: Discard frames from unused ports	2018-04-08 10:34:49 -04:00
ethernet
hsr	net: hsr: Convert timers to use timer_setup()	2017-10-25 13:00:27 +09:00
ieee802154	net: ieee802154: 6lowpan: fix frag reassembly	2018-04-23 20:56:24 +02:00
ife	net: sched: ife: check on metadata length	2018-04-22 21:12:00 -04:00
ipv4	erspan: fix invalid erspan version.	2018-05-17 15:48:49 -04:00
ipv6	net: ip6_gre: Fix headroom request in ip6erspan_tunnel_xmit()	2018-05-17 16:50:06 -04:00
iucv	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2018-03-23 11:31:58 -04:00
kcm	net: Drop pernet_operations::async	2018-03-27 13:18:09 -04:00
key	af_key: Always verify length of provided sadb_key	2018-04-09 07:06:38 +02:00
l2tp	l2tp: check sockaddr length in pppol2tp_connect()	2018-04-23 21:10:43 -04:00
l3mdev
lapb	treewide: Remove TIMER_FUNC_TYPE and TIMER_DATA_TYPE casts	2017-11-21 16:35:54 -08:00
llc	llc: better deal with too small mtu	2018-05-08 00:11:40 -04:00
mac80211	mac80211: use timeout from the AddBA response instead of the request	2018-05-07 20:35:15 +02:00
mac802154	net/mac802154: disambiguate mac80215 vs mac802154 trace events	2018-03-28 22:55:18 +02:00
mpls	net: Drop pernet_operations::async	2018-03-27 13:18:09 -04:00
ncsi	net/ncsi: check for null return from call to nla_nest_start	2018-03-27 10:38:26 -04:00
netfilter	netfilter: nf_tables: fix memory leak on error exit return	2018-05-14 00:21:59 +02:00
netlabel	netlabel: If PF_INET6, check sk_buff ip header version	2018-02-14 14:01:41 -05:00
netlink	net/netlink: make sure the headers line up actual value output	2018-05-04 13:00:57 -04:00
netrom	net: Use octal not symbolic permissions	2018-03-26 12:07:48 -04:00
nfc	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2018-02-19 18:46:11 -05:00
nsh	nsh: fix infinite loop	2018-05-04 12:54:38 -04:00
openvswitch	openvswitch: Don't swap table in nlattr_set() after OVS_ATTR_NESTED is found	2018-05-04 12:51:02 -04:00
packet	packet: in packet_snd start writing at link layer allocation	2018-05-13 20:19:27 -04:00
phonet	net: Drop pernet_operations::async	2018-03-27 13:18:09 -04:00
psample	MAINTAINERS: Update Yotam's E-mail	2017-11-01 12:19:03 +09:00
qrtr	net: qrtr: add MODULE_ALIAS_NETPROTO macro	2018-04-17 09:58:00 -04:00
rds	rds: do not leak kernel memory to user land	2018-05-03 11:26:14 -04:00
rfkill	rfkill: gpio: fix memory leak in probe error path	2018-05-07 15:01:40 +02:00
rose	net: Use octal not symbolic permissions	2018-03-26 12:07:48 -04:00
rxrpc	rxrpc: Trace UDP transmission failure	2018-05-10 23:26:01 +01:00
sched	net/sched: fix refcnt leak in the error path of tcf_vlan_init()	2018-05-16 14:41:44 -04:00
sctp	sctp: remove sctp_chunk_put from fail_mark err path in sctp_ulpevent_make_rcvmsg	2018-05-10 17:48:36 -04:00
smc	net/smc: check for missing nlattrs in SMC_PNETID messages	2018-05-14 16:40:45 -04:00
strparser	strparser: Do not call mod_delayed_work with a timeout of LONG_MAX	2018-04-22 21:09:16 -04:00
sunrpc	NFS client fixes for Linux 4.17-rc4	2018-05-11 13:56:43 -07:00
switchdev	net: bridge: Add/del switchdev object on host join/leave	2017-11-10 13:41:40 +09:00
tipc	tipc: fix one byte leak in tipc_sk_set_orig_addr()	2018-05-10 17:28:39 -04:00
tls	tls: don't use stack memory in a scatterlist	2018-05-17 14:49:38 -04:00
unix	af_unix: remove redundant lockdep class	2018-04-04 11:13:40 -04:00
vmw_vsock	VSOCK: make af_vsock.ko removable again	2018-04-17 09:44:30 -04:00
wimax	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
wireless	nl80211: Free connkeys on external authentication failure	2018-04-20 09:58:03 +02:00
x25	net: Use octal not symbolic permissions	2018-03-26 12:07:48 -04:00
xfrm	xfrm: Fix warning in xfrm6_tunnel_net_exit.	2018-04-16 07:50:09 +02:00
compat.c	net: support compat 64-bit time in {s,g}etsockopt	2018-04-27 19:46:06 -04:00
Kconfig	Staging/IIO patches for 4.16-rc1	2018-02-01 09:51:57 -08:00
Makefile	ipx: move Novell IPX protocol support into staging	2017-11-28 13:55:00 +01:00
socket.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial	2018-04-05 11:56:35 -07:00
sysctl_net.c	net: Drop pernet_operations::async	2018-03-27 13:18:09 -04:00