Hannes Frederic Sowa 75a493e60a ipv6: ip6_append_data_mtu did not care about pmtudisc and frag_size ... If the socket had an IPV6_MTU value set, ip6_append_data_mtu lost track of this when appending the second frame on a corked socket. This results in the following splat: [37598.993962] ------------[ cut here ]------------ [37598.994008] kernel BUG at net/core/skbuff.c:2064! [37598.994008] invalid opcode: 0000 [#1] SMP [37598.994008] Modules linked in: tcp_lp uvcvideo videobuf2_vmalloc videobuf2_memops videobuf2_core videodev media vfat fat usb_storage fuse ebtable_nat xt_CHECKSUM bridge stp llc ipt_MASQUERADE nf_conntrack_netbios_ns nf_conntrack_broadcast ip6table_mangle ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 iptable_nat +nf_nat_ipv4 nf_nat iptable_mangle nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack ebtable_filter ebtables ip6table_filter ip6_tables be2iscsi iscsi_boot_sysfs bnx2i cnic uio cxgb4i cxgb4 cxgb3i cxgb3 mdio libcxgbi ib_iser rdma_cm ib_addr iw_cm ib_cm ib_sa ib_mad ib_core iscsi_tcp libiscsi_tcp libiscsi +scsi_transport_iscsi rfcomm bnep iTCO_wdt iTCO_vendor_support snd_hda_codec_conexant arc4 iwldvm mac80211 snd_hda_intel acpi_cpufreq mperf coretemp snd_hda_codec microcode cdc_wdm cdc_acm [37598.994008] snd_hwdep cdc_ether snd_seq snd_seq_device usbnet mii joydev btusb snd_pcm bluetooth i2c_i801 e1000e lpc_ich mfd_core ptp iwlwifi pps_core snd_page_alloc mei cfg80211 snd_timer thinkpad_acpi snd tpm_tis soundcore rfkill tpm tpm_bios vhost_net tun macvtap macvlan kvm_intel kvm uinput binfmt_misc +dm_crypt i915 i2c_algo_bit drm_kms_helper drm i2c_core wmi video [37598.994008] CPU 0 [37598.994008] Pid: 27320, comm: t2 Not tainted 3.9.6-200.fc18.x86_64 #1 LENOVO 27744PG/27744PG [37598.994008] RIP: 0010:[<ffffffff815443a5>] [<ffffffff815443a5>] skb_copy_and_csum_bits+0x325/0x330 [37598.994008] RSP: 0018:ffff88003670da18 EFLAGS: 00010202 [37598.994008] RAX: ffff88018105c018 RBX: 0000000000000004 RCX: 00000000000006c0 [37598.994008] RDX: ffff88018105a6c0 RSI: ffff88018105a000 RDI: ffff8801e1b0aa00 [37598.994008] RBP: ffff88003670da78 R08: 0000000000000000 R09: ffff88018105c040 [37598.994008] R10: ffff8801e1b0aa00 R11: 0000000000000000 R12: 000000000000fff8 [37598.994008] R13: 00000000000004fc R14: 00000000ffff0504 R15: 0000000000000000 [37598.994008] FS: 00007f28eea59740(0000) GS:ffff88023bc00000(0000) knlGS:0000000000000000 [37598.994008] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b [37598.994008] CR2: 0000003d935789e0 CR3: 00000000365cb000 CR4: 00000000000407f0 [37598.994008] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [37598.994008] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [37598.994008] Process t2 (pid: 27320, threadinfo ffff88003670c000, task ffff88022c162ee0) [37598.994008] Stack: [37598.994008] ffff88022e098a00 ffff88020f973fc0 0000000000000008 00000000000004c8 [37598.994008] ffff88020f973fc0 00000000000004c4 ffff88003670da78 ffff8801e1b0a200 [37598.994008] 0000000000000018 00000000000004c8 ffff88020f973fc0 00000000000004c4 [37598.994008] Call Trace: [37598.994008] [<ffffffff815fc21f>] ip6_append_data+0xccf/0xfe0 [37598.994008] [<ffffffff8158d9f0>] ? ip_copy_metadata+0x1a0/0x1a0 [37598.994008] [<ffffffff81661f66>] ? _raw_spin_lock_bh+0x16/0x40 [37598.994008] [<ffffffff8161548d>] udpv6_sendmsg+0x1ed/0xc10 [37598.994008] [<ffffffff812a2845>] ? sock_has_perm+0x75/0x90 [37598.994008] [<ffffffff815c3693>] inet_sendmsg+0x63/0xb0 [37598.994008] [<ffffffff812a2973>] ? selinux_socket_sendmsg+0x23/0x30 [37598.994008] [<ffffffff8153a450>] sock_sendmsg+0xb0/0xe0 [37598.994008] [<ffffffff810135d1>] ? __switch_to+0x181/0x4a0 [37598.994008] [<ffffffff8153d97d>] sys_sendto+0x12d/0x180 [37598.994008] [<ffffffff810dfb64>] ? __audit_syscall_entry+0x94/0xf0 [37598.994008] [<ffffffff81020ed1>] ? syscall_trace_enter+0x231/0x240 [37598.994008] [<ffffffff8166a7e7>] tracesys+0xdd/0xe2 [37598.994008] Code: fe 07 00 00 48 c7 c7 04 28 a6 81 89 45 a0 4c 89 4d b8 44 89 5d a8 e8 1b ac b1 ff 44 8b 5d a8 4c 8b 4d b8 8b 45 a0 e9 cf fe ff ff <0f> 0b 66 0f 1f 84 00 00 00 00 00 66 66 66 66 90 55 48 89 e5 48 [37598.994008] RIP [<ffffffff815443a5>] skb_copy_and_csum_bits+0x325/0x330 [37598.994008] RSP <ffff88003670da18> [37599.007323] ---[ end trace d69f6a17f8ac8eee ]--- While there, also check if path mtu discovery is activated for this socket. The logic was adapted from ip6_append_data when first writing on the corked socket. This bug was introduced with commit 0c1833797a ("ipv6: fix incorrect ipsec fragment"). v2: a) Replace IPV6_PMTU_DISC_DO with IPV6_PMTUDISC_PROBE. b) Don't pass ipv6_pinfo to ip6_append_data_mtu (suggestion by Gao feng, thanks!). c) Change mtu to unsigned int, else we get a warning about non-matching types because of the min()-macro type-check. Acked-by: Gao feng <gaofeng@cn.fujitsu.com> Cc: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org> Signed-off-by: David S. Miller <davem@davemloft.net>		2013-07-02 12:44:18 -07:00
..
9p	zero copy error fix	2013-06-10 17:35:25 -07:00
802	net/802/mrp: fix lockdep splat	2013-05-14 13:02:30 -07:00
8021q	net: pass info struct via netdevice notifier	2013-05-28 13:11:01 -07:00
appletalk	net: pass info struct via netdevice notifier	2013-05-28 13:11:01 -07:00
atm	net: always pass struct netdev_notifier_info to netdevice notifiers	2013-05-28 21:58:54 -07:00
ax25	net: Convert uses of typedef ctl_table to struct ctl_table	2013-06-13 02:36:09 -07:00
batman-adv	net: Unmap fragment page once iterator is done	2013-06-24 01:46:01 -07:00
bluetooth	Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless	2013-06-26 12:01:42 -04:00
bridge	bridge: check for zero ether address in fdb add	2013-06-25 16:59:27 -07:00
caif	net: pass info struct via netdevice notifier	2013-05-28 13:11:01 -07:00
can	net: pass info struct via netdevice notifier	2013-05-28 13:11:01 -07:00
ceph	libceph: must hold mutex for reset_changed_osds()	2013-05-17 12:45:40 -05:00
core	ethtool: make .get_dump_data() harder to misuse by drivers	2013-07-02 00:15:56 -07:00
dcb	rtnetlink: Remove passing of attributes into rtnl_doit functions	2013-03-22 10:31:16 -04:00
dccp	tcp: Remove TCPCT	2013-03-17 14:35:13 -04:00
decnet	net: Convert uses of typedef ctl_table to struct ctl_table	2013-06-13 02:36:09 -07:00
dns_resolver	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security	2012-12-16 15:40:50 -08:00
dsa	dsa: fix freeing of sparse port allocation	2013-03-25 12:23:41 -04:00
ethernet	net: add ETH_P_802_3_MIN	2013-03-28 01:20:42 -04:00
ieee802154	net: pass info struct via netdevice notifier	2013-05-28 13:11:01 -07:00
ipv4	ipv6: call udp_push_pending_frames when uncorking a socket with AF_INET pending data	2013-07-02 12:44:18 -07:00
ipv6	ipv6: ip6_append_data_mtu did not care about pmtudisc and frag_size	2013-07-02 12:44:18 -07:00
ipx	net: pass info struct via netdevice notifier	2013-05-28 13:11:01 -07:00
irda	net: Convert uses of typedef ctl_table to struct ctl_table	2013-06-13 02:36:09 -07:00
iucv	net: pass info struct via netdevice notifier	2013-05-28 13:11:01 -07:00
key	xfrm: force a garbage collection after deleting a policy	2013-05-31 17:30:07 -07:00
l2tp	l2tp: add missing .owner to struct pppox_proto	2013-07-02 01:11:56 -07:00
lapb	net/lapb: remove depends on CONFIG_EXPERIMENTAL	2013-01-11 11:40:01 -08:00
llc	llc: Fix missing msg_namelen update in llc_ui_recvmsg()	2013-04-07 16:28:01 -04:00
mac80211	Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next into for-davem	2013-06-28 13:18:21 -04:00
mac802154	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2013-04-30 03:55:20 -04:00
mpls	MPLS: Add limited GSO support	2013-05-27 22:50:59 -07:00
netfilter	netfilter: nf_queue: add NFQA_SKB_CSUM_NOTVERIFIED info flag	2013-06-30 18:15:48 +02:00
netlabel	net: pass info struct via netdevice notifier	2013-05-28 13:11:01 -07:00
netlink	netlink: fix splat in skb_clone with large messages	2013-06-27 22:44:16 -07:00
netrom	net: Convert uses of typedef ctl_table to struct ctl_table	2013-06-13 02:36:09 -07:00
nfc	NFC: llcp: Fix the well known services endianness	2013-06-14 13:45:10 +02:00
openvswitch	openvswitch: Add Kconfig dependency on GRE-DEMUX.	2013-07-01 13:19:43 -07:00
packet	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2013-06-19 16:49:39 -07:00
phonet	net: Convert uses of typedef ctl_table to struct ctl_table	2013-06-13 02:36:09 -07:00
rds	net: Convert uses of typedef ctl_table to struct ctl_table	2013-06-13 02:36:09 -07:00
rfkill	Merge branch 'for-john' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211-next	2013-04-22 14:58:14 -04:00
rose	net: Convert uses of typedef ctl_table to struct ctl_table	2013-06-13 02:36:09 -07:00
rxrpc	Driver core patches for 3.9-rc1	2013-02-21 12:05:51 -08:00
sched	netem: use rb tree to implement the time queue	2013-07-01 18:07:15 -07:00
sctp	net: sctp: get rid of SCTP_DBG_TSNS entirely	2013-07-02 00:08:03 -07:00
sunrpc	net: Convert uses of typedef ctl_table to struct ctl_table	2013-06-13 02:36:09 -07:00
tipc	tipc: remove dev_base_lock use from enable_bearer	2013-06-17 15:53:01 -07:00
unix	net: Convert uses of typedef ctl_table to struct ctl_table	2013-06-13 02:36:09 -07:00
vmw_vsock	VSOCK: Fix VSOCK_HASH and VSOCK_CONN_HASH	2013-06-23 23:51:48 -07:00
wimax	…
wireless	Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next into for-davem	2013-06-28 13:18:21 -04:00
x25	x25: Fix broken locking in ioctl error paths.	2013-07-01 18:15:25 -07:00
xfrm	Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next	2013-06-26 13:23:13 -07:00
Kconfig	net: remove NET_LL_RX_POLL config menue	2013-06-17 15:48:14 -07:00
Makefile	MPLS: Add limited GSO support	2013-05-27 22:50:59 -07:00
compat.c	net: Unbreak compat_sys_{send,recv}msg	2013-06-06 11:52:14 -07:00
nonet.c	…
socket.c	net: poll/select low latency socket support	2013-06-25 16:35:52 -07:00
sysctl_net.c	user_ns: get rid of duplicate code in net_ctl_permissions	2012-11-18 20:32:45 -05:00