David Lebrun af3b5158b8 ipv6: sr: fix BUG due to headroom too small after SRH push ... When a locally generated packet receives an SRH with two or more segments, the remaining headroom is too small to push an ethernet header. This patch ensures that the headroom is large enough after SRH push. The BUG generated the following trace. [ 192.950285] skbuff: skb_under_panic: text:ffffffff81809675 len:198 put:14 head:ffff88006f306400 data:ffff88006f3063fa tail:0xc0 end:0x2c0 dev:A-1 [ 192.952456] ------------[ cut here ]------------ [ 192.953218] kernel BUG at net/core/skbuff.c:105! [ 192.953411] invalid opcode: 0000 [#1] PREEMPT SMP [ 192.953411] Modules linked in: [ 192.953411] CPU: 5 PID: 3433 Comm: ping6 Not tainted 4.11.0-rc3+ #237 [ 192.953411] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.10.1-0-g8891697-prebuilt.qemu-project.org 04/01/2014 [ 192.953411] task: ffff88007c2d42c0 task.stack: ffffc90000ef4000 [ 192.953411] RIP: 0010:skb_panic+0x61/0x70 [ 192.953411] RSP: 0018:ffffc90000ef7900 EFLAGS: 00010286 [ 192.953411] RAX: 0000000000000085 RBX: 00000000000086dd RCX: 0000000000000201 [ 192.953411] RDX: 0000000080000201 RSI: ffffffff81d104c5 RDI: 00000000ffffffff [ 192.953411] RBP: ffffc90000ef7920 R08: 0000000000000001 R09: 0000000000000000 [ 192.953411] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 192.953411] R13: ffff88007c5a4000 R14: ffff88007b363d80 R15: 00000000000000b8 [ 192.953411] FS: 00007f94b558b700(0000) GS:ffff88007fd40000(0000) knlGS:0000000000000000 [ 192.953411] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 192.953411] CR2: 00007fff5ecd5080 CR3: 0000000074141000 CR4: 00000000001406e0 [ 192.953411] Call Trace: [ 192.953411] skb_push+0x3b/0x40 [ 192.953411] eth_header+0x25/0xc0 [ 192.953411] neigh_resolve_output+0x168/0x230 [ 192.953411] ? ip6_finish_output2+0x242/0x8f0 [ 192.953411] ip6_finish_output2+0x242/0x8f0 [ 192.953411] ? ip6_finish_output2+0x76/0x8f0 [ 192.953411] ip6_finish_output+0xa8/0x1d0 [ 192.953411] ip6_output+0x64/0x2d0 [ 192.953411] ? ip6_output+0x73/0x2d0 [ 192.953411] ? ip6_dst_check+0xb5/0xc0 [ 192.953411] ? dst_cache_per_cpu_get.isra.2+0x40/0x80 [ 192.953411] seg6_output+0xb0/0x220 [ 192.953411] lwtunnel_output+0xcf/0x210 [ 192.953411] ? lwtunnel_output+0x59/0x210 [ 192.953411] ip6_local_out+0x38/0x70 [ 192.953411] ip6_send_skb+0x2a/0xb0 [ 192.953411] ip6_push_pending_frames+0x48/0x50 [ 192.953411] rawv6_sendmsg+0xa39/0xf10 [ 192.953411] ? __lock_acquire+0x489/0x890 [ 192.953411] ? __mutex_lock+0x1fc/0x970 [ 192.953411] ? __lock_acquire+0x489/0x890 [ 192.953411] ? __mutex_lock+0x1fc/0x970 [ 192.953411] ? tty_ioctl+0x283/0xec0 [ 192.953411] inet_sendmsg+0x45/0x1d0 [ 192.953411] ? _copy_from_user+0x54/0x80 [ 192.953411] sock_sendmsg+0x33/0x40 [ 192.953411] SYSC_sendto+0xef/0x170 [ 192.953411] ? entry_SYSCALL_64_fastpath+0x5/0xc2 [ 192.953411] ? trace_hardirqs_on_caller+0x12b/0x1b0 [ 192.953411] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 192.953411] SyS_sendto+0x9/0x10 [ 192.953411] entry_SYSCALL_64_fastpath+0x1f/0xc2 [ 192.953411] RIP: 0033:0x7f94b453db33 [ 192.953411] RSP: 002b:00007fff5ecd0578 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 192.953411] RAX: ffffffffffffffda RBX: 00007fff5ecd16e0 RCX: 00007f94b453db33 [ 192.953411] RDX: 0000000000000040 RSI: 000055a78352e9c0 RDI: 0000000000000003 [ 192.953411] RBP: 00007fff5ecd1690 R08: 000055a78352c940 R09: 000000000000001c [ 192.953411] R10: 0000000000000000 R11: 0000000000000246 R12: 000055a783321e10 [ 192.953411] R13: 000055a7839890c0 R14: 0000000000000004 R15: 0000000000000000 [ 192.953411] Code: 00 00 48 89 44 24 10 8b 87 c4 00 00 00 48 89 44 24 08 48 8b 87 d8 00 00 00 48 c7 c7 90 58 d2 81 48 89 04 24 31 c0 e8 4f 70 9a ff <0f> 0b 0f 1f 00 66 2e 0f 1f 84 00 00 00 00 00 48 8b 97 d8 00 00 [ 192.953411] RIP: skb_panic+0x61/0x70 RSP: ffffc90000ef7900 [ 193.000186] ---[ end trace bd0b89fabdf2f92c ]--- [ 193.000951] Kernel panic - not syncing: Fatal exception in interrupt [ 193.001137] Kernel Offset: disabled [ 193.001169] ---[ end Kernel panic - not syncing: Fatal exception in interrupt Fixes: 19d5a26f5e ("ipv6: sr: expand skb head only if necessary") Signed-off-by: David Lebrun <david.lebrun@uclouvain.be> Signed-off-by: David S. Miller <davem@davemloft.net>		2017-04-17 15:33:53 -04:00
..
ila	netlink: pass extended ACK struct to parsing functions	2017-04-13 13:58:22 -04:00
netfilter	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-03-23 16:41:27 -07:00
addrconf.c	Merge branch 'for-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next	2017-04-17 15:00:57 -04:00
addrconf_core.c
addrlabel.c	netlink: pass extended ACK struct to parsing functions	2017-04-13 13:58:22 -04:00
af_inet6.c	ipv6: add support for NETDEV_RESEND_IGMP event	2017-03-28 22:02:21 -07:00
ah6.c	IPsec: do not ignore crypto err in ah6 input	2017-01-16 12:57:48 +01:00
anycast.c
calipso.c
datagram.c	ipv6: Handle IPv4-mapped src to in6addr_any dst.	2017-02-14 12:13:51 -05:00
esp6.c	esp: Introduce a helper to setup the trailer	2017-01-17 10:23:08 +01:00
esp6_offload.c	esp: Add a software GRO codepath	2017-02-15 11:04:11 +01:00
exthdrs.c	ipv6: sr: remove cleanup flag and fix HMAC computation	2017-02-03 11:05:23 -05:00
exthdrs_core.c
exthdrs_offload.c
fib6_rules.c
fou6.c
icmp.c	net: for rate-limited ICMP replies save one atomic operation	2017-01-09 15:49:12 -05:00
inet6_connection_sock.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-01-28 10:33:06 -05:00
inet6_hashtables.c	inet: collapse ipv4/v6 rcv_saddr_equal functions into one	2017-01-18 13:04:28 -05:00
ip6_checksum.c
ip6_fib.c	ipv6: make ECMP route replacement less greedy	2017-03-13 12:16:17 -07:00
ip6_flowlabel.c	Replace <asm/uaccess.h> with <linux/uaccess.h> globally	2016-12-24 11:46:01 -08:00
ip6_gre.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-02-07 16:29:30 -05:00
ip6_icmp.c
ip6_input.c	net: Add sysctl to toggle early demux for tcp and udp	2017-03-24 13:17:07 -07:00
ip6_offload.c	net/tunnel: set inner protocol in network gro hooks	2017-03-09 13:19:52 -08:00
ip6_offload.h
ip6_output.c	ipv6: avoid write to a possibly cloned skb	2017-03-13 12:53:35 -07:00
ip6_tunnel.c	ipv6: pointer math error in ip6_tnl_parse_tlv_enc_lim()	2017-02-01 12:27:33 -05:00
ip6_udp_tunnel.c
ip6_vti.c	Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec	2017-03-07 15:00:37 -08:00
ip6mr.c	net: ipv6: Refactor inet6_netconf_notify_devconf to take event	2017-03-28 22:32:42 -07:00
ipcomp6.c
ipv6_sockglue.c	net: Allow IP_MULTICAST_IF to set index to L3 slave	2016-12-30 15:24:47 -05:00
Kconfig	ipv6: sr: select DST_CACHE by default	2017-03-27 16:05:06 -07:00
Makefile	esp: Add a software GRO codepath	2017-02-15 11:04:11 +01:00
mcast.c	ipv6: add support for NETDEV_RESEND_IGMP event	2017-03-28 22:02:21 -07:00
mcast_snoop.c
mip6.c	ktime: Get rid of ktime_equal()	2016-12-25 17:21:23 +01:00
ndisc.c	net: ipv6: send unsolicited NA on admin up	2017-04-17 12:44:55 -04:00
netfilter.c
output_core.c	ipv6: Set skb->protocol properly for local output	2016-12-02 12:34:22 -05:00
ping.c	ipv6: remove unnecessary inet6_sk check	2016-12-29 12:05:49 -05:00
proc.c
protocol.c	net: Add sysctl to toggle early demux for tcp and udp	2017-03-24 13:17:07 -07:00
raw.c	net: use dst_confirm_neigh for UDP, RAW, ICMP, L2TP	2017-02-07 13:07:47 -05:00
reassembly.c
route.c	netlink: pass extended ACK struct to parsing functions	2017-04-13 13:58:22 -04:00
seg6.c	ipv6: seg6_genl_set_tunsrc() must check kmemdup() return value	2017-01-20 11:07:48 -05:00
seg6_hmac.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-02-07 16:29:30 -05:00
seg6_iptunnel.c	ipv6: sr: fix BUG due to headroom too small after SRH push	2017-04-17 15:33:53 -04:00
sit.c	sit: fix a double free on error path	2017-02-08 13:12:22 -05:00
syncookies.c	syncookies: use SipHash in place of SHA1	2017-01-09 13:58:57 -05:00
sysctl_net_ipv6.c
tcp_ipv6.c	tcp: Record Rx hash and NAPI ID in tcp_child_process	2017-03-24 20:49:30 -07:00
tcpv6_offload.c
tunnel6.c
udp.c	net: Add sysctl to toggle early demux for tcp and udp	2017-03-24 13:17:07 -07:00
udp_impl.h	udplite: call proper backlog handlers	2016-11-24 15:32:14 -05:00
udp_offload.c
udplite.c	udplite: call proper backlog handlers	2016-11-24 15:32:14 -05:00
xfrm6_input.c	esp: Add a software GRO codepath	2017-02-15 11:04:11 +01:00
xfrm6_mode_beet.c
xfrm6_mode_ro.c
xfrm6_mode_transport.c	esp: Add a software GRO codepath	2017-02-15 11:04:11 +01:00
xfrm6_mode_tunnel.c
xfrm6_output.c
xfrm6_policy.c	xfrm: policy: make policy backend const	2017-02-09 10:22:19 +01:00
xfrm6_protocol.c	xfrm: input: constify xfrm_input_afinfo	2017-02-09 10:22:17 +01:00
xfrm6_state.c
xfrm6_tunnel.c