OpenE2K/linux
6
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
5e374fb626
linux/include/net
History
Eric W. Biederman b9f75f45a6 netns: Don't receive new packets in a dead network namespace. 
Alexey Dobriyan <adobriyan@gmail.com> writes:
> Subject: ICMP sockets destruction vs ICMP packets oops

> After icmp_sk_exit() nuked ICMP sockets, we get an interrupt.
> icmp_reply() wants ICMP socket.
>
> Steps to reproduce:
>
> 	launch shell in new netns
> 	move real NIC to netns
> 	setup routing
> 	ping -i 0
> 	exit from shell
>
> BUG: unable to handle kernel NULL pointer dereference at 0000000000000000
> IP: [<ffffffff803fce17>] icmp_sk+0x17/0x30
> PGD 17f3cd067 PUD 17f3ce067 PMD 0 
> Oops: 0000 [1] PREEMPT SMP DEBUG_PAGEALLOC
> CPU 0 
> Modules linked in: usblp usbcore
> Pid: 0, comm: swapper Not tainted 2.6.26-rc6-netns-ct #4
> RIP: 0010:[<ffffffff803fce17>]  [<ffffffff803fce17>] icmp_sk+0x17/0x30
> RSP: 0018:ffffffff8057fc30  EFLAGS: 00010286
> RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff81017c7db900
> RDX: 0000000000000034 RSI: ffff81017c7db900 RDI: ffff81017dc41800
> RBP: ffffffff8057fc40 R08: 0000000000000001 R09: 000000000000a815
> R10: 0000000000000000 R11: 0000000000000001 R12: ffffffff8057fd28
> R13: ffffffff8057fd00 R14: ffff81017c7db938 R15: ffff81017dc41800
> FS:  0000000000000000(0000) GS:ffffffff80525000(0000) knlGS:0000000000000000
> CS:  0010 DS: 0018 ES: 0018 CR0: 000000008005003b
> CR2: 0000000000000000 CR3: 000000017fcda000 CR4: 00000000000006e0
> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
> Process swapper (pid: 0, threadinfo ffffffff8053a000, task ffffffff804fa4a0)
> Stack:  0000000000000000 ffff81017c7db900 ffffffff8057fcf0 ffffffff803fcfe4
>  ffffffff804faa38 0000000000000246 0000000000005a40 0000000000000246
>  000000000001ffff ffff81017dd68dc0 0000000000005a40 0000000055342436
> Call Trace:
>  <IRQ>  [<ffffffff803fcfe4>] icmp_reply+0x44/0x1e0
>  [<ffffffff803d3a0a>] ? ip_route_input+0x23a/0x1360
>  [<ffffffff803fd645>] icmp_echo+0x65/0x70
>  [<ffffffff803fd300>] icmp_rcv+0x180/0x1b0
>  [<ffffffff803d6d84>] ip_local_deliver+0xf4/0x1f0
>  [<ffffffff803d71bb>] ip_rcv+0x33b/0x650
>  [<ffffffff803bb16a>] netif_receive_skb+0x27a/0x340
>  [<ffffffff803be57d>] process_backlog+0x9d/0x100
>  [<ffffffff803bdd4d>] net_rx_action+0x18d/0x250
>  [<ffffffff80237be5>] __do_softirq+0x75/0x100
>  [<ffffffff8020c97c>] call_softirq+0x1c/0x30
>  [<ffffffff8020f085>] do_softirq+0x65/0xa0
>  [<ffffffff80237af7>] irq_exit+0x97/0xa0
>  [<ffffffff8020f198>] do_IRQ+0xa8/0x130
>  [<ffffffff80212ee0>] ? mwait_idle+0x0/0x60
>  [<ffffffff8020bc46>] ret_from_intr+0x0/0xf
>  <EOI>  [<ffffffff80212f2c>] ? mwait_idle+0x4c/0x60
>  [<ffffffff80212f23>] ? mwait_idle+0x43/0x60
>  [<ffffffff8020a217>] ? cpu_idle+0x57/0xa0
>  [<ffffffff8040f380>] ? rest_init+0x70/0x80
> Code: 10 5b 41 5c 41 5d 41 5e c9 c3 66 2e 0f 1f 84 00 00 00 00 00 55 48 89 e5 53
> 48 83 ec 08 48 8b 9f 78 01 00 00 e8 2b c7 f1 ff 89 c0 <48> 8b 04 c3 48 83 c4 08
> 5b c9 c3 66 66 66 66 66 2e 0f 1f 84 00
> RIP  [<ffffffff803fce17>] icmp_sk+0x17/0x30
>  RSP <ffffffff8057fc30>
> CR2: 0000000000000000
> ---[ end trace ea161157b76b33e8 ]---
> Kernel panic - not syncing: Aiee, killing interrupt handler!

Receiving packets while we are cleaning up a network namespace is a
racy proposition. It is possible when the packet arrives that we have
removed some but not all of the state we need to fully process it.  We
have the choice of either playing wack-a-mole with the cleanup routines
or simply dropping packets when we don't have a network namespace to
handle them.

Since the check looks inexpensive in netif_receive_skb let's just
drop the incoming packets.

Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2008-06-20 22:16:51 -07:00
..
9p 9p: fix error path during early mount 2008-05-14 19:23:27 -05:00
bluetooth bluetooth: Make hci_sock_cleanup() return void 2008-03-05 18:47:03 -08:00
irda irda: Fix a misalign access issue. (v2) 2008-05-13 23:25:57 -07:00
iucv
netfilter netfilter: nf_nat: fix RCU races 2008-06-17 15:51:47 -07:00
netns [NETNS]: The generic per-net pointers. 2008-04-15 00:36:08 -07:00
sctp sctp: Fix ECN markings for IPv6 2008-06-04 12:40:15 -07:00
tc_act
tipc [TIPC]: Overhaul of socket locking logic 2008-04-15 00:22:02 -07:00
act_api.h
addrconf.h [IPV6] ADDRCONF: Allow longer lifetime on 64bit archs. 2008-06-05 04:02:34 +09:00
af_rxrpc.h
af_unix.h
ah.h
arp.h
atmclip.h
ax25.h [AX25] ax25_ds_timer: use mod_timer instead of add_timer 2008-02-12 17:53:34 -08:00
ax88796.h
cfg80211.h nl80211/cfg80211: support for mesh, sta dumping 2008-03-06 15:30:41 -05:00
checksum.h
cipso_ipv4.h
compat.h net: Add compat support for getsockopt (MCAST_MSFILTER) 2008-04-29 03:23:22 -07:00
datalink.h
dn_dev.h
dn_fib.h
dn_neigh.h
dn_nsp.h
dn_route.h
dn.h
dsfield.h
dst.h [NET]: uninline dst_release 2008-03-27 17:53:31 -07:00
esp.h
fib_rules.h [NETNS]: Add netns refcnt debug to fib rules. 2008-04-16 02:01:56 -07:00
flow.h
gen_stats.h
genetlink.h netlink: Improve returned error codes 2008-06-03 16:36:54 -07:00
icmp.h [NETNS][ICMP]: Move ICMP sysctls on struct net. 2008-03-26 01:55:37 -07:00
ieee80211_crypt.h
ieee80211_radiotap.h
ieee80211.h include/net/ieee80211.h - remove duplicate include 2008-03-13 19:32:31 -04:00
if_inet6.h
inet6_connection_sock.h
inet6_hashtables.h
inet_common.h [NETNS]: Inet control socket should not hold a namespace. 2008-04-03 14:28:30 -07:00
inet_connection_sock.h [INET]: Rename inet_csk_ctl_sock_create to inet_ctl_sock_create. 2008-04-03 14:22:32 -07:00
inet_ecn.h [IPV6]: Use appropriate sock tclass setting for routing lookup. 2008-04-13 23:40:51 -07:00
inet_frag.h [NET]: Rename inet_frag.h identifiers COMPLETE, FIRST_IN, LAST_IN to INET_FRAG_* 2008-03-28 16:35:27 -07:00
inet_hashtables.h [INET]: Uninline the __inet_inherit_port call. 2008-04-17 23:18:15 -07:00
inet_sock.h inet{6}_request_sock: Init ->opt and ->pktopts in the constructor 2008-06-10 12:39:35 -07:00
inet_timewait_sock.h [NETNS]: Compilation warnings under CONFIG_NET_NS. 2008-03-26 00:48:17 -07:00
inetpeer.h
ip6_checksum.h
ip6_fib.h [NETNS][IPV6] rt6_info - move rt6_info structure inside the namespace 2008-03-04 13:48:30 -08:00
ip6_route.h [IPV6]: Make address arguments const. 2008-04-12 13:43:18 +09:00
ip6_tunnel.h [IP_TUNNEL]: Don't limit the number of tunnels with generic name explicitly. 2008-02-23 20:19:20 -08:00
ip_fib.h
ip_vs.h ipvs: fix oops in backup for fwmark conn templates 2008-04-29 03:21:23 -07:00
ip.h ip: Make use of the inline function dst_metric_locked() 2008-05-04 22:12:43 -07:00
ipcomp.h
ipconfig.h
ipip.h [IPV6] SIT: Add SIOCGETPRL ioctl to get/dump PRL. 2008-04-03 10:06:00 +09:00
ipv6.h ipv6: Drop packets for loopback address from outside of the box. 2008-06-19 16:33:57 -07:00
ipx.h
iw_handler.h
lapb.h
llc_c_ac.h
llc_c_ev.h
llc_c_st.h
llc_conn.h
llc_if.h [LLC]: Kill static inline llc_addrany 2008-02-29 11:46:17 -08:00
llc_pdu.h [LLC]: skb allocation size for responses 2008-03-31 21:02:47 -07:00
llc_s_ac.h
llc_s_ev.h
llc_s_st.h
llc_sap.h [LLC]: skb allocation size for responses 2008-03-31 21:02:47 -07:00
llc.h [LLC]: station source mac address 2008-03-28 16:28:36 -07:00
mac80211.h mac80211: Add RTNL version of ieee80211_iterate_active_interfaces 2008-05-16 17:15:09 -04:00
mip6.h [IPV6] MIP6: Use our standard definitions for paddings. 2008-04-12 13:43:22 +09:00
ndisc.h ndisc: Add missing strategies for per-device retrans timer/reachable time settings. 2008-05-19 16:25:42 -07:00
neighbour.h Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6 2008-03-27 18:48:56 -07:00
net_namespace.h netns: Don't receive new packets in a dead network namespace. 2008-06-20 22:16:51 -07:00
netdma.h
netevent.h
netlabel.h Audit: collect sessionid in netlink messages 2008-04-28 06:18:03 -04:00
netlink.h netlink: Improve returned error codes 2008-06-03 16:36:54 -07:00
netrom.h
nexthop.h
p8022.h
pkt_cls.h [PKT_SCHED]: Pass real namespace in net scheduler classifiers. 2008-03-27 16:53:37 -07:00
pkt_sched.h
protocol.h [NETNS]: Drop packets in the non-initial namespace on the per/protocol basis. 2008-03-24 15:33:00 -07:00
psnap.h
raw.h [RAW]: Add raw_hashinfo member on struct proto. 2008-03-22 16:56:51 -07:00
rawv6.h
red.h
request_sock.h tcp: Revert 'process defer accept as established' changes. 2008-06-12 16:34:35 -07:00
rose.h
route.h ipv4: Update MTU to all related cache entries in ip_rt_frag_needed() 2008-04-29 03:32:25 -07:00
rtnetlink.h [RTNL]: Introduce the rtnl_kill_links helper. 2008-04-16 00:46:52 -07:00
sch_generic.h
scm.h
slhc_vj.h
snmp.h
sock.h [NETNS]: Add netns refcnt debug for kernel sockets. 2008-04-16 01:59:46 -07:00
syncppp.h syncppp: Fix crashes. 2008-05-12 03:29:11 -07:00
tcp_states.h
tcp.h tcp: Revert 'process defer accept as established' changes. 2008-06-12 16:34:35 -07:00
timewait_sock.h
transp_v6.h [IPV6] NETNS: Handle ancillary data in appropriate namespace. 2008-06-05 04:02:36 +09:00
udp.h [IPV6]: inet_sk(sk)->cork.opt leak 2008-06-05 04:02:38 +09:00
udplite.h [UDP]: Revert udplite and code split. 2008-03-06 16:22:02 -08:00
wext.h
wireless.h cfg80211: don't export ieee80211_get_channel 2008-03-27 16:03:20 -04:00
x25.h
x25device.h
xfrm.h xfrm: convert empty xfrm_audit_* macros to functions 2008-05-03 21:03:01 -07:00