Revision 1d325d217c7f190a42fb620ead20bb240fc16af0 authored by Florian Westphal on 16 September 2015, 15:26:14 UTC, committed by David S. Miller on 18 September 2015, 04:36:15 UTC
David Woodhouse reports skb_under_panic when we try to push ethernet header to fragmented ipv6 skbs: skbuff: skb_under_panic: text:c1277f1e len:1294 put:14 head:dec98000 data:dec97ffc tail:0xdec9850a end:0xdec98f40 dev:br-lan [..] ip6_finish_output2+0x196/0x4da David further debugged this: [..] offending fragments were arriving here with skb_headroom(skb)==10. Which is reasonable, being the Solos ADSL card's header of 8 bytes followed by 2 bytes of PPP frame type. The problem is that if netfilter ipv6 defragmentation is used, skb_cow() in ip6_forward will only see reassembled skb. Therefore, headroom is overestimated by 8 bytes (we pulled fragment header) and we don't check the skbs in the frag_list either. We can't do these checks in netfilter defrag since outdev isn't known yet. Furthermore, existing tests in ip6_fragment did not consider the fragment or ipv6 header size when checking headroom of the fraglist skbs. While at it, also fix a skb leak on memory allocation -- ip6_fragment must consume the skb. I tested this e1000 driver hacked to not allocate additional headroom (we end up in slowpath, since LL_RESERVED_SPACE is 16). If 2 bytes of headroom are allocated, fastpath is taken (14 byte ethernet header was pulled, so 16 byte headroom available in all fragments). Reported-by: David Woodhouse <dwmw2@infradead.org> Diagnosed-by: David Woodhouse <dwmw2@infradead.org> Signed-off-by: Florian Westphal <fw@strlen.de> Tested-by: David Woodhouse <David.Woodhouse@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net>
1 parent ce816eb
File | Mode | Size |
---|---|---|
Kconfig | -rw-r--r-- | 65.1 KB |
Makefile | -rw-r--r-- | 1.1 KB |
calibrate.c | -rw-r--r-- | 8.5 KB |
do_mounts.c | -rw-r--r-- | 14.6 KB |
do_mounts.h | -rw-r--r-- | 1.4 KB |
do_mounts_initrd.c | -rw-r--r-- | 3.4 KB |
do_mounts_md.c | -rw-r--r-- | 8.2 KB |
do_mounts_rd.c | -rw-r--r-- | 8.7 KB |
init_task.c | -rw-r--r-- | 728 bytes |
initramfs.c | -rw-r--r-- | 13.8 KB |
main.c | -rw-r--r-- | 24.7 KB |
noinitramfs.c | -rw-r--r-- | 1.5 KB |
version.c | -rw-r--r-- | 1.2 KB |
![swh spinner](/static/img/swh-spinner.gif)
Computing file changes ...