https://github.com/torvalds/linux
Revision 3ba3458fb9c050718b95275a3310b74415e767e2 authored by Jakub Sitnicki on 05 April 2016, 16:41:08 UTC, committed by David S. Miller on 08 April 2016, 02:41:37 UTC
When sending a UDPv6 message longer than MTU, account for the length of fragmentable IPv6 extension headers in skb->network_header offset. Same as we do in alloc_new_skb path in __ip6_append_data(). This ensures that later on __ip6_make_skb() will make space in headroom for fragmentable extension headers: /* move skb->data to ip header from ext header */ if (skb->data < skb_network_header(skb)) __skb_pull(skb, skb_network_offset(skb)); Prevents a splat due to skb_under_panic: skbuff: skb_under_panic: text:ffffffff8143397b len:2126 put:14 \ head:ffff880005bacf50 data:ffff880005bacf4a tail:0x48 end:0xc0 dev:lo ------------[ cut here ]------------ kernel BUG at net/core/skbuff.c:104! invalid opcode: 0000 [#1] KASAN CPU: 0 PID: 160 Comm: reproducer Not tainted 4.6.0-rc2 #65 [...] Call Trace: [<ffffffff813eb7b9>] skb_push+0x79/0x80 [<ffffffff8143397b>] eth_header+0x2b/0x100 [<ffffffff8141e0d0>] neigh_resolve_output+0x210/0x310 [<ffffffff814eab77>] ip6_finish_output2+0x4a7/0x7c0 [<ffffffff814efe3a>] ip6_output+0x16a/0x280 [<ffffffff815440c1>] ip6_local_out+0xb1/0xf0 [<ffffffff814f1115>] ip6_send_skb+0x45/0xd0 [<ffffffff81518836>] udp_v6_send_skb+0x246/0x5d0 [<ffffffff8151985e>] udpv6_sendmsg+0xa6e/0x1090 [...] Reported-by: Ji Jianwen <jiji@redhat.com> Signed-off-by: Jakub Sitnicki <jkbs@redhat.com> Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org> Signed-off-by: David S. Miller <davem@davemloft.net>
1 parent 579ba85
Tip revision: 3ba3458fb9c050718b95275a3310b74415e767e2 authored by Jakub Sitnicki on 05 April 2016, 16:41:08 UTC
ipv6: Count in extension headers in skb->network_header
ipv6: Count in extension headers in skb->network_header
Tip revision: 3ba3458
File | Mode | Size |
---|---|---|
3com | ||
acenic | ||
adaptec | ||
advansys | ||
av7110 | ||
bnx2 | ||
bnx2x | ||
cis | ||
cpia2 | ||
cxgb3 | ||
dsp56k | ||
e100 | ||
edgeport | ||
emi26 | ||
emi62 | ||
ess | ||
kaweth | ||
keyspan | ||
keyspan_pda | ||
korg | ||
matrox | ||
myricom | ||
ositech | ||
qlogic | ||
r128 | ||
radeon | ||
sb16 | ||
sun | ||
tehuti | ||
tigon | ||
ttusb-budget | ||
vicam | ||
yam | ||
yamaha | ||
.gitignore | -rw-r--r-- | 39 bytes |
Makefile | -rw-r--r-- | 10.9 KB |
README.AddingFirmware | -rw-r--r-- | 1.7 KB |
WHENCE | -rw-r--r-- | 26.3 KB |
atmsar11.HEX | -rw-r--r-- | 18.7 KB |
ihex2fw.c | -rw-r--r-- | 6.6 KB |
mts_cdma.fw.ihex | -rw-r--r-- | 37.2 KB |
mts_edge.fw.ihex | -rw-r--r-- | 37.8 KB |
mts_gsm.fw.ihex | -rw-r--r-- | 37.2 KB |
ti_3410.fw.ihex | -rw-r--r-- | 37.0 KB |
ti_5052.fw.ihex | -rw-r--r-- | 37.0 KB |
whiteheat.HEX | -rw-r--r-- | 43.9 KB |
whiteheat_loader.HEX | -rw-r--r-- | 11.8 KB |
whiteheat_loader_debug.HEX | -rw-r--r-- | 17.2 KB |
Computing file changes ...