Vitaliy Gusev
4dd7972d12
tcp: Fix NULL dereference in tcp_4_send_ack()
Fix NULL dereference in tcp_4_send_ack().
As skb->dev is reset to NULL in tcp_v4_rcv() thus OOPS occurs:
BUG: unable to handle kernel NULL pointer dereference at 00000000000004d0
IP: [<ffffffff80498503>] tcp_v4_send_ack+0x203/0x250
Stack: ffff810005dbb000 ffff810015c8acc0 e77b2c6e5f861600 a01610802e90cb6d
0a08010100000000 88afffff88afffff 0000000080762be8 0000000115c872e8
0004122000000000 0000000000000001 ffffffff80762b88 0000000000000020
Call Trace:
<IRQ> [<ffffffff80499c33>] tcp_v4_reqsk_send_ack+0x20/0x22
[<ffffffff8049bce5>] tcp_check_req+0x108/0x14c
[<ffffffff8047aaf7>] ? rt_intern_hash+0x322/0x33c
[<ffffffff80499846>] tcp_v4_do_rcv+0x399/0x4ec
[<ffffffff8045ce4b>] ? skb_checksum+0x4f/0x272
[<ffffffff80485b74>] ? __inet_lookup_listener+0x14a/0x15c
[<ffffffff8049babc>] tcp_v4_rcv+0x6a1/0x701
[<ffffffff8047e739>] ip_local_deliver_finish+0x157/0x24a
[<ffffffff8047ec9a>] ip_local_deliver+0x72/0x7c
[<ffffffff8047e5bd>] ip_rcv_finish+0x38d/0x3b2
[<ffffffff803d3548>] ? scsi_io_completion+0x19d/0x39e
[<ffffffff8047ebe5>] ip_rcv+0x2a2/0x2e5
[<ffffffff80462faa>] netif_receive_skb+0x293/0x303
[<ffffffff80465a9b>] process_backlog+0x80/0xd0
[<ffffffff802630b4>] ? __rcu_process_callbacks+0x125/0x1b4
[<ffffffff8046560e>] net_rx_action+0xb9/0x17f
[<ffffffff80234cc5>] __do_softirq+0xa3/0x164
[<ffffffff8020c52c>] call_softirq+0x1c/0x28
<EOI> [<ffffffff8020de1c>] do_softirq+0x34/0x72
[<ffffffff80234b8e>] local_bh_enable_ip+0x3f/0x50
[<ffffffff804d43ca>] _spin_unlock_bh+0x12/0x14
[<ffffffff804599cd>] release_sock+0xb8/0xc1
[<ffffffff804a6f9a>] inet_stream_connect+0x146/0x25c
[<ffffffff80243078>] ? autoremove_wake_function+0x0/0x38
[<ffffffff8045751f>] sys_connect+0x68/0x8e
[<ffffffff80291818>] ? fd_install+0x5f/0x68
[<ffffffff80457784>] ? sock_map_fd+0x55/0x62
[<ffffffff8020b39b>] system_call_after_swapgs+0x7b/0x80
Code: 41 10 11 d0 83 d0 00 4d 85 ed 89 45 c0 c7 45 c4 08 00 00 00 74 07 41 8b 45 04 89 45 c8 48 8b 43 20 8b 4d b8 48 8d 55 b0 48 89 de <48> 8b 80 d0 04 00 00 48 8b b8 60 01 00 00 e8 20 ae fe ff 65 48
RIP [<ffffffff80498503>] tcp_v4_send_ack+0x203/0x250
RSP <ffffffff80762b78>
CR2: 00000000000004d0
Signed-off-by: Vitaliy Gusev <vgusev@openvz.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
|
2008-10-01 01:51:39 -07:00 |
| .. |
|
ipvs
|
ipvs: Explictly clear ip_vs_stats members
|
2008-08-11 14:00:55 +02:00 |
|
netfilter
|
nf_nat: use secure_ipv4_port_ephemeral() for NAT port randomization
|
2008-08-18 21:32:32 -07:00 |
|
af_inet.c
|
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6
|
2008-07-26 20:23:44 -07:00 |
|
ah4.c
|
|
|
|
arp.c
|
mib: add net to NET_INC_STATS_BH
|
2008-07-16 20:31:16 -07:00 |
|
cipso_ipv4.c
|
|
|
|
datagram.c
|
mib: add net to IP_INC_STATS_BH
|
2008-07-16 20:20:11 -07:00 |
|
devinet.c
|
ipv: Re-enable IP when MTU > 68
|
2008-09-02 17:28:58 -07:00 |
|
esp4.c
|
ipsec: Interfamily IPSec BEET
|
2008-08-06 02:39:30 -07:00 |
|
fib_frontend.c
|
netns: add namespace parameter to rt_cache_flush
|
2008-07-05 19:00:44 -07:00 |
|
fib_hash.c
|
netns: add namespace parameter to rt_cache_flush
|
2008-07-05 19:00:44 -07:00 |
|
fib_lookup.h
|
|
|
|
fib_rules.c
|
net: add fib_rules_ops to flush_cache method
|
2008-07-05 19:01:28 -07:00 |
|
fib_semantics.c
|
Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6
|
2008-06-13 20:52:39 -07:00 |
|
fib_trie.c
|
proc: consolidate per-net single-release callers
|
2008-07-18 04:07:44 -07:00 |
|
icmp.c
|
icmp: icmp_sk() should not use smp_processor_id() in preemptible code
|
2008-08-23 04:43:33 -07:00 |
|
igmp.c
|
netns: Fix crash by making igmp per namespace
|
2008-08-13 16:15:57 -07:00 |
|
inet_connection_sock.c
|
net: convert BUG_TRAP to generic WARN_ON
|
2008-07-25 21:43:18 -07:00 |
|
inet_diag.c
|
net: remove CVS keywords
|
2008-06-11 21:00:38 -07:00 |
|
inet_fragment.c
|
net: convert BUG_TRAP to generic WARN_ON
|
2008-07-25 21:43:18 -07:00 |
|
inet_hashtables.c
|
net: convert BUG_TRAP to generic WARN_ON
|
2008-07-25 21:43:18 -07:00 |
|
inet_lro.c
|
net/inet_lro: remove setting skb->ip_summed when not LRO-able
|
2008-06-27 20:09:00 -07:00 |
|
inet_timewait_sock.c
|
netns : fix kernel panic in timewait socket destruction
|
2008-09-08 13:17:27 -07:00 |
|
inetpeer.c
|
net: remove CVS keywords
|
2008-06-11 21:00:38 -07:00 |
|
ip_forward.c
|
mib: add net to IP_INC_STATS_BH
|
2008-07-16 20:20:11 -07:00 |
|
ip_fragment.c
|
net: convert BUG_TRAP to generic WARN_ON
|
2008-07-25 21:43:18 -07:00 |
|
ip_gre.c
|
|
|
|
ip_input.c
|
mib: put ip statistics on struct net
|
2008-07-18 04:02:42 -07:00 |
|
ip_options.c
|
net: remove CVS keywords
|
2008-06-11 21:00:38 -07:00 |
|
ip_output.c
|
net: convert BUG_TRAP to generic WARN_ON
|
2008-07-25 21:43:18 -07:00 |
|
ip_sockglue.c
|
net: remove CVS keywords
|
2008-06-11 21:00:38 -07:00 |
|
ipcomp.c
|
ipcomp: Fix warnings after ipcomp consolidation.
|
2008-07-27 03:59:24 -07:00 |
|
ipconfig.c
|
netns: Use net_eq() to compare net-namespaces for optimization.
|
2008-07-19 22:34:43 -07:00 |
|
ipip.c
|
net: remove CVS keywords
|
2008-06-11 21:00:38 -07:00 |
|
ipmr.c
|
netns: Use net_eq() to compare net-namespaces for optimization.
|
2008-07-19 22:34:43 -07:00 |
|
Kconfig
|
ipsec: ipcomp - Merge IPComp implementations
|
2008-07-25 02:54:40 -07:00 |
|
Makefile
|
|
|
|
netfilter.c
|
|
|
|
proc.c
|
tcp: MD5: Use MIB counter instead of warning for MD5 mismatch.
|
2008-07-30 03:27:25 -07:00 |
|
protocol.c
|
net: remove CVS keywords
|
2008-06-11 21:00:38 -07:00 |
|
raw.c
|
mib: add net to IP_INC_STATS
|
2008-07-16 20:19:49 -07:00 |
|
route.c
|
ipv4: mode 0555 in ipv4_skeleton
|
2008-08-27 02:35:18 -07:00 |
|
syncookies.c
|
syncookies: Make sure ECN is disabled
|
2008-07-26 02:21:54 -07:00 |
|
sysctl_net_ipv4.c
|
net: Add missing extra2 parameter for ip_default_ttl sysctl
|
2008-08-03 14:06:44 -07:00 |
|
tcp.c
|
net: convert BUG_TRAP to generic WARN_ON
|
2008-07-25 21:43:18 -07:00 |
|
tcp_bic.c
|
|
|
|
tcp_cong.c
|
|
|
|
tcp_cubic.c
|
|
|
|
tcp_diag.c
|
net: remove CVS keywords
|
2008-06-11 21:00:38 -07:00 |
|
tcp_highspeed.c
|
|
|
|
tcp_htcp.c
|
|
|
|
tcp_hybla.c
|
|
|
|
tcp_illinois.c
|
|
|
|
tcp_input.c
|
net: convert BUG_TRAP to generic WARN_ON
|
2008-07-25 21:43:18 -07:00 |
|
tcp_ipv4.c
|
tcp: Fix NULL dereference in tcp_4_send_ack()
|
2008-10-01 01:51:39 -07:00 |
|
tcp_lp.c
|
|
|
|
tcp_minisocks.c
|
tcp: (whitespace only) fix confusing indentation
|
2008-08-07 20:27:45 -07:00 |
|
tcp_output.c
|
tcp: fix tcp header size miscalculation when window scale is unused
|
2008-08-27 02:33:50 -07:00 |
|
tcp_probe.c
|
tcp: correct kcalloc usage
|
2008-07-10 16:51:32 -07:00 |
|
tcp_scalable.c
|
|
|
|
tcp_timer.c
|
net: convert BUG_TRAP to generic WARN_ON
|
2008-07-25 21:43:18 -07:00 |
|
tcp_vegas.c
|
|
|
|
tcp_vegas.h
|
|
|
|
tcp_veno.c
|
|
|
|
tcp_westwood.c
|
|
|
|
tcp_yeah.c
|
|
|
|
tunnel4.c
|
|
|
|
udp.c
|
udp: Fix rcv socket locking
|
2008-09-15 11:48:46 -07:00 |
|
udp_impl.h
|
net: change proto destroy method to return void
|
2008-06-14 17:04:49 -07:00 |
|
udplite.c
|
mib: put udplite statistics on struct net
|
2008-07-18 04:03:45 -07:00 |
|
xfrm4_input.c
|
|
|
|
xfrm4_mode_beet.c
|
ipsec: Interfamily IPSec BEET
|
2008-08-06 02:39:30 -07:00 |
|
xfrm4_mode_transport.c
|
|
|
|
xfrm4_mode_tunnel.c
|
xfrm: fix fragmentation for ipv4 xfrm tunnel
|
2008-06-17 16:38:23 -07:00 |
|
xfrm4_output.c
|
|
|
|
xfrm4_policy.c
|
|
|
|
xfrm4_state.c
|
|
|
|
xfrm4_tunnel.c
|
|
|