aboutsummaryrefslogtreecommitdiffstats
path: root/net/dccp/ipv4.c
diff options
context:
space:
mode:
authorGerrit Renker <gerrit@erg.abdn.ac.uk>2006-10-11 11:26:54 -0400
committerDavid S. Miller <davem@sunset.davemloft.net>2006-10-21 22:55:20 -0400
commit82709531a800fcf8de71bb8c5d8e92462fb81f84 (patch)
treef5b91c66d478db78af46ca7a9863951b82d28c06 /net/dccp/ipv4.c
parent5cfc35cf79d46af998346e3d5cc66fa344d1af0e (diff)
[DCCP]: Fix Oops in DCCPv6
I think I got the cause for the Oops observed in http://www.mail-archive.com/dccp@vger.kernel.org/msg00578.html The problem is always with applications listening on PF_INET6 sockets. Apart from the mentioned oops, I observed another one one, triggered at irregular intervals via timer interrupt: run_timer_softirq -> dccp_keepalive_timer -> inet_csk_reqsk_queue_prune -> reqsk_free -> dccp_v6_reqsk_destructor The latter function is the problem and is also the last function to be called in said kernel panic. In any case, there is a real problem with allocating the right request_sock which is what this patch tackles. It fixes the following problem: - application listens on PF_INET6 - DCCPv4 packet comes in, is handed over to dccp_v4_do_rcv, from there to dccp_v4_conn_request Now: socket is PF_INET6, packet is IPv4. The following code then furnishes the connection with IPv6 - request_sock operations: req = reqsk_alloc(sk->sk_prot->rsk_prot); The first problem is that all further incoming packets will get a Reset since the connection can not be looked up. The second problem is worse: --> reqsk_alloc is called instead of inet6_reqsk_alloc --> consequently inet6_rsk_offset is never set (dangling pointer) --> the request_sock_ops are nevertheless still dccp6_request_ops --> destructor is called via reqsk_free --> dccp_v6_reqsk_destructor tries to free random memory location (inet6_rsk_offset not set) --> panic I have tested this for a while, DCCP sockets are now handled correctly in all three scenarios (v4/v6 only/v4-mapped). Commiter note: I've added the dccp_request_sock_ops forward declaration to keep the tree building and to reduce the size of the patch for 2.6.19, later I'll move the functions to the top of the affected source code to match what we have in the TCP counterpart, where this problem hasn't existed in the first place, dumb me not to have done the same thing on DCCP land 8) Signed-off-by: Gerrit Renker <gerrit@erg.abdn.ac.uk> Signed-off-by: Arnaldo Carvalho de Melo <acme@mandriva.com>
Diffstat (limited to 'net/dccp/ipv4.c')
-rw-r--r--net/dccp/ipv4.c4
1 files changed, 3 insertions, 1 deletions
diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c
index 7e746c4c1688..aaaf4d09516b 100644
--- a/net/dccp/ipv4.c
+++ b/net/dccp/ipv4.c
@@ -449,6 +449,8 @@ static inline u64 dccp_v4_init_sequence(const struct sock *sk,
449 dccp_hdr(skb)->dccph_sport); 449 dccp_hdr(skb)->dccph_sport);
450} 450}
451 451
452static struct request_sock_ops dccp_request_sock_ops;
453
452int dccp_v4_conn_request(struct sock *sk, struct sk_buff *skb) 454int dccp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
453{ 455{
454 struct inet_request_sock *ireq; 456 struct inet_request_sock *ireq;
@@ -489,7 +491,7 @@ int dccp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
489 if (sk_acceptq_is_full(sk) && inet_csk_reqsk_queue_young(sk) > 1) 491 if (sk_acceptq_is_full(sk) && inet_csk_reqsk_queue_young(sk) > 1)
490 goto drop; 492 goto drop;
491 493
492 req = reqsk_alloc(sk->sk_prot->rsk_prot); 494 req = reqsk_alloc(&dccp_request_sock_ops);
493 if (req == NULL) 495 if (req == NULL)
494 goto drop; 496 goto drop;
495 497