• Eric Dumazet's avatar
    ip_tunnel: fix kernel panic with icmp_dest_unreach · a6222602
    Eric Dumazet authored
    Daniel Petre reported crashes in icmp_dst_unreach() with following call
    graph:
    
    #3 [ffff88003fc03938] __stack_chk_fail at ffffffff81037f77
    #4 [ffff88003fc03948] icmp_send at ffffffff814d5fec
    #5 [ffff88003fc03ae8] ipv4_link_failure at ffffffff814a1795
    #6 [ffff88003fc03af8] ipgre_tunnel_xmit at ffffffff814e7965
    #7 [ffff88003fc03b78] dev_hard_start_xmit at ffffffff8146e032
    #8 [ffff88003fc03bc8] sch_direct_xmit at ffffffff81487d66
    #9 [ffff88003fc03c08] __qdisc_run at ffffffff81487efd
    #10 [ffff88003fc03c48] dev_queue_xmit at ffffffff8146e5a7
    #11 [ffff88003fc03c88] ip_finish_output at ffffffff814ab596
    
    Daniel found a similar problem mentioned in
     http://lkml.indiana.edu/hypermail/linux/kernel/1007.0/00961.html
    
    And indeed this is the root cause : skb->cb[] contains data fooling IP
    stack.
    
    We must clear IPCB in ip_tunnel_xmit() sooner in case dst_link_failure()
    is called. Or else skb->cb[] might contain garbage from GSO segmentation
    layer.
    
    A similar fix was tested on linux-3.9, but gre code was refactored in
    linux-3.10. I'll send patches for stable kernels as well.
    
    Many thanks to Daniel for providing reports, patches and testing !
    Reported-by: default avatarDaniel Petre <daniel.petre@rcs-rds.ro>
    Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    a6222602
ip_tunnel.c 24.1 KB