Toshiaki Makita 4bf9ffa0fb veth: Orphan skb before GRO ... GRO expects skbs not to be owned by sockets, but when XDP is enabled veth passed skbs owned by sockets. It caused corrupted sk_wmem_alloc. Paolo Abeni reported the following splat: [ 362.098904] refcount_t overflow at skb_set_owner_w+0x5e/0xa0 in iperf3[1644], uid/euid: 0/0 [ 362.108239] WARNING: CPU: 0 PID: 1644 at kernel/panic.c:648 refcount_error_report+0xa0/0xa4 [ 362.117547] Modules linked in: tcp_diag inet_diag veth intel_rapl sb_edac x86_pkg_temp_thermal intel_powerclamp coretemp kvm_intel kvm irqbypass crct10dif_pclmul crc32_pclmul ghash_clmulni_intel intel_cstate intel_uncore intel_rapl_perf ipmi_ssif iTCO_wdt sg ipmi_si iTCO_vendor_support ipmi_devintf mxm_wmi ipmi_msghandler pcspkr dcdbas mei_me wmi mei lpc_ich acpi_power_meter pcc_cpufreq xfs libcrc32c sd_mod mgag200 drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops ixgbe igb ttm ahci mdio libahci ptp crc32c_intel drm pps_core libata i2c_algo_bit dca dm_mirror dm_region_hash dm_log dm_mod [ 362.176622] CPU: 0 PID: 1644 Comm: iperf3 Not tainted 4.19.0-rc2.vanilla+ #2025 [ 362.184777] Hardware name: Dell Inc. PowerEdge R730/072T6D, BIOS 2.1.7 06/16/2016 [ 362.193124] RIP: 0010:refcount_error_report+0xa0/0xa4 [ 362.198758] Code: 08 00 00 48 8b 95 80 00 00 00 49 8d 8c 24 80 0a 00 00 41 89 c1 44 89 2c 24 48 89 de 48 c7 c7 18 4d e7 9d 31 c0 e8 30 fa ff ff <0f> 0b eb 88 0f 1f 44 00 00 55 48 89 e5 41 56 41 55 41 54 49 89 fc [ 362.219711] RSP: 0018:ffff9ee6ff603c20 EFLAGS: 00010282 [ 362.225538] RAX: 0000000000000000 RBX: ffffffff9de83e10 RCX: 0000000000000000 [ 362.233497] RDX: 0000000000000001 RSI: ffff9ee6ff6167d8 RDI: ffff9ee6ff6167d8 [ 362.241457] RBP: ffff9ee6ff603d78 R08: 0000000000000490 R09: 0000000000000004 [ 362.249416] R10: 0000000000000000 R11: ffff9ee6ff603990 R12: ffff9ee664b94500 [ 362.257377] R13: 0000000000000000 R14: 0000000000000004 R15: ffffffff9de615f9 [ 362.265337] FS: 00007f1d22d28740(0000) GS:ffff9ee6ff600000(0000) knlGS:0000000000000000 [ 362.274363] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 362.280773] CR2: 00007f1d222f35d0 CR3: 0000001fddfec003 CR4: 00000000001606f0 [ 362.288733] Call Trace: [ 362.291459] <IRQ> [ 362.293702] ex_handler_refcount+0x4e/0x80 [ 362.298269] fixup_exception+0x35/0x40 [ 362.302451] do_trap+0x109/0x150 [ 362.306048] do_error_trap+0xd5/0x130 [ 362.315766] invalid_op+0x14/0x20 [ 362.319460] RIP: 0010:skb_set_owner_w+0x5e/0xa0 [ 362.324512] Code: ef ff ff 74 49 48 c7 43 60 20 7b 4a 9d 8b 85 f4 01 00 00 85 c0 75 16 8b 83 e0 00 00 00 f0 01 85 44 01 00 00 0f 88 d8 23 16 00 <5b> 5d c3 80 8b 91 00 00 00 01 8b 85 f4 01 00 00 89 83 a4 00 00 00 [ 362.345465] RSP: 0018:ffff9ee6ff603e20 EFLAGS: 00010a86 [ 362.351291] RAX: 0000000000001100 RBX: ffff9ee65deec700 RCX: ffff9ee65e829244 [ 362.359250] RDX: 0000000000000100 RSI: ffff9ee65e829100 RDI: ffff9ee65deec700 [ 362.367210] RBP: ffff9ee65e829100 R08: 000000000002a380 R09: 0000000000000000 [ 362.375169] R10: 0000000000000002 R11: fffff1a4bf77bb00 R12: ffffc0754661d000 [ 362.383130] R13: ffff9ee65deec200 R14: ffff9ee65f597000 R15: 00000000000000aa [ 362.391092] veth_xdp_rcv+0x4e4/0x890 [veth] [ 362.399357] veth_poll+0x4d/0x17a [veth] [ 362.403731] net_rx_action+0x2af/0x3f0 [ 362.407912] __do_softirq+0xdd/0x29e [ 362.411897] do_softirq_own_stack+0x2a/0x40 [ 362.416561] </IRQ> [ 362.418899] do_softirq+0x4b/0x70 [ 362.422594] __local_bh_enable_ip+0x50/0x60 [ 362.427258] ip_finish_output2+0x16a/0x390 [ 362.431824] ip_output+0x71/0xe0 [ 362.440670] __tcp_transmit_skb+0x583/0xab0 [ 362.445333] tcp_write_xmit+0x247/0xfb0 [ 362.449609] __tcp_push_pending_frames+0x2d/0xd0 [ 362.454760] tcp_sendmsg_locked+0x857/0xd30 [ 362.459424] tcp_sendmsg+0x27/0x40 [ 362.463216] sock_sendmsg+0x36/0x50 [ 362.467104] sock_write_iter+0x87/0x100 [ 362.471382] __vfs_write+0x112/0x1a0 [ 362.475369] vfs_write+0xad/0x1a0 [ 362.479062] ksys_write+0x52/0xc0 [ 362.482759] do_syscall_64+0x5b/0x180 [ 362.486841] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 362.492473] RIP: 0033:0x7f1d22293238 [ 362.496458] Code: 89 02 48 c7 c0 ff ff ff ff eb b3 0f 1f 80 00 00 00 00 f3 0f 1e fa 48 8d 05 c5 54 2d 00 8b 00 85 c0 75 17 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 58 c3 0f 1f 80 00 00 00 00 41 54 49 89 d4 55 [ 362.517409] RSP: 002b:00007ffebaef8008 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 362.525855] RAX: ffffffffffffffda RBX: 0000000000002800 RCX: 00007f1d22293238 [ 362.533816] RDX: 0000000000002800 RSI: 00007f1d22d36000 RDI: 0000000000000005 [ 362.541775] RBP: 00007f1d22d36000 R08: 00000002db777a30 R09: 0000562b70712b20 [ 362.549734] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 362.557693] R13: 0000000000002800 R14: 00007ffebaef8060 R15: 0000562b70712260 In order to avoid this, orphan the skb before entering GRO. Fixes: 948d4f214f ("veth: Add driver XDP") Reported-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: Toshiaki Makita <makita.toshiaki@lab.ntt.co.jp> Tested-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2018-09-16 15:33:50 -07:00
..
accessibility
acpi	Merge branch 'acpi-bus'	2018-09-07 10:05:20 +02:00
amba
android	android: binder: Rate-limit debug and userspace triggered err msgs	2018-08-08 11:05:47 +02:00
ata	SCSI fixes on 20180905	2018-09-05 09:17:20 -07:00
atm
auxdisplay	Char/Misc driver patches for 4.19-rc1	2018-08-18 11:04:51 -07:00
base	memory_hotplug: fix kernel_panic on offline page processing	2018-09-04 16:45:02 -07:00
bcma
block	Two rbd patches to complete support for images within namespaces that	2018-09-07 10:57:59 -07:00
bluetooth	Bluetooth: hci_ldisc: Free rw_semaphore on close	2018-09-11 13:33:57 +02:00
bus	Merge branch 'perm-fix' into omap-for-v4.19/fixes-v2	2018-08-28 09:58:03 -07:00
cdrom	cdrom: Fix info leak/OOB read in cdrom_ioctl_drive_status	2018-08-29 08:09:20 -06:00
char	Fix things so the choice of whether or not to trust RDRAND to	2018-09-09 05:54:05 -07:00
clk	clk: x86: Set default parent to 48Mhz	2018-08-30 14:47:41 -07:00
clocksource	RISC-V Updates for the 4.19 Merge Window	2018-08-19 09:56:38 -07:00
connector
cpufreq	ARM: SoC driver updates	2018-08-23 13:52:46 -07:00
cpuidle	cpuidle: menu: Retain tick when shallow state is selected	2018-08-25 13:16:08 +02:00
crypto	Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6	2018-08-29 13:38:39 -07:00
dax	drivers/dax/device.c: convert variable to vm_fault_t type	2018-09-04 16:45:02 -07:00
dca
devfreq	Char/Misc driver patches for 4.19-rc1	2018-08-18 11:04:51 -07:00
dio
dma	Merge branch 'ida-4.19' of git://git.infradead.org/users/willy/linux-dax	2018-08-26 11:48:42 -07:00
dma-buf
edac	EDAC: Add missing MEM_LRDDR4 entry in edac_mem_types[]	2018-08-17 15:13:34 +02:00
eisa
extcon
firewire	firewire: use 64-bit time_t based interfaces	2018-08-17 16:20:27 -07:00
firmware	firmware: arm_scmi: fix divide by zero when sustained_perf_level is zero	2018-09-06 09:59:40 -07:00
fmc
fpga
fsi	fsi: sbefifo: Bump max command length	2018-08-08 15:44:47 +10:00
gnss
gpio	gpio: Fix crash due to registration race	2018-08-31 11:30:45 +02:00
gpu	Merge branch 'linux-4.19' of git://github.com/skeggsb/linux into drm-fixes	2018-09-11 16:54:46 +10:00
hid	HID: i2c-hid: Don't reset device upon system resume	2018-09-06 16:30:53 +02:00
hsi
hv	Drivers: hv: vmbus: Cleanup synic memory free path	2018-08-02 10:20:59 +02:00
hwmon	ARM: SoC fixes	2018-09-08 15:38:57 -07:00
hwspinlock
hwtracing	drivers/hwtracing/intel_th/msu.c: change return type to vm_fault_t	2018-08-23 18:48:43 -07:00
i2c	i2c: xiic: Make the start and the byte count write atomic	2018-09-06 20:49:09 +02:00
ide	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/ide	2018-08-22 07:40:33 -07:00
idle
iio	treewide: convert ISO_8859-1 text comments to utf-8	2018-08-23 18:48:43 -07:00
infiniband	RDMA/mlx4: Ensure that maximal send/receive SGE less than supported by HW	2018-09-06 13:16:12 -06:00
input	ARM: 32-bit SoC platform updates	2018-08-23 13:44:43 -07:00
iommu	ARM: SoC: late updates	2018-08-25 14:12:36 -07:00
ipack
irqchip	irqchip/gic-v3-its: Cap lpi_id_bits to reduce memory footprint	2018-09-06 20:31:59 +02:00
isdn	isdn: Disable IIOCDBGVAR	2018-08-16 12:26:24 -07:00
leds	leds: ns2: Change unsigned to unsigned int	2018-08-06 23:03:12 +02:00
lightnvm
macintosh	macintosh: therm_windtunnel: drop using attach_adapter	2018-08-24 14:42:42 +02:00
mailbox	mailbox: Add support for i.MX messaging unit	2018-08-15 09:53:07 +05:30
mcb
md	md-cluster: release RESYNC lock after the last resync message	2018-08-31 17:38:10 -07:00
media	Merge branch 'ida-4.19' of git://git.infradead.org/users/willy/linux-dax	2018-08-26 11:48:42 -07:00
memory	memory: ti-aemif: fix a potential NULL-pointer dereference	2018-09-06 10:04:07 -07:00
memstick
message
mfd	Merge branch 'i2c/for-4.19' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux	2018-08-21 17:40:46 -07:00
misc	Merge branch 'ida-4.19' of git://git.infradead.org/users/willy/linux-dax	2018-08-26 11:48:42 -07:00
mmc	mmc: renesas_sdhi_internal_dmac: mask DMAC interrupts	2018-08-23 10:00:49 +02:00
mtd	mtd: rawnand: denali: do not pass zero maxchips to nand_scan()	2018-08-27 20:41:46 +02:00
mux	mux: adgs1408: new driver for Analog Devices ADGS1408/1409 mux	2018-08-02 10:23:02 +02:00
net	veth: Orphan skb before GRO	2018-09-16 15:33:50 -07:00
nfc
ntb
nubus
nvdimm	libnvdimm-for-4.19_dax-memory-failure	2018-08-25 18:43:59 -07:00
nvme	nvmet: free workqueue object if module init fails	2018-08-28 08:40:44 +02:00
nvmem
of	dma-mapping fixes for 4.19-rc2	2018-09-02 20:09:36 -07:00
opp
oprofile
parisc
parport	Char/Misc driver patches for 4.19-rc1	2018-08-18 11:04:51 -07:00
pci	Merge branch 'akpm' (patches from Andrew)	2018-08-22 12:34:08 -07:00
pcmcia	pcmcia: remove long deprecated pcmcia_request_exclusive_irq() function	2018-08-18 12:30:42 -07:00
perf	Char/Misc driver patches for 4.19-rc1	2018-08-18 11:04:51 -07:00
phy
pinctrl	- New Drivers	2018-08-20 15:38:44 -07:00
platform	platform-drivers-x86 for v4.19-1	2018-08-22 14:14:15 -07:00
pnp
power	treewide: convert ISO_8859-1 text comments to utf-8	2018-08-23 18:48:43 -07:00
powercap
pps
ps3
ptp	Char/Misc driver patches for 4.19-rc1	2018-08-18 11:04:51 -07:00
pwm	pwm: mediatek: Add MT7628 support	2018-08-20 11:36:07 +02:00
rapidio	drivers/rapidio/devices/rio_mport_cdev.c: remove redundant pointer md	2018-08-22 10:52:51 -07:00
ras
regulator	- New Drivers	2018-08-20 15:38:44 -07:00
remoteproc	remoteproc/davinci: use the reset framework	2018-08-16 17:39:55 -07:00
reset	ARM: SoC: late updates	2018-08-25 14:12:36 -07:00
rpmsg
rtc	RTC for 4.19	2018-08-20 16:30:27 -07:00
s390	s390/qeth: don't dump past end of unknown HW header	2018-09-12 13:12:51 -07:00
sbus
scsi	scsi: qedi: Add the CRC size within iSCSI NVM image	2018-08-30 07:15:22 -04:00
sfi
sh	sh: introduce a sh_cacheop_vaddr helper	2018-08-02 13:54:06 +02:00
siox
slimbus
sn
soc	ARM: Device-tree updates	2018-08-23 14:02:22 -07:00
soundwire
spi	hwspinlock updates for v4.19	2018-08-18 16:45:27 -07:00
spmi
ssb	ssb: Remove SSB_WARN_ON, SSB_BUG_ON and SSB_DEBUG	2018-08-09 18:47:47 +03:00
staging	ARM: SoC driver updates	2018-08-23 13:52:46 -07:00
target	scsi: iscsi: target: Fix conn_ops double free	2018-08-30 07:07:12 -04:00
tc
tee	ARM: SoC driver updates	2018-08-23 13:52:46 -07:00
thermal	Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/evalenti/linux-soc-thermal	2018-08-28 16:11:34 -07:00
thunderbolt
tty	powerpc fixes for 4.19 #2	2018-08-24 09:34:23 -07:00
uio	Char/Misc fix for 4.19-rc1	2018-08-19 09:30:44 -07:00
usb	ARM: SoC driver updates	2018-08-23 13:52:46 -07:00
uwb
vfio	powerpc updates for 4.19	2018-08-17 11:32:50 -07:00
vhost	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2018-08-27 11:59:39 -07:00
video	fbdev changes for v4.19:	2018-08-23 15:44:58 -07:00
virt
virtio	virtio, vhost: fixes, tweaks	2018-08-24 08:45:19 -07:00
visorbus
vlynq
vme
w1	power supply and reset changes for the v4.19 series	2018-08-21 18:06:27 -07:00
watchdog	include/linux/compiler*.h: make compiler-*.h mutually exclusive	2018-08-22 17:31:34 -07:00
xen	xen: fixes for 4.19-rc2	2018-08-31 08:45:16 -07:00
zorro
Kconfig
Makefile	Char/Misc driver patches for 4.19-rc1	2018-08-18 11:04:51 -07:00