Yonghong Song 13acc94eff net: permit skb_segment on head_frag frag_list skb ...

One of our in-house projects, bpf-based NAT, hits a kernel BUG_ON at
function skb_segment(), line 3667. The bpf program attaches to
clsact ingress, calls bpf_skb_change_proto to change protocol
from ipv4 to ipv6 or from ipv6 to ipv4, and then calls bpf_redirect
to send the changed packet out.

3472 struct sk_buff *skb_segment(struct sk_buff *head_skb,
3473                             netdev_features_t features)
3474 {
3475         struct sk_buff *segs = NULL;
3476         struct sk_buff *tail = NULL;
...
3665                 while (pos < offset + len) {
3666                         if (i >= nfrags) {
3667                                 BUG_ON(skb_headlen(list_skb));
3668
3669                                 i = 0;
3670                                 nfrags = skb_shinfo(list_skb)->nr_frags;
3671                                 frag = skb_shinfo(list_skb)->frags;
3672                                 frag_skb = list_skb;
...

call stack:
...
 #1 [ffff883ffef03558] __crash_kexec at ffffffff8110c525
 #2 [ffff883ffef03620] crash_kexec at ffffffff8110d5cc
 #3 [ffff883ffef03640] oops_end at ffffffff8101d7e7
 #4 [ffff883ffef03668] die at ffffffff8101deb2
 #5 [ffff883ffef03698] do_trap at ffffffff8101a700
 #6 [ffff883ffef036e8] do_error_trap at ffffffff8101abfe
 #7 [ffff883ffef037a0] do_invalid_op at ffffffff8101acd0
 #8 [ffff883ffef037b0] invalid_op at ffffffff81a00bab
    [exception RIP: skb_segment+3044]
    RIP: ffffffff817e4dd4  RSP: ffff883ffef03860  RFLAGS: 00010216
    RAX: 0000000000002bf6  RBX: ffff883feb7aaa00  RCX: 0000000000000011
    RDX: ffff883fb87910c0  RSI: 0000000000000011  RDI: ffff883feb7ab500
    RBP: ffff883ffef03928   R8: 0000000000002ce2   R9: 00000000000027da
    R10: 000001ea00000000  R11: 0000000000002d82  R12: ffff883f90a1ee80
    R13: ffff883fb8791120  R14: ffff883feb7abc00  R15: 0000000000002ce2
    ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018
 #9 [ffff883ffef03930] tcp_gso_segment at ffffffff818713e7

Signed-off-by: David S. Miller <davem@davemloft.net>

2018-03-25 16:46:04 -04:00

..

datagram.c

vfs: do bulk POLL* -> EPOLL* replacement

2018-02-11 14:34:03 -08:00

dev_addr_lists.c

net: fix spelling for synchronized

2014-11-18 15:26:32 -05:00

dev_ioctl.c

net: don't unnecessarily load kernel modules in dev_ioctl()

2018-03-07 15:12:58 -05:00

dev.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2018-03-23 11:31:58 -04:00

devlink.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2018-03-23 11:31:58 -04:00

drop_monitor.c

treewide: setup_timer() -> timer_setup()

2017-11-21 15:57:07 -08:00

dst_cache.c

net: core: dst_cache_set_ip6: Rename 'addr' parameter to 'saddr' for consistency

2018-03-05 12:52:45 -05:00

dst.c

net: Remove dst->next

2017-11-30 09:54:27 -05:00

ethtool.c

net: ethtool: extend RXNFC API to support RSS spreading of filter matches

2018-03-08 21:54:52 -05:00

fib_notifier.c

net: Convert fib_* pernet_operations, registered via subsys_initcall

2018-02-13 10:36:07 -05:00

fib_rules.c

net: fib_rules: support for match on ip_proto, sport and dport

2018-02-28 22:44:43 -05:00

filter.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2018-03-23 11:31:58 -04:00

flow_dissector.c

net: Remove unused get_hash_from_flow functions

2018-03-04 13:04:23 -05:00

gen_estimator.c

net_sched: gen_estimator: fix broken estimators based on percpu stats

2018-02-23 12:35:46 -05:00

gen_stats.c

net: sched: add support for TCQ_F_NOLOCK subqueues to sch_mq

2017-12-08 13:32:26 -05:00

gro_cells.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

hwbm.c

net: hwbm: Fix unbalanced spinlock in error case

2016-05-25 12:35:09 -07:00

link_watch.c

net: link_watch: mark bonding link events urgent

2018-01-23 19:43:30 -05:00

lwt_bpf.c

bpf: rename bpf_compute_data_end into bpf_compute_data_pointers

2017-09-26 13:36:44 -07:00

lwtunnel.c

ipv6: sr: define core operations for seg6local lightweight tunnel

2017-08-07 14:16:22 -07:00

Makefile

xdp: base API for new XDP rx-queue info concept

2018-01-05 15:21:20 -08:00

neighbour.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2018-01-17 00:10:42 -05:00

net_namespace.c

net: Replace ip_ra_lock with per-net mutex

2018-03-22 15:12:56 -04:00

net-procfs.c

net: Convert pernet_subsys ops, registered via net_dev_init()

2018-02-13 10:36:07 -05:00

net-sysfs.c

net: introduce helper dev_change_tx_queue_len()

2018-01-29 12:42:15 -05:00

net-sysfs.h

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

net-traces.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2017-11-04 09:26:51 +09:00

netclassid_cgroup.c

cgroup: add @flags to css_task_iter_start() and implement CSS_TASK_ITER_PROCS

2017-07-21 11:14:51 -04:00

netevent.c

netevent: remove automatic variable in register_netevent_notifier()

2015-05-31 00:03:21 -07:00

netpoll.c

netpoll: Use lockdep to assert IRQs are disabled/enabled

2017-11-08 11:13:54 +01:00

netprio_cgroup.c

net: remove duplicate includes

2017-12-13 13:18:46 -05:00

pktgen.c

pktgen: Fix memory leak in pktgen_if_write

2018-03-14 10:02:15 -04:00

ptp_classifier.c

ptp: Change ptp_class to a proper bitmask

2015-11-03 11:08:22 -05:00

request_sock.c

ipv4: Namespaceify tcp_max_syn_backlog knob

2016-12-29 11:38:31 -05:00

rtnetlink.c

net: Add rtnl_lock_killable()

2018-03-16 12:31:19 -04:00

scm.c

sched/headers: Prepare for new header dependencies before moving code to <linux/sched/user.h>

2017-03-02 08:42:29 +01:00

secure_seq.c

tcp: Namespaceify sysctl_tcp_timestamps

2017-06-08 10:53:29 -04:00

skbuff.c

net: permit skb_segment on head_frag frag_list skb

2018-03-25 16:46:04 -04:00

sock_diag.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2018-03-23 11:31:58 -04:00

sock_reuseport.c

soreuseport: fix mem leak in reuseport_add_sock()

2018-02-02 19:47:03 -05:00

sock.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2018-03-23 11:31:58 -04:00

stream.c

vfs: do bulk POLL* -> EPOLL* replacement

2018-02-11 14:34:03 -08:00

sysctl_net_core.c

net: do not create fallback tunnels for non-default namespaces

2018-03-09 11:23:11 -05:00

timestamping.c

net: skb_defer_rx_timestamp should check for phydev before setting up classify

2015-07-09 14:17:15 -07:00

tso.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

utils.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next

2017-05-02 16:40:27 -07:00

xdp.c

xdp/qede: setup xdp_rxq_info and intro xdp_rxq_info_is_reg

2018-01-05 15:21:21 -08:00