Eric Dumazet 7ab4551f3b tcp: fix TFO regression ...

Fengguang Wu reported various panics and bisected to commit
8336886f78 (tcp: TCP Fast Open Server - support TFO listeners)

Fix this by making sure socket is a TCP socket before accessing TFO data
structures.

[  233.046014] kfree_debugcheck: out of range ptr ea6000000bb8h.
[  233.047399] ------------[ cut here ]------------
[  233.048393] kernel BUG at /c/kernel-tests/src/stable/mm/slab.c:3074!
[  233.048393] invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC
[  233.048393] Modules linked in:
[  233.048393] CPU 0
[  233.048393] Pid: 3929, comm: trinity-watchdo Not tainted 3.6.0-rc3+
#4192 Bochs Bochs
[  233.048393] RIP: 0010:[<ffffffff81169653>]  [<ffffffff81169653>]
kfree_debugcheck+0x27/0x2d
[  233.048393] RSP: 0018:ffff88000facbca8  EFLAGS: 00010092
[  233.048393] RAX: 0000000000000031 RBX: 0000ea6000000bb8 RCX:
00000000a189a188
[  233.048393] RDX: 000000000000a189 RSI: ffffffff8108ad32 RDI:
ffffffff810d30f9
[  233.048393] RBP: ffff88000facbcb8 R08: 0000000000000002 R09:
ffffffff843846f0
[  233.048393] R10: ffffffff810ae37c R11: 0000000000000908 R12:
0000000000000202
[  233.048393] R13: ffffffff823dbd5a R14: ffff88000ec5bea8 R15:
ffffffff8363c780
[  233.048393] FS:  00007faa6899c700(0000) GS:ffff88001f200000(0000)
knlGS:0000000000000000
[  233.048393] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[  233.048393] CR2: 00007faa6841019c CR3: 0000000012c82000 CR4:
00000000000006f0
[  233.048393] DR0: 0000000000000000 DR1: 0000000000000000 DR2:
0000000000000000
[  233.048393] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7:
0000000000000400
[  233.048393] Process trinity-watchdo (pid: 3929, threadinfo
ffff88000faca000, task ffff88000faec600)
[  233.048393] Stack:
[  233.048393]  0000000000000000 0000ea6000000bb8 ffff88000facbce8
ffffffff8116ad81
[  233.048393]  ffff88000ff588a0 ffff88000ff58850 ffff88000ff588a0
0000000000000000
[  233.048393]  ffff88000facbd08 ffffffff823dbd5a ffffffff823dbcb0
ffff88000ff58850
[  233.048393] Call Trace:
[  233.048393]  [<ffffffff8116ad81>] kfree+0x5f/0xca
[  233.048393]  [<ffffffff823dbd5a>] inet_sock_destruct+0xaa/0x13c
[  233.048393]  [<ffffffff823dbcb0>] ? inet_sk_rebuild_header
+0x319/0x319
[  233.048393]  [<ffffffff8231c307>] __sk_free+0x21/0x14b
[  233.048393]  [<ffffffff8231c4bd>] sk_free+0x26/0x2a
[  233.048393]  [<ffffffff825372db>] sctp_close+0x215/0x224
[  233.048393]  [<ffffffff810d6835>] ? lock_release+0x16f/0x1b9
[  233.048393]  [<ffffffff823daf12>] inet_release+0x7e/0x85
[  233.048393]  [<ffffffff82317d15>] sock_release+0x1f/0x77
[  233.048393]  [<ffffffff82317d94>] sock_close+0x27/0x2b
[  233.048393]  [<ffffffff81173bbe>] __fput+0x101/0x20a
[  233.048393]  [<ffffffff81173cd5>] ____fput+0xe/0x10
[  233.048393]  [<ffffffff810a3794>] task_work_run+0x5d/0x75
[  233.048393]  [<ffffffff8108da70>] do_exit+0x290/0x7f5
[  233.048393]  [<ffffffff82707415>] ? retint_swapgs+0x13/0x1b
[  233.048393]  [<ffffffff8108e23f>] do_group_exit+0x7b/0xba
[  233.048393]  [<ffffffff8108e295>] sys_exit_group+0x17/0x17
[  233.048393]  [<ffffffff8270de10>] tracesys+0xdd/0xe2
[  233.048393] Code: 59 01 5d c3 55 48 89 e5 53 41 50 0f 1f 44 00 00 48
89 fb e8 d4 b0 f0 ff 84 c0 75 11 48 89 de 48 c7 c7 fc fa f7 82 e8 0d 0f
57 01 <0f> 0b 5f 5b 5d c3 55 48 89 e5 0f 1f 44 00 00 48 63 87 d8 00 00
[  233.048393] RIP  [<ffffffff81169653>] kfree_debugcheck+0x27/0x2d
[  233.048393]  RSP <ffff88000facbca8>

Reported-by: Fengguang Wu <wfg@linux.intel.com>
Tested-by: Fengguang Wu <wfg@linux.intel.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: "H.K. Jerry Chu" <hkchu@google.com>
Acked-by: Neal Cardwell <ncardwell@google.com>
Acked-by: H.K. Jerry Chu <hkchu@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

2012-09-06 14:21:10 -04:00

..

netfilter

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2012-08-31 15:14:18 -04:00

af_inet.c

tcp: fix TFO regression

2012-09-06 14:21:10 -04:00

ah4.c

ipv4: Add redirect support to all protocol icmp error handlers.

2012-07-11 21:27:49 -07:00

arp.c

ipv4: Fix input route performance regression.

2012-07-26 15:50:39 -07:00

cipso_ipv4.c

cipso: don't follow a NULL pointer when setsockopt() is called

2012-07-18 09:01:12 -07:00

datagram.c

ipv4: Lock socket and use cork flow in ip4_datagram_connect().

2011-05-08 13:48:57 -07:00

devinet.c

net: reinstate rtnl in call_netdevice_notifiers()

2012-08-23 09:24:42 -07:00

esp4.c

ipv4: Add redirect support to all protocol icmp error handlers.

2012-07-11 21:27:49 -07:00

fib_frontend.c

net: reinstate rtnl in call_netdevice_notifiers()

2012-08-23 09:24:42 -07:00

fib_lookup.h

ipv4: Fix nexthop caching wrt. scoping.

2011-03-24 18:06:47 -07:00

fib_rules.c

ipv4: Don't store a rule pointer in fib_result.

2012-07-13 08:21:29 -07:00

fib_semantics.c

ipv4: Cache routes in nexthop exception entries.

2012-07-31 15:02:02 -07:00

fib_trie.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2012-08-22 14:21:38 -07:00

gre.c

net: ipv4: Standardize prefixes for message logging

2012-03-12 17:05:21 -07:00

icmp.c

ipv4: Prepare for change of rt->rt_iif encoding.

2012-07-23 16:36:26 -07:00

igmp.c

time: jiffies_delta_to_clock_t() helper to the rescue

2012-08-09 16:17:03 -07:00

inet_connection_sock.c

tcp: fix TFO regression

2012-09-06 14:21:10 -04:00

inet_diag.c

userns: Teach inet_diag to work with user namespaces

2012-08-14 21:55:20 -07:00

inet_fragment.c

inetpeer: add parameter net for inet_getpeer_v4,v6

2012-06-08 14:27:23 -07:00

inet_hashtables.c

ipv4: fix checkpatch errors

2012-04-15 12:37:19 -04:00

inet_lro.c

net: add skb frag size accessors

2011-10-19 03:10:46 -04:00

inet_timewait_sock.c

net: ipv4 and ipv6: Convert printk(KERN_DEBUG to pr_debug

2012-05-16 01:01:03 -04:00

inetpeer.c

ipv4: Maintain redirect and PMTU info in struct rtable again.

2012-07-10 22:40:14 -07:00

ip_forward.c

snmp: fix OutOctets counter to include forwarded datagrams

2012-06-07 14:50:56 -07:00

ip_fragment.c

ipv4: fix path MTU discovery with connection tracking

2012-08-26 19:13:55 +02:00

ip_gre.c

ipv4: Adjust semantics of rt->rt_gateway.

2012-07-20 13:31:20 -07:00

ip_input.c

net: TCP early demux cleanup

2012-07-30 14:53:21 -07:00

ip_options.c

ipv4: optimize fib_compute_spec_dst call in ip_options_echo

2012-07-19 08:30:49 -07:00

ip_output.c

ipv4: fix path MTU discovery with connection tracking

2012-08-26 19:13:55 +02:00

ip_sockglue.c

ipv4: Prepare for change of rt->rt_iif encoding.

2012-07-23 16:36:26 -07:00

ip_vti.c

net/ipv4/ip_vti.c: Fix __rcu warnings detected by sparse.

2012-07-23 13:00:54 -07:00

ipcomp.c

ipv4: Add redirect support to all protocol icmp error handlers.

2012-07-11 21:27:49 -07:00

ipconfig.c

net/ipv4/ipconfig: neaten __setup placement

2012-05-20 04:06:16 -04:00

ipip.c

ipv4: Adjust semantics of rt->rt_gateway.

2012-07-20 13:31:20 -07:00

ipmr.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2012-08-31 15:14:18 -04:00

Kconfig

net/ipv4: VTI support new module for ip_vti.

2012-07-18 09:36:12 -07:00

Makefile

memcg: rename config variables

2012-07-31 18:42:43 -07:00

netfilter.c

netfilter: properly annotate ipv4_netfilter_{init,fini}()

2012-09-03 13:56:04 +02:00

ping.c

userns: Use kgids for sysctl_ping_group_range

2012-08-14 21:49:10 -07:00

proc.c

tcp: TCP Fast Open Server - header & support functions

2012-08-31 20:02:18 -04:00

protocol.c

inet: Sanitize inet{,6} protocol demux.

2012-06-19 18:56:21 -07:00

raw.c

userns: Print out socket uids in a user namespace aware fashion.

2012-08-14 21:48:06 -07:00

route.c

ipv4: Minor logic clean-up in ipv4_mtu

2012-08-31 16:22:50 -04:00

syncookies.c

tcp: TCP Fast Open Server - support TFO listeners

2012-08-31 20:02:19 -04:00

sysctl_net_ipv4.c

tcp: TCP Fast Open Server - header & support functions

2012-08-31 20:02:18 -04:00

tcp_bic.c

tcp: fix undo after RTO for BIC

2012-01-20 14:17:26 -05:00

tcp_cong.c

tcp: Apply device TSO segment limit earlier

2012-08-02 00:19:17 -07:00

tcp_cubic.c

tcp: fix undo after RTO for CUBIC

2012-01-20 14:17:26 -05:00

tcp_diag.c

inet_diag: Rename inet_diag_req into inet_diag_req_v2

2012-01-11 12:56:06 -08:00

tcp_fastopen.c

tcp: TCP Fast Open Server - header & support functions

2012-08-31 20:02:18 -04:00

tcp_highspeed.c

tcp: mark tcp_congestion_ops read_mostly

2011-03-10 00:40:17 -08:00

tcp_htcp.c

tcp: mark tcp_congestion_ops read_mostly

2011-03-10 00:40:17 -08:00

tcp_hybla.c

tcp: bool conversions

2012-05-17 14:59:59 -04:00

tcp_illinois.c

tcp: mark tcp_congestion_ops read_mostly

2011-03-10 00:40:17 -08:00

tcp_input.c

tcp: use PRR to reduce cwin in CWR state

2012-09-03 14:34:02 -04:00

tcp_ipv4.c

tcp: TCP Fast Open Server - main code path

2012-08-31 20:02:19 -04:00

tcp_lp.c

Fix common misspellings

2011-03-31 11:26:23 -03:00

tcp_memcontrol.c

memcg: decrement static keys at real destroy time

2012-05-29 16:22:28 -07:00

tcp_metrics.c

tcp: add generic netlink support for tcp_metrics

2012-09-05 15:15:02 -04:00

tcp_minisocks.c

tcp: TCP Fast Open Server - support TFO listeners

2012-08-31 20:02:19 -04:00

tcp_output.c

tcp: use PRR to reduce cwin in CWR state

2012-09-03 14:34:02 -04:00

tcp_probe.c

net: cleanup unsigned to unsigned int

2012-04-15 12:44:40 -04:00

tcp_scalable.c

tcp: mark tcp_congestion_ops read_mostly

2011-03-10 00:40:17 -08:00

tcp_timer.c

tcp: TCP Fast Open Server - support TFO listeners

2012-08-31 20:02:19 -04:00

tcp_vegas.c

tcp: mark tcp_congestion_ops read_mostly

2011-03-10 00:40:17 -08:00

tcp_vegas.h

…

tcp_veno.c

tcp: mark tcp_congestion_ops read_mostly

2011-03-10 00:40:17 -08:00

tcp_westwood.c

tcp: mark tcp_congestion_ops read_mostly

2011-03-10 00:40:17 -08:00

tcp_yeah.c

Fix common misspellings

2011-03-31 11:26:23 -03:00

tcp.c

tcp: TCP Fast Open Server - support TFO listeners

2012-08-31 20:02:19 -04:00

tunnel4.c

net: Convert printks to pr_<level>

2012-03-11 23:42:51 -07:00

udp_diag.c

userns: Teach inet_diag to work with user namespaces

2012-08-14 21:55:20 -07:00

udp_impl.h

ipv4: fix checkpatch errors

2012-04-15 12:37:19 -04:00

udp.c

Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace

2012-08-24 18:54:37 -04:00

udplite.c

net: ipv4: Standardize prefixes for message logging

2012-03-12 17:05:21 -07:00

xfrm4_input.c

ipv4: Fix input route performance regression.

2012-07-26 15:50:39 -07:00

xfrm4_mode_beet.c

ipsec: be careful of non existing mac headers

2012-02-23 16:50:45 -05:00

xfrm4_mode_transport.c

…

xfrm4_mode_tunnel.c

net/ipv4: VTI support rx-path hook in xfrm4_mode_tunnel.

2012-07-18 09:36:12 -07:00

xfrm4_output.c

xfrm4: Don't call icmp_send on local error

2011-07-01 17:33:19 -07:00

xfrm4_policy.c

ipv4: Properly purge netdev references on uncached routes.

2012-07-31 15:06:50 -07:00

xfrm4_state.c

net: Add export.h for EXPORT_SYMBOL/THIS_MODULE to non-modules

2011-10-31 19:30:30 -04:00

xfrm4_tunnel.c

net: ipv4: Standardize prefixes for message logging

2012-03-12 17:05:21 -07:00