Messages in this thread | | | From | Josh Elsasser <> | Subject | [PATCH 0/1] net: avoid a kernel panic during sk_busy_loop | Date | Sun, 11 Mar 2018 12:22:54 -0700 |
| |
Hi Dave,
I stumbled across a reproducible kernel panic while playing around with busy_poll on a Linux 4.9.86 kernel. There's an unfortunate interaction between init_dummy_netdev, which doesn't bother to fill in netdev_ops, and sk_busy_loop, which assumes netdev_ops is a valid pointer.
To reproduce on the device under test (DUT), I did:
$ ip addr show dev wlan0 8: wlan0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq [...] inet 172.16.122.6/23 brd 172.16.123.255 scope global wlan0 $ sysctl -w net.core.busy_read=50 $ nc -l 172.16.122.6 5001
Then transmitted some data to this socket from a second host:
$ echo "foo" | nc 172.16.122.6 5001
The DUT immediately hits a kernel panic.
I've attached a patch that applies cleanly to the 4.9.87 stable release. This fix isn't necessary for net/net-next (ndo_busy_poll was removed in linux-4.11), but a further backport of this commit is likely required for any stable releases older than linux-4.5.
I hope this is the right way to raise something like this. I couldn't find a clear answer from the -stable and netdev howtos for bugs against features that no longer exist in mainline.
Thanks, Josh
| |