projects
/
linux-2.6-microblaze.git
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
| inline |
side by side
(parent:
3811ae7
)
ipvs: ip_vs_sip_fill_param() BUG: bad check of return value
author
Hans Schillstrom
<hans@schillstrom.com>
Sat, 27 Apr 2013 18:06:14 +0000
(20:06 +0200)
committer
David S. Miller
<davem@davemloft.net>
Mon, 29 Apr 2013 15:35:30 +0000
(11:35 -0400)
The reason for this patch is crash in kmemdup
caused by returning from get_callid with uniialized
matchoff and matchlen.
Removing Zero check of matchlen since it's done by ct_sip_get_header()
BUG: unable to handle kernel paging request at
ffff880457b5763f
IP: [<
ffffffff810df7fc
>] kmemdup+0x2e/0x35
PGD
27f6067
PUD 0
Oops: 0000 [#1] PREEMPT SMP
Modules linked in: xt_state xt_helper nf_conntrack_ipv6 nf_defrag_ipv6 ip6table_mangle xt_connmark xt_conntrack ip6_tables nf_conntrack_ftp ip_vs_ftp nf_nat xt_tcpudp iptable_mangle xt_mark ip_tables x_tables ip_vs_rr ip_vs_lblcr ip_vs_pe_sip ip_vs nf_conntrack_sip nf_conntrack bonding igb i2c_algo_bit i2c_core
CPU 5
Pid: 0, comm: swapper/5 Not tainted 3.9.0-rc5+ #5 /S1200KP
RIP: 0010:[<
ffffffff810df7fc
>] [<
ffffffff810df7fc
>] kmemdup+0x2e/0x35
RSP: 0018:
ffff8803fea03648
EFLAGS:
00010282
RAX:
ffff8803d61063e0
RBX:
0000000000000003
RCX:
0000000000000003
RDX:
0000000000000003
RSI:
ffff880457b5763f
RDI:
ffff8803d61063e0
RBP:
ffff8803fea03658
R08:
0000000000000008
R09:
0000000000000011
R10:
0000000000000011
R11:
00ffffffff81a8a3
R12:
ffff880457b5763f
R13:
ffff8803d67f786a
R14:
ffff8803fea03730
R15:
ffffffffa0098e90
FS:
0000000000000000
(0000) GS:
ffff8803fea00000
(0000) knlGS:
0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0:
0000000080050033
CR2:
ffff880457b5763f
CR3:
0000000001a0c000
CR4:
00000000001407e0
DR0:
0000000000000000
DR1:
0000000000000000
DR2:
0000000000000000
DR3:
0000000000000000
DR6:
00000000ffff0ff0
DR7:
0000000000000400
Process swapper/5 (pid: 0, threadinfo
ffff8803ee18c000
, task
ffff8803ee18a480
)
Stack:
ffff8803d822a080
000000000000001c
ffff8803fea036c8
ffffffffa000937a
ffffffff81f0d8a0
000000038135fdd5
ffff880300000014
ffff880300110000
ffffffff150118ac
ffff8803d7e8a000
ffff88031e0118ac
0000000000000000
Call Trace:
<IRQ>
[<
ffffffffa000937a
>] ip_vs_sip_fill_param+0x13a/0x187 [ip_vs_pe_sip]
[<
ffffffffa007b209
>] ip_vs_sched_persist+0x2c6/0x9c3 [ip_vs]
[<
ffffffff8107dc53
>] ? __lock_acquire+0x677/0x1697
[<
ffffffff8100972e
>] ? native_sched_clock+0x3c/0x7d
[<
ffffffff8100972e
>] ? native_sched_clock+0x3c/0x7d
[<
ffffffff810649bc
>] ? sched_clock_cpu+0x43/0xcf
[<
ffffffffa007bb1e
>] ip_vs_schedule+0x181/0x4ba [ip_vs]
...
Signed-off-by: Hans Schillstrom <hans@schillstrom.com>
Acked-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Simon Horman <horms@verge.net.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/netfilter/ipvs/ip_vs_pe_sip.c
patch
|
blob
|
history
diff --git
a/net/netfilter/ipvs/ip_vs_pe_sip.c
b/net/netfilter/ipvs/ip_vs_pe_sip.c
index
12475ef
..
e5920fb
100644
(file)
--- a/
net/netfilter/ipvs/ip_vs_pe_sip.c
+++ b/
net/netfilter/ipvs/ip_vs_pe_sip.c
@@
-37,14
+37,10
@@
static int get_callid(const char *dptr, unsigned int dataoff,
if (ret > 0)
break;
if (!ret)
- return
0
;
+ return
-EINVAL
;
dataoff += *matchoff;
}
- /* Empty callid is useless */
- if (!*matchlen)
- return -EINVAL;
-
/* Too large is useless */
if (*matchlen > IP_VS_PEDATA_MAXLEN)
return -EINVAL;