From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S1751524AbdJ1WVD (ORCPT <rfc822;w@1wt.eu>);
        Sat, 28 Oct 2017 18:21:03 -0400
Received: from mail-pg0-f65.google.com ([74.125.83.65]:53897 "EHLO
        mail-pg0-f65.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
        with ESMTP id S1751273AbdJ1WVB (ORCPT
        <rfc822;linux-kernel@vger.kernel.org>);
        Sat, 28 Oct 2017 18:21:01 -0400
X-Google-Smtp-Source: ABhQp+SpnqhqdjicrD32ADYo+aPNfcMTCuaoYo55nMQ5sc2B/KW0XY5/z86+iP8+qsiYfI1uma7Skg==
Content-Type: text/plain; charset=utf-8
Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\))
Subject: Re: [PATCH V2 net] tuntap: properly align skb->head before building
 skb
From: Wei Wei <dotweiba@gmail.com>
In-Reply-To: <20171028.190615.1780763141354795593.davem@redhat.com>
Date: Sat, 28 Oct 2017 18:20:54 -0400
Cc: jasowang@redhat.com, netdev <netdev@vger.kernel.org>,
        LKML <linux-kernel@vger.kernel.org>,
        Eric Dumazet <edumazet@google.com>,
        Willem de Bruijn <willemdebruijn.kernel@gmail.com>,
        Dmitry Vyukov <dvyukov@google.com>,
        Mark Rutland <mark.rutland@arm.com>
Message-Id: <06D9B61F-5C89-47C4-A060-B63FE5A8F922@gmail.com>
References: <1509073544-4474-1-git-send-email-jasowang@redhat.com>
 <20171028.190615.1780763141354795593.davem@redhat.com>
To: David Miller <davem@redhat.com>
X-Mailer: Apple Mail (2.3273)
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from quoted-printable to 8bit by nfs id v9SMLQFR021948

With this patch, the crash can’t be reproduced with the syz-repro and crash log0/log1.

The auto-generated reproducers are here: 
https://github.com/dotweiba/skb_clone_atomic_inc_bug

Thanks,
Wei
> On 28 Oct 2017, at 6:06 AM, David Miller <davem@redhat.com> wrote:
> 
> From: Jason Wang <jasowang@redhat.com>
> Date: Fri, 27 Oct 2017 11:05:44 +0800
> 
>> An unaligned alloc_frag->offset caused by previous allocation will
>> result an unaligned skb->head. This will lead unaligned
>> skb_shared_info and then unaligned dataref which requires to be
>> aligned for accessing on some architecture. Fix this by aligning
>> alloc_frag->offset before the frag refilling.
>> 
>> Fixes: 0bbd7dad34f8 ("tun: make tun_build_skb() thread safe")
>> Cc: Eric Dumazet <edumazet@google.com>
>> Cc: Willem de Bruijn <willemdebruijn.kernel@gmail.com>
>> Cc: Wei Wei <dotweiba@gmail.com>
>> Cc: Dmitry Vyukov <dvyukov@google.com>
>> Cc: Mark Rutland <mark.rutland@arm.com>
>> Reported-by: Wei Wei <dotweiba@gmail.com>
>> Signed-off-by: Jason Wang <jasowang@redhat.com>
> 
> Applied and queued up for -stable, thanks Jason.