From: Hannes Frederic Sowa <hannes@stressinduktion.org>
To: "Theodore Ts'o" <tytso@mit.edu>
Cc: netdev@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [REGRESSION v3.14-rc2] NULL dereference in icmp6_send()
Date: Mon, 17 Feb 2014 19:50:53 +0100 [thread overview]
Message-ID: <20140217185053.GF22833@order.stressinduktion.org> (raw)
In-Reply-To: <nsxzjlp4lxm.fsf@closure.thunk.org>
Hi!
On Mon, Feb 17, 2014 at 01:46:13PM -0500, Theodore Ts'o wrote:
> I was sitting in the Admiral's Club of Boston Logan airport, having
> connected to the free airport wifi, although I had not yet logged into
> the captive portal, when I received the following BUG. I've also seen
> this once before when connected to my home network (running the CeroWRT
> stable snapshot, versoin 3.7.5-2), although I wasn't able to get a
> screen shot that time:
>
> https://plus.google.com/photos/+TheodoreTso/albums/5981437894092747105/5981437896646076466
>
> The transcribed stack dump is:
>
> icmp6_send
> ip6_expire_frag_queue
> ip6_frag_expire
> call_timer_fn
> run_timer_softirq
> irq_exit
> ...
>
> I was running v3.13 and v3.13-rcX previously without seeing this, so I
> suspect this is a regression.
At that point the skb does not have a dst attached, so we panic in
icmp6_send.
This is fixed here:
https://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit/?id=d94c1f92bbf2c42c5febd68bbea51fffeac90834
Greetings,
Hannes
next prev parent reply other threads:[~2014-02-17 18:50 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-02-17 18:46 Theodore Ts'o
2014-02-17 18:50 ` Hannes Frederic Sowa [this message]
2014-02-17 19:13 ` David Miller
2014-02-17 19:43 ` Theodore Ts'o
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20140217185053.GF22833@order.stressinduktion.org \
--to=hannes@stressinduktion.org \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=tytso@mit.edu \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®