From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752628AbdBIJk4 convert rfc822-to-8bit (ORCPT ); Thu, 9 Feb 2017 04:40:56 -0500 Received: from einhorn.in-berlin.de ([192.109.42.8]:55386 "EHLO einhorn.in-berlin.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752286AbdBIJkg (ORCPT ); Thu, 9 Feb 2017 04:40:36 -0500 X-Greylist: delayed 796 seconds by postgrey-1.27 at vger.kernel.org; Thu, 09 Feb 2017 04:40:35 EST X-Envelope-From: thomas@osterried.de From: Thomas Osterried Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 8BIT Mime-Version: 1.0 (Mac OS X Mail 10.2 \(3259\)) Date: Thu, 9 Feb 2017 10:27:10 +0100 Subject: linux mkiss.c panic: fix Cc: =?utf-8?Q?Ralf_B=C3=A4chle_DL5RB?= To: netdev@vger.kernel.org, "David S. Miller" , Andrew Morton , linux-kernel@vger.kernel.org Message-Id: X-Mailer: Apple Mail (2.3259) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Hello, linux mkiss driver could cause a panic. This patch fixes this issue: Signed-off-by: Thomas Osterried mkiss kernel panic fix: Correct device variables guarantees proper skb room. --- mkiss.c.orig 2015-11-18 11:08:46.000000000 +0100 +++ mkiss.c 2016-02-06 18:04:05.000000000 +0100 @@ -678,8 +678,8 @@ { /* Finish setting up the DEVICE info. */ dev->mtu = AX_MTU; - dev->hard_header_len = 0; - dev->addr_len = 0; + dev->hard_header_len = AX25_MAX_HEADER_LEN; + dev->addr_len = AX25_ADDR_LEN; dev->type = ARPHRD_AX25; dev->tx_queue_len = 10; dev->header_ops = &ax_header_ops; Reason: if you plug off i.e. your usb-serial-adapter, the driver re-initializes, with dev->hard_header_len and dev->addr_len set to zero, instead of the correct values. If afterwards a packet should be sent to the half-dead interface, it causes a kernel panic. These device parameters are used in other parts of the IP-stack when calculating the necessary room for the skb. After a packet goes to the mkiss driver for being sent out, there's no room left in the skb, due to the reserved length of 0. If skb_push pushes the ax25-header to the skb with no room left, we panic. The panic looked like this: => >> [] (skb_panic) from [] (skb_push+0x4c/0x50) >> [] (skb_push) from [] (ax25_hard_header+0x34/0xf4 [ax25]) >> [] (ax25_hard_header [ax25]) from [] (ax_header+0x38/0x40 [mkiss]) >> [] (ax_header [mkiss]) from [] (neigh_compat_output+0x8c/0xd8) >> [] (neigh_compat_output) from [] (ip_finish_output+0x2a0/0x914) >> [] (ip_finish_output) from [] (ip_output+0xd8/0xf0) >> [] (ip_output) from [] (ip_local_out_sk+0x44/0x48) This patch makes mkiss behave like the 6pack driver. 6pack does not panic. In 6pack.c sp_setup() (same function name here) the values for dev->hard_header_len and dev->addr_len are set to the same values as in my mkiss patch. vy 73, - Thomas dl9sau