Pablo Neira 3a36515f72 netlink: fix splat in skb_clone with large messages ... Since (c05cdb1 netlink: allow large data transfers from user-space), netlink splats if it invokes skb_clone on large netlink skbs since: * skb_shared_info was not correctly initialized. * skb->destructor is not set in the cloned skb. This was spotted by trinity: [ 894.990671] BUG: unable to handle kernel paging request at ffffc9000047b001 [ 894.991034] IP: [<ffffffff81a212c4>] skb_clone+0x24/0xc0 [...] [ 894.991034] Call Trace: [ 894.991034] [<ffffffff81ad299a>] nl_fib_input+0x6a/0x240 [ 894.991034] [<ffffffff81c3b7e6>] ? _raw_read_unlock+0x26/0x40 [ 894.991034] [<ffffffff81a5f189>] netlink_unicast+0x169/0x1e0 [ 894.991034] [<ffffffff81a601e1>] netlink_sendmsg+0x251/0x3d0 Fix it by: 1) introducing a new netlink_skb_clone function that is used in nl_fib_input, that sets our special skb->destructor in the cloned skb. Moreover, handle the release of the large cloned skb head area in the destructor path. 2) not allowing large skbuffs in the netlink broadcast path. I cannot find any reasonable use of the large data transfer using netlink in that path, moreover this helps to skip extra skb_clone handling. I found two more netlink clients that are cloning the skbs, but they are not in the sendmsg path. Therefore, the sole client cloning that I found seems to be the fib frontend. Thanks to Eric Dumazet for helping to address this issue. Reported-by: Fengguang Wu <fengguang.wu@intel.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: David S. Miller <davem@davemloft.net>		2013-06-27 22:44:16 -07:00
..
acpi	ACPI / PM: Allow device power states to be used for CONFIG_PM unset	2013-05-22 00:19:28 +02:00
asm-generic	Merge branch 'fixes' of git://git.kernel.org/pub/scm/virt/kvm/kvm	2013-06-11 11:16:43 -07:00
clocksource	ARM: late Exynos multiplatform changes	2013-05-07 11:28:42 -07:00
crypto	crypto: sha512 - Expose generic sha512 routine to be callable from other modules	2013-04-25 21:00:57 +08:00
drm	Merge branch 'drm-radeon-sun-hainan' of git://people.freedesktop.org/~airlied/linux	2013-05-21 08:50:57 -07:00
dt-bindings
keys
linux	netlink: fix splat in skb_clone with large messages	2013-06-27 22:44:16 -07:00
math-emu
media	Merge branch 'topic/omap3isp' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media	2013-05-01 09:57:04 -07:00
memory
misc
net	sit: add support of x-netns	2013-06-27 22:30:47 -07:00
pcmcia
ras
rdma
rxrpc
scsi	Merge branch 'postmerge' into for-linus	2013-05-10 07:54:01 -07:00
sound	ASoC: dapm: Treat DAI widgets like AIF widgets for power	2013-06-07 15:54:50 +01:00
target	target: Propigate up ->cmd_kref put return via transport_generic_free_cmd	2013-05-31 01:21:23 -07:00
trace	Fixed regressions (two stability regressions and a performance	2013-05-14 09:30:54 -07:00
uapi	Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next	2013-06-26 13:23:13 -07:00
video	Merge branch 'fbdev-3.10-fixes' of git://gitorious.org/linux-omap-dss2/linux into linux-fbdev/for-3.10-fixes	2013-05-29 17:00:34 +08:00
xen	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2013-06-05 16:37:30 -07:00
Kbuild	UAPI: remove empty Kbuild files	2013-04-30 17:04:09 -07:00