Eric Dumazet f32f193395 bonding: set dev->needed_headroom in bond_setup_by_slave() ... syzbot managed to crash a host by creating a bond with a GRE device. For non Ethernet device, bonding calls bond_setup_by_slave() instead of ether_setup(), and unfortunately dev->needed_headroom was not copied from the new added member. [ 171.243095] skbuff: skb_under_panic: text:ffffffffa184b9ea len:116 put:20 head:ffff883f84012dc0 data:ffff883f84012dbc tail:0x70 end:0xd00 dev:bond0 [ 171.243111] ------------[ cut here ]------------ [ 171.243112] kernel BUG at net/core/skbuff.c:112! [ 171.243117] invalid opcode: 0000 [#1] SMP KASAN PTI [ 171.243469] gsmi: Log Shutdown Reason 0x03 [ 171.243505] Call Trace: [ 171.243506] <IRQ> [ 171.243512] [<ffffffffa171be59>] skb_push+0x49/0x50 [ 171.243516] [<ffffffffa184b9ea>] ipgre_header+0x2a/0xf0 [ 171.243520] [<ffffffffa17452d7>] neigh_connected_output+0xb7/0x100 [ 171.243524] [<ffffffffa186f1d3>] ip6_finish_output2+0x383/0x490 [ 171.243528] [<ffffffffa186ede2>] __ip6_finish_output+0xa2/0x110 [ 171.243531] [<ffffffffa186acbc>] ip6_finish_output+0x2c/0xa0 [ 171.243534] [<ffffffffa186abe9>] ip6_output+0x69/0x110 [ 171.243537] [<ffffffffa186ac90>] ? ip6_output+0x110/0x110 [ 171.243541] [<ffffffffa189d952>] mld_sendpack+0x1b2/0x2d0 [ 171.243544] [<ffffffffa189d290>] ? mld_send_report+0xf0/0xf0 [ 171.243548] [<ffffffffa189c797>] mld_ifc_timer_expire+0x2d7/0x3b0 [ 171.243551] [<ffffffffa189c4c0>] ? mld_gq_timer_expire+0x50/0x50 [ 171.243556] [<ffffffffa0fea270>] call_timer_fn+0x30/0x130 [ 171.243559] [<ffffffffa0fea17c>] expire_timers+0x4c/0x110 [ 171.243563] [<ffffffffa0fea0e3>] __run_timers+0x213/0x260 [ 171.243566] [<ffffffffa0fecb7d>] ? ktime_get+0x3d/0xa0 [ 171.243570] [<ffffffffa0ff9c4e>] ? clockevents_program_event+0x7e/0xe0 [ 171.243574] [<ffffffffa0f7e5d5>] ? sched_clock_cpu+0x15/0x190 [ 171.243577] [<ffffffffa0fe973d>] run_timer_softirq+0x1d/0x40 [ 171.243581] [<ffffffffa1c00152>] __do_softirq+0x152/0x2f0 [ 171.243585] [<ffffffffa0f44e1f>] irq_exit+0x9f/0xb0 [ 171.243588] [<ffffffffa1a02e1d>] smp_apic_timer_interrupt+0xfd/0x1a0 [ 171.243591] [<ffffffffa1a01ea6>] apic_timer_interrupt+0x86/0x90 Fixes: f5184d267c ("net: Allow netdevices to specify needed head/tailroom") Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: syzbot <syzkaller@googlegroups.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2020-09-25 17:04:55 -07:00
..
appletalk	treewide: Use fallthrough pseudo-keyword	2020-08-23 17:36:59 -05:00
arcnet	treewide: Use fallthrough pseudo-keyword	2020-08-23 17:36:59 -05:00
bonding	bonding: set dev->needed_headroom in bond_setup_by_slave()	2020-09-25 17:04:55 -07:00
caif
can	treewide: Use fallthrough pseudo-keyword	2020-08-23 17:36:59 -05:00
dsa	net: dsa: microchip: really look for phy-mode in port nodes	2020-09-24 20:08:48 -07:00
ethernet	net: ethernet: cavium: octeon_mgmt: use phy_start and phy_stop	2020-09-25 16:51:31 -07:00
fddi	treewide: Use fallthrough pseudo-keyword	2020-08-23 17:36:59 -05:00
fjes	treewide: Use fallthrough pseudo-keyword	2020-08-23 17:36:59 -05:00
hamradio	treewide: Use fallthrough pseudo-keyword	2020-08-23 17:36:59 -05:00
hippi
hyperv	hv_netvsc: Add validation for untrusted Hyper-V values	2020-09-17 16:21:26 -07:00
ieee802154	ieee802154/adf7242: check status of adf7242_read_reg	2020-08-03 20:19:21 +02:00
ipa	net: ipa: fix u32_replace_bits by u32p_xxx version	2020-09-11 17:28:48 -07:00
ipvlan	ipvlan: fix device features	2020-08-16 15:15:00 -07:00
netdevsim	treewide: Use fallthrough pseudo-keyword	2020-08-23 17:36:59 -05:00
phy	net: phy: Do not warn in phy_stop() on PHY_DOWN	2020-09-17 16:55:35 -07:00
plip	treewide: Use fallthrough pseudo-keyword	2020-08-23 17:36:59 -05:00
ppp	mm, treewide: rename kzfree() to kfree_sensitive()	2020-08-07 11:33:22 -07:00
slip
team
usb	rndis_host: increase sleep time in the query-response loop	2020-09-14 14:39:59 -07:00
vmxnet3	vmxnet3: fix cksum offload issues for non-udp tunnels	2020-09-25 16:41:40 -07:00
wan	drivers/net/wan/x25_asy: Correct the ndo_open and ndo_stop functions	2020-09-24 19:52:58 -07:00
wimax	treewide: Use fallthrough pseudo-keyword	2020-08-23 17:36:59 -05:00
wireguard	wireguard: peerlookup: take lock before checking hash in replace operation	2020-09-09 11:31:38 -07:00
wireless	mt76: mt7615: reduce maximum VHT MPDU length to 7991	2020-09-24 16:12:22 +03:00
xen-netback	treewide: Use fallthrough pseudo-keyword	2020-08-23 17:36:59 -05:00
bareudp.c	tunnels: PMTU discovery support for directly bridged IP packets	2020-08-04 13:01:45 -07:00
dummy.c
eql.c
geneve.c	geneve: add transport ports in route lookup for geneve	2020-09-16 17:41:38 -07:00
gtp.c	gtp: add GTPA_LINK info to msg sent to userspace	2020-08-25 06:28:53 -07:00
ifb.c
Kconfig
LICENSE.SRC
loopback.c
macsec.c
macvlan.c	treewide: Use fallthrough pseudo-keyword	2020-08-23 17:36:59 -05:00
macvtap.c
Makefile
mdio.c
mii.c	treewide: Use fallthrough pseudo-keyword	2020-08-23 17:36:59 -05:00
net_failover.c
netconsole.c
nlmon.c
ntb_netdev.c
rionet.c
sb1000.c
Space.c
sungem_phy.c
tap.c
thunderbolt.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next	2020-08-05 20:13:21 -07:00
tun.c	treewide: Use fallthrough pseudo-keyword	2020-08-23 17:36:59 -05:00
veth.c	treewide: Use fallthrough pseudo-keyword	2020-08-23 17:36:59 -05:00
virtio_net.c	treewide: Use fallthrough pseudo-keyword	2020-08-23 17:36:59 -05:00
vrf.c	vrf: Handle CONFIG_SYSCTL not set	2020-07-23 17:51:04 -07:00
vsockmon.c
vxlan.c	Revert "vxlan: fix tos value before xmit"	2020-08-05 12:09:10 -07:00
xen-netfront.c	treewide: Use fallthrough pseudo-keyword	2020-08-23 17:36:59 -05:00