lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
ece6b0a2b2
linux-kernel-test/net
History
Cong Wang ece6b0a2b2 rds: limit the size allocated by rds_message_alloc() 
Dave Jones reported the following bug:

"When fed mangled socket data, rds will trust what userspace gives it,
and tries to allocate enormous amounts of memory larger than what
kmalloc can satisfy."

WARNING: at mm/page_alloc.c:2393 __alloc_pages_nodemask+0xa0d/0xbe0()
Hardware name: GA-MA78GM-S2H
Modules linked in: vmw_vsock_vmci_transport vmw_vmci vsock fuse bnep dlci bridge 8021q garp stp mrp binfmt_misc l2tp_ppp l2tp_core rfcomm s
Pid: 24652, comm: trinity-child2 Not tainted 3.8.0+ #65
Call Trace:
 [<ffffffff81044155>] warn_slowpath_common+0x75/0xa0
 [<ffffffff8104419a>] warn_slowpath_null+0x1a/0x20
 [<ffffffff811444ad>] __alloc_pages_nodemask+0xa0d/0xbe0
 [<ffffffff8100a196>] ? native_sched_clock+0x26/0x90
 [<ffffffff810b2128>] ? trace_hardirqs_off_caller+0x28/0xc0
 [<ffffffff810b21cd>] ? trace_hardirqs_off+0xd/0x10
 [<ffffffff811861f8>] alloc_pages_current+0xb8/0x180
 [<ffffffff8113eaaa>] __get_free_pages+0x2a/0x80
 [<ffffffff811934fe>] kmalloc_order_trace+0x3e/0x1a0
 [<ffffffff81193955>] __kmalloc+0x2f5/0x3a0
 [<ffffffff8104df0c>] ? local_bh_enable_ip+0x7c/0xf0
 [<ffffffffa0401ab3>] rds_message_alloc+0x23/0xb0 [rds]
 [<ffffffffa04043a1>] rds_sendmsg+0x2b1/0x990 [rds]
 [<ffffffff810b21cd>] ? trace_hardirqs_off+0xd/0x10
 [<ffffffff81564620>] sock_sendmsg+0xb0/0xe0
 [<ffffffff810b2052>] ? get_lock_stats+0x22/0x70
 [<ffffffff810b24be>] ? put_lock_stats.isra.23+0xe/0x40
 [<ffffffff81567f30>] sys_sendto+0x130/0x180
 [<ffffffff810b872d>] ? trace_hardirqs_on+0xd/0x10
 [<ffffffff816c547b>] ? _raw_spin_unlock_irq+0x3b/0x60
 [<ffffffff816cd767>] ? sysret_check+0x1b/0x56
 [<ffffffff810b8695>] ? trace_hardirqs_on_caller+0x115/0x1a0
 [<ffffffff81341d8e>] ? trace_hardirqs_on_thunk+0x3a/0x3f
 [<ffffffff816cd742>] system_call_fastpath+0x16/0x1b
---[ end trace eed6ae990d018c8b ]---

Reported-by: Dave Jones <davej@redhat.com>
Cc: Dave Jones <davej@redhat.com>
Cc: David S. Miller <davem@davemloft.net>
Cc: Venkat Venkatsubra <venkat.x.venkatsubra@oracle.com>
Signed-off-by: Cong Wang <amwang@redhat.com>
Acked-by: Venkat Venkatsubra <venkat.x.venkatsubra@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-03-04 14:12:06 -05:00
..
9p Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace 2013-02-25 16:00:49 -08:00
802 mrp: make mrp_rcv static 2013-02-11 14:16:26 -05:00
8021q net: proc: change proc_net_remove to remove_proc_entry 2013-02-18 14:53:08 -05:00
appletalk
atm net: proc: change proc_net_remove to remove_proc_entry 2013-02-18 14:53:08 -05:00
ax25 net: proc: change proc_net_remove to remove_proc_entry 2013-02-18 14:53:08 -05:00
batman-adv Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net into net 2013-02-18 23:34:21 -05:00
bluetooth Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial 2013-02-21 17:40:58 -08:00
bridge bridge: make ifla_br_policy and br_af_ops static 2013-02-14 13:27:45 -05:00
caif caif_dev: fix sparse warnings for caif_flow_cb 2013-03-03 01:43:48 -05:00
can net: proc: change proc_net_remove to remove_proc_entry 2013-02-18 14:53:08 -05:00
ceph Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace 2013-02-25 16:00:49 -08:00
core Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2013-02-26 11:44:11 -08:00
dcb net: Allow DCBnl to use other namespaces besides init_net 2012-12-10 14:09:01 -05:00
dccp Driver core patches for 3.9-rc1 2013-02-21 12:05:51 -08:00
decnet Driver core patches for 3.9-rc1 2013-02-21 12:05:51 -08:00
dns_resolver Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security 2012-12-16 15:40:50 -08:00
dsa dsa: make dsa_switch_setup check for valid port names 2013-01-21 15:40:12 -05:00
ethernet net: split eth_mac_addr for better error handling 2013-01-21 14:07:44 -05:00
ieee802154 Driver core patches for 3.9-rc1 2013-02-21 12:05:51 -08:00
ipv4 ipv[4|6]: correct dropwatch false positive in local_deliver_finish 2013-03-01 15:56:29 -05:00
ipv6 ipv[4|6]: correct dropwatch false positive in local_deliver_finish 2013-03-01 15:56:29 -05:00
ipx
irda irda: small read beyond end of array in debug code 2013-02-27 13:10:35 -05:00
iucv iucv: fix kernel panic at reboot 2013-02-14 15:55:19 +01:00
key net: proc: change proc_net_remove to remove_proc_entry 2013-02-18 14:53:08 -05:00
l2tp l2tp: Restore socket refcount when sendmsg succeeds 2013-03-01 14:13:09 -05:00
lapb net/lapb: remove depends on CONFIG_EXPERIMENTAL 2013-01-11 11:40:01 -08:00
llc net: Allow userns root to control llc, netfilter, netlink, packet, and xfrm 2012-11-18 20:32:45 -05:00
mac80211 Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless into for-davem 2013-03-01 13:52:03 -05:00
mac802154 Driver core patches for 3.9-rc1 2013-02-21 12:05:51 -08:00
netfilter Merge branch 'master' of git://1984.lsi.us.es/nf 2013-02-26 17:24:26 -05:00
netlabel
netlink net: proc: change proc_net_remove to remove_proc_entry 2013-02-18 14:53:08 -05:00
netrom net: proc: change proc_net_remove to remove_proc_entry 2013-02-18 14:53:08 -05:00
nfc Driver core patches for 3.9-rc1 2013-02-21 12:05:51 -08:00
openvswitch Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2013-02-08 18:02:14 -05:00
packet net: proc: change proc_net_remove to remove_proc_entry 2013-02-18 14:53:08 -05:00
phonet net: proc: change proc_net_remove to remove_proc_entry 2013-02-18 14:53:08 -05:00
rds rds: limit the size allocated by rds_message_alloc() 2013-03-04 14:12:06 -05:00
rfkill rfkill: don't use [delayed_]work_pending() 2012-12-28 13:40:16 -08:00
rose net: proc: change proc_net_remove to remove_proc_entry 2013-02-18 14:53:08 -05:00
rxrpc Driver core patches for 3.9-rc1 2013-02-21 12:05:51 -08:00
sched net: proc: change proc_net_remove to remove_proc_entry 2013-02-18 14:53:08 -05:00
sctp sctp: use the passed in gfp flags instead GFP_KERNEL 2013-03-01 15:59:56 -05:00
sunrpc Main batch of InfiniBand/RDMA changes for 3.9: 2013-02-26 11:41:08 -08:00
tipc Driver core patches for 3.9-rc1 2013-02-21 12:05:51 -08:00
unix net: proc: change proc_net_remove to remove_proc_entry 2013-02-18 14:53:08 -05:00
vmw_vsock VSOCK: Don't reject PF_VSOCK protocol 2013-02-18 15:02:51 -05:00
wimax
wireless Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless into for-davem 2013-03-01 13:52:03 -05:00
x25 net/x25: remove depends on CONFIG_EXPERIMENTAL 2013-01-11 11:40:03 -08:00
xfrm Driver core patches for 3.9-rc1 2013-02-21 12:05:51 -08:00
compat.c
Kconfig Driver core patches for 3.9-rc1 2013-02-21 12:05:51 -08:00
Makefile VSOCK: Introduce VM Sockets 2013-02-10 19:41:08 -05:00
nonet.c
socket.c ethtool: fix sparse warning 2013-02-11 14:16:26 -05:00
sysctl_net.c user_ns: get rid of duplicate code in net_ctl_permissions 2012-11-18 20:32:45 -05:00