Skip to content

Commit

Permalink
compat: Fix IPv6 frag expiry crash.
Browse files Browse the repository at this point in the history
If a user sends some fragments of an IPv6 message through OVS, but OVS
fails to assemble the IPv6 message and the OVS module is then unloaded
before the fragments expire, it could lead to a kernel panic like the
following:

Call Trace:
 <IRQ>
 [<ffffffff810e1919>] ? call_timer_fn+0x39/0x130
 [<ffffffff810e31fe>] run_timer_softirq+0x20e/0x2c0
 [<ffffffff8107dd0d>] __do_softirq+0xdd/0x290
 [<ffffffff817c5bdc>] do_softirq_own_stack+0x1c/0x30
 <EOI>
 [<ffffffff8107df5f>] do_softirq+0x4f/0x60
 [<ffffffff8107dff5>] __local_bh_enable_ip+0x85/0x90
 [<ffffffff8173994f>] inet_frags_exit_net+0x6f/0xc0
 [<ffffffffc00c02a3>] nf_ct_net_exit+0x43/0x50 [nf_defrag_ipv6]
 [<ffffffff816ae528>] ops_exit_list.isra.4+0x38/0x60
 [<ffffffff816ae656>] unregister_pernet_operations+0x96/0xe0
 [<ffffffff816ae6c5>] unregister_pernet_subsys+0x25/0x40
 [<ffffffffc00c1315>] nf_ct_frag6_cleanup+0x15/0x23 [nf_defrag_ipv6]
 [<ffffffffc00c133d>] nf_defrag_fini+0x1a/0xcdd [nf_defrag_ipv6]
 [<ffffffff810fbedd>] SyS_delete_module+0x18d/0x220
 [<ffffffff817c40b2>] entry_SYSCALL_64_fastpath+0x16/0x75
Code:  Bad RIP value.
RIP  [<ffffffffc030f990>] 0xffffffffc030f990
 RSP <ffff88007a043e90>
CR2: ffffffffc030f990
---[ end trace 3bd8c1bbc4478fe2 ]---
Kernel panic - not syncing: Fatal exception in interrupt

Fixes: 73b09af ("compat: Backport IPv6 reassembly.")
Reported-by: Jarno Rajahalme <jarno@ovn.org>
Signed-off-by: Joe Stringer <joe@ovn.org>
Acked-by: Pravin B Shelar <pshelar@ovn.org>
  • Loading branch information
joestringer committed Aug 1, 2016
1 parent c34a87b commit e92669b
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion datapath/linux/compat/nf_conntrack_reasm.c
Expand Up @@ -581,7 +581,7 @@ static int nf_ct_net_init(struct net *net)

static void nf_ct_net_exit(struct net *net)
{
inet_frags_exit_net(&net->ipv6.frags, &nf_frags);
inet_frags_exit_net(&net->nf_frag.frags, &nf_frags);
}

static struct pernet_operations nf_ct_net_ops = {
Expand Down

0 comments on commit e92669b

Please sign in to comment.