<feed xmlns='http://www.w3.org/2005/Atom'>
<title>linux-stable.git/net/phonet, branch linux-3.6.y</title>
<subtitle>Linux kernel stable tree</subtitle>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/'/>
<entry>
<title>net: remove my future former mail address</title>
<updated>2012-06-17T23:29:38+00:00</updated>
<author>
<name>Rémi Denis-Courmont</name>
<email>remi.denis-courmont@nokia.com</email>
</author>
<published>2012-06-13T22:29:03+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=31fdc5553b42abd7e29bb7b89f6ba07514eb4763'/>
<id>31fdc5553b42abd7e29bb7b89f6ba07514eb4763</id>
<content type='text'>
Signed-off-by: Rémi Denis-Courmont &lt;remi@remlab.net&gt;
Cc: Sakari Ailus &lt;sakari.ailus@nokia.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Signed-off-by: Rémi Denis-Courmont &lt;remi@remlab.net&gt;
Cc: Sakari Ailus &lt;sakari.ailus@nokia.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>net: Convert all sysctl registrations to register_net_sysctl</title>
<updated>2012-04-21T01:22:30+00:00</updated>
<author>
<name>Eric W. Biederman</name>
<email>ebiederm@xmission.com</email>
</author>
<published>2012-04-19T13:44:49+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=ec8f23ce0f4005b74013d4d122e0d540397a93c9'/>
<id>ec8f23ce0f4005b74013d4d122e0d540397a93c9</id>
<content type='text'>
This results in code with less boiler plate that is a bit easier
to read.

Additionally stops us from using compatibility code in the sysctl
core, hastening the day when the compatibility code can be removed.

Signed-off-by: Eric W. Biederman &lt;ebiederm@xmission.com&gt;
Acked-by: Pavel Emelyanov &lt;xemul@parallels.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
This results in code with less boiler plate that is a bit easier
to read.

Additionally stops us from using compatibility code in the sysctl
core, hastening the day when the compatibility code can be removed.

Signed-off-by: Eric W. Biederman &lt;ebiederm@xmission.com&gt;
Acked-by: Pavel Emelyanov &lt;xemul@parallels.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>net: Move all of the network sysctls without a namespace into init_net.</title>
<updated>2012-04-21T01:21:17+00:00</updated>
<author>
<name>Eric W. Biederman</name>
<email>ebiederm@xmission.com</email>
</author>
<published>2012-04-19T13:24:33+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=5dd3df105b9f6cb7dd2472b59e028d0d1c878ecb'/>
<id>5dd3df105b9f6cb7dd2472b59e028d0d1c878ecb</id>
<content type='text'>
This makes it clearer which sysctls are relative to your current network
namespace.

This makes it a little less error prone by not exposing sysctls for the
initial network namespace in other namespaces.

This is the same way we handle all of our other network interfaces to
userspace and I can't honestly remember why we didn't do this for
sysctls right from the start.

Signed-off-by: Eric W. Biederman &lt;ebiederm@xmission.com&gt;
Acked-by: Pavel Emelyanov &lt;xemul@parallels.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
This makes it clearer which sysctls are relative to your current network
namespace.

This makes it a little less error prone by not exposing sysctls for the
initial network namespace in other namespaces.

This is the same way we handle all of our other network interfaces to
userspace and I can't honestly remember why we didn't do this for
sysctls right from the start.

Signed-off-by: Eric W. Biederman &lt;ebiederm@xmission.com&gt;
Acked-by: Pavel Emelyanov &lt;xemul@parallels.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>net: cleanup unsigned to unsigned int</title>
<updated>2012-04-15T16:44:40+00:00</updated>
<author>
<name>Eric Dumazet</name>
<email>eric.dumazet@gmail.com</email>
</author>
<published>2012-04-15T05:58:06+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=95c961747284a6b83a5e2d81240e214b0fa3464d'/>
<id>95c961747284a6b83a5e2d81240e214b0fa3464d</id>
<content type='text'>
Use of "unsigned int" is preferred to bare "unsigned" in net tree.

Signed-off-by: Eric Dumazet &lt;eric.dumazet@gmail.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Use of "unsigned int" is preferred to bare "unsigned" in net tree.

Signed-off-by: Eric Dumazet &lt;eric.dumazet@gmail.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>Phonet: missing headers (sparse)</title>
<updated>2012-04-13T18:03:16+00:00</updated>
<author>
<name>Rémi Denis-Courmont</name>
<email>remi.denis-courmont@nokia.com</email>
</author>
<published>2012-04-12T03:39:17+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=8e052e52896e5d665e1380d5524c9c21f52c0bfd'/>
<id>8e052e52896e5d665e1380d5524c9c21f52c0bfd</id>
<content type='text'>
Signed-off-by: Rémi Denis-Courmont &lt;remi.denis-courmont@nokia.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Signed-off-by: Rémi Denis-Courmont &lt;remi.denis-courmont@nokia.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>Phonet: phonet_net_id can be static (sparse)</title>
<updated>2012-04-13T18:03:16+00:00</updated>
<author>
<name>Rémi Denis-Courmont</name>
<email>remi.denis-courmont@nokia.com</email>
</author>
<published>2012-04-12T03:39:16+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=3c490a87f6f6ce5b002c42f9c00c9136ddbd7248'/>
<id>3c490a87f6f6ce5b002c42f9c00c9136ddbd7248</id>
<content type='text'>
Signed-off-by: Rémi Denis-Courmont &lt;remi.denis-courmont@nokia.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Signed-off-by: Rémi Denis-Courmont &lt;remi.denis-courmont@nokia.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net</title>
<updated>2012-04-13T15:36:48+00:00</updated>
<author>
<name>David S. Miller</name>
<email>davem@davemloft.net</email>
</author>
<published>2012-04-13T15:30:55+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=e65ac4d54546b7d7514a9e8be1484c758f2b7ba3'/>
<id>e65ac4d54546b7d7514a9e8be1484c758f2b7ba3</id>
<content type='text'>
Pull in the 'net' tree to get CAIF bug fixes upon which
the following set of CAIF feature patches depend.

Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Pull in the 'net' tree to get CAIF bug fixes upon which
the following set of CAIF feature patches depend.

Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>phonet: Sort out initiailziation and cleanup code.</title>
<updated>2012-04-13T15:01:43+00:00</updated>
<author>
<name>Eric W. Biederman</name>
<email>ebiederm@xmission.com</email>
</author>
<published>2012-04-06T15:35:39+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=03478756b1b9298686ca9c8793e484ae39eb4649'/>
<id>03478756b1b9298686ca9c8793e484ae39eb4649</id>
<content type='text'>
Recently an oops was reported in phonet if there was a failure during
network namespace creation.

[  163.733755] ------------[ cut here ]------------
[  163.734501] kernel BUG at include/net/netns/generic.h:45!
[  163.734501] invalid opcode: 0000 [#1] PREEMPT SMP
[  163.734501] CPU 2
[  163.734501] Pid: 19145, comm: trinity Tainted: G        W 3.4.0-rc1-next-20120405-sasha-dirty #57
[  163.734501] RIP: 0010:[&lt;ffffffff824d6062&gt;]  [&lt;ffffffff824d6062&gt;] phonet_pernet+0x182/0x1a0
[  163.734501] RSP: 0018:ffff8800674d5ca8  EFLAGS: 00010246
[  163.734501] RAX: 000000003fffffff RBX: 0000000000000000 RCX: ffff8800678c88d8
[  163.734501] RDX: 00000000003f4000 RSI: ffff8800678c8910 RDI: 0000000000000282
[  163.734501] RBP: ffff8800674d5cc8 R08: 0000000000000000 R09: 0000000000000000
[  163.734501] R10: 0000000000000000 R11: 0000000000000000 R12: ffff880068bec920
[  163.734501] R13: ffffffff836b90c0 R14: 0000000000000000 R15: 0000000000000000
[  163.734501] FS:  00007f055e8de700(0000) GS:ffff88007d000000(0000) knlGS:0000000000000000
[  163.734501] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[  163.734501] CR2: 00007f055e6bb518 CR3: 0000000070c16000 CR4: 00000000000406e0
[  163.734501] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  163.734501] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[  163.734501] Process trinity (pid: 19145, threadinfo ffff8800674d4000, task ffff8800678c8000)
[  163.734501] Stack:
[  163.734501]  ffffffff824d5f00 ffffffff810e2ec1 ffff880067ae0000 00000000ffffffd4
[  163.734501]  ffff8800674d5cf8 ffffffff824d667a ffff880067ae0000 00000000ffffffd4
[  163.734501]  ffffffff836b90c0 0000000000000000 ffff8800674d5d18 ffffffff824d707d
[  163.734501] Call Trace:
[  163.734501]  [&lt;ffffffff824d5f00&gt;] ? phonet_pernet+0x20/0x1a0
[  163.734501]  [&lt;ffffffff810e2ec1&gt;] ? get_parent_ip+0x11/0x50
[  163.734501]  [&lt;ffffffff824d667a&gt;] phonet_device_destroy+0x1a/0x100
[  163.734501]  [&lt;ffffffff824d707d&gt;] phonet_device_notify+0x3d/0x50
[  163.734501]  [&lt;ffffffff810dd96e&gt;] notifier_call_chain+0xee/0x130
[  163.734501]  [&lt;ffffffff810dd9d1&gt;] raw_notifier_call_chain+0x11/0x20
[  163.734501]  [&lt;ffffffff821cce12&gt;] call_netdevice_notifiers+0x52/0x60
[  163.734501]  [&lt;ffffffff821cd235&gt;] rollback_registered_many+0x185/0x270
[  163.734501]  [&lt;ffffffff821cd334&gt;] unregister_netdevice_many+0x14/0x60
[  163.734501]  [&lt;ffffffff823123e3&gt;] ipip_exit_net+0x1b3/0x1d0
[  163.734501]  [&lt;ffffffff82312230&gt;] ? ipip_rcv+0x420/0x420
[  163.734501]  [&lt;ffffffff821c8515&gt;] ops_exit_list+0x35/0x70
[  163.734501]  [&lt;ffffffff821c911b&gt;] setup_net+0xab/0xe0
[  163.734501]  [&lt;ffffffff821c9416&gt;] copy_net_ns+0x76/0x100
[  163.734501]  [&lt;ffffffff810dc92b&gt;] create_new_namespaces+0xfb/0x190
[  163.734501]  [&lt;ffffffff810dca21&gt;] unshare_nsproxy_namespaces+0x61/0x80
[  163.734501]  [&lt;ffffffff810afd1f&gt;] sys_unshare+0xff/0x290
[  163.734501]  [&lt;ffffffff8187622e&gt;] ? trace_hardirqs_on_thunk+0x3a/0x3f
[  163.734501]  [&lt;ffffffff82665539&gt;] system_call_fastpath+0x16/0x1b
[  163.734501] Code: e0 c3 fe 66 0f 1f 44 00 00 48 c7 c2 40 60 4d 82 be 01 00 00 00 48 c7 c7 80 d1 23 83 e8 48 2a c4 fe e8 73 06 c8 fe 48 85 db 75 0e &lt;0f&gt; 0b 0f 1f 40 00 eb fe 66 0f 1f 44 00 00 48 83 c4 10 48 89 d8
[  163.734501] RIP  [&lt;ffffffff824d6062&gt;] phonet_pernet+0x182/0x1a0
[  163.734501]  RSP &lt;ffff8800674d5ca8&gt;
[  163.861289] ---[ end trace fb5615826c548066 ]---

After investigation it turns out there were two issues.
1) Phonet was not implementing network devices but was using register_pernet_device
   instead of register_pernet_subsys.

   This was allowing there to be cases when phonenet was not initialized and
   the phonet net_generic was not set for a network namespace when network
   device events were being reported on the netdevice_notifier for a network
   namespace leading to the oops above.

2) phonet_exit_net was implementing a confusing and special case of handling all
   network devices from going away that it was hard to see was correct, and would
   only occur when the phonet module was removed.

   Now that unregister_netdevice_notifier has been modified to synthesize unregistration
   events for the network devices that are extant when called this confusing special
   case in phonet_exit_net is no longer needed.

Signed-off-by: Eric W. Biederman &lt;ebiederm@xmission.com&gt;
Acked-by: Rémi Denis-Courmont &lt;remi.denis-courmont@nokia.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Recently an oops was reported in phonet if there was a failure during
network namespace creation.

[  163.733755] ------------[ cut here ]------------
[  163.734501] kernel BUG at include/net/netns/generic.h:45!
[  163.734501] invalid opcode: 0000 [#1] PREEMPT SMP
[  163.734501] CPU 2
[  163.734501] Pid: 19145, comm: trinity Tainted: G        W 3.4.0-rc1-next-20120405-sasha-dirty #57
[  163.734501] RIP: 0010:[&lt;ffffffff824d6062&gt;]  [&lt;ffffffff824d6062&gt;] phonet_pernet+0x182/0x1a0
[  163.734501] RSP: 0018:ffff8800674d5ca8  EFLAGS: 00010246
[  163.734501] RAX: 000000003fffffff RBX: 0000000000000000 RCX: ffff8800678c88d8
[  163.734501] RDX: 00000000003f4000 RSI: ffff8800678c8910 RDI: 0000000000000282
[  163.734501] RBP: ffff8800674d5cc8 R08: 0000000000000000 R09: 0000000000000000
[  163.734501] R10: 0000000000000000 R11: 0000000000000000 R12: ffff880068bec920
[  163.734501] R13: ffffffff836b90c0 R14: 0000000000000000 R15: 0000000000000000
[  163.734501] FS:  00007f055e8de700(0000) GS:ffff88007d000000(0000) knlGS:0000000000000000
[  163.734501] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[  163.734501] CR2: 00007f055e6bb518 CR3: 0000000070c16000 CR4: 00000000000406e0
[  163.734501] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  163.734501] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[  163.734501] Process trinity (pid: 19145, threadinfo ffff8800674d4000, task ffff8800678c8000)
[  163.734501] Stack:
[  163.734501]  ffffffff824d5f00 ffffffff810e2ec1 ffff880067ae0000 00000000ffffffd4
[  163.734501]  ffff8800674d5cf8 ffffffff824d667a ffff880067ae0000 00000000ffffffd4
[  163.734501]  ffffffff836b90c0 0000000000000000 ffff8800674d5d18 ffffffff824d707d
[  163.734501] Call Trace:
[  163.734501]  [&lt;ffffffff824d5f00&gt;] ? phonet_pernet+0x20/0x1a0
[  163.734501]  [&lt;ffffffff810e2ec1&gt;] ? get_parent_ip+0x11/0x50
[  163.734501]  [&lt;ffffffff824d667a&gt;] phonet_device_destroy+0x1a/0x100
[  163.734501]  [&lt;ffffffff824d707d&gt;] phonet_device_notify+0x3d/0x50
[  163.734501]  [&lt;ffffffff810dd96e&gt;] notifier_call_chain+0xee/0x130
[  163.734501]  [&lt;ffffffff810dd9d1&gt;] raw_notifier_call_chain+0x11/0x20
[  163.734501]  [&lt;ffffffff821cce12&gt;] call_netdevice_notifiers+0x52/0x60
[  163.734501]  [&lt;ffffffff821cd235&gt;] rollback_registered_many+0x185/0x270
[  163.734501]  [&lt;ffffffff821cd334&gt;] unregister_netdevice_many+0x14/0x60
[  163.734501]  [&lt;ffffffff823123e3&gt;] ipip_exit_net+0x1b3/0x1d0
[  163.734501]  [&lt;ffffffff82312230&gt;] ? ipip_rcv+0x420/0x420
[  163.734501]  [&lt;ffffffff821c8515&gt;] ops_exit_list+0x35/0x70
[  163.734501]  [&lt;ffffffff821c911b&gt;] setup_net+0xab/0xe0
[  163.734501]  [&lt;ffffffff821c9416&gt;] copy_net_ns+0x76/0x100
[  163.734501]  [&lt;ffffffff810dc92b&gt;] create_new_namespaces+0xfb/0x190
[  163.734501]  [&lt;ffffffff810dca21&gt;] unshare_nsproxy_namespaces+0x61/0x80
[  163.734501]  [&lt;ffffffff810afd1f&gt;] sys_unshare+0xff/0x290
[  163.734501]  [&lt;ffffffff8187622e&gt;] ? trace_hardirqs_on_thunk+0x3a/0x3f
[  163.734501]  [&lt;ffffffff82665539&gt;] system_call_fastpath+0x16/0x1b
[  163.734501] Code: e0 c3 fe 66 0f 1f 44 00 00 48 c7 c2 40 60 4d 82 be 01 00 00 00 48 c7 c7 80 d1 23 83 e8 48 2a c4 fe e8 73 06 c8 fe 48 85 db 75 0e &lt;0f&gt; 0b 0f 1f 40 00 eb fe 66 0f 1f 44 00 00 48 83 c4 10 48 89 d8
[  163.734501] RIP  [&lt;ffffffff824d6062&gt;] phonet_pernet+0x182/0x1a0
[  163.734501]  RSP &lt;ffff8800674d5ca8&gt;
[  163.861289] ---[ end trace fb5615826c548066 ]---

After investigation it turns out there were two issues.
1) Phonet was not implementing network devices but was using register_pernet_device
   instead of register_pernet_subsys.

   This was allowing there to be cases when phonenet was not initialized and
   the phonet net_generic was not set for a network namespace when network
   device events were being reported on the netdevice_notifier for a network
   namespace leading to the oops above.

2) phonet_exit_net was implementing a confusing and special case of handling all
   network devices from going away that it was hard to see was correct, and would
   only occur when the phonet module was removed.

   Now that unregister_netdevice_notifier has been modified to synthesize unregistration
   events for the network devices that are extant when called this confusing special
   case in phonet_exit_net is no longer needed.

Signed-off-by: Eric W. Biederman &lt;ebiederm@xmission.com&gt;
Acked-by: Rémi Denis-Courmont &lt;remi.denis-courmont@nokia.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net</title>
<updated>2012-04-10T18:30:45+00:00</updated>
<author>
<name>David S. Miller</name>
<email>davem@davemloft.net</email>
</author>
<published>2012-04-10T18:30:45+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=06eb4eafbdc0796d741d139a44f1253278da8611'/>
<id>06eb4eafbdc0796d741d139a44f1253278da8611</id>
<content type='text'>
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
</pre>
</div>
</content>
</entry>
<entry>
<title>phonet: Check input from user before allocating</title>
<updated>2012-04-05T23:05:56+00:00</updated>
<author>
<name>Sasha Levin</name>
<email>levinsasha928@gmail.com</email>
</author>
<published>2012-04-05T12:07:45+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=bcf1b70ac6eb0ed8286c66e6bf37cb747cbaa04c'/>
<id>bcf1b70ac6eb0ed8286c66e6bf37cb747cbaa04c</id>
<content type='text'>
A phonet packet is limited to USHRT_MAX bytes, this is never checked during
tx which means that the user can specify any size he wishes, and the kernel
will attempt to allocate that size.

In the good case, it'll lead to the following warning, but it may also cause
the kernel to kick in the OOM and kill a random task on the server.

[ 8921.744094] WARNING: at mm/page_alloc.c:2255 __alloc_pages_slowpath+0x65/0x730()
[ 8921.749770] Pid: 5081, comm: trinity Tainted: G        W    3.4.0-rc1-next-20120402-sasha #46
[ 8921.756672] Call Trace:
[ 8921.758185]  [&lt;ffffffff810b2ba7&gt;] warn_slowpath_common+0x87/0xb0
[ 8921.762868]  [&lt;ffffffff810b2be5&gt;] warn_slowpath_null+0x15/0x20
[ 8921.765399]  [&lt;ffffffff8117eae5&gt;] __alloc_pages_slowpath+0x65/0x730
[ 8921.769226]  [&lt;ffffffff81179c8a&gt;] ? zone_watermark_ok+0x1a/0x20
[ 8921.771686]  [&lt;ffffffff8117d045&gt;] ? get_page_from_freelist+0x625/0x660
[ 8921.773919]  [&lt;ffffffff8117f3a8&gt;] __alloc_pages_nodemask+0x1f8/0x240
[ 8921.776248]  [&lt;ffffffff811c03e0&gt;] kmalloc_large_node+0x70/0xc0
[ 8921.778294]  [&lt;ffffffff811c4bd4&gt;] __kmalloc_node_track_caller+0x34/0x1c0
[ 8921.780847]  [&lt;ffffffff821b0e3c&gt;] ? sock_alloc_send_pskb+0xbc/0x260
[ 8921.783179]  [&lt;ffffffff821b3c65&gt;] __alloc_skb+0x75/0x170
[ 8921.784971]  [&lt;ffffffff821b0e3c&gt;] sock_alloc_send_pskb+0xbc/0x260
[ 8921.787111]  [&lt;ffffffff821b002e&gt;] ? release_sock+0x7e/0x90
[ 8921.788973]  [&lt;ffffffff821b0ff0&gt;] sock_alloc_send_skb+0x10/0x20
[ 8921.791052]  [&lt;ffffffff824cfc20&gt;] pep_sendmsg+0x60/0x380
[ 8921.792931]  [&lt;ffffffff824cb4a6&gt;] ? pn_socket_bind+0x156/0x180
[ 8921.794917]  [&lt;ffffffff824cb50f&gt;] ? pn_socket_autobind+0x3f/0x90
[ 8921.797053]  [&lt;ffffffff824cb63f&gt;] pn_socket_sendmsg+0x4f/0x70
[ 8921.798992]  [&lt;ffffffff821ab8e7&gt;] sock_aio_write+0x187/0x1b0
[ 8921.801395]  [&lt;ffffffff810e325e&gt;] ? sub_preempt_count+0xae/0xf0
[ 8921.803501]  [&lt;ffffffff8111842c&gt;] ? __lock_acquire+0x42c/0x4b0
[ 8921.805505]  [&lt;ffffffff821ab760&gt;] ? __sock_recv_ts_and_drops+0x140/0x140
[ 8921.807860]  [&lt;ffffffff811e07cc&gt;] do_sync_readv_writev+0xbc/0x110
[ 8921.809986]  [&lt;ffffffff811958e7&gt;] ? might_fault+0x97/0xa0
[ 8921.811998]  [&lt;ffffffff817bd99e&gt;] ? security_file_permission+0x1e/0x90
[ 8921.814595]  [&lt;ffffffff811e17e2&gt;] do_readv_writev+0xe2/0x1e0
[ 8921.816702]  [&lt;ffffffff810b8dac&gt;] ? do_setitimer+0x1ac/0x200
[ 8921.818819]  [&lt;ffffffff810e2ec1&gt;] ? get_parent_ip+0x11/0x50
[ 8921.820863]  [&lt;ffffffff810e325e&gt;] ? sub_preempt_count+0xae/0xf0
[ 8921.823318]  [&lt;ffffffff811e1926&gt;] vfs_writev+0x46/0x60
[ 8921.825219]  [&lt;ffffffff811e1a3f&gt;] sys_writev+0x4f/0xb0
[ 8921.827127]  [&lt;ffffffff82658039&gt;] system_call_fastpath+0x16/0x1b
[ 8921.829384] ---[ end trace dffe390f30db9eb7 ]---

Signed-off-by: Sasha Levin &lt;levinsasha928@gmail.com&gt;
Acked-by: Rémi Denis-Courmont &lt;remi.denis-courmont@nokia.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
A phonet packet is limited to USHRT_MAX bytes, this is never checked during
tx which means that the user can specify any size he wishes, and the kernel
will attempt to allocate that size.

In the good case, it'll lead to the following warning, but it may also cause
the kernel to kick in the OOM and kill a random task on the server.

[ 8921.744094] WARNING: at mm/page_alloc.c:2255 __alloc_pages_slowpath+0x65/0x730()
[ 8921.749770] Pid: 5081, comm: trinity Tainted: G        W    3.4.0-rc1-next-20120402-sasha #46
[ 8921.756672] Call Trace:
[ 8921.758185]  [&lt;ffffffff810b2ba7&gt;] warn_slowpath_common+0x87/0xb0
[ 8921.762868]  [&lt;ffffffff810b2be5&gt;] warn_slowpath_null+0x15/0x20
[ 8921.765399]  [&lt;ffffffff8117eae5&gt;] __alloc_pages_slowpath+0x65/0x730
[ 8921.769226]  [&lt;ffffffff81179c8a&gt;] ? zone_watermark_ok+0x1a/0x20
[ 8921.771686]  [&lt;ffffffff8117d045&gt;] ? get_page_from_freelist+0x625/0x660
[ 8921.773919]  [&lt;ffffffff8117f3a8&gt;] __alloc_pages_nodemask+0x1f8/0x240
[ 8921.776248]  [&lt;ffffffff811c03e0&gt;] kmalloc_large_node+0x70/0xc0
[ 8921.778294]  [&lt;ffffffff811c4bd4&gt;] __kmalloc_node_track_caller+0x34/0x1c0
[ 8921.780847]  [&lt;ffffffff821b0e3c&gt;] ? sock_alloc_send_pskb+0xbc/0x260
[ 8921.783179]  [&lt;ffffffff821b3c65&gt;] __alloc_skb+0x75/0x170
[ 8921.784971]  [&lt;ffffffff821b0e3c&gt;] sock_alloc_send_pskb+0xbc/0x260
[ 8921.787111]  [&lt;ffffffff821b002e&gt;] ? release_sock+0x7e/0x90
[ 8921.788973]  [&lt;ffffffff821b0ff0&gt;] sock_alloc_send_skb+0x10/0x20
[ 8921.791052]  [&lt;ffffffff824cfc20&gt;] pep_sendmsg+0x60/0x380
[ 8921.792931]  [&lt;ffffffff824cb4a6&gt;] ? pn_socket_bind+0x156/0x180
[ 8921.794917]  [&lt;ffffffff824cb50f&gt;] ? pn_socket_autobind+0x3f/0x90
[ 8921.797053]  [&lt;ffffffff824cb63f&gt;] pn_socket_sendmsg+0x4f/0x70
[ 8921.798992]  [&lt;ffffffff821ab8e7&gt;] sock_aio_write+0x187/0x1b0
[ 8921.801395]  [&lt;ffffffff810e325e&gt;] ? sub_preempt_count+0xae/0xf0
[ 8921.803501]  [&lt;ffffffff8111842c&gt;] ? __lock_acquire+0x42c/0x4b0
[ 8921.805505]  [&lt;ffffffff821ab760&gt;] ? __sock_recv_ts_and_drops+0x140/0x140
[ 8921.807860]  [&lt;ffffffff811e07cc&gt;] do_sync_readv_writev+0xbc/0x110
[ 8921.809986]  [&lt;ffffffff811958e7&gt;] ? might_fault+0x97/0xa0
[ 8921.811998]  [&lt;ffffffff817bd99e&gt;] ? security_file_permission+0x1e/0x90
[ 8921.814595]  [&lt;ffffffff811e17e2&gt;] do_readv_writev+0xe2/0x1e0
[ 8921.816702]  [&lt;ffffffff810b8dac&gt;] ? do_setitimer+0x1ac/0x200
[ 8921.818819]  [&lt;ffffffff810e2ec1&gt;] ? get_parent_ip+0x11/0x50
[ 8921.820863]  [&lt;ffffffff810e325e&gt;] ? sub_preempt_count+0xae/0xf0
[ 8921.823318]  [&lt;ffffffff811e1926&gt;] vfs_writev+0x46/0x60
[ 8921.825219]  [&lt;ffffffff811e1a3f&gt;] sys_writev+0x4f/0xb0
[ 8921.827127]  [&lt;ffffffff82658039&gt;] system_call_fastpath+0x16/0x1b
[ 8921.829384] ---[ end trace dffe390f30db9eb7 ]---

Signed-off-by: Sasha Levin &lt;levinsasha928@gmail.com&gt;
Acked-by: Rémi Denis-Courmont &lt;remi.denis-courmont@nokia.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</pre>
</div>
</content>
</entry>
</feed>
