[opensuse-kernel] [INFO] BCM and ISOTP crashes Linux 3.11 - 3.13 when running on REAL HW CAN interfaces

Hello all, at 2013-08-01 Eric Dumazet created this patch to make sure some networking rules are enforced in the Linux Kernel in Linux 3.11: http://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit/?id=376c731... This affects CAN BCM and CAN ISOTP and leads to a KERNEL CRASH when you are *sending* with the BCM or ISOTP on REAL(!) CAN interfaces. AFAIK there are not so many use cases. That's why it lasted 6 months to detect it :-( Virtual CAN and SLCAN interfaces do not have this problem (no echo skbs). Do I have to care about this issue? Usually the embedded systems do not have such a recent kernel. Regarding desktop distributions Redhat 7 runs a 3.10 kernel which is safe. But e.g. OpenSuse 13.1 and Ubuntu 13.10 / Linux Mint Petra are based on Linux 3.11 and Debian Jessie (current Debian testing) is on Linux 3.12. The latter have the described problem with BCM / ISOTP until this patch http://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit/?id=0ae89be... is applied by the stable kernel maintainers and distribution maintainers. The patch is already upstream for Linux 3.14 but it will take some time until it gets into the stable kernels 3.11 - 3.13 and the distributions. As Linux 3.11 is already end-of-life [EOL] I'll address the Ubuntu and OpenSuse maintainers directly so that this patch for 3.11 does not get lost. David Miller already queued this patch up for -stable Original post: http://marc.info/?l=linux-netdev&m=139107310226665&w=2 Take care, Oliver -------- Original Message -------- Subject: Re: [PATCH stable 3.9+] can: add destructor for self generated skbs Date: Thu, 30 Jan 2014 16:27:23 -0800 (PST) From: David Miller To: socketcan@hartkopp.net CC: eric.dumazet@gmail.com, nautsch2@gmail.com, netdev@vger.kernel.org, linux-can@vger.kernel.org From: Oliver Hartkopp Date: Thu, 30 Jan 2014 10:11:28 +0100

Self generated skbuffs in net/can/bcm.c are setting a skb->sk reference but no explicit destructor which is enforced since Linux 3.11 with commit 376c7311bdb6 (net: add a temporary sanity check in skb_orphan()).

This patch adds some helper functions to make sure that a destructor is properly defined when a sock reference is assigned to a CAN related skb. To create an unshared skb owned by the original sock a common helper function has been introduced to replace open coded functions to create CAN echo skbs.

Signed-off-by: Oliver Hartkopp Tested-by: Andre Naujoks

Applied and queued up for -stable, thanks. -- To unsubscribe, e-mail: opensuse-kernel+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-kernel+owner@opensuse.org