Re: 2.0.38 TCP Crashes

From: Paul Gortmaker (p_gortmaker@yahoo.com)
Date: Tue Jul 25 2000 - 00:45:32 EST


Mario Lorenz wrote:

> All out of a sudden, our production web server crashes every other day.
> It was running fine on 2.0.35 for a long time, but script kiddies forced the
> upgrade to 2.0.38 and later to 2.0.39pre1 for the IP stack vulnerability to
> be patched.
>
> I was able to capture the ooopses as appended. Machine was rock solid and
> needed a hard reboot though.
>
> It is a Pentium 166, BusLogic SCSI, software RAID 1.
> Kernel is 2.0.38 plus .39pre1 plus the OpenWall noexec-
> stack (.38-ow4). The stack trace seem to point to the TCPIP layer, so
> we might be talking about some new DoS vulnerability here, since the problems
> started all out of the sudden.

I don't expect that many people will be looking at 2.0.3x bug reports
with knocking 2.4 into shape but you might want to try this patch.

Failing that, try enabling the IS_SKB(skb) check in sock_wfree()
(and possibly other places)to see if that sheds any more light on
things.

Paul.

--- linux-2.0.38/net/core/sock.c~ Mon Jul 24 14:25:11 2000
+++ linux-2.0.38/net/core/sock.c Mon Jul 24 14:30:31 2000
@@ -73,6 +73,7 @@
  * Michael Pall : SO_ERROR returns positive errno again
  * Elliot Poger : Added support for SO_BINDTODEVICE.
  * Russell King : Add #ifdef CONFIG_INET to SO_BINDTODEVICE
+ * Paul Gortmaker : No write_space callback on dead socket.
  *
  * To Fix:
  *
@@ -475,7 +476,8 @@
         if (sk)
         {
                 /* In case it might be waiting for more memory. */
- sk->write_space(sk);
+ if (!sk->dead)
+ sk->write_space(sk);
                 atomic_sub(s, &sk->wmem_alloc);
         }
 }

__________________________________________________
Do You Yahoo!?
Talk to your friends online with Yahoo! Messenger.
http://im.yahoo.com

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/



This archive was generated by hypermail 2b29 : Mon Jul 31 2000 - 21:00:18 EST