Exceptions in 2.1 (help with 2.1.125 ip_masq oops)

David Woodhouse (David.Woodhouse@mvhi.com)
Fri, 23 Oct 1998 11:48:48 +0100


I've traced the oops I reported a few minutes ago - it occurs when
csum_partial is called from list 1761 of ip_masq.c, in ip_fw_demasquerade...

switch (skb->ip_summed)
{
case CHECKSUM_NONE:
doff = proto_doff(iph->protocol, h.raw);
oops here --> csum = csum_partial(h.raw + doff, size - doff, 0);
IP_MASQ_DEBUG(3, "O-pkt: %s I-datacsum=%d\n",
masq_proto_name(iph->protocol),
csum);


Is there a way I can use the memory exception handling mechanism to catch this?
What I'd like to do is dump the whole packet to the console, and just drop it,
rather than panicking the machine.

TRY...CATCH anyone?

Wishful thinking aside, should I be able to do it with verify_area?

If I insert this before the csum_partial line...:
if (verify_area(VERIFY_READ, h.raw + doff, size-doff))
{
/* Whinge a lot and dump the packet */
return -1; /* make ip_input() drop it, rather than just
passing it on to something else that will oops */
}

... will it catch the error? I would just put it in place and try it, but as
these oopsen are only occurring about once a fortnight, it's not to easy to
check.

Is it possible that this is caused by the ISDN subsystem passing non-IP
packets to ip_rcv?

The variable 'size' is evidently wrong, and it's taken out of the IP header
without verifying it against the recorded size in (*skb_p)->len

I can see how this would generate crap if it's not actually an IP packet.

---- ---- ----
David Woodhouse David.Woodhouse@mvhi.com Office: (+44) 1223 810302
Project Leader, Process Information Systems Mobile: (+44) 976 658355
Axiom (Cambridge) Ltd., Swaffham Bulbeck, Cambridge, CB5 0NA, UK.
finger dwmw2@ferret.lmh.ox.ac.uk for PGP key.

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/