Cong Wang ece6b0a2b2 rds: limit the size allocated by rds_message_alloc() ... Dave Jones reported the following bug: "When fed mangled socket data, rds will trust what userspace gives it, and tries to allocate enormous amounts of memory larger than what kmalloc can satisfy." WARNING: at mm/page_alloc.c:2393 __alloc_pages_nodemask+0xa0d/0xbe0() Hardware name: GA-MA78GM-S2H Modules linked in: vmw_vsock_vmci_transport vmw_vmci vsock fuse bnep dlci bridge 8021q garp stp mrp binfmt_misc l2tp_ppp l2tp_core rfcomm s Pid: 24652, comm: trinity-child2 Not tainted 3.8.0+ #65 Call Trace: [<ffffffff81044155>] warn_slowpath_common+0x75/0xa0 [<ffffffff8104419a>] warn_slowpath_null+0x1a/0x20 [<ffffffff811444ad>] __alloc_pages_nodemask+0xa0d/0xbe0 [<ffffffff8100a196>] ? native_sched_clock+0x26/0x90 [<ffffffff810b2128>] ? trace_hardirqs_off_caller+0x28/0xc0 [<ffffffff810b21cd>] ? trace_hardirqs_off+0xd/0x10 [<ffffffff811861f8>] alloc_pages_current+0xb8/0x180 [<ffffffff8113eaaa>] __get_free_pages+0x2a/0x80 [<ffffffff811934fe>] kmalloc_order_trace+0x3e/0x1a0 [<ffffffff81193955>] __kmalloc+0x2f5/0x3a0 [<ffffffff8104df0c>] ? local_bh_enable_ip+0x7c/0xf0 [<ffffffffa0401ab3>] rds_message_alloc+0x23/0xb0 [rds] [<ffffffffa04043a1>] rds_sendmsg+0x2b1/0x990 [rds] [<ffffffff810b21cd>] ? trace_hardirqs_off+0xd/0x10 [<ffffffff81564620>] sock_sendmsg+0xb0/0xe0 [<ffffffff810b2052>] ? get_lock_stats+0x22/0x70 [<ffffffff810b24be>] ? put_lock_stats.isra.23+0xe/0x40 [<ffffffff81567f30>] sys_sendto+0x130/0x180 [<ffffffff810b872d>] ? trace_hardirqs_on+0xd/0x10 [<ffffffff816c547b>] ? _raw_spin_unlock_irq+0x3b/0x60 [<ffffffff816cd767>] ? sysret_check+0x1b/0x56 [<ffffffff810b8695>] ? trace_hardirqs_on_caller+0x115/0x1a0 [<ffffffff81341d8e>] ? trace_hardirqs_on_thunk+0x3a/0x3f [<ffffffff816cd742>] system_call_fastpath+0x16/0x1b ---[ end trace eed6ae990d018c8b ]--- Reported-by: Dave Jones <davej@redhat.com> Cc: Dave Jones <davej@redhat.com> Cc: David S. Miller <davem@davemloft.net> Cc: Venkat Venkatsubra <venkat.x.venkatsubra@oracle.com> Signed-off-by: Cong Wang <amwang@redhat.com> Acked-by: Venkat Venkatsubra <venkat.x.venkatsubra@oracle.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2013-03-04 14:12:06 -05:00
..
af_rds.c
bind.c
cong.c
connection.c
ib_cm.c	IB/rds: suppress incompatible protocol when version is known	2012-12-26 15:17:37 -08:00
ib_rdma.c
ib_recv.c	IB/rds: Correct ib_api use with gs_dma_address/sg_dma_len	2012-12-26 15:17:37 -08:00
ib_ring.c
ib_send.c
ib_stats.c
ib_sysctl.c
ib.c
ib.h	net: rds: use this_cpu_* per-cpu helper	2012-11-19 18:59:44 -05:00
info.c
info.h
iw_cm.c
iw_rdma.c
iw_recv.c
iw_ring.c
iw_send.c
iw_stats.c
iw_sysctl.c
iw.c
iw.h
Kconfig	net/rds: remove depends on CONFIG_EXPERIMENTAL	2013-01-11 11:40:02 -08:00
loop.c
loop.h
Makefile
message.c	rds: limit the size allocated by rds_message_alloc()	2013-03-04 14:12:06 -05:00
page.c
rdma_transport.c
rdma_transport.h
rdma.c
rds.h
recv.c	rds: set correct msg_namelen	2012-07-23 01:01:44 -07:00
send.c	RDS: fix rds-ping spinlock recursion	2012-10-09 13:57:23 -04:00
stats.c
sysctl.c
tcp_connect.c	rds: Don't disable BH on BH context	2012-08-22 22:52:04 -07:00
tcp_listen.c	rds: Don't disable BH on BH context	2012-08-22 22:52:04 -07:00
tcp_recv.c	rds: Don't disable BH on BH context	2012-08-22 22:52:04 -07:00
tcp_send.c	rds: Don't disable BH on BH context	2012-08-22 22:52:04 -07:00
tcp_stats.c
tcp.c
tcp.h
threads.c
transport.c