Re: 2.0.38 TCP Crashes

From: Paul Gortmaker (p_gortmaker@yahoo.com)
Date: Tue Jul 25 2000 - 01:45:32 EDT

  • Next message: Chris Quinn: "Address info on SIGSEGV?"

    Mario Lorenz wrote:

    > All out of a sudden, our production web server crashes every other day.
    > It was running fine on 2.0.35 for a long time, but script kiddies forced the
    > upgrade to 2.0.38 and later to 2.0.39pre1 for the IP stack vulnerability to
    > be patched.
    >
    > I was able to capture the ooopses as appended. Machine was rock solid and
    > needed a hard reboot though.
    >
    > It is a Pentium 166, BusLogic SCSI, software RAID 1.
    > Kernel is 2.0.38 plus .39pre1 plus the OpenWall noexec-
    > stack (.38-ow4). The stack trace seem to point to the TCPIP layer, so
    > we might be talking about some new DoS vulnerability here, since the problems
    > started all out of the sudden.

    I don't expect that many people will be looking at 2.0.3x bug reports
    with knocking 2.4 into shape but you might want to try this patch.

    Failing that, try enabling the IS_SKB(skb) check in sock_wfree()
    (and possibly other places)to see if that sheds any more light on
    things.

    Paul.

    --- linux-2.0.38/net/core/sock.c~ Mon Jul 24 14:25:11 2000
    +++ linux-2.0.38/net/core/sock.c Mon Jul 24 14:30:31 2000
    @@ -73,6 +73,7 @@
      * Michael Pall : SO_ERROR returns positive errno again
      * Elliot Poger : Added support for SO_BINDTODEVICE.
      * Russell King : Add #ifdef CONFIG_INET to SO_BINDTODEVICE
    + * Paul Gortmaker : No write_space callback on dead socket.
      *
      * To Fix:
      *
    @@ -475,7 +476,8 @@
             if (sk)
             {
                     /* In case it might be waiting for more memory. */
    - sk->write_space(sk);
    + if (!sk->dead)
    + sk->write_space(sk);
                     atomic_sub(s, &sk->wmem_alloc);
             }
     }

    __________________________________________________
    Do You Yahoo!?
    Talk to your friends online with Yahoo! Messenger.
    http://im.yahoo.com

    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.rutgers.edu
    Please read the FAQ at http://www.tux.org/lkml/



    This archive was generated by hypermail 2b29 : Tue Jul 25 2000 - 04:41:10 EDT