* ipv6 && kernel BUG at net/core/skbuff.c:126! @ 2013-06-07 18:33 Tommi Rantala 2013-06-07 21:49 ` Brian Haley 0 siblings, 1 reply; 3+ messages in thread From: Tommi Rantala @ 2013-06-07 18:33 UTC (permalink / raw) To: David S. Miller, Alexey Kuznetsov, James Morris, Eric Dumazet, Hideaki YOSHIFUJI, Patrick McHardy Cc: netdev, LKML, Dave Jones Hello, Hit this while fuzzing v3.10-rc4-214-g1612e11 (plus a one-liner af_netlink patch from Patrick McHardy, that I hope is not related to this bug). Tommi [19081.311430] vhci_hcd: changed 0 [19085.248780] type=1401 audit(1370620096.643:275): SELinux: unrecognized netlink message type=26994 for sclass=34 [19085.248780] [19212.879972] RDS: rds_bind() could not find a transport, load rds_tcp or rds_rdma? [19261.840596] type=1401 audit(1370620273.235:276): SELinux: unrecognized netlink message type=0 for sclass=34 [19261.840596] [19275.403689] RDS: rds_bind() could not find a transport, load rds_tcp or rds_rdma? [19276.607552] trinity-watchdo[26887]: segfault at b4aae80 ip 00000000004050df sp 00007fffbef9e348 error 4 in trinity[400000+22000] [19344.507844] RDS: rds_bind() could not find a transport, load rds_tcp or rds_rdma? [19491.565638] skbuff: skb_under_panic: text:ffffffff81fc402c len:48 put:40 head:ffff88008c6a5a40 data:ffff88008c6a5a3c tail:0x2c end:0xc0 dev:<NULL> [19491.570959] ------------[ cut here ]------------ [19491.572556] kernel BUG at /build/linux-one/net/core/skbuff.c:126! [19491.574432] invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC [19491.576143] CPU: 0 PID: 27749 Comm: trinity-child16 Not tainted 3.10.0-rc4+ #1 [19491.578330] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [19491.580017] task: ffff8800b51aa3e0 ti: ffff8800ad4b0000 task.ti: ffff8800ad4b0000 [19491.582268] RIP: 0010:[<ffffffff8229b949>] [<ffffffff8229b949>] skb_panic+0x5e/0x60 [19491.584558] RSP: 0018:ffff8800ad4b1e00 EFLAGS: 00010282 [19491.586165] RAX: 0000000000000086 RBX: ffff8800b7dd6900 RCX: 0000000000000006 [19491.588290] RDX: 0000000000003420 RSI: ffff8800b51aaab8 RDI: 0000000000000246 [19491.590426] RBP: ffff8800ad4b1e20 R08: 0000000000000002 R09: 0000000000000000 [19491.592632] R10: 0000000000000001 R11: 0000000000000001 R12: ffffffff82dc29c0 [19491.594897] R13: ffff8800b6a37000 R14: ffff8800b6a375f8 R15: ffff8800b5075680 [19491.597103] FS: 00007feced22c700(0000) GS:ffff8800bf600000(0000) knlGS:0000000000000000 [19491.599585] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [19491.601313] CR2: 00007f603b3cdb90 CR3: 00000000b03a2000 CR4: 00000000000006f0 [19491.603450] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [19491.605580] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [19491.607710] Stack: [19491.608362] ffff88008c6a5a3c 000000000000002c 00000000000000c0 ffffffff82b59d69 [19491.610681] ffff8800ad4b1e30 ffffffff81eb6243 ffff8800ad4b1e90 ffffffff81fc402c [19491.613074] ffffffff81119c55 11ff8800b51aa3e0 ffff8800ad4b1e58 0100007f0100007f [19491.615447] Call Trace: [19491.616273] [<ffffffff81eb6243>] skb_push+0x33/0x40 [19491.617840] [<ffffffff81fc402c>] ip6_push_pending_frames+0x20c/0x4b0 [19491.619768] [<ffffffff81119c55>] ? local_bh_enable+0xc5/0xf0 [19491.621476] [<ffffffff81fdf650>] udp_v6_push_pending_frames+0x390/0x3a0 [19491.623475] [<ffffffff81119c55>] ? local_bh_enable+0xc5/0xf0 [19491.625236] [<ffffffff81fdf2c0>] ? compat_udpv6_setsockopt+0x30/0x30 [19491.627153] [<ffffffff81f60812>] udp_lib_setsockopt+0xc2/0x1d0 [19491.628965] [<ffffffff81fdf67d>] udpv6_setsockopt+0x1d/0x30 [19491.630674] [<ffffffff81eb33bf>] sock_common_setsockopt+0xf/0x20 [19491.632577] [<ffffffff81ead7e6>] SyS_setsockopt+0x96/0xe0 [19491.634376] [<ffffffff822a47a9>] system_call_fastpath+0x16/0x1b [19491.636189] Code: 00 00 48 89 44 24 10 8b 87 d0 00 00 00 48 89 44 24 08 48 8b 87 e0 00 00 00 48 c7 c7 d0 82 b6 82 48 89 04 24 31 c0 e8 b9 c3 fe ff <0f> 0b 55 48 89 e5 41 56 41 55 41 54 53 48 89 fb 48 83 ec 28 4c [19491.643452] RIP [<ffffffff8229b949>] skb_panic+0x5e/0x60 [19491.645166] RSP <ffff8800ad4b1e00> [19491.696563] ---[ end trace 65e4f208315d47ce ]--- [19592.612621] irda_setsockopt: not allowed to set MAXSDUSIZE for this socket type! ^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: ipv6 && kernel BUG at net/core/skbuff.c:126! 2013-06-07 18:33 ipv6 && kernel BUG at net/core/skbuff.c:126! Tommi Rantala @ 2013-06-07 21:49 ` Brian Haley 2013-06-09 6:36 ` Tommi Rantala 0 siblings, 1 reply; 3+ messages in thread From: Brian Haley @ 2013-06-07 21:49 UTC (permalink / raw) To: Tommi Rantala Cc: David S. Miller, Alexey Kuznetsov, James Morris, Eric Dumazet, Hideaki YOSHIFUJI, Patrick McHardy, netdev, LKML, Dave Jones On 06/07/2013 02:33 PM, Tommi Rantala wrote: > Hello, > > Hit this while fuzzing v3.10-rc4-214-g1612e11 (plus a one-liner > af_netlink patch from Patrick McHardy, that I hope is not related to > this bug). > > Tommi > [19491.615447] Call Trace: > [19491.616273] [<ffffffff81eb6243>] skb_push+0x33/0x40 > [19491.617840] [<ffffffff81fc402c>] ip6_push_pending_frames+0x20c/0x4b0 > [19491.619768] [<ffffffff81119c55>] ? local_bh_enable+0xc5/0xf0 > [19491.621476] [<ffffffff81fdf650>] udp_v6_push_pending_frames+0x390/0x3a0 > [19491.623475] [<ffffffff81119c55>] ? local_bh_enable+0xc5/0xf0 > [19491.625236] [<ffffffff81fdf2c0>] ? compat_udpv6_setsockopt+0x30/0x30 > [19491.627153] [<ffffffff81f60812>] udp_lib_setsockopt+0xc2/0x1d0 > [19491.628965] [<ffffffff81fdf67d>] udpv6_setsockopt+0x1d/0x30 > [19491.630674] [<ffffffff81eb33bf>] sock_common_setsockopt+0xf/0x20 > [19491.632577] [<ffffffff81ead7e6>] SyS_setsockopt+0x96/0xe0 > [19491.634376] [<ffffffff822a47a9>] system_call_fastpath+0x16/0x1b Does something as simple below crash? It at least tickles the code path from what I can tell. -Brian #include <stdio.h> #include <stdlib.h> #include <string.h> #include <errno.h> #include <sys/socket.h> #include <netinet/in.h> #include <netinet/udp.h> main() { int s, cork, err, flags = 0; struct sockaddr_in6 sin6 = {0}; char *buf = "1234546789"; s = socket(AF_INET6, SOCK_DGRAM, 0); if (s < 0) { perror("socket"); exit(1); } cork = 1; err = setsockopt(s, SOL_UDP, UDP_CORK, &cork, sizeof(cork)); if (err < 0) { perror("setsockopt"); goto out; } sin6.sin6_family = AF_INET6; sin6.sin6_port = htons(1234); err = sendto(s, buf, strlen(buf), flags, (const struct sockaddr *)&sin6, sizeof(sin6)); if (err < 0) { perror("sendto"); goto out; } cork = 0; err = setsockopt(s, SOL_UDP, UDP_CORK, &cork, sizeof(cork)); if (err < 0) perror("setsockopt"); out: close(s); exit(0); } ^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: ipv6 && kernel BUG at net/core/skbuff.c:126! 2013-06-07 21:49 ` Brian Haley @ 2013-06-09 6:36 ` Tommi Rantala 0 siblings, 0 replies; 3+ messages in thread From: Tommi Rantala @ 2013-06-09 6:36 UTC (permalink / raw) To: Brian Haley Cc: David S. Miller, Alexey Kuznetsov, James Morris, Eric Dumazet, Hideaki YOSHIFUJI, Patrick McHardy, netdev, LKML, Dave Jones 2013/6/8 Brian Haley <brian.haley@hp.com>: > On 06/07/2013 02:33 PM, Tommi Rantala wrote: >> Hello, >> >> Hit this while fuzzing v3.10-rc4-214-g1612e11 (plus a one-liner >> af_netlink patch from Patrick McHardy, that I hope is not related to >> this bug). >> >> Tommi > >> [19491.615447] Call Trace: >> [19491.616273] [<ffffffff81eb6243>] skb_push+0x33/0x40 >> [19491.617840] [<ffffffff81fc402c>] ip6_push_pending_frames+0x20c/0x4b0 >> [19491.619768] [<ffffffff81119c55>] ? local_bh_enable+0xc5/0xf0 >> [19491.621476] [<ffffffff81fdf650>] udp_v6_push_pending_frames+0x390/0x3a0 >> [19491.623475] [<ffffffff81119c55>] ? local_bh_enable+0xc5/0xf0 >> [19491.625236] [<ffffffff81fdf2c0>] ? compat_udpv6_setsockopt+0x30/0x30 >> [19491.627153] [<ffffffff81f60812>] udp_lib_setsockopt+0xc2/0x1d0 >> [19491.628965] [<ffffffff81fdf67d>] udpv6_setsockopt+0x1d/0x30 >> [19491.630674] [<ffffffff81eb33bf>] sock_common_setsockopt+0xf/0x20 >> [19491.632577] [<ffffffff81ead7e6>] SyS_setsockopt+0x96/0xe0 >> [19491.634376] [<ffffffff822a47a9>] system_call_fastpath+0x16/0x1b > > Does something as simple below crash? It at least tickles the code path from > what I can tell. Nope, no visible effect. # strace ./i execve("./i", ["./i"], [/* 14 vars */]) = 0 [...] socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP) = 3 setsockopt(3, SOL_UDP, 1, [1], 4) = 0 sendto(3, "1234546789", 10, 0, {sa_family=AF_INET6, sin6_port=htons(1234), inet_pton(AF_INET6, "::", &sin6_addr), sin6_flowinfo=0, sin6_scope_id=0}, 28) = 10 setsockopt(3, SOL_UDP, 1, [0], 4) = 0 close(3) = 0 exit_group(0) = ? +++ exited with 0 +++ > -Brian > > > #include <stdio.h> > #include <stdlib.h> > #include <string.h> > #include <errno.h> > #include <sys/socket.h> > #include <netinet/in.h> > #include <netinet/udp.h> > > main() > { > int s, cork, err, flags = 0; > struct sockaddr_in6 sin6 = {0}; > char *buf = "1234546789"; > > s = socket(AF_INET6, SOCK_DGRAM, 0); > if (s < 0) { > perror("socket"); > exit(1); > } > > cork = 1; > err = setsockopt(s, SOL_UDP, UDP_CORK, &cork, sizeof(cork)); > if (err < 0) { > perror("setsockopt"); > goto out; > } > > sin6.sin6_family = AF_INET6; > sin6.sin6_port = htons(1234); > err = sendto(s, buf, strlen(buf), flags, > (const struct sockaddr *)&sin6, > sizeof(sin6)); > if (err < 0) { > perror("sendto"); > goto out; > } > > cork = 0; > err = setsockopt(s, SOL_UDP, UDP_CORK, &cork, sizeof(cork)); > if (err < 0) > perror("setsockopt"); > > out: > close(s); > exit(0); > } ^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2013-06-09 6:36 UTC | newest] Thread overview: 3+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2013-06-07 18:33 ipv6 && kernel BUG at net/core/skbuff.c:126! Tommi Rantala 2013-06-07 21:49 ` Brian Haley 2013-06-09 6:36 ` Tommi Rantala
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox