Re: Kernel panic when using bridge

[Eric Dumazet <eric.dumazet@gmail.com>]

Le mardi 12 avril 2011 à 02:02 -0500, Scot Doyle a écrit :
> On 04/12/2011 12:51 AM, Eric Dumazet wrote:
> >
> > Oh well, sorry (not enough time these days to even test patches)
> >
> > 	if (!skb_dst(skb)) {
> 
> --- br_netfilter.c.a    2011-04-01 02:37:53.000000000 -0500
> +++ br_netfilter.c.b    2011-04-12 00:29:00.000000000 -0500
> @@ -221,6 +221,7 @@ static int br_parse_ip_options(struct sk
>       struct ip_options *opt;
>       struct iphdr *iph;
>       struct net_device *dev = skb->dev;
> +    struct rtable *rt;
>       u32 len;
> 
>       iph = ip_hdr(skb);
> @@ -255,6 +256,16 @@ static int br_parse_ip_options(struct sk
>           return 0;
>       }
> 
> +    /* Associate bogus bridge route table */
> +    if (!skb_dst(skb)) {
> +        rt = bridge_parent_rtable(dev);
> +        if (!rt) {
> +            kfree_skb(skb);
> +            return 0;
> +        }
> +        skb_dst_set_noref(skb,&rt->dst);
> +    }
> +
>       opt->optlen = iph->ihl*4 - sizeof(struct iphdr);
>       if (ip_options_compile(dev_net(dev), opt, skb))
>           goto inhdr_error;
> 
> 
> Now we are making progress! With the patch above from Stephen and Eric, 
> I cannot make the kernel panic when sending packets to the IP address of 
> the bridge.
> 
> However, if a guest virtual machine is sharing the bridge with the host 
> via a tap device, I can cause a host panic by targeting the IP address 
> of the guest. Is this an unrelated problem?
> 
> Here are two kernel panics. The guest virtual machine was pingable 
> before being attacked with IP Stack Checker's tcpsic command. Spanning 
> Tree Protocol was off during the first panic and on during the second.
> 


I wonder if you are not running out of free stack space...

And it might be because of inet_getpeer() calling cleanup_once()

# objdump64 -d net/ipv4/inetpeer.o | scripts/checkstack.pl
0x0317 cleanup_once [inetpeer.o]:			344
0x03d6 cleanup_once [inetpeer.o]:			344
0x0680 inet_getpeer [inetpeer.o]:			344
0x071d inet_getpeer [inetpeer.o]:			344
0x0004 inet_initpeers [inetpeer.o]:			112