* [PATCH/RFC net] ipv6: probably fragmentation bug
@ 2013-11-04 9:26 Alexander Aring
2013-11-04 9:26 ` [PATCH/RFC net] ipv6: fix " Alexander Aring
0 siblings, 1 reply; 7+ messages in thread
From: Alexander Aring @ 2013-11-04 9:26 UTC (permalink / raw)
To: davem; +Cc: kuznet, jmorris, yoshfuji, kaber, netdev, Alexander Aring
I currently working for 6lowpan and try to use the fragmentation api like in ipv6.
Maybe I do something wrong with using the api but I don't catch any mistakes and
my sk_buff is already sent to the ipv6 layer correctly.
In a very poor connection with high payload(which is good for testing) I got a nullpointer
dereference when the fragmentation expire timer occurs.
BUG: unable to handle kernel NULL pointer dereference
at 0000000c
IP: [<c0389538>] _decode_session6+0x4f/0x1db
*pde = 00000000
Oops: 0000 [#1] SMP
Modules linked in:
CPU: 0 PID: 0 Comm: swapper/0 Not tainted
3.12.0-rc6-12694-g9ce9a7b-dirty #194
Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
task: c05007e8 ti: c7808000 task.ti: c04f6000
EIP: 0060:[<c0389538>] EFLAGS: 00210246 CPU: 0
EIP is at _decode_session6+0x4f/0x1db
EAX: 00000000 EBX: c5e602e0 ECX: 00000000 EDX: c5e65c3d
ESI: c5e602e0 EDI: c7809ee8 EBP: c7809eac ESP: c7809e70
DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068
CR0: 8005003b CR2: 0000000c CR3: 07b31000 CR4: 00000690
Stack:
00000005 00282c6c 00000001 c05232dc c5e602e0 c0095bc0 c051de00 c0360508
c7809eac c5e602e0 c5e602e0 c037ef65 00000001 c795aa60 c795aa60 00000000
00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
Call Trace:
[<c0360508>] ? __xfrm_decode_session+0x22/0x2f
[<c037ef65>] ? icmpv6_route_lookup+0xa9/0x119
[<c037f396>] ? icmp6_send+0x3c1/0x4bf
[<c037efd5>] ? icmpv6_route_lookup+0x119/0x119
[<c038cea6>] ? icmpv6_send+0x17/0x1a
[<c0382fbd>] ? ip6_expire_frag_queue+0x10a/0x11b
[<c0382fce>] ? ip6_expire_frag_queue+0x11b/0x11b
[<c0127eda>] ? call_timer_fn.isra.28+0x13/0x58
[<c01280bf>] ? run_timer_softirq+0x11a/0x14d
[<c0124097>] ? __do_softirq+0x95/0x13c
Maybe this occurs because I did some mistakes in my current 6lowpan fragmentation
implementation. That's why I sending it to this mailinglist... or maybe I found a bug.
The patch fix this issue you can find the removal of skb_dst_drop(skb) which
was comming in on commit id: 97599dc792b45b1669c3cdb9a4b365aad0232f65
Maybe this wasn't a correct solution. We need the sk_buff sometimes when the expire occurs to call
the icmp6_send function.
Regards Alex
Alexander Aring (1):
ipv6: fix fragmentation bug
net/ipv6/reassembly.c | 1 -
1 file changed, 1 deletion(-)
--
1.8.4.2
^ permalink raw reply [flat|nested] 7+ messages in thread
* [PATCH/RFC net] ipv6: fix fragmentation bug
2013-11-04 9:26 [PATCH/RFC net] ipv6: probably fragmentation bug Alexander Aring
@ 2013-11-04 9:26 ` Alexander Aring
2013-11-04 9:39 ` Fan Du
2013-11-04 14:25 ` Eric Dumazet
0 siblings, 2 replies; 7+ messages in thread
From: Alexander Aring @ 2013-11-04 9:26 UTC (permalink / raw)
To: davem; +Cc: kuznet, jmorris, yoshfuji, kaber, netdev, Alexander Aring
In a very poor 6lowpan wireless connection I got this:
BUG: unable to handle kernel NULL pointer dereference
at 0000000c
IP: [<c0389538>] _decode_session6+0x4f/0x1db
*pde = 00000000
Oops: 0000 [#1] SMP
Modules linked in:
CPU: 0 PID: 0 Comm: swapper/0 Not tainted
3.12.0-rc6-12694-g9ce9a7b-dirty #194
Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
task: c05007e8 ti: c7808000 task.ti: c04f6000
EIP: 0060:[<c0389538>] EFLAGS: 00210246 CPU: 0
EIP is at _decode_session6+0x4f/0x1db
EAX: 00000000 EBX: c5e602e0 ECX: 00000000 EDX: c5e65c3d
ESI: c5e602e0 EDI: c7809ee8 EBP: c7809eac ESP: c7809e70
DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068
CR0: 8005003b CR2: 0000000c CR3: 07b31000 CR4: 00000690
Stack:
00000005 00282c6c 00000001 c05232dc c5e602e0 c0095bc0 c051de00 c0360508
c7809eac c5e602e0 c5e602e0 c037ef65 00000001 c795aa60 c795aa60 00000000
00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
Call Trace:
[<c0360508>] ? __xfrm_decode_session+0x22/0x2f
[<c037ef65>] ? icmpv6_route_lookup+0xa9/0x119
[<c037f396>] ? icmp6_send+0x3c1/0x4bf
[<c037efd5>] ? icmpv6_route_lookup+0x119/0x119
[<c038cea6>] ? icmpv6_send+0x17/0x1a
[<c0382fbd>] ? ip6_expire_frag_queue+0x10a/0x11b
[<c0382fce>] ? ip6_expire_frag_queue+0x11b/0x11b
[<c0127eda>] ? call_timer_fn.isra.28+0x13/0x58
[<c01280bf>] ? run_timer_softirq+0x11a/0x14d
[<c0124097>] ? __do_softirq+0x95/0x13c
I think we need to drop skb_dst_drop(skb) in ip6_frag_queue because we
send a icmp6_send in the expire function "ip6_expire_frag_queue":
icmpv6_send(fq->q.fragments, ICMPV6_TIME_EXCEED, ICMPV6_EXC_FRAGTIME,
0);
and it can be that the skb is already freed. This null pointer
dereference occurs when the timer expires.
Signed-off-by: Alexander Aring <alex.aring@gmail.com>
---
net/ipv6/reassembly.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
index cc85a9b..6463ae0 100644
--- a/net/ipv6/reassembly.c
+++ b/net/ipv6/reassembly.c
@@ -352,7 +352,6 @@ found:
return res;
}
- skb_dst_drop(skb);
inet_frag_lru_move(&fq->q);
return -1;
--
1.8.4.2
^ permalink raw reply related [flat|nested] 7+ messages in thread
* Re: [PATCH/RFC net] ipv6: fix fragmentation bug
2013-11-04 9:26 ` [PATCH/RFC net] ipv6: fix " Alexander Aring
@ 2013-11-04 9:39 ` Fan Du
2013-11-04 9:43 ` Alexander Aring
2013-11-04 14:25 ` Eric Dumazet
1 sibling, 1 reply; 7+ messages in thread
From: Fan Du @ 2013-11-04 9:39 UTC (permalink / raw)
To: Alexander Aring; +Cc: davem, kuznet, jmorris, yoshfuji, kaber, netdev
Hi, Alexander
I don't know whether which head commit you are sitting, this issue might has already been fixed by Steffen:
https://git.kernel.org/cgit/linux/kernel/git/klassert/ipsec.git/commit/?id=84502b5ef9849a9694673b15c31bd3ac693010ae
On 2013年11月04日 17:26, Alexander Aring wrote:
> In a very poor 6lowpan wireless connection I got this:
>
> BUG: unable to handle kernel NULL pointer dereference
> at 0000000c
> IP: [<c0389538>] _decode_session6+0x4f/0x1db
> *pde = 00000000
> Oops: 0000 [#1] SMP
> Modules linked in:
> CPU: 0 PID: 0 Comm: swapper/0 Not tainted
> 3.12.0-rc6-12694-g9ce9a7b-dirty #194
> Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
> task: c05007e8 ti: c7808000 task.ti: c04f6000
> EIP: 0060:[<c0389538>] EFLAGS: 00210246 CPU: 0
> EIP is at _decode_session6+0x4f/0x1db
> EAX: 00000000 EBX: c5e602e0 ECX: 00000000 EDX: c5e65c3d
> ESI: c5e602e0 EDI: c7809ee8 EBP: c7809eac ESP: c7809e70
> DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068
> CR0: 8005003b CR2: 0000000c CR3: 07b31000 CR4: 00000690
> Stack:
> 00000005 00282c6c 00000001 c05232dc c5e602e0 c0095bc0 c051de00 c0360508
> c7809eac c5e602e0 c5e602e0 c037ef65 00000001 c795aa60 c795aa60 00000000
> 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
> Call Trace:
> [<c0360508>] ? __xfrm_decode_session+0x22/0x2f
> [<c037ef65>] ? icmpv6_route_lookup+0xa9/0x119
> [<c037f396>] ? icmp6_send+0x3c1/0x4bf
> [<c037efd5>] ? icmpv6_route_lookup+0x119/0x119
> [<c038cea6>] ? icmpv6_send+0x17/0x1a
> [<c0382fbd>] ? ip6_expire_frag_queue+0x10a/0x11b
> [<c0382fce>] ? ip6_expire_frag_queue+0x11b/0x11b
> [<c0127eda>] ? call_timer_fn.isra.28+0x13/0x58
> [<c01280bf>] ? run_timer_softirq+0x11a/0x14d
> [<c0124097>] ? __do_softirq+0x95/0x13c
>
> I think we need to drop skb_dst_drop(skb) in ip6_frag_queue because we
> send a icmp6_send in the expire function "ip6_expire_frag_queue":
>
> icmpv6_send(fq->q.fragments, ICMPV6_TIME_EXCEED, ICMPV6_EXC_FRAGTIME,
> 0);
>
> and it can be that the skb is already freed. This null pointer
> dereference occurs when the timer expires.
>
> Signed-off-by: Alexander Aring<alex.aring@gmail.com>
> ---
> net/ipv6/reassembly.c | 1 -
> 1 file changed, 1 deletion(-)
>
> diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
> index cc85a9b..6463ae0 100644
> --- a/net/ipv6/reassembly.c
> +++ b/net/ipv6/reassembly.c
> @@ -352,7 +352,6 @@ found:
> return res;
> }
>
> - skb_dst_drop(skb);
> inet_frag_lru_move(&fq->q);
> return -1;
>
--
浮沉随浪只记今朝笑
--fan
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH/RFC net] ipv6: fix fragmentation bug
2013-11-04 9:39 ` Fan Du
@ 2013-11-04 9:43 ` Alexander Aring
2013-11-04 9:46 ` Fan Du
0 siblings, 1 reply; 7+ messages in thread
From: Alexander Aring @ 2013-11-04 9:43 UTC (permalink / raw)
To: Fan Du; +Cc: davem, kuznet, jmorris, yoshfuji, kaber, netdev
Hi,
On Mon, Nov 04, 2013 at 05:39:38PM +0800, Fan Du wrote:
> Hi, Alexander
>
> I don't know whether which head commit you are sitting, this issue might has already been fixed by Steffen:
> https://git.kernel.org/cgit/linux/kernel/git/klassert/ipsec.git/commit/?id=84502b5ef9849a9694673b15c31bd3ac693010ae
>
>
oh I am using current net-next which haven't this fix.
Thanks
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH/RFC net] ipv6: fix fragmentation bug
2013-11-04 9:43 ` Alexander Aring
@ 2013-11-04 9:46 ` Fan Du
2013-11-04 9:51 ` Alexander Aring
0 siblings, 1 reply; 7+ messages in thread
From: Fan Du @ 2013-11-04 9:46 UTC (permalink / raw)
To: Alexander Aring; +Cc: davem, kuznet, jmorris, yoshfuji, kaber, netdev
On 2013年11月04日 17:43, Alexander Aring wrote:
> Hi,
>
> On Mon, Nov 04, 2013 at 05:39:38PM +0800, Fan Du wrote:
>> > Hi, Alexander
>> >
>> > I don't know whether which head commit you are sitting, this issue might has already been fixed by Steffen:
>> > https://git.kernel.org/cgit/linux/kernel/git/klassert/ipsec.git/commit/?id=84502b5ef9849a9694673b15c31bd3ac693010ae
>> >
>> >
> oh I am using current net-next which haven't this fix.
>
Since it's a bug fix, so it's in net tree for the moment...
--
浮沉随浪只记今朝笑
--fan
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH/RFC net] ipv6: fix fragmentation bug
2013-11-04 9:46 ` Fan Du
@ 2013-11-04 9:51 ` Alexander Aring
0 siblings, 0 replies; 7+ messages in thread
From: Alexander Aring @ 2013-11-04 9:51 UTC (permalink / raw)
To: Fan Du; +Cc: davem, kuznet, jmorris, yoshfuji, kaber, netdev
On Mon, Nov 04, 2013 at 05:46:56PM +0800, Fan Du wrote:
>
>
> On 2013年11月04日 17:43, Alexander Aring wrote:
> >Hi,
> >
> >On Mon, Nov 04, 2013 at 05:39:38PM +0800, Fan Du wrote:
> >>> Hi, Alexander
> >>>
> >>> I don't know whether which head commit you are sitting, this issue might has already been fixed by Steffen:
> >>> https://git.kernel.org/cgit/linux/kernel/git/klassert/ipsec.git/commit/?id=84502b5ef9849a9694673b15c31bd3ac693010ae
> >>>
> >>>
> >oh I am using current net-next which haven't this fix.
> >
>
> Since it's a bug fix, so it's in net tree for the moment...
>
Ok, thanks and sorry for the noise...
- Alex
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH/RFC net] ipv6: fix fragmentation bug
2013-11-04 9:26 ` [PATCH/RFC net] ipv6: fix " Alexander Aring
2013-11-04 9:39 ` Fan Du
@ 2013-11-04 14:25 ` Eric Dumazet
1 sibling, 0 replies; 7+ messages in thread
From: Eric Dumazet @ 2013-11-04 14:25 UTC (permalink / raw)
To: Alexander Aring; +Cc: davem, kuznet, jmorris, yoshfuji, kaber, netdev
On Mon, 2013-11-04 at 10:26 +0100, Alexander Aring wrote:
> In a very poor 6lowpan wireless connection I got this:
>
> I think we need to drop skb_dst_drop(skb) in ip6_frag_queue because we
> send a icmp6_send in the expire function "ip6_expire_frag_queue":
>
> icmpv6_send(fq->q.fragments, ICMPV6_TIME_EXCEED, ICMPV6_EXC_FRAGTIME,
> 0);
>
> and it can be that the skb is already freed. This null pointer
> dereference occurs when the timer expires.
>
> Signed-off-by: Alexander Aring <alex.aring@gmail.com>
> ---
> net/ipv6/reassembly.c | 1 -
> 1 file changed, 1 deletion(-)
>
> diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
> index cc85a9b..6463ae0 100644
> --- a/net/ipv6/reassembly.c
> +++ b/net/ipv6/reassembly.c
> @@ -352,7 +352,6 @@ found:
> return res;
> }
>
> - skb_dst_drop(skb);
> inet_frag_lru_move(&fq->q);
> return -1;
>
Well, no, this call is needed, please check commit
97599dc792b45b1669c3cdb9a4b365aad0232f65
(" net: drop dst before queueing fragments")
for details.
^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2013-11-04 14:25 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-11-04 9:26 [PATCH/RFC net] ipv6: probably fragmentation bug Alexander Aring
2013-11-04 9:26 ` [PATCH/RFC net] ipv6: fix " Alexander Aring
2013-11-04 9:39 ` Fan Du
2013-11-04 9:43 ` Alexander Aring
2013-11-04 9:46 ` Fan Du
2013-11-04 9:51 ` Alexander Aring
2013-11-04 14:25 ` Eric Dumazet
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).