From: Eric Sesterhenn <snakebyte@gmx.de>
To: netdev@vger.kernel.org
Subject: Slab Corruption with ipv6 and tcp6fuzz
Date: Thu, 24 Apr 2008 16:27:27 +0200 [thread overview]
Message-ID: <20080424142727.GA24025@alice> (raw)
hi,
i found some local ivp6 network fuzzing tools from the bsd folks
today and wanted to add them to my testmachine. When
trying one of them (running with user privs) it gave me slab corruption errors.
Running http://clem1.be/lf6/tcp6fuzz.c 1 to 5 times
always results in errors, strangely using the same seed twice
in a row doesnt trigger the warnings again.
If there is any more info i can provide please let me know.
A sample of the warnings follows:
[ 57.315914] process `tcp6fuzz' is using obsolete setsockopt SO_BSDCOMPAT
[ 57.810370] sock_set_timeout: `tcp6fuzz' (pid 3721) tries to set negative timeout
[ 215.102729] =============================================================================
[ 215.102786] BUG skbuff_head_cache: Invalid object pointer 0xccd2b520
[ 215.102810] -----------------------------------------------------------------------------
[ 215.102816]
[ 215.102840] INFO: Slab 0xc119c560 used=10 fp=0x00000000 flags=0x40000083
[ 215.102868] Pid: 0, comm: swapper Not tainted 2.6.25-03562-g3dc5063 #23
[ 215.102880] [<c0177b57>] slab_err+0x47/0x50
[ 215.102978] [<c0177bc7>] ? slab_pad_check+0x67/0xe0
[ 215.102994] [<c0177c92>] ? check_slab+0x52/0x80
[ 215.103010] [<c0179405>] __slab_free+0x1d5/0x2d0
[ 215.103024] [<c0179eb0>] kmem_cache_free+0x80/0xe0
[ 215.103039] [<c05d91dc>] ? __kfree_skb+0x3c/0x90
[ 215.103063] [<c05d91dc>] ? __kfree_skb+0x3c/0x90
[ 215.103078] [<c05d91dc>] __kfree_skb+0x3c/0x90
[ 215.103090] [<c05d9249>] kfree_skb+0x19/0x30
[ 215.103103] [<c0671e3b>] tcp_v6_do_rcv+0x33b/0xcd0
[ 215.103128] [<c0146fe5>] ? __lock_acquire+0x395/0x1020
[ 215.103161] [<c0146fe5>] ? __lock_acquire+0x395/0x1020
[ 215.103177] [<c0146fe5>] ? __lock_acquire+0x395/0x1020
[ 215.103191] [<c012b075>] ? local_bh_enable_ip+0x85/0xf0
[ 215.103220] [<c0680718>] ? ip6t_do_table+0x318/0x590
[ 215.103245] [<c0146fe5>] ? __lock_acquire+0x395/0x1020
[ 215.103260] [<c0146721>] ? trace_hardirqs_on+0x81/0x150
[ 215.103275] [<c0680718>] ? ip6t_do_table+0x318/0x590
[ 215.103289] [<c0109637>] ? native_sched_clock+0x67/0xb0
[ 215.103317] [<c014424d>] ? put_lock_stats+0xd/0x30
[ 215.103333] [<c0674e97>] ? tcp_v6_rcv+0x567/0x710
[ 215.103349] [<c0706615>] ? _spin_lock_nested+0x65/0x80
[ 215.103377] [<c0674e97>] ? tcp_v6_rcv+0x567/0x710
[ 215.103391] [<c0674f57>] tcp_v6_rcv+0x627/0x710
[ 215.103404] [<c06809c0>] ? ip6t_hook+0x0/0x30
[ 215.103418] [<c05f3c89>] ? nf_iterate+0x59/0x80
[ 215.103448] [<c0653ff2>] ip6_input_finish+0xc2/0x2a0
[ 215.103465] [<c0653f30>] ? ip6_input_finish+0x0/0x2a0
[ 215.103479] [<c06541ef>] ip6_input+0x1f/0x60
[ 215.103491] [<c0653f30>] ? ip6_input_finish+0x0/0x2a0
[ 215.103505] [<c0654464>] ipv6_rcv+0x194/0x2e0
[ 215.103518] [<c0654290>] ? ip6_rcv_finish+0x0/0x40
[ 215.103532] [<c06542d0>] ? ipv6_rcv+0x0/0x2e0
[ 215.103545] [<c05de7f0>] netif_receive_skb+0x280/0x2f0
[ 215.103560] [<c05e1336>] process_backlog+0x76/0xd0
[ 215.103576] [<c05e0c90>] net_rx_action+0x120/0x1a0
[ 215.103589] [<c012ac92>] __do_softirq+0x62/0xc0
[ 215.103602] [<c010676a>] do_softirq+0x8a/0xd0
[ 215.103618] [<c0155f80>] ? handle_level_irq+0x0/0xe0
[ 215.103634] [<c012abc6>] irq_exit+0x86/0x90
[ 215.103647] [<c010684a>] do_IRQ+0x9a/0x100
[ 215.103659] [<c0706e49>] ? _spin_unlock_irqrestore+0x39/0x70
[ 215.103677] [<c01047f2>] common_interrupt+0x2e/0x34
[ 215.103691] [<c0140000>] ? sysfs_override_clocksource+0x70/0x100
[ 215.103706] [<c04b6d42>] ? acpi_idle_enter_simple+0x18a/0x1fc
[ 215.103739] [<c058decd>] cpuidle_idle_call+0x5d/0xb0
[ 215.103760] [<c058de70>] ? cpuidle_idle_call+0x0/0xb0
[ 215.103775] [<c0102838>] cpu_idle+0x38/0xa0
[ 215.103787] [<c06f94cc>] rest_init+0x5c/0x60
[ 215.103811] =======================
[ 215.103819] FIX skbuff_head_cache: Object at 0xccd2b520 not freed
[ 215.108749] =============================================================================
[ 215.108796] BUG skbuff_head_cache: Invalid object pointer 0xcb13a820
[ 215.108820] -----------------------------------------------------------------------------
[ 215.108826]
[ 215.108851] INFO: Slab 0xc1164740 used=5 fp=0xcb13a600 flags=0x40000083
[ 215.108879] Pid: 3172, comm: dd Not tainted 2.6.25-03562-g3dc5063 #23
[ 215.108896] [<c0177b57>] slab_err+0x47/0x50
[ 215.108935] [<c0177bc7>] ? slab_pad_check+0x67/0xe0
[ 215.108951] [<c0177c92>] ? check_slab+0x52/0x80
[ 215.108966] [<c0179405>] __slab_free+0x1d5/0x2d0
[ 215.108981] [<c0179eb0>] kmem_cache_free+0x80/0xe0
[ 215.108995] [<c05d91dc>] ? __kfree_skb+0x3c/0x90
[ 215.109021] [<c05d91dc>] ? __kfree_skb+0x3c/0x90
[ 215.109035] [<c05d91dc>] __kfree_skb+0x3c/0x90
[ 215.109048] [<c05d9249>] kfree_skb+0x19/0x30
[ 215.109060] [<c0671e3b>] tcp_v6_do_rcv+0x33b/0xcd0
[ 215.109086] [<c0146fe5>] ? __lock_acquire+0x395/0x1020
[ 215.109120] [<c0146fe5>] ? __lock_acquire+0x395/0x1020
[ 215.109136] [<c0146fe5>] ? __lock_acquire+0x395/0x1020
[ 215.109151] [<c012b075>] ? local_bh_enable_ip+0x85/0xf0
[ 215.109181] [<c0680718>] ? ip6t_do_table+0x318/0x590
[ 215.109209] [<c0146fe5>] ? __lock_acquire+0x395/0x1020
[ 215.109224] [<c0146721>] ? trace_hardirqs_on+0x81/0x150
[ 215.109239] [<c0680718>] ? ip6t_do_table+0x318/0x590
[ 215.109253] [<c0109637>] ? native_sched_clock+0x67/0xb0
[ 215.109281] [<c014424d>] ? put_lock_stats+0xd/0x30
[ 215.109296] [<c0674e97>] ? tcp_v6_rcv+0x567/0x710
[ 215.109312] [<c0706615>] ? _spin_lock_nested+0x65/0x80
[ 215.109337] [<c0674e97>] ? tcp_v6_rcv+0x567/0x710
[ 215.109352] [<c0674f57>] tcp_v6_rcv+0x627/0x710
[ 215.109365] [<c06809c0>] ? ip6t_hook+0x0/0x30
[ 215.109379] [<c05f3c89>] ? nf_iterate+0x59/0x80
[ 215.109412] [<c0653ff2>] ip6_input_finish+0xc2/0x2a0
[ 215.109428] [<c0653f30>] ? ip6_input_finish+0x0/0x2a0
[ 215.109443] [<c06541ef>] ip6_input+0x1f/0x60
[ 215.109455] [<c0653f30>] ? ip6_input_finish+0x0/0x2a0
[ 215.109469] [<c0654464>] ipv6_rcv+0x194/0x2e0
[ 215.109481] [<c0654290>] ? ip6_rcv_finish+0x0/0x40
[ 215.109495] [<c06542d0>] ? ipv6_rcv+0x0/0x2e0
[ 215.109508] [<c05de7f0>] netif_receive_skb+0x280/0x2f0
[ 215.109524] [<c05e1336>] process_backlog+0x76/0xd0
[ 215.109540] [<c05e0c90>] net_rx_action+0x120/0x1a0
[ 215.109554] [<c012ac92>] __do_softirq+0x62/0xc0
[ 215.109567] [<c010676a>] do_softirq+0x8a/0xd0
[ 215.109583] [<c0155f80>] ? handle_level_irq+0x0/0xe0
[ 215.109599] [<c012abc6>] irq_exit+0x86/0x90
[ 215.109612] [<c010684a>] do_IRQ+0x9a/0x100
[ 215.109625] [<c01047f2>] common_interrupt+0x2e/0x34
[ 215.109639] [<c0147cff>] ? lock_acquire+0x8f/0xa0
[ 215.109654] [<c01959e0>] ? mnt_want_write+0x20/0x90
[ 215.109677] [<c0706669>] _spin_lock+0x39/0x70
[ 215.109690] [<c01959e0>] ? mnt_want_write+0x20/0x90
[ 215.109704] [<c01959e0>] mnt_want_write+0x20/0x90
[ 215.109717] [<c0191a79>] file_update_time+0x39/0xd0
[ 215.109744] [<c018413a>] pipe_write+0x21a/0x450
[ 215.109772] [<c0146fe5>] ? __lock_acquire+0x395/0x1020
[ 215.109788] [<c017d55c>] do_sync_write+0xcc/0x110
[ 215.109802] [<c0138a80>] ? autoremove_wake_function+0x0/0x50
[ 215.109827] [<c01b1c9e>] ? dnotify_parent+0x6e/0x80
[ 215.109850] [<c0706d47>] ? _spin_unlock+0x27/0x50
[ 215.109867] [<c017dd99>] vfs_write+0x99/0x130
[ 215.109879] [<c017d490>] ? do_sync_write+0x0/0x110
[ 215.109893] [<c017e38d>] sys_write+0x3d/0x70
[ 215.109906] [<c0103d75>] sysenter_past_esp+0x6a/0xb1
[ 215.109920] =======================
[ 215.109928] FIX skbuff_head_cache: Object at 0xcb13a820 not freed
[ 215.116324] =============================================================================
[ 215.116372] BUG skbuff_head_cache: Invalid object pointer 0xccbf10a0
[ 215.116396] -----------------------------------------------------------------------------
[ 215.116401]
[ 215.116426] INFO: Slab 0xc1199e20 used=10 fp=0x00000000 flags=0x40000083
[ 215.116455] Pid: 3172, comm: dd Not tainted 2.6.25-03562-g3dc5063 #23
[ 215.116467] [<c0177b57>] slab_err+0x47/0x50
[ 215.116506] [<c0177bc7>] ? slab_pad_check+0x67/0xe0
[ 215.116522] [<c0177c92>] ? check_slab+0x52/0x80
[ 215.116537] [<c0179405>] __slab_free+0x1d5/0x2d0
[ 215.116553] [<c0179eb0>] kmem_cache_free+0x80/0xe0
[ 215.116567] [<c05d91dc>] ? __kfree_skb+0x3c/0x90
[ 215.116592] [<c05d91dc>] ? __kfree_skb+0x3c/0x90
[ 215.116606] [<c05d91dc>] __kfree_skb+0x3c/0x90
[ 215.116619] [<c05d9249>] kfree_skb+0x19/0x30
[ 215.116631] [<c0671e3b>] tcp_v6_do_rcv+0x33b/0xcd0
[ 215.116657] [<c0146fe5>] ? __lock_acquire+0x395/0x1020
[ 215.116693] [<c0146fe5>] ? __lock_acquire+0x395/0x1020
[ 215.116709] [<c0146fe5>] ? __lock_acquire+0x395/0x1020
[ 215.116724] [<c012b075>] ? local_bh_enable_ip+0x85/0xf0
[ 215.116753] [<c0680718>] ? ip6t_do_table+0x318/0x590
[ 215.116781] [<c0146fe5>] ? __lock_acquire+0x395/0x1020
[ 215.116796] [<c0146721>] ? trace_hardirqs_on+0x81/0x150
[ 215.116811] [<c0680718>] ? ip6t_do_table+0x318/0x590
[ 215.116826] [<c0109637>] ? native_sched_clock+0x67/0xb0
[ 215.116855] [<c014424d>] ? put_lock_stats+0xd/0x30
[ 215.116870] [<c0674e97>] ? tcp_v6_rcv+0x567/0x710
[ 215.116886] [<c0706615>] ? _spin_lock_nested+0x65/0x80
[ 215.116913] [<c0674e97>] ? tcp_v6_rcv+0x567/0x710
[ 215.116928] [<c0674f57>] tcp_v6_rcv+0x627/0x710
[ 215.116941] [<c06809c0>] ? ip6t_hook+0x0/0x30
[ 215.116955] [<c05f3c89>] ? nf_iterate+0x59/0x80
[ 215.116988] [<c0653ff2>] ip6_input_finish+0xc2/0x2a0
[ 215.117006] [<c0653f30>] ? ip6_input_finish+0x0/0x2a0
[ 215.117021] [<c06541ef>] ip6_input+0x1f/0x60
[ 215.117033] [<c0653f30>] ? ip6_input_finish+0x0/0x2a0
[ 215.117047] [<c0654464>] ipv6_rcv+0x194/0x2e0
[ 215.117059] [<c0654290>] ? ip6_rcv_finish+0x0/0x40
[ 215.117073] [<c06542d0>] ? ipv6_rcv+0x0/0x2e0
[ 215.117087] [<c05de7f0>] netif_receive_skb+0x280/0x2f0
[ 215.117102] [<c05e1336>] process_backlog+0x76/0xd0
[ 215.117118] [<c05e0c90>] net_rx_action+0x120/0x1a0
[ 215.117131] [<c012ac92>] __do_softirq+0x62/0xc0
[ 215.117145] [<c010676a>] do_softirq+0x8a/0xd0
[ 215.117161] [<c0155f80>] ? handle_level_irq+0x0/0xe0
[ 215.117178] [<c012abc6>] irq_exit+0x86/0x90
[ 215.117191] [<c010684a>] do_IRQ+0x9a/0x100
[ 215.117203] [<c0109637>] ? native_sched_clock+0x67/0xb0
[ 215.117218] [<c0109637>] ? native_sched_clock+0x67/0xb0
[ 215.117234] [<c01047f2>] common_interrupt+0x2e/0x34
[ 215.117247] [<c070007b>] ? tulip_init_one+0x5eb/0xda0
[ 215.117262] [<c0192e3a>] ? __mnt_is_readonly+0xa/0x20
[ 215.117281] [<c01959e7>] ? mnt_want_write+0x27/0x90
[ 215.117299] [<c0191a79>] file_update_time+0x39/0xd0
[ 215.117322] [<c018413a>] pipe_write+0x21a/0x450
[ 215.117348] [<c0146fe5>] ? __lock_acquire+0x395/0x1020
[ 215.117364] [<c017d55c>] do_sync_write+0xcc/0x110
[ 215.117378] [<c0138a80>] ? autoremove_wake_function+0x0/0x50
[ 215.117401] [<c01b1c9e>] ? dnotify_parent+0x6e/0x80
[ 215.117423] [<c0706d47>] ? _spin_unlock+0x27/0x50
[ 215.117439] [<c017dd99>] vfs_write+0x99/0x130
[ 215.117451] [<c017d490>] ? do_sync_write+0x0/0x110
[ 215.117465] [<c017e38d>] sys_write+0x3d/0x70
[ 215.117478] [<c0103d75>] sysenter_past_esp+0x6a/0xb1
[ 215.117492] =======================
[ 215.117499] FIX skbuff_head_cache: Object at 0xccbf10a0 not freed
[ 215.125990] =============================================================================
[ 215.126042] BUG skbuff_head_cache: Invalid object pointer 0xccbe1820
[ 215.126066] -----------------------------------------------------------------------------
[ 215.126071]
[ 215.126095] INFO: Slab 0xc1199c20 used=5 fp=0xccbe1600 flags=0x40000083
[ 215.126123] Pid: 3172, comm: dd Not tainted 2.6.25-03562-g3dc5063 #23
[ 215.126135] [<c0177b57>] slab_err+0x47/0x50
[ 215.126172] [<c0177bc7>] ? slab_pad_check+0x67/0xe0
[ 215.126189] [<c0177c92>] ? check_slab+0x52/0x80
[ 215.126204] [<c0179405>] __slab_free+0x1d5/0x2d0
[ 215.126219] [<c0179eb0>] kmem_cache_free+0x80/0xe0
[ 215.126233] [<c05d91dc>] ? __kfree_skb+0x3c/0x90
[ 215.126258] [<c05d91dc>] ? __kfree_skb+0x3c/0x90
[ 215.126273] [<c05d91dc>] __kfree_skb+0x3c/0x90
[ 215.126285] [<c05d9249>] kfree_skb+0x19/0x30
[ 215.126298] [<c0671e3b>] tcp_v6_do_rcv+0x33b/0xcd0
[ 215.126324] [<c0146fe5>] ? __lock_acquire+0x395/0x1020
[ 215.126359] [<c0146fe5>] ? __lock_acquire+0x395/0x1020
[ 215.126375] [<c0146fe5>] ? __lock_acquire+0x395/0x1020
[ 215.126389] [<c012b075>] ? local_bh_enable_ip+0x85/0xf0
[ 215.126420] [<c0680718>] ? ip6t_do_table+0x318/0x590
[ 215.126446] [<c0146fe5>] ? __lock_acquire+0x395/0x1020
[ 215.126461] [<c0146721>] ? trace_hardirqs_on+0x81/0x150
[ 215.126476] [<c0680718>] ? ip6t_do_table+0x318/0x590
[ 215.126490] [<c0109637>] ? native_sched_clock+0x67/0xb0
[ 215.126519] [<c014424d>] ? put_lock_stats+0xd/0x30
[ 215.126534] [<c0674e97>] ? tcp_v6_rcv+0x567/0x710
[ 215.126550] [<c0706615>] ? _spin_lock_nested+0x65/0x80
[ 215.126580] [<c0674e97>] ? tcp_v6_rcv+0x567/0x710
[ 215.126594] [<c0674f57>] tcp_v6_rcv+0x627/0x710
[ 215.126608] [<c06809c0>] ? ip6t_hook+0x0/0x30
[ 215.126622] [<c05f3c89>] ? nf_iterate+0x59/0x80
[ 215.126654] [<c0653ff2>] ip6_input_finish+0xc2/0x2a0
[ 215.126672] [<c0653f30>] ? ip6_input_finish+0x0/0x2a0
[ 215.126687] [<c06541ef>] ip6_input+0x1f/0x60
[ 215.126699] [<c0653f30>] ? ip6_input_finish+0x0/0x2a0
[ 215.126713] [<c0654464>] ipv6_rcv+0x194/0x2e0
[ 215.126725] [<c0654290>] ? ip6_rcv_finish+0x0/0x40
[ 215.126739] [<c06542d0>] ? ipv6_rcv+0x0/0x2e0
[ 215.126752] [<c05de7f0>] netif_receive_skb+0x280/0x2f0
[ 215.126767] [<c05e1336>] process_backlog+0x76/0xd0
[ 215.126783] [<c05e0c90>] net_rx_action+0x120/0x1a0
[ 215.126796] [<c012ac92>] __do_softirq+0x62/0xc0
[ 215.126810] [<c010676a>] do_softirq+0x8a/0xd0
[ 215.126826] [<c0155f80>] ? handle_level_irq+0x0/0xe0
[ 215.126842] [<c012abc6>] irq_exit+0x86/0x90
[ 215.126855] [<c010684a>] do_IRQ+0x9a/0x100
[ 215.126867] [<c0109637>] ? native_sched_clock+0x67/0xb0
[ 215.126883] [<c01047f2>] common_interrupt+0x2e/0x34
[ 215.126897] [<c0140000>] ? sysfs_override_clocksource+0x70/0x100
[ 215.126912] [<c0706e67>] ? _spin_unlock_irqrestore+0x57/0x70
[ 215.126929] [<c011e5c6>] __wake_up_sync+0x46/0x60
[ 215.126942] [<c0184119>] pipe_write+0x1f9/0x450
[ 215.126968] [<c0146fe5>] ? __lock_acquire+0x395/0x1020
[ 215.126983] [<c017d55c>] do_sync_write+0xcc/0x110
[ 215.126997] [<c0138a80>] ? autoremove_wake_function+0x0/0x50
[ 215.127021] [<c01b1c9e>] ? dnotify_parent+0x6e/0x80
[ 215.127044] [<c0706d47>] ? _spin_unlock+0x27/0x50
[ 215.127059] [<c017dd99>] vfs_write+0x99/0x130
[ 215.127071] [<c017d490>] ? do_sync_write+0x0/0x110
[ 215.127085] [<c017e38d>] sys_write+0x3d/0x70
[ 215.127098] [<c0103d75>] sysenter_past_esp+0x6a/0xb1
[ 215.127112] =======================
[ 215.127119] FIX skbuff_head_cache: Object at 0xccbe1820 not freed
Greetings, Eric
next reply other threads:[~2008-04-24 14:27 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2008-04-24 14:27 Eric Sesterhenn [this message]
2008-04-24 19:48 ` Slab Corruption with ipv6 and tcp6fuzz Ilpo Järvinen
2008-04-24 21:13 ` Evgeniy Polyakov
2008-04-25 12:52 ` Eric Sesterhenn
2008-04-25 13:09 ` Evgeniy Polyakov
2008-04-26 16:05 ` Evgeniy Polyakov
2008-04-27 6:05 ` David Miller
2008-04-27 13:25 ` Patrick McManus
2008-04-27 15:32 ` Eric Sesterhenn
2008-04-27 16:48 ` Patrick McManus
2008-04-27 22:27 ` David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20080424142727.GA24025@alice \
--to=snakebyte@gmx.de \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).