From mboxrd@z Thu Jan 1 00:00:00 1970 From: Eric Sesterhenn Subject: Slab Corruption with ipv6 and tcp6fuzz Date: Thu, 24 Apr 2008 16:27:27 +0200 Message-ID: <20080424142727.GA24025@alice> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 To: netdev@vger.kernel.org Return-path: Received: from mail.gmx.net ([213.165.64.20]:56096 "HELO mail.gmx.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with SMTP id S1751623AbYDXO1c (ORCPT ); Thu, 24 Apr 2008 10:27:32 -0400 Content-Disposition: inline Sender: netdev-owner@vger.kernel.org List-ID: hi, i found some local ivp6 network fuzzing tools from the bsd folks today and wanted to add them to my testmachine. When trying one of them (running with user privs) it gave me slab corruption errors. Running http://clem1.be/lf6/tcp6fuzz.c 1 to 5 times always results in errors, strangely using the same seed twice in a row doesnt trigger the warnings again. If there is any more info i can provide please let me know. A sample of the warnings follows: [ 57.315914] process `tcp6fuzz' is using obsolete setsockopt SO_BSDCOMPAT [ 57.810370] sock_set_timeout: `tcp6fuzz' (pid 3721) tries to set negative timeout [ 215.102729] ============================================================================= [ 215.102786] BUG skbuff_head_cache: Invalid object pointer 0xccd2b520 [ 215.102810] ----------------------------------------------------------------------------- [ 215.102816] [ 215.102840] INFO: Slab 0xc119c560 used=10 fp=0x00000000 flags=0x40000083 [ 215.102868] Pid: 0, comm: swapper Not tainted 2.6.25-03562-g3dc5063 #23 [ 215.102880] [] slab_err+0x47/0x50 [ 215.102978] [] ? slab_pad_check+0x67/0xe0 [ 215.102994] [] ? check_slab+0x52/0x80 [ 215.103010] [] __slab_free+0x1d5/0x2d0 [ 215.103024] [] kmem_cache_free+0x80/0xe0 [ 215.103039] [] ? __kfree_skb+0x3c/0x90 [ 215.103063] [] ? __kfree_skb+0x3c/0x90 [ 215.103078] [] __kfree_skb+0x3c/0x90 [ 215.103090] [] kfree_skb+0x19/0x30 [ 215.103103] [] tcp_v6_do_rcv+0x33b/0xcd0 [ 215.103128] [] ? __lock_acquire+0x395/0x1020 [ 215.103161] [] ? __lock_acquire+0x395/0x1020 [ 215.103177] [] ? __lock_acquire+0x395/0x1020 [ 215.103191] [] ? local_bh_enable_ip+0x85/0xf0 [ 215.103220] [] ? ip6t_do_table+0x318/0x590 [ 215.103245] [] ? __lock_acquire+0x395/0x1020 [ 215.103260] [] ? trace_hardirqs_on+0x81/0x150 [ 215.103275] [] ? ip6t_do_table+0x318/0x590 [ 215.103289] [] ? native_sched_clock+0x67/0xb0 [ 215.103317] [] ? put_lock_stats+0xd/0x30 [ 215.103333] [] ? tcp_v6_rcv+0x567/0x710 [ 215.103349] [] ? _spin_lock_nested+0x65/0x80 [ 215.103377] [] ? tcp_v6_rcv+0x567/0x710 [ 215.103391] [] tcp_v6_rcv+0x627/0x710 [ 215.103404] [] ? ip6t_hook+0x0/0x30 [ 215.103418] [] ? nf_iterate+0x59/0x80 [ 215.103448] [] ip6_input_finish+0xc2/0x2a0 [ 215.103465] [] ? ip6_input_finish+0x0/0x2a0 [ 215.103479] [] ip6_input+0x1f/0x60 [ 215.103491] [] ? ip6_input_finish+0x0/0x2a0 [ 215.103505] [] ipv6_rcv+0x194/0x2e0 [ 215.103518] [] ? ip6_rcv_finish+0x0/0x40 [ 215.103532] [] ? ipv6_rcv+0x0/0x2e0 [ 215.103545] [] netif_receive_skb+0x280/0x2f0 [ 215.103560] [] process_backlog+0x76/0xd0 [ 215.103576] [] net_rx_action+0x120/0x1a0 [ 215.103589] [] __do_softirq+0x62/0xc0 [ 215.103602] [] do_softirq+0x8a/0xd0 [ 215.103618] [] ? handle_level_irq+0x0/0xe0 [ 215.103634] [] irq_exit+0x86/0x90 [ 215.103647] [] do_IRQ+0x9a/0x100 [ 215.103659] [] ? _spin_unlock_irqrestore+0x39/0x70 [ 215.103677] [] common_interrupt+0x2e/0x34 [ 215.103691] [] ? sysfs_override_clocksource+0x70/0x100 [ 215.103706] [] ? acpi_idle_enter_simple+0x18a/0x1fc [ 215.103739] [] cpuidle_idle_call+0x5d/0xb0 [ 215.103760] [] ? cpuidle_idle_call+0x0/0xb0 [ 215.103775] [] cpu_idle+0x38/0xa0 [ 215.103787] [] rest_init+0x5c/0x60 [ 215.103811] ======================= [ 215.103819] FIX skbuff_head_cache: Object at 0xccd2b520 not freed [ 215.108749] ============================================================================= [ 215.108796] BUG skbuff_head_cache: Invalid object pointer 0xcb13a820 [ 215.108820] ----------------------------------------------------------------------------- [ 215.108826] [ 215.108851] INFO: Slab 0xc1164740 used=5 fp=0xcb13a600 flags=0x40000083 [ 215.108879] Pid: 3172, comm: dd Not tainted 2.6.25-03562-g3dc5063 #23 [ 215.108896] [] slab_err+0x47/0x50 [ 215.108935] [] ? slab_pad_check+0x67/0xe0 [ 215.108951] [] ? check_slab+0x52/0x80 [ 215.108966] [] __slab_free+0x1d5/0x2d0 [ 215.108981] [] kmem_cache_free+0x80/0xe0 [ 215.108995] [] ? __kfree_skb+0x3c/0x90 [ 215.109021] [] ? __kfree_skb+0x3c/0x90 [ 215.109035] [] __kfree_skb+0x3c/0x90 [ 215.109048] [] kfree_skb+0x19/0x30 [ 215.109060] [] tcp_v6_do_rcv+0x33b/0xcd0 [ 215.109086] [] ? __lock_acquire+0x395/0x1020 [ 215.109120] [] ? __lock_acquire+0x395/0x1020 [ 215.109136] [] ? __lock_acquire+0x395/0x1020 [ 215.109151] [] ? local_bh_enable_ip+0x85/0xf0 [ 215.109181] [] ? ip6t_do_table+0x318/0x590 [ 215.109209] [] ? __lock_acquire+0x395/0x1020 [ 215.109224] [] ? trace_hardirqs_on+0x81/0x150 [ 215.109239] [] ? ip6t_do_table+0x318/0x590 [ 215.109253] [] ? native_sched_clock+0x67/0xb0 [ 215.109281] [] ? put_lock_stats+0xd/0x30 [ 215.109296] [] ? tcp_v6_rcv+0x567/0x710 [ 215.109312] [] ? _spin_lock_nested+0x65/0x80 [ 215.109337] [] ? tcp_v6_rcv+0x567/0x710 [ 215.109352] [] tcp_v6_rcv+0x627/0x710 [ 215.109365] [] ? ip6t_hook+0x0/0x30 [ 215.109379] [] ? nf_iterate+0x59/0x80 [ 215.109412] [] ip6_input_finish+0xc2/0x2a0 [ 215.109428] [] ? ip6_input_finish+0x0/0x2a0 [ 215.109443] [] ip6_input+0x1f/0x60 [ 215.109455] [] ? ip6_input_finish+0x0/0x2a0 [ 215.109469] [] ipv6_rcv+0x194/0x2e0 [ 215.109481] [] ? ip6_rcv_finish+0x0/0x40 [ 215.109495] [] ? ipv6_rcv+0x0/0x2e0 [ 215.109508] [] netif_receive_skb+0x280/0x2f0 [ 215.109524] [] process_backlog+0x76/0xd0 [ 215.109540] [] net_rx_action+0x120/0x1a0 [ 215.109554] [] __do_softirq+0x62/0xc0 [ 215.109567] [] do_softirq+0x8a/0xd0 [ 215.109583] [] ? handle_level_irq+0x0/0xe0 [ 215.109599] [] irq_exit+0x86/0x90 [ 215.109612] [] do_IRQ+0x9a/0x100 [ 215.109625] [] common_interrupt+0x2e/0x34 [ 215.109639] [] ? lock_acquire+0x8f/0xa0 [ 215.109654] [] ? mnt_want_write+0x20/0x90 [ 215.109677] [] _spin_lock+0x39/0x70 [ 215.109690] [] ? mnt_want_write+0x20/0x90 [ 215.109704] [] mnt_want_write+0x20/0x90 [ 215.109717] [] file_update_time+0x39/0xd0 [ 215.109744] [] pipe_write+0x21a/0x450 [ 215.109772] [] ? __lock_acquire+0x395/0x1020 [ 215.109788] [] do_sync_write+0xcc/0x110 [ 215.109802] [] ? autoremove_wake_function+0x0/0x50 [ 215.109827] [] ? dnotify_parent+0x6e/0x80 [ 215.109850] [] ? _spin_unlock+0x27/0x50 [ 215.109867] [] vfs_write+0x99/0x130 [ 215.109879] [] ? do_sync_write+0x0/0x110 [ 215.109893] [] sys_write+0x3d/0x70 [ 215.109906] [] sysenter_past_esp+0x6a/0xb1 [ 215.109920] ======================= [ 215.109928] FIX skbuff_head_cache: Object at 0xcb13a820 not freed [ 215.116324] ============================================================================= [ 215.116372] BUG skbuff_head_cache: Invalid object pointer 0xccbf10a0 [ 215.116396] ----------------------------------------------------------------------------- [ 215.116401] [ 215.116426] INFO: Slab 0xc1199e20 used=10 fp=0x00000000 flags=0x40000083 [ 215.116455] Pid: 3172, comm: dd Not tainted 2.6.25-03562-g3dc5063 #23 [ 215.116467] [] slab_err+0x47/0x50 [ 215.116506] [] ? slab_pad_check+0x67/0xe0 [ 215.116522] [] ? check_slab+0x52/0x80 [ 215.116537] [] __slab_free+0x1d5/0x2d0 [ 215.116553] [] kmem_cache_free+0x80/0xe0 [ 215.116567] [] ? __kfree_skb+0x3c/0x90 [ 215.116592] [] ? __kfree_skb+0x3c/0x90 [ 215.116606] [] __kfree_skb+0x3c/0x90 [ 215.116619] [] kfree_skb+0x19/0x30 [ 215.116631] [] tcp_v6_do_rcv+0x33b/0xcd0 [ 215.116657] [] ? __lock_acquire+0x395/0x1020 [ 215.116693] [] ? __lock_acquire+0x395/0x1020 [ 215.116709] [] ? __lock_acquire+0x395/0x1020 [ 215.116724] [] ? local_bh_enable_ip+0x85/0xf0 [ 215.116753] [] ? ip6t_do_table+0x318/0x590 [ 215.116781] [] ? __lock_acquire+0x395/0x1020 [ 215.116796] [] ? trace_hardirqs_on+0x81/0x150 [ 215.116811] [] ? ip6t_do_table+0x318/0x590 [ 215.116826] [] ? native_sched_clock+0x67/0xb0 [ 215.116855] [] ? put_lock_stats+0xd/0x30 [ 215.116870] [] ? tcp_v6_rcv+0x567/0x710 [ 215.116886] [] ? _spin_lock_nested+0x65/0x80 [ 215.116913] [] ? tcp_v6_rcv+0x567/0x710 [ 215.116928] [] tcp_v6_rcv+0x627/0x710 [ 215.116941] [] ? ip6t_hook+0x0/0x30 [ 215.116955] [] ? nf_iterate+0x59/0x80 [ 215.116988] [] ip6_input_finish+0xc2/0x2a0 [ 215.117006] [] ? ip6_input_finish+0x0/0x2a0 [ 215.117021] [] ip6_input+0x1f/0x60 [ 215.117033] [] ? ip6_input_finish+0x0/0x2a0 [ 215.117047] [] ipv6_rcv+0x194/0x2e0 [ 215.117059] [] ? ip6_rcv_finish+0x0/0x40 [ 215.117073] [] ? ipv6_rcv+0x0/0x2e0 [ 215.117087] [] netif_receive_skb+0x280/0x2f0 [ 215.117102] [] process_backlog+0x76/0xd0 [ 215.117118] [] net_rx_action+0x120/0x1a0 [ 215.117131] [] __do_softirq+0x62/0xc0 [ 215.117145] [] do_softirq+0x8a/0xd0 [ 215.117161] [] ? handle_level_irq+0x0/0xe0 [ 215.117178] [] irq_exit+0x86/0x90 [ 215.117191] [] do_IRQ+0x9a/0x100 [ 215.117203] [] ? native_sched_clock+0x67/0xb0 [ 215.117218] [] ? native_sched_clock+0x67/0xb0 [ 215.117234] [] common_interrupt+0x2e/0x34 [ 215.117247] [] ? tulip_init_one+0x5eb/0xda0 [ 215.117262] [] ? __mnt_is_readonly+0xa/0x20 [ 215.117281] [] ? mnt_want_write+0x27/0x90 [ 215.117299] [] file_update_time+0x39/0xd0 [ 215.117322] [] pipe_write+0x21a/0x450 [ 215.117348] [] ? __lock_acquire+0x395/0x1020 [ 215.117364] [] do_sync_write+0xcc/0x110 [ 215.117378] [] ? autoremove_wake_function+0x0/0x50 [ 215.117401] [] ? dnotify_parent+0x6e/0x80 [ 215.117423] [] ? _spin_unlock+0x27/0x50 [ 215.117439] [] vfs_write+0x99/0x130 [ 215.117451] [] ? do_sync_write+0x0/0x110 [ 215.117465] [] sys_write+0x3d/0x70 [ 215.117478] [] sysenter_past_esp+0x6a/0xb1 [ 215.117492] ======================= [ 215.117499] FIX skbuff_head_cache: Object at 0xccbf10a0 not freed [ 215.125990] ============================================================================= [ 215.126042] BUG skbuff_head_cache: Invalid object pointer 0xccbe1820 [ 215.126066] ----------------------------------------------------------------------------- [ 215.126071] [ 215.126095] INFO: Slab 0xc1199c20 used=5 fp=0xccbe1600 flags=0x40000083 [ 215.126123] Pid: 3172, comm: dd Not tainted 2.6.25-03562-g3dc5063 #23 [ 215.126135] [] slab_err+0x47/0x50 [ 215.126172] [] ? slab_pad_check+0x67/0xe0 [ 215.126189] [] ? check_slab+0x52/0x80 [ 215.126204] [] __slab_free+0x1d5/0x2d0 [ 215.126219] [] kmem_cache_free+0x80/0xe0 [ 215.126233] [] ? __kfree_skb+0x3c/0x90 [ 215.126258] [] ? __kfree_skb+0x3c/0x90 [ 215.126273] [] __kfree_skb+0x3c/0x90 [ 215.126285] [] kfree_skb+0x19/0x30 [ 215.126298] [] tcp_v6_do_rcv+0x33b/0xcd0 [ 215.126324] [] ? __lock_acquire+0x395/0x1020 [ 215.126359] [] ? __lock_acquire+0x395/0x1020 [ 215.126375] [] ? __lock_acquire+0x395/0x1020 [ 215.126389] [] ? local_bh_enable_ip+0x85/0xf0 [ 215.126420] [] ? ip6t_do_table+0x318/0x590 [ 215.126446] [] ? __lock_acquire+0x395/0x1020 [ 215.126461] [] ? trace_hardirqs_on+0x81/0x150 [ 215.126476] [] ? ip6t_do_table+0x318/0x590 [ 215.126490] [] ? native_sched_clock+0x67/0xb0 [ 215.126519] [] ? put_lock_stats+0xd/0x30 [ 215.126534] [] ? tcp_v6_rcv+0x567/0x710 [ 215.126550] [] ? _spin_lock_nested+0x65/0x80 [ 215.126580] [] ? tcp_v6_rcv+0x567/0x710 [ 215.126594] [] tcp_v6_rcv+0x627/0x710 [ 215.126608] [] ? ip6t_hook+0x0/0x30 [ 215.126622] [] ? nf_iterate+0x59/0x80 [ 215.126654] [] ip6_input_finish+0xc2/0x2a0 [ 215.126672] [] ? ip6_input_finish+0x0/0x2a0 [ 215.126687] [] ip6_input+0x1f/0x60 [ 215.126699] [] ? ip6_input_finish+0x0/0x2a0 [ 215.126713] [] ipv6_rcv+0x194/0x2e0 [ 215.126725] [] ? ip6_rcv_finish+0x0/0x40 [ 215.126739] [] ? ipv6_rcv+0x0/0x2e0 [ 215.126752] [] netif_receive_skb+0x280/0x2f0 [ 215.126767] [] process_backlog+0x76/0xd0 [ 215.126783] [] net_rx_action+0x120/0x1a0 [ 215.126796] [] __do_softirq+0x62/0xc0 [ 215.126810] [] do_softirq+0x8a/0xd0 [ 215.126826] [] ? handle_level_irq+0x0/0xe0 [ 215.126842] [] irq_exit+0x86/0x90 [ 215.126855] [] do_IRQ+0x9a/0x100 [ 215.126867] [] ? native_sched_clock+0x67/0xb0 [ 215.126883] [] common_interrupt+0x2e/0x34 [ 215.126897] [] ? sysfs_override_clocksource+0x70/0x100 [ 215.126912] [] ? _spin_unlock_irqrestore+0x57/0x70 [ 215.126929] [] __wake_up_sync+0x46/0x60 [ 215.126942] [] pipe_write+0x1f9/0x450 [ 215.126968] [] ? __lock_acquire+0x395/0x1020 [ 215.126983] [] do_sync_write+0xcc/0x110 [ 215.126997] [] ? autoremove_wake_function+0x0/0x50 [ 215.127021] [] ? dnotify_parent+0x6e/0x80 [ 215.127044] [] ? _spin_unlock+0x27/0x50 [ 215.127059] [] vfs_write+0x99/0x130 [ 215.127071] [] ? do_sync_write+0x0/0x110 [ 215.127085] [] sys_write+0x3d/0x70 [ 215.127098] [] sysenter_past_esp+0x6a/0xb1 [ 215.127112] ======================= [ 215.127119] FIX skbuff_head_cache: Object at 0xccbe1820 not freed Greetings, Eric