* BUG: ping without route segfaults in dst_release
@ 2011-03-28 23:18 Marc Kleine-Budde
2011-03-28 23:51 ` David Miller
0 siblings, 1 reply; 5+ messages in thread
From: Marc Kleine-Budde @ 2011-03-28 23:18 UTC (permalink / raw)
To: Netdev; +Cc: David Miller, kernel@pengutronix.de
[-- Attachment #1: Type: text/plain, Size: 4977 bytes --]
Hello,
I just found this breakage in current mainline (v2.6.38-8876-g036a982)
root@ptx:~ ifconfig
eth0 Link encap:Ethernet HWaddr 00:04:9F:01:7E:E9
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
root@ptx:~ ping 130.75.1.32
PING 130.75.1.32 (130.75[ 10.160000] Unable to handle kernel paging request at virtual address ffffffdb
[ 10.160000] pgd = c7998000
[ 10.160000] [ffffffdb] *pgd=47ffe831, *pte=00000000, *ppte=00000000
[ 10.160000] Internal error: Oops: 1 [#1]
[ 10.160000] last sysfs file: /sys/kernel/uevent_seqnum
[ 10.160000] Modules linked in:
[ 10.160000] CPU: 0 Not tainted (2.6.38+ #10)
[ 10.160000] PC is at dst_release+0x1c/0x80
[ 10.160000] LR is at raw_sendmsg+0x68c/0x714
[ 10.160000] pc : [<c017a3fc>] lr : [<c01ae0d0>] psr: a0000093
[ 10.160000] sp : c7965d70 ip : 8220014b fp : 00000000
[ 10.160000] r10: 00000000 r9 : 00000000 r8 : 20014b82
[ 10.160000] r7 : 00000001 r6 : c78e1b40 r5 : ffffff9b r4 : ffffff9b
[ 10.160000] r3 : a0000093 r2 : a0000013 r1 : 6b006b83 r0 : ffffff9b
[ 10.160000] Flags: NzCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment user
[ 10.160000] Control: 0005317f Table: 47998000 DAC: 00000015
[ 10.160000] Process ping (pid: 102, stack limit = 0xc7964270)
[ 10.160000] Stack: (0xc7965d70 to 0xc7966000)
[ 10.160000] 5d60: 00000000 ffffff9b c7965f5c c01ae0d0
[ 10.160000] 5d80: 60000013 c7994fc0 00000000 80000093 00000040 00000000 00000000 00000000
[ 10.160000] 5da0: 00000000 04010000 00000000 20014b82 00000000 00000008 20014b82 00000000
[ 10.160000] 5dc0: 00000000 c791f500 c7965dec ffffff9b 00000062 c78e1b40 00000040 c7965e10
[ 10.160000] 5de0: c7965f5c 00085cc8 c7964000 0000001c be8b4e54 c01b7858 00000000 00000000
[ 10.160000] 5e00: 00000000 00000000 c7965edc c0163810 c03d8e60 00000000 00000000 00000001
[ 10.160000] 5e20: ffffffff 00000000 00000000 00000000 00000000 00000000 c7994fc0 00000200
[ 10.160000] 5e40: 00000000 00000000 0006a000 c03d8e60 c7965e88 00000000 c7998000 c791f580
[ 10.160000] 5e60: c79761a8 0006a000 c7998000 00000000 c7a16000 c007a8c8 00000062 00000000
[ 10.160000] 5e80: 00000000 c03cf7e0 00000000 c006b76c c03cf7e0 00000040 c74752c0 00000000
[ 10.160000] 5ea0: 00000000 c7965f5c c7998000 c74752c0 00000000 c7965edc 00085cc8 c7965edc
[ 10.160000] 5ec0: 0000001c 00000000 00000040 c74752c0 00000000 c0164144 80000005 00000002
[ 10.160000] 5ee0: 20014b82 00000000 00000000 00000000 00000000 00000000 00000005 c7965fb0
[ 10.160000] 5f00: 0006a2bc be8b4e54 00085c70 c0021220 c02a4408 c01f13b4 00000000 c008e684
[ 10.160000] 5f20: c7965f58 00000000 00000001 c78e1b40 00001c70 c74752c0 00000000 c0168020
[ 10.160000] 5f40: c7965f4c c016456c c0296310 be8b4968 00000002 000000ae c0022088 c7965edc
[ 10.160000] 5f60: 0000001c c7965f78 00000001 00000000 00000000 00000000 00ad80f8 00000040
[ 10.160000] 5f80: 00000000 00000000 00000000 00085cc8 0000001c 00085c70 00000122 c0022088
[ 10.160000] 5fa0: 00000000 c0021ee0 00085cc8 0000001c 00000003 00ad80f8 00000040 00000000
[ 10.160000] 5fc0: 00085cc8 0000001c 00085c70 00000122 00000000 be8b4e54 00085c70 be8b4e54
[ 10.160000] 5fe0: 000179d4 be8b4b70 0000da90 401a7f28 60000010 00000003 00000001 0000000a
[ 10.160000] [<c017a3fc>] (dst_release+0x1c/0x80) from [<c01ae0d0>] (raw_sendmsg+0x68c/0x714)
[ 10.160000] [<c01ae0d0>] (raw_sendmsg+0x68c/0x714) from [<c01b7858>] (inet_sendmsg+0x68/0x74)
[ 10.160000] [<c01b7858>] (inet_sendmsg+0x68/0x74) from [<c0163810>] (sock_sendmsg+0x88/0xa8)
[ 10.160000] [<c0163810>] (sock_sendmsg+0x88/0xa8) from [<c0164144>] (sys_sendto+0xb4/0xd8)
[ 10.160000] [<c0164144>] (sys_sendto+0xb4/0xd8) from [<c0021ee0>] (ret_fast_syscall+0x0/0x2c)
[ 10.160000] Code: 0a000017 e10f2000 e3823080 e121f003 (e5953040)
.1.32): 56 data bytes
[ 10.470000] ---[ end trace 6d4174e1407fa33f ]---
Segmentation fault
2.6.38 works:
root@ptx:~ ping 130.75.1.32
PING 130.75.1.32 (130.75.1.32): 56 data bytes
ping: sendto: Network is unreachable
cheers, Marc
--
Pengutronix e.K. | Marc Kleine-Budde |
Industrial Linux Solutions | Phone: +49-231-2826-924 |
Vertretung West/Dortmund | Fax: +49-5121-206917-5555 |
Amtsgericht Hildesheim, HRA 2686 | http://www.pengutronix.de |
[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 262 bytes --]
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: BUG: ping without route segfaults in dst_release
2011-03-28 23:18 BUG: ping without route segfaults in dst_release Marc Kleine-Budde
@ 2011-03-28 23:51 ` David Miller
2011-03-29 0:00 ` Marc Kleine-Budde
2011-03-29 0:18 ` Marc Kleine-Budde
0 siblings, 2 replies; 5+ messages in thread
From: David Miller @ 2011-03-28 23:51 UTC (permalink / raw)
To: mkl; +Cc: Netdev, kernel
From: Marc Kleine-Budde <mkl@pengutronix.de>
Date: Tue, 29 Mar 2011 01:18:48 +0200
> root@ptx:~ ping 130.75.1.32
> PING 130.75.1.32 (130.75[ 10.160000] Unable to handle kernel paging request at virtual address ffffffdb
Well, that was easy enough :-)
--------------------
ipv4: Don't ip_rt_put() an error pointer in RAW sockets.
Reported-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
---
net/ipv4/raw.c | 1 +
1 files changed, 1 insertions(+), 0 deletions(-)
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index e837ffd..2d3c72e 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -569,6 +569,7 @@ static int raw_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
rt = ip_route_output_flow(sock_net(sk), &fl4, sk);
if (IS_ERR(rt)) {
err = PTR_ERR(rt);
+ rt = NULL;
goto done;
}
}
--
1.7.4.1
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: BUG: ping without route segfaults in dst_release
2011-03-28 23:51 ` David Miller
@ 2011-03-29 0:00 ` Marc Kleine-Budde
2011-03-29 0:18 ` Marc Kleine-Budde
1 sibling, 0 replies; 5+ messages in thread
From: Marc Kleine-Budde @ 2011-03-29 0:00 UTC (permalink / raw)
To: David Miller; +Cc: Netdev, kernel
[-- Attachment #1: Type: text/plain, Size: 2150 bytes --]
On 03/29/2011 01:51 AM, David Miller wrote:
> From: Marc Kleine-Budde <mkl@pengutronix.de>
> Date: Tue, 29 Mar 2011 01:18:48 +0200
>
>> root@ptx:~ ping 130.75.1.32
>> PING 130.75.1.32 (130.75[ 10.160000] Unable to handle kernel paging request at virtual address ffffffdb
>
> Well, that was easy enough :-)
..just finished bisecting :)
FWIW:
b23dd4fe42b455af5c6e20966b7d6959fa8352ea is the first bad commit
commit b23dd4fe42b455af5c6e20966b7d6959fa8352ea
Author: David S. Miller <davem@davemloft.net>
Date: Wed Mar 2 14:31:35 2011 -0800
ipv4: Make output route lookup return rtable directly.
Instead of on the stack.
Signed-off-by: David S. Miller <davem@davemloft.net>
:040000 040000 a30b2e32bbbbed71fe97ba44b8e0ac4d8691232b 589f843359ccb53c7800e594ea5efa074413f22e M drivers
:040000 040000 001c629e354ff875e8f2d3d7e4df2506f3396448 a55b417b1c10c3f23fafdf9fa5c6ab3c132d5223 M include
:040000 040000 1a0100ddadb50d9e61b66d1f18f47f25a4866856 4e89411fcefcfb87f8973910a97b4776d7a3f7f1 M net
>
> --------------------
> ipv4: Don't ip_rt_put() an error pointer in RAW sockets.
>
> Reported-by: Marc Kleine-Budde <mkl@pengutronix.de>
> Signed-off-by: David S. Miller <davem@davemloft.net>
> ---
> net/ipv4/raw.c | 1 +
> 1 files changed, 1 insertions(+), 0 deletions(-)
>
> diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
> index e837ffd..2d3c72e 100644
> --- a/net/ipv4/raw.c
> +++ b/net/ipv4/raw.c
> @@ -569,6 +569,7 @@ static int raw_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
> rt = ip_route_output_flow(sock_net(sk), &fl4, sk);
> if (IS_ERR(rt)) {
> err = PTR_ERR(rt);
> + rt = NULL;
IIRC I saw another commit which looks the same, in a different file
though. Any chance there are more rt = NULL missing?
> goto done;
> }
> }
Marc
--
Pengutronix e.K. | Marc Kleine-Budde |
Industrial Linux Solutions | Phone: +49-231-2826-924 |
Vertretung West/Dortmund | Fax: +49-5121-206917-5555 |
Amtsgericht Hildesheim, HRA 2686 | http://www.pengutronix.de |
[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 262 bytes --]
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: BUG: ping without route segfaults in dst_release
2011-03-28 23:51 ` David Miller
2011-03-29 0:00 ` Marc Kleine-Budde
@ 2011-03-29 0:18 ` Marc Kleine-Budde
2011-03-29 0:18 ` David Miller
1 sibling, 1 reply; 5+ messages in thread
From: Marc Kleine-Budde @ 2011-03-29 0:18 UTC (permalink / raw)
To: David Miller; +Cc: Netdev, kernel
[-- Attachment #1: Type: text/plain, Size: 890 bytes --]
On 03/29/2011 01:51 AM, David Miller wrote:
> From: Marc Kleine-Budde <mkl@pengutronix.de>
> Date: Tue, 29 Mar 2011 01:18:48 +0200
>
>> root@ptx:~ ping 130.75.1.32
>> PING 130.75.1.32 (130.75[ 10.160000] Unable to handle kernel paging request at virtual address ffffffdb
>
> Well, that was easy enough :-)
\o/, ping works again.
> --------------------
> ipv4: Don't ip_rt_put() an error pointer in RAW sockets.
>
> Reported-by: Marc Kleine-Budde <mkl@pengutronix.de>
> Signed-off-by: David S. Miller <davem@davemloft.net>
Tested-by: Marc Kleine-Budde <mkl@pengutronix.de>
g'night
Marc
--
Pengutronix e.K. | Marc Kleine-Budde |
Industrial Linux Solutions | Phone: +49-231-2826-924 |
Vertretung West/Dortmund | Fax: +49-5121-206917-5555 |
Amtsgericht Hildesheim, HRA 2686 | http://www.pengutronix.de |
[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 262 bytes --]
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: BUG: ping without route segfaults in dst_release
2011-03-29 0:18 ` Marc Kleine-Budde
@ 2011-03-29 0:18 ` David Miller
0 siblings, 0 replies; 5+ messages in thread
From: David Miller @ 2011-03-29 0:18 UTC (permalink / raw)
To: mkl; +Cc: Netdev, kernel
From: Marc Kleine-Budde <mkl@pengutronix.de>
Date: Tue, 29 Mar 2011 02:18:00 +0200
> On 03/29/2011 01:51 AM, David Miller wrote:
>> From: Marc Kleine-Budde <mkl@pengutronix.de>
>> Date: Tue, 29 Mar 2011 01:18:48 +0200
>>
>>> root@ptx:~ ping 130.75.1.32
>>> PING 130.75.1.32 (130.75[ 10.160000] Unable to handle kernel paging request at virtual address ffffffdb
>>
>> Well, that was easy enough :-)
>
> \o/, ping works again.
>
>> --------------------
>> ipv4: Don't ip_rt_put() an error pointer in RAW sockets.
>>
>> Reported-by: Marc Kleine-Budde <mkl@pengutronix.de>
>> Signed-off-by: David S. Miller <davem@davemloft.net>
> Tested-by: Marc Kleine-Budde <mkl@pengutronix.de>
Thanks for testing.
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2011-03-29 0:18 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2011-03-28 23:18 BUG: ping without route segfaults in dst_release Marc Kleine-Budde
2011-03-28 23:51 ` David Miller
2011-03-29 0:00 ` Marc Kleine-Budde
2011-03-29 0:18 ` Marc Kleine-Budde
2011-03-29 0:18 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).