From: Dave Jones <davej@redhat.com>
To: netdev@vger.kernel.org
Subject: GPF in ip6_dst_lookup_tail
Date: Thu, 27 Sep 2012 10:03:23 -0400 [thread overview]
Message-ID: <20120927140323.GA1459@redhat.com> (raw)
Trinity bug of the day. I added some code to fabricate sockaddr's.
This seems to be the first casualty of that.
general protection fault: 0000 [#1] SMP
Modules linked in: ipt_ULOG tun fuse binfmt_misc nfnetlink nfc caif_socket caif phonet can llc2 pppoe pppox ppp_generic slhc irda crc_ccitt rds af_key decnet rose x25 atm netrom appletalk ipx p8023 psnap p8022 llc ax25 lockd sunrpc bluetooth rfkill ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 ip6table_filter ip6_tables nf_conntrack_ipv4 nf_defrag_ipv4 xt_state nf_conntrack kvm_intel kvm usb_debug crc32c_intel ghash_clmulni_intel microcode pcspkr i2c_i801 e1000e uinput i915 video i2c_algo_bit drm_kms_helper drm i2c_core
CPU 4
Pid: 21651, comm: trinity-child4 Not tainted 3.6.0-rc7+ #55
RIP: 0010:[<ffffffff81628797>] [<ffffffff81628797>] ip6_dst_lookup_tail+0x147/0x380
RSP: 0018:ffff8800144c3a48 EFLAGS: 00010286
RAX: 8000000000000011 RBX: ffff8800144c3b00 RCX: 0000000000000001
RDX: ffff8800144c2000 RSI: 0000000000000000 RDI: 0000000000000282
RBP: ffff8800144c3ae8 R08: 0000000000000014 R09: ffff8800034708c0
R10: ffffffff81c34a60 R11: 0000000000000000 R12: 0000000000000000
R13: ffff8800144c3bf0 R14: ffffffff81cd9580 R15: ffff8801052e4200
FS: 00007f74949af740(0000) GS:ffff880148400000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000051f7000 CR3: 00000000a8f72000 CR4: 00000000001407e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process trinity-child4 (pid: 21651, threadinfo ffff8800144c2000, task ffff880003470000)
Stack:
ffffffff81628730 ffffffff810dafbf ffff880003470000 0000000000000000
ffff8800144c3aa8 0000000000000282 ffff8800144c3aa8 ffff88013d79dd40
ffff8801052e4200 0000000000000003 0000000000000001 0000000000000000
Call Trace:
[<ffffffff81628730>] ? ip6_dst_lookup_tail+0xe0/0x380
[<ffffffff810dafbf>] ? lock_release_holdtime.part.26+0xf/0x180
[<ffffffff81556b20>] ? sock_def_wakeup+0x1b0/0x1b0
[<ffffffff81628a9b>] ip6_sk_dst_lookup_flow+0xcb/0x1b0
[<ffffffff81649d8d>] udpv6_sendmsg+0x6ad/0xc40
[<ffffffff81023af9>] ? native_sched_clock+0x19/0x80
[<ffffffff810db438>] ? trace_hardirqs_off_caller+0x28/0xd0
[<ffffffff810db4ed>] ? trace_hardirqs_off+0xd/0x10
[<ffffffff815e613a>] inet_sendmsg+0x12a/0x240
[<ffffffff815e6010>] ? inet_create+0x6f0/0x6f0
[<ffffffff815562a1>] ? sock_update_classid+0xb1/0x390
[<ffffffff81556340>] ? sock_update_classid+0x150/0x390
[<ffffffff8155115c>] sock_sendmsg+0xbc/0xf0
[<ffffffff810b46c9>] ? local_clock+0x99/0xc0
[<ffffffff810dff4f>] ? lock_release_non_nested+0x2df/0x320
[<ffffffff810dafbf>] ? lock_release_holdtime.part.26+0xf/0x180
[<ffffffff81553740>] sys_sendto+0x130/0x180
[<ffffffff816af8ad>] system_call_fastpath+0x1a/0x1f
Code: c0 74 19 80 3d 0e 4d 6d 00 00 75 10 e8 73 cb af ff 85 c0 0f 85 e3 01 00 00 0f 1f 00 48 8b 03 48 8b 80 98 00 00 00 48 85 c0 74 09 <f6> 80 6d 01 00 00 de 74 48 e8 3b db a6 ff 85 c0 74 0d 80 3d d5
The disassembly points here..
983 rcu_read_lock();
984 rt = (struct rt6_info *) *dst;
985 n = rt->n;
986 if (n && !(n->nud_state & NUD_VALID)) {
db2: 48 85 c0 test %rax,%rax
db5: 74 09 je dc0 <ip6_dst_lookup_tail+0x150>
db7: f6 80 6d 01 00 00 de testb $0xde,0x16d(%rax)
dbe: 74 48 je e08 <ip6_dst_lookup_tail+0x198>
'rt->n' is 0x8000000000000011, which looks like one of the garbage values trinity generates
Dave
next reply other threads:[~2012-09-27 14:03 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-09-27 14:03 Dave Jones [this message]
2012-10-02 13:59 ` GPF in ip6_dst_lookup_tail Dave Jones
-- strict thread matches above, loose matches on Subject: below --
2012-12-07 14:15 Dave Jones
2012-12-07 17:43 ` David Miller
2012-12-07 18:04 ` Dave Jones
2012-12-07 18:05 ` David Miller
2012-12-09 2:04 ` Eric Dumazet
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20120927140323.GA1459@redhat.com \
--to=davej@redhat.com \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).