* 3.11rc7 net/ipv6 addrlabel OOPS @ 2013-09-02 21:31 Michele Baldessari 2013-09-03 0:13 ` [PATCH] ipv6: fix null pointer dereference in __ip6addrlbl_add Hannes Frederic Sowa 0 siblings, 1 reply; 6+ messages in thread From: Michele Baldessari @ 2013-09-02 21:31 UTC (permalink / raw) To: netdev, Hideaki YOSHIFUJI; +Cc: David S. Miller Hi, with the latest linux master git tree from Linus (248d296d6d9df384996c2ed95676b367d876d48c - 2 Sep) I can reproduceably oops the kernel with the following commands: ip addrlabel flush ip addrlabel add prefix ::1/128 label 0 ip addrlabel add prefix ::/0 label 1 The backtrace is: [ 15.129204] BUG: unable to handle kernel NULL pointer dereference at 0000000000000028 [ 15.129220] IP: [<ffffffff815f3720>] ip6addrlbl_add+0x210/0x370 [ 15.129235] PGD 114f64067 PUD 115bdc067 PMD 0 [ 15.129248] Oops: 0000 [#1] SMP [ 15.129257] Modules linked in: nf_conntrack_netbios_ns nf_conntrack_broadcast ipt_MASQUERADE ip6table_nat nf_nat_ipv6 ip6table_mangle ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 iptable_nat nf_nat_ipv4 nf_nat iptable_mangle nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack ebtable_filter ebtables ip6table_filter ip6_tables snd_hda_intel snd_hda_codec snd_hwdep snd_seq snd_seq_device snd_pcm snd_page_alloc snd_timer joydev pcspkr serio_raw virtio_balloon microcode snd soundcore i2c_piix4 mperf xfs libcrc32c qxl drm_kms_helper ttm drm virtio_net virtio_blk i2c_core ata_generic pata_acpi floppy [ 15.129401] CPU: 3 PID: 1122 Comm: ip Not tainted 3.11.0-rc7+ #2 [ 15.129407] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 15.129414] task: ffff88011481eac0 ti: ffff8801149ac000 task.ti: ffff8801149ac000 [ 15.129422] RIP: 0010:[<ffffffff815f3720>] [<ffffffff815f3720>] ip6addrlbl_add+0x210/0x370 [ 15.129434] RSP: 0018:ffff8801149ad9c8 EFLAGS: 00010246 [ 15.129440] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff88011453b900 [ 15.129447] RDX: 0000000000000007 RSI: 0000000000000000 RDI: 0000000000000246 [ 15.129455] RBP: ffff8801149ada18 R08: 0000000000000000 R09: 00000000000002a1 [ 15.129578] R10: 00000000127c7901 R11: ffffffff81855500 R12: ffff880119baaa28 [ 15.129700] R13: 0000000000000000 R14: 0000000000000000 R15: ffff880114e34ea0 [ 15.129828] FS: 00007f4449519740(0000) GS:ffff88011fd80000(0000) knlGS:0000000000000000 [ 15.129952] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b [ 15.130125] CR2: 0000000000000028 CR3: 0000000114280000 CR4: 00000000000006e0 [ 15.130133] Stack: [ 15.130133] 0000000000000000 0000000000000000 00000000149ada18 ffffffff81cbd940 [ 15.130133] 0000000000000001 ffff880119baaa00 ffffffff81cbd940 0000000000000038 [ 15.130133] ffff880119baaa24 ffff880119baaa28 ffff8801149ada98 ffffffff815f3b3e [ 15.130133] Call Trace: [ 15.130133] [<ffffffff815f3b3e>] ip6addrlbl_newdel+0x24e/0x2d0 [ 15.130133] [<ffffffff8129843e>] ? selinux_capable+0x2e/0x40 [ 15.130133] [<ffffffff8154e669>] rtnetlink_rcv_msg+0x99/0x260 [ 15.130133] [<ffffffff812956c5>] ? sock_has_perm+0x75/0x90 [ 15.130133] [<ffffffff8154e5d0>] ? rtnetlink_rcv+0x30/0x30 [ 15.130133] [<ffffffff8156d0a9>] netlink_rcv_skb+0xa9/0xc0 [ 15.130133] [<ffffffff8154e5c8>] rtnetlink_rcv+0x28/0x30 [ 15.130133] [<ffffffff8156c6fd>] netlink_unicast+0xdd/0x190 [ 15.130133] [<ffffffff8156caaf>] netlink_sendmsg+0x2ff/0x740 [ 15.130133] [<ffffffff815296b9>] sock_sendmsg+0x99/0xd0 [ 15.130133] [<ffffffff812f848e>] ? radix_tree_lookup_slot+0xe/0x10 [ 15.130133] [<ffffffff81529aac>] ___sys_sendmsg+0x36c/0x380 [ 15.130133] [<ffffffff81164e11>] ? handle_mm_fault+0x291/0x660 [ 15.130133] [<ffffffff81646f74>] ? __do_page_fault+0x1f4/0x510 [ 15.130133] [<ffffffff8156c096>] ? netlink_autobind.isra.43+0x106/0x170 [ 15.130133] [<ffffffff8152852f>] ? move_addr_to_user+0xaf/0xd0 [ 15.130133] [<ffffffff8152862c>] ? SYSC_getsockname+0xdc/0xf0 [ 15.130133] [<ffffffff8152a892>] __sys_sendmsg+0x42/0x80 [ 15.130133] [<ffffffff8152a8e2>] SyS_sendmsg+0x12/0x20 [ 15.130133] [<ffffffff8164b9d9>] system_call_fastpath+0x16/0x1b [ 15.130133] Code: 30 83 05 0f a7 9e 00 01 31 db 80 05 02 a7 9e 00 01 31 c0 85 db 0f 85 e0 00 00 00 48 83 c4 28 5b 41 5c 41 5d 41 5e 41 5f 5d c3 90 <48> 8b 04 25 28 00 00 00 49 8d 57 28 49 c7 47 30 28 00 00 00 49 [ 15.130133] RIP [<ffffffff815f3720>] ip6addrlbl_add+0x210/0x370 [ 15.130133] RSP <ffff8801149ad9c8> [ 15.130133] CR2: 0000000000000028 I believe I've bisected it down to (although it might very well be that this patch just brought the root issue to surface): b67bfe0 - 2013-02-27 - hlist: drop the node parameter from iterators cheers, Michele -- Michele Baldessari <michele@acksyn.org> C2A5 9DA3 9961 4FFB E01B D0BC DDD4 DCCB 7515 5C6D ^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH] ipv6: fix null pointer dereference in __ip6addrlbl_add 2013-09-02 21:31 3.11rc7 net/ipv6 addrlabel OOPS Michele Baldessari @ 2013-09-03 0:13 ` Hannes Frederic Sowa 2013-09-03 8:04 ` Michele Baldessari 2013-09-04 18:13 ` David Miller 0 siblings, 2 replies; 6+ messages in thread From: Hannes Frederic Sowa @ 2013-09-03 0:13 UTC (permalink / raw) To: Michele Baldessari Cc: netdev, Hideaki YOSHIFUJI, David S. Miller, Sasha Levin Hi! On Mon, Sep 02, 2013 at 10:31:28PM +0100, Michele Baldessari wrote: > with the latest linux master git tree from Linus > (248d296d6d9df384996c2ed95676b367d876d48c - 2 Sep) I can reproduceably oops > the kernel with the following commands: > ip addrlabel flush > ip addrlabel add prefix ::1/128 label 0 > ip addrlabel add prefix ::/0 label 1 Thanks for the report! This patch should fix this issue: [PATCH] ipv6: fix null pointer dereference in __ip6addrlbl_add Commit b67bfe0d42cac56c512dd5da4b1b347a23f4b70a ("hlist: drop the node parameter from iterators") changed the behavior of hlist_for_each_entry_safe to leave the p argument NULL. Fix this up by tracking the last argument. Reported-by: Michele Baldessari <michele@acksyn.org> Cc: Hideaki YOSHIFUJI <yoshfuji@linux-ipv6.org> Cc: Sasha Levin <sasha.levin@oracle.com> Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org> --- net/ipv6/addrlabel.c | 48 +++++++++++++++++++++++------------------------- 1 file changed, 23 insertions(+), 25 deletions(-) diff --git a/net/ipv6/addrlabel.c b/net/ipv6/addrlabel.c index f083a58..b30ad37 100644 --- a/net/ipv6/addrlabel.c +++ b/net/ipv6/addrlabel.c @@ -251,38 +251,36 @@ static struct ip6addrlbl_entry *ip6addrlbl_alloc(struct net *net, /* add a label */ static int __ip6addrlbl_add(struct ip6addrlbl_entry *newp, int replace) { + struct hlist_node *n; + struct ip6addrlbl_entry *last = NULL, *p = NULL; int ret = 0; - ADDRLABEL(KERN_DEBUG "%s(newp=%p, replace=%d)\n", - __func__, - newp, replace); + ADDRLABEL(KERN_DEBUG "%s(newp=%p, replace=%d)\n", __func__, newp, + replace); - if (hlist_empty(&ip6addrlbl_table.head)) { - hlist_add_head_rcu(&newp->list, &ip6addrlbl_table.head); - } else { - struct hlist_node *n; - struct ip6addrlbl_entry *p = NULL; - hlist_for_each_entry_safe(p, n, - &ip6addrlbl_table.head, list) { - if (p->prefixlen == newp->prefixlen && - net_eq(ip6addrlbl_net(p), ip6addrlbl_net(newp)) && - p->ifindex == newp->ifindex && - ipv6_addr_equal(&p->prefix, &newp->prefix)) { - if (!replace) { - ret = -EEXIST; - goto out; - } - hlist_replace_rcu(&p->list, &newp->list); - ip6addrlbl_put(p); - goto out; - } else if ((p->prefixlen == newp->prefixlen && !p->ifindex) || - (p->prefixlen < newp->prefixlen)) { - hlist_add_before_rcu(&newp->list, &p->list); + hlist_for_each_entry_safe(p, n, &ip6addrlbl_table.head, list) { + if (p->prefixlen == newp->prefixlen && + net_eq(ip6addrlbl_net(p), ip6addrlbl_net(newp)) && + p->ifindex == newp->ifindex && + ipv6_addr_equal(&p->prefix, &newp->prefix)) { + if (!replace) { + ret = -EEXIST; goto out; } + hlist_replace_rcu(&p->list, &newp->list); + ip6addrlbl_put(p); + goto out; + } else if ((p->prefixlen == newp->prefixlen && !p->ifindex) || + (p->prefixlen < newp->prefixlen)) { + hlist_add_before_rcu(&newp->list, &p->list); + goto out; } - hlist_add_after_rcu(&p->list, &newp->list); + last = p; } + if (last) + hlist_add_after_rcu(&last->list, &newp->list); + else + hlist_add_head_rcu(&newp->list, &ip6addrlbl_table.head); out: if (!ret) ip6addrlbl_table.seq++; -- 1.8.3.1 ^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH] ipv6: fix null pointer dereference in __ip6addrlbl_add 2013-09-03 0:13 ` [PATCH] ipv6: fix null pointer dereference in __ip6addrlbl_add Hannes Frederic Sowa @ 2013-09-03 8:04 ` Michele Baldessari 2013-09-04 18:13 ` David Miller 1 sibling, 0 replies; 6+ messages in thread From: Michele Baldessari @ 2013-09-03 8:04 UTC (permalink / raw) To: netdev, Hideaki YOSHIFUJI, David S. Miller, Sasha Levin Hi Hannes, On Tue, Sep 03, 2013 at 02:13:31AM +0200, Hannes Frederic Sowa wrote: > On Mon, Sep 02, 2013 at 10:31:28PM +0100, Michele Baldessari wrote: > > with the latest linux master git tree from Linus > > (248d296d6d9df384996c2ed95676b367d876d48c - 2 Sep) I can reproduceably oops > > the kernel with the following commands: > > ip addrlabel flush > > ip addrlabel add prefix ::1/128 label 0 > > ip addrlabel add prefix ::/0 label 1 > > Thanks for the report! This patch should fix this issue: > > [PATCH] ipv6: fix null pointer dereference in __ip6addrlbl_add > > Commit b67bfe0d42cac56c512dd5da4b1b347a23f4b70a ("hlist: drop > the node parameter from iterators") changed the behavior of > hlist_for_each_entry_safe to leave the p argument NULL. > > Fix this up by tracking the last argument. > > Reported-by: Michele Baldessari <michele@acksyn.org> > Cc: Hideaki YOSHIFUJI <yoshfuji@linux-ipv6.org> > Cc: Sasha Levin <sasha.levin@oracle.com> > Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org> Thanks for the patch, fixes it for me. Tested-by: Michele Baldessari <michele@acksyn.org> ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] ipv6: fix null pointer dereference in __ip6addrlbl_add 2013-09-03 0:13 ` [PATCH] ipv6: fix null pointer dereference in __ip6addrlbl_add Hannes Frederic Sowa 2013-09-03 8:04 ` Michele Baldessari @ 2013-09-04 18:13 ` David Miller 2013-09-04 18:51 ` Hannes Frederic Sowa 1 sibling, 1 reply; 6+ messages in thread From: David Miller @ 2013-09-04 18:13 UTC (permalink / raw) To: hannes; +Cc: michele, netdev, yoshfuji, sasha.levin From: Hannes Frederic Sowa <hannes@stressinduktion.org> Date: Tue, 3 Sep 2013 02:13:31 +0200 > Hi! > > On Mon, Sep 02, 2013 at 10:31:28PM +0100, Michele Baldessari wrote: >> with the latest linux master git tree from Linus >> (248d296d6d9df384996c2ed95676b367d876d48c - 2 Sep) I can reproduceably oops >> the kernel with the following commands: >> ip addrlabel flush >> ip addrlabel add prefix ::1/128 label 0 >> ip addrlabel add prefix ::/0 label 1 > > Thanks for the report! This patch should fix this issue: > > [PATCH] ipv6: fix null pointer dereference in __ip6addrlbl_add > > Commit b67bfe0d42cac56c512dd5da4b1b347a23f4b70a ("hlist: drop > the node parameter from iterators") changed the behavior of > hlist_for_each_entry_safe to leave the p argument NULL. > > Fix this up by tracking the last argument. > > Reported-by: Michele Baldessari <michele@acksyn.org> > Cc: Hideaki YOSHIFUJI <yoshfuji@linux-ipv6.org> > Cc: Sasha Levin <sasha.levin@oracle.com> > Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org> Applied. ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] ipv6: fix null pointer dereference in __ip6addrlbl_add 2013-09-04 18:13 ` David Miller @ 2013-09-04 18:51 ` Hannes Frederic Sowa 2013-09-04 18:58 ` David Miller 0 siblings, 1 reply; 6+ messages in thread From: Hannes Frederic Sowa @ 2013-09-04 18:51 UTC (permalink / raw) To: David Miller; +Cc: michele, netdev, yoshfuji, sasha.levin On Wed, Sep 04, 2013 at 02:13:01PM -0400, David Miller wrote: > From: Hannes Frederic Sowa <hannes@stressinduktion.org> > Date: Tue, 3 Sep 2013 02:13:31 +0200 > > > Hi! > > > > On Mon, Sep 02, 2013 at 10:31:28PM +0100, Michele Baldessari wrote: > >> with the latest linux master git tree from Linus > >> (248d296d6d9df384996c2ed95676b367d876d48c - 2 Sep) I can reproduceably oops > >> the kernel with the following commands: > >> ip addrlabel flush > >> ip addrlabel add prefix ::1/128 label 0 > >> ip addrlabel add prefix ::/0 label 1 > > > > Thanks for the report! This patch should fix this issue: > > > > [PATCH] ipv6: fix null pointer dereference in __ip6addrlbl_add > > > > Commit b67bfe0d42cac56c512dd5da4b1b347a23f4b70a ("hlist: drop > > the node parameter from iterators") changed the behavior of > > hlist_for_each_entry_safe to leave the p argument NULL. > > > > Fix this up by tracking the last argument. > > > > Reported-by: Michele Baldessari <michele@acksyn.org> > > Cc: Hideaki YOSHIFUJI <yoshfuji@linux-ipv6.org> > > Cc: Sasha Levin <sasha.levin@oracle.com> > > Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org> > > Applied. Sorry I forgot to mention that this patch is also applicable to solve this issue in the longterm 3.10 kernel. Maybe this should go to stable? Thanks, Hannes ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] ipv6: fix null pointer dereference in __ip6addrlbl_add 2013-09-04 18:51 ` Hannes Frederic Sowa @ 2013-09-04 18:58 ` David Miller 0 siblings, 0 replies; 6+ messages in thread From: David Miller @ 2013-09-04 18:58 UTC (permalink / raw) To: hannes; +Cc: michele, netdev, yoshfuji, sasha.levin From: Hannes Frederic Sowa <hannes@stressinduktion.org> Date: Wed, 4 Sep 2013 20:51:45 +0200 > Sorry I forgot to mention that this patch is also applicable to solve > this issue in the longterm 3.10 kernel. Maybe this should go to stable? I did queue it up for -stable already. ^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2013-09-04 18:58 UTC | newest] Thread overview: 6+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2013-09-02 21:31 3.11rc7 net/ipv6 addrlabel OOPS Michele Baldessari 2013-09-03 0:13 ` [PATCH] ipv6: fix null pointer dereference in __ip6addrlbl_add Hannes Frederic Sowa 2013-09-03 8:04 ` Michele Baldessari 2013-09-04 18:13 ` David Miller 2013-09-04 18:51 ` Hannes Frederic Sowa 2013-09-04 18:58 ` David Miller
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).