[Issue] iproute2: coredump problem with command ip link xstats

[Issue] iproute2: coredump problem with command ip link xstats

[z30015464]

Hello everyone,

I having an issues while using iprute2 6.15.0. When I created a bond and intended to use 'ip link xstats' command to query extended information, a stack overflow occurred, followed by a coredump. I couldn't identify the root cause through the code and need some help.

Example:
ifconfig eth1 up
modprobe bonding mode=4 max_bonds=1 lacp_rate=1 miimon=100
ip addr add 7.7.0.100/24 dev bond0
ip link xstats type bond dev bond0

Here is the result:
[root@localhost /]# ip link xstats type bond
bond0
                    LACPDU Rx 0
                    LACPDU Tx 0
                    LACPDU Unknown type Rx 0
                    LACPDU Illegal Rx 0
                    Marker Rx 0
                    Marker Tx 0
                    Marker response Rx 0
                    Marker response Tx 0
                    Marker unknown type Rx 0
*** stack smashing detected ***: terminated
Aborted (core dumped)

Here is the result with valgrind:
[root@localhost /]# valgrind ip link xstats type bond dev bond0
==242893== Memcheck, a memory error detector
==242893== Copyright (C) 2002-2022, and GNU GPL'd, by Julian Seward et al.
==242893== Using Valgrind-3.22.0 and LibVEX; rerun with -h for copyright info
==242893== Command: ip link xstats type bond dev bond0
==242893==
bond0
                    LACPDU Rx 0
                    LACPDU Tx 0
                    LACPDU Unknown type Rx 0
                    LACPDU Illegal Rx 0
                    Marker Rx 0
                    Marker Tx 0
                    Marker response Rx 0
                    Marker response Tx 0
                    Marker unknown type Rx 0
*** stack smashing detected ***: terminated
==242893==
==242893== Process terminating with default action of signal 6 (SIGABRT)
==242893==    at 0x498AB5C: __pthread_kill_implementation (pthread_kill.c:44)
==242893==    by 0x493CF45: raise (raise.c:26)
==242893==    by 0x492733B: abort (abort.c:79)
==242893==    by 0x49281A8: __libc_message.cold (libc_fatal.c:152)
==242893==    by 0x4A1621A: __fortify_fail (fortify_fail.c:24)
==242893==    by 0x4A17435: __stack_chk_fail (stack_chk_fail.c:24)
==242893==    by 0x157A81: bond_print_stats_attr (iplink_bond.c:877)
==242893==    by 0x157B02: bond_print_xstats (iplink_bond.c:895)
==242893==    by 0x1846A9: rtnl_dump_filter_l (libnetlink.c:926)
==242893==    by 0x185A01: rtnl_dump_filter_nc (libnetlink.c:969)
==242893==    by 0x16B0BF: iplink_ifla_xstats (iplink_xstats.c:71)
==242893==    by 0x118C3C: do_cmd (ip.c:131)
==242893==
==242893== HEAP SUMMARY:
==242893==     in use at exit: 33,878 bytes in 4 blocks
==242893==   total heap usage: 8 allocs, 4 frees, 66,755 bytes allocated
==242893==
==242893== LEAK SUMMARY:
==242893==    definitely lost: 0 bytes in 0 blocks
==242893==    indirectly lost: 0 bytes in 0 blocks
==242893==      possibly lost: 0 bytes in 0 blocks
==242893==    still reachable: 33,878 bytes in 4 blocks
==242893==         suppressed: 0 bytes in 0 blocks
==242893== Rerun with --leak-check=full to see details of leaked memory
==242893==
==242893== For lists of detected and suppressed errors, rerun with: -s
==242893== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 0 from 0)
Aborted (core dumped)

Through gdb debugging, __stack_chk_fail was triggered after the end of function bond_print_stats_attr function.
I first found this issue in version 6.6.0. After replacing package 6.15.0, the issue still persists. 
I also tried version 5.15.0 but there was no abnormality.
Maybe some modifications triggered this issue, but I cannot found the cause. I hope to get some helps.

Thank you very much.

[Issue] iproute2: coredump problem with command ip link xstats

[z30015464]

Hello everyone,

I having an issues while using iprute2 6.15.0. When I created a bond and intended to use 'ip link xstats' command to query extended information, a stack overflow occurred, followed by a coredump. I couldn't identify the root cause through the code and need some help.

Example:
ifconfig eth1 up
modprobe bonding mode=4 max_bonds=1 lacp_rate=1 miimon=100
ip addr add 7.7.0.100/24 dev bond0
ip link xstats type bond dev bond0

Here is the result:
[root@localhost /]# ip link xstats type bond
bond0
                    LACPDU Rx 0
                    LACPDU Tx 0
                    LACPDU Unknown type Rx 0
                    LACPDU Illegal Rx 0
                    Marker Rx 0
                    Marker Tx 0
                    Marker response Rx 0
                    Marker response Tx 0
                    Marker unknown type Rx 0
*** stack smashing detected ***: terminated
Aborted (core dumped)

Here is the result with valgrind:
[root@localhost /]# valgrind ip link xstats type bond dev bond0
==242893== Memcheck, a memory error detector
==242893== Copyright (C) 2002-2022, and GNU GPL'd, by Julian Seward et al.
==242893== Using Valgrind-3.22.0 and LibVEX; rerun with -h for copyright info
==242893== Command: ip link xstats type bond dev bond0
==242893==
bond0
                    LACPDU Rx 0
                    LACPDU Tx 0
                    LACPDU Unknown type Rx 0
                    LACPDU Illegal Rx 0
                    Marker Rx 0
                    Marker Tx 0
                    Marker response Rx 0
                    Marker response Tx 0
                    Marker unknown type Rx 0
*** stack smashing detected ***: terminated
==242893==
==242893== Process terminating with default action of signal 6 (SIGABRT)
==242893==    at 0x498AB5C: __pthread_kill_implementation (pthread_kill.c:44)
==242893==    by 0x493CF45: raise (raise.c:26)
==242893==    by 0x492733B: abort (abort.c:79)
==242893==    by 0x49281A8: __libc_message.cold (libc_fatal.c:152)
==242893==    by 0x4A1621A: __fortify_fail (fortify_fail.c:24)
==242893==    by 0x4A17435: __stack_chk_fail (stack_chk_fail.c:24)
==242893==    by 0x157A81: bond_print_stats_attr (iplink_bond.c:877)
==242893==    by 0x157B02: bond_print_xstats (iplink_bond.c:895)
==242893==    by 0x1846A9: rtnl_dump_filter_l (libnetlink.c:926)
==242893==    by 0x185A01: rtnl_dump_filter_nc (libnetlink.c:969)
==242893==    by 0x16B0BF: iplink_ifla_xstats (iplink_xstats.c:71)
==242893==    by 0x118C3C: do_cmd (ip.c:131)
==242893==
==242893== HEAP SUMMARY:
==242893==     in use at exit: 33,878 bytes in 4 blocks
==242893==   total heap usage: 8 allocs, 4 frees, 66,755 bytes allocated
==242893==
==242893== LEAK SUMMARY:
==242893==    definitely lost: 0 bytes in 0 blocks
==242893==    indirectly lost: 0 bytes in 0 blocks
==242893==      possibly lost: 0 bytes in 0 blocks
==242893==    still reachable: 33,878 bytes in 4 blocks
==242893==         suppressed: 0 bytes in 0 blocks
==242893== Rerun with --leak-check=full to see details of leaked memory
==242893==
==242893== For lists of detected and suppressed errors, rerun with: -s
==242893== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 0 from 0)
Aborted (core dumped)

Through gdb debugging, __stack_chk_fail was triggered after the end of function bond_print_stats_attr function.
I first found this issue in version 6.6.0. After replacing package 6.15.0, the issue still persists. 
I also tried version 5.15.0 but there was no abnormality.
Maybe some modifications triggered this issue, but I cannot found the cause. I hope to get some helps.

Thank you very much.

Re: [Issue] iproute2: coredump problem with command ip link xstats

[Stephen Hemminger]

On Thu, 19 Jun 2025 15:45:52 +0800
z30015464 <zhongxuan2@huawei.com> wrote:

> Hello everyone,
> 
> I having an issues while using iprute2 6.15.0. When I created a bond and intended to use 'ip link xstats' command to query extended information, a stack overflow occurred, followed by a coredump. I couldn't identify the root cause through the code and need some help.
> 
> Example:
> ifconfig eth1 up
> modprobe bonding mode=4 max_bonds=1 lacp_rate=1 miimon=100
> ip addr add 7.7.0.100/24 dev bond0
> ip link xstats type bond dev bond0
> 
> Here is the result:
> [root@localhost /]# ip link xstats type bond
> bond0
>                     LACPDU Rx 0
>                     LACPDU Tx 0
>                     LACPDU Unknown type Rx 0
>                     LACPDU Illegal Rx 0
>                     Marker Rx 0
>                     Marker Tx 0
>                     Marker response Rx 0
>                     Marker response Tx 0
>                     Marker unknown type Rx 0
> *** stack smashing detected ***: terminated
> Aborted (core dumped)
> 
> Here is the result with valgrind:
> [root@localhost /]# valgrind ip link xstats type bond dev bond0
> ==242893== Memcheck, a memory error detector
> ==242893== Copyright (C) 2002-2022, and GNU GPL'd, by Julian Seward et al.
> ==242893== Using Valgrind-3.22.0 and LibVEX; rerun with -h for copyright info
> ==242893== Command: ip link xstats type bond dev bond0
> ==242893==
> bond0
>                     LACPDU Rx 0
>                     LACPDU Tx 0
>                     LACPDU Unknown type Rx 0
>                     LACPDU Illegal Rx 0
>                     Marker Rx 0
>                     Marker Tx 0
>                     Marker response Rx 0
>                     Marker response Tx 0
>                     Marker unknown type Rx 0
> *** stack smashing detected ***: terminated
> ==242893==
> ==242893== Process terminating with default action of signal 6 (SIGABRT)
> ==242893==    at 0x498AB5C: __pthread_kill_implementation (pthread_kill.c:44)
> ==242893==    by 0x493CF45: raise (raise.c:26)
> ==242893==    by 0x492733B: abort (abort.c:79)
> ==242893==    by 0x49281A8: __libc_message.cold (libc_fatal.c:152)
> ==242893==    by 0x4A1621A: __fortify_fail (fortify_fail.c:24)
> ==242893==    by 0x4A17435: __stack_chk_fail (stack_chk_fail.c:24)
> ==242893==    by 0x157A81: bond_print_stats_attr (iplink_bond.c:877)
> ==242893==    by 0x157B02: bond_print_xstats (iplink_bond.c:895)
> ==242893==    by 0x1846A9: rtnl_dump_filter_l (libnetlink.c:926)
> ==242893==    by 0x185A01: rtnl_dump_filter_nc (libnetlink.c:969)
> ==242893==    by 0x16B0BF: iplink_ifla_xstats (iplink_xstats.c:71)
> ==242893==    by 0x118C3C: do_cmd (ip.c:131)
> ==242893==
> ==242893== HEAP SUMMARY:
> ==242893==     in use at exit: 33,878 bytes in 4 blocks
> ==242893==   total heap usage: 8 allocs, 4 frees, 66,755 bytes allocated
> ==242893==
> ==242893== LEAK SUMMARY:
> ==242893==    definitely lost: 0 bytes in 0 blocks
> ==242893==    indirectly lost: 0 bytes in 0 blocks
> ==242893==      possibly lost: 0 bytes in 0 blocks
> ==242893==    still reachable: 33,878 bytes in 4 blocks
> ==242893==         suppressed: 0 bytes in 0 blocks
> ==242893== Rerun with --leak-check=full to see details of leaked memory
> ==242893==
> ==242893== For lists of detected and suppressed errors, rerun with: -s
> ==242893== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 0 from 0)
> Aborted (core dumped)
> 
> Through gdb debugging, __stack_chk_fail was triggered after the end of function bond_print_stats_attr function.
> I first found this issue in version 6.6.0. After replacing package 6.15.0, the issue still persists. 
> I also tried version 5.15.0 but there was no abnormality.
> Maybe some modifications triggered this issue, but I cannot found the cause. I hope to get some helps.
> 
> Thank you very much.
> 
> 
> 

Thanks, fixed it with:

From e4d10d064f5dbc64e4d2d73074c33b54d06b4514 Mon Sep 17 00:00:00 2001
From: Stephen Hemminger <stephen@networkplumber.org>
Date: Thu, 26 Jun 2025 06:50:17 -0700
Subject: [PATCH] bond: fix stack smash in xstats

Building with stack smashing detection finds an off by one
in the bond xstats attribute parsing.

$ ip link xstats type bond dev bond0
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
bond0
                    LACPDU Rx 0
                    LACPDU Tx 0
                    LACPDU Unknown type Rx 0
                    LACPDU Illegal Rx 0
                    Marker Rx 0
                    Marker Tx 0
                    Marker response Rx 0
                    Marker response Tx 0
                    Marker unknown type Rx 0
*** stack smashing detected ***: terminated

Program received signal SIGABRT, Aborted.

Reported-by: z30015464 <zhongxuan2@huawei.com>
Fixes: 440c5075d662 ("ip: bond: add xstats support")
Cc: nikolay@cumulusnetworks.com
Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
---
 ip/iplink_bond.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ip/iplink_bond.c b/ip/iplink_bond.c
index 19af67d0..62dd907c 100644
--- a/ip/iplink_bond.c
+++ b/ip/iplink_bond.c
@@ -852,7 +852,7 @@ static void bond_print_stats_attr(struct rtattr *attr, int ifindex)
 	const char *ifname = "";
 	int rem;
 
-	parse_rtattr(bondtb, LINK_XSTATS_TYPE_MAX+1, RTA_DATA(attr),
+	parse_rtattr(bondtb, LINK_XSTATS_TYPE_MAX, RTA_DATA(attr),
 	RTA_PAYLOAD(attr));
 	if (!bondtb[LINK_XSTATS_TYPE_BOND])
 		return;
-- 
2.47.2