Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1594849
| From | David Ahern <dsa@cumulusnetworks.com> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | Re: net: heap out-of-bounds in fib6_clean_node/rt6_fill_node/fib6_age/fib6_prune_clone |
| Date | 2017-03-08 05:50 +0100 |
| Message-ID | <tirSi-2Tr-27@gated-at.bofh.it> (permalink) |
| References | (4 earlier) <ti4M1-2ZV-13@gated-at.bofh.it> <ti61r-3R8-7@gated-at.bofh.it> <tiaHL-7eE-5@gated-at.bofh.it> <tiiYF-4Va-1@gated-at.bofh.it> <tikxs-66H-19@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
On 3/7/17 2:21 AM, Dmitry Vyukov wrote:
> I've commented that warning just to see I can obtain more information.
> Then I also got this:
>
> ------------[ cut here ]------------
> WARNING: CPU: 2 PID: 3990 at net/ipv6/ip6_fib.c:991
> fib6_add+0x2e12/0x3290 net/ipv6/ip6_fib.c:991 net/ipv6/ip6_fib.c:991
> Kernel panic - not syncing: panic_on_warn set ...
again panic_on_warn is triggering ...
>
> CPU: 2 PID: 3990 Comm: kworker/2:4 Not tainted 4.11.0-rc1+ #311
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
> Workqueue: ipv6_addrconf addrconf_dad_work
> Call Trace:
> __dump_stack lib/dump_stack.c:16 [inline]
> __dump_stack lib/dump_stack.c:16 [inline] lib/dump_stack.c:52
> dump_stack+0x2fb/0x3fd lib/dump_stack.c:52 lib/dump_stack.c:52
> panic+0x20f/0x426 kernel/panic.c:180 kernel/panic.c:180
> __warn+0x1c4/0x1e0 kernel/panic.c:541 kernel/panic.c:541
> warn_slowpath_null+0x2c/0x40 kernel/panic.c:584 kernel/panic.c:584
> fib6_add+0x2e12/0x3290 net/ipv6/ip6_fib.c:991 net/ipv6/ip6_fib.c:991
on this warning:
/* dst.next really should not be set at this point */
if (rt->dst.next && rt->dst.next->ops->family != AF_INET6) {
pr_warn("fib6_add: adding rt with bad next -- family %d dst
flags %x\n",
rt->dst.next->ops->family, rt->dst.next->flags);
WARN_ON(1);
}
You should have seen the pr_warn in the log preceding the WARN_ON dump.
> __ip6_ins_rt+0x60/0x80 net/ipv6/route.c:948 net/ipv6/route.c:948
> ip6_ins_rt+0x19b/0x220 net/ipv6/route.c:959 net/ipv6/route.c:959
> __ipv6_ifa_notify+0x62e/0x7a0 net/ipv6/addrconf.c:5485 net/ipv6/addrconf.c:5485
> ipv6_ifa_notify+0xdf/0x1d0 net/ipv6/addrconf.c:5518 net/ipv6/addrconf.c:5518
> addrconf_dad_completed+0xe6/0x950 net/ipv6/addrconf.c:3983
> net/ipv6/addrconf.c:3983
> addrconf_dad_begin net/ipv6/addrconf.c:3797 [inline]
> addrconf_dad_begin net/ipv6/addrconf.c:3797 [inline] net/ipv6/addrconf.c:3897
> addrconf_dad_work+0x32a/0xea0 net/ipv6/addrconf.c:3897 net/ipv6/addrconf.c:3897
> process_one_work+0xc06/0x1c40 kernel/workqueue.c:2096 kernel/workqueue.c:2096
> worker_thread+0x223/0x19f0 kernel/workqueue.c:2230 kernel/workqueue.c:2230
> kthread+0x334/0x400 kernel/kthread.c:229 kernel/kthread.c:229
> ret_from_fork+0x31/0x40 arch/x86/entry/entry_64.S:430
> arch/x86/entry/entry_64.S:430
>
>
>
> And this without any preceding warnings:
>
> ==================================================================
> BUG: KASAN: slab-out-of-bounds in fib6_age+0x3fd/0x480
> net/ipv6/ip6_fib.c:1787 at addr ffff88004d4fbe54
another ipv4 route in ipv6 fib walk
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
net: heap out-of-bounds in fib6_clean_node/rt6_fill_node/fib6_age/fib6_prune_clone Dmitry Vyukov <dvyukov@google.com> - 2017-03-03 18:40 +0100
Re: net: heap out-of-bounds in fib6_clean_node/rt6_fill_node/fib6_age/fib6_prune_clone Dmitry Vyukov <dvyukov@google.com> - 2017-03-03 20:20 +0100
Re: net: heap out-of-bounds in fib6_clean_node/rt6_fill_node/fib6_age/fib6_prune_clone David Ahern <dsa@cumulusnetworks.com> - 2017-03-03 20:50 +0100
Re: net: heap out-of-bounds in fib6_clean_node/rt6_fill_node/fib6_age/fib6_prune_clone Dmitry Vyukov <dvyukov@google.com> - 2017-03-04 20:00 +0100
Re: net: heap out-of-bounds in fib6_clean_node/rt6_fill_node/fib6_age/fib6_prune_clone Dmitry Vyukov <dvyukov@google.com> - 2017-03-04 20:10 +0100
Re: net: heap out-of-bounds in fib6_clean_node/rt6_fill_node/fib6_age/fib6_prune_clone Eric Dumazet <eric.dumazet@gmail.com> - 2017-03-04 21:20 +0100
Re: net: heap out-of-bounds in fib6_clean_node/rt6_fill_node/fib6_age/fib6_prune_clone Dmitry Vyukov <dvyukov@google.com> - 2017-03-05 12:00 +0100
Re: net: heap out-of-bounds in fib6_clean_node/rt6_fill_node/fib6_age/fib6_prune_clone David Ahern <dsa@cumulusnetworks.com> - 2017-03-06 18:40 +0100
Re: net: heap out-of-bounds in fib6_clean_node/rt6_fill_node/fib6_age/fib6_prune_clone Dmitry Vyukov <dvyukov@google.com> - 2017-03-06 20:00 +0100
Re: net: heap out-of-bounds in fib6_clean_node/rt6_fill_node/fib6_age/fib6_prune_clone David Ahern <dsa@cumulusnetworks.com> - 2017-03-07 01:00 +0100
Re: net: heap out-of-bounds in fib6_clean_node/rt6_fill_node/fib6_age/fib6_prune_clone Dmitry Vyukov <dvyukov@google.com> - 2017-03-07 09:50 +0100
Re: net: heap out-of-bounds in fib6_clean_node/rt6_fill_node/fib6_age/fib6_prune_clone Dmitry Vyukov <dvyukov@google.com> - 2017-03-07 11:30 +0100
Re: net: heap out-of-bounds in fib6_clean_node/rt6_fill_node/fib6_age/fib6_prune_clone Dmitry Vyukov <dvyukov@google.com> - 2017-03-07 19:20 +0100
Re: net: heap out-of-bounds in fib6_clean_node/rt6_fill_node/fib6_age/fib6_prune_clone David Ahern <dsa@cumulusnetworks.com> - 2017-03-07 19:50 +0100
Re: net: heap out-of-bounds in fib6_clean_node/rt6_fill_node/fib6_age/fib6_prune_clone Dmitry Vyukov <dvyukov@google.com> - 2017-03-07 20:20 +0100
Re: net: heap out-of-bounds in fib6_clean_node/rt6_fill_node/fib6_age/fib6_prune_clone Dmitry Vyukov <dvyukov@google.com> - 2017-03-07 20:50 +0100
Re: net: heap out-of-bounds in fib6_clean_node/rt6_fill_node/fib6_age/fib6_prune_clone Dmitry Vyukov <dvyukov@google.com> - 2017-03-07 21:10 +0100
Re: net: heap out-of-bounds in fib6_clean_node/rt6_fill_node/fib6_age/fib6_prune_clone Dmitry Vyukov <dvyukov@google.com> - 2017-03-08 13:30 +0100
Re: net: heap out-of-bounds in fib6_clean_node/rt6_fill_node/fib6_age/fib6_prune_clone David Ahern <dsa@cumulusnetworks.com> - 2017-03-08 05:50 +0100
Re: net: heap out-of-bounds in fib6_clean_node/rt6_fill_node/fib6_age/fib6_prune_clone Dmitry Vyukov <dvyukov@google.com> - 2017-03-07 18:50 +0100
Re: net: heap out-of-bounds in fib6_clean_node/rt6_fill_node/fib6_age/fib6_prune_clone David Ahern <dsa@cumulusnetworks.com> - 2017-03-07 18:50 +0100
Re: net: heap out-of-bounds in fib6_clean_node/rt6_fill_node/fib6_age/fib6_prune_clone David Ahern <dsa@cumulusnetworks.com> - 2017-03-07 19:30 +0100
csiph-web