Date:   Mon, 13 Nov 2017 18:23:05 +0200
From:   Tommi Rantala <tommi.t.rantala@...ia.com>
To:     Jon Maloy <jon.maloy@...csson.com>,
        Ying Xue <ying.xue@...driver.com>,
        "David S. Miller" <davem@...emloft.net>, netdev@...r.kernel.org,
        tipc-discussion@...ts.sourceforge.net, linux-kernel@...r.kernel.org
Subject: tipc_udp_send_msg oops in 4.4 when setting link tolerance

Hi,

I always get an instant TIPC oops in 4.4, when I try to set the link 
tolerance (with LINKNAME != "broadcast-link"):

  $ tipc link set tolerance 1000 link $LINKNAME

Any idea what's going on? Some tipc patch missing in 4.4?

In 4.9 the "tipc" command executes just fine, but I've seen a few times 
that later some random process crashes with "BUG: Bad page state". KASAN 
does not report anything before it happens.

4.14 is OK, could not reproduce these problems with it.




tipc_udp_send_msg+0x102/0x4f0

matches to:
tipc_udp_send_msg at linux-stable/net/tipc/udp_media.c:172

static int tipc_udp_send_msg(struct net *net, struct sk_buff *skb,
                              struct tipc_bearer *b,
                              struct tipc_media_addr *dest)
{
         int ttl, err = 0;
         struct udp_bearer *ub;
         struct udp_media_addr *dst = (struct udp_media_addr *)&dest->value;
         struct udp_media_addr *src = (struct udp_media_addr 
*)&b->addr.value;
         struct rtable *rt;

         if (skb_headroom(skb) < UDP_MIN_HEADROOM) {
                 err = pskb_expand_head(skb, UDP_MIN_HEADROOM, 0, 
GFP_ATOMIC);
                 if (err)
                         goto tx_error;
         }

         skb_set_inner_protocol(skb, htons(ETH_P_TIPC));
         ub = rcu_dereference_rtnl(b->media_ptr);
         if (!ub) {
                 err = -ENODEV;
                 goto tx_error;
         }
         if (dst->proto == htons(ETH_P_IP)) {   <------ HERE



[  111.423647] 
==================================================================
[  111.424826] BUG: KASAN: null-ptr-deref on address           (null)
[  111.425538] Read of size 2 by task tipc/2643
[  111.426215] CPU: 3 PID: 2643 Comm: tipc Not tainted 4.4.97-pc64 #1
[  111.428081]  0000000000000000 ffff880026327478 ffffffff8248005e 
0000000000000002
[  111.429476]  ffff880047ad5ac0 ffff8800263274f8 ffffffff8227f5af 
0000000265711040
[  111.430728]  0000000000000000 0000000000000297 ffffffffa0387fd2 
02090220ffffffff
[  111.432051] Call Trace:
[  111.432472]  [<ffffffff8248005e>] dump_stack+0x86/0xc8
[  111.433208]  [<ffffffff8227f5af>] kasan_report.part.2+0x41f/0x520
[  111.434040]  [<ffffffffa0387fd2>] ? tipc_udp_send_msg+0x102/0x4f0 [tipc]
[  111.434908]  [<ffffffff8227f965>] kasan_report+0x25/0x30
[  111.435647]  [<ffffffff8227e3a6>] __asan_load2+0x66/0x70
[  111.436391]  [<ffffffffa0387fd2>] tipc_udp_send_msg+0x102/0x4f0 [tipc]
[  111.437334]  [<ffffffff8227eb1e>] ? kasan_kmalloc+0x5e/0x70
[  111.438301]  [<ffffffff8227edfd>] ? kasan_slab_alloc+0xd/0x10
[  111.439328]  [<ffffffff8227e04c>] ? 
__kmalloc_node_track_caller+0xac/0x230
[  111.440493]  [<ffffffff8227eb1e>] ? kasan_kmalloc+0x5e/0x70
[  111.441479]  [<ffffffffa0387ed0>] ? tipc_udp_disable+0xe0/0xe0 [tipc]
[  111.442628]  [<ffffffff8227eb1e>] ? kasan_kmalloc+0x5e/0x70
[  111.443598]  [<ffffffff8227ef52>] ? kasan_krealloc+0x62/0x80
[  111.444610]  [<ffffffff8227ebf8>] ? memset+0x28/0x30
[  111.445539]  [<ffffffff8275fab3>] ? __alloc_skb+0x2b3/0x310
[  111.446560]  [<ffffffff8275f800>] ? skb_complete_tx_timestamp+0x110/0x110
[  111.447695]  [<ffffffff82147a16>] ? __module_text_address+0x16/0xa0
[  111.448735]  [<ffffffff8275e3fb>] ? skb_put+0x8b/0xd0
[  111.449608]  [<ffffffff8227ec76>] ? memcpy+0x36/0x40
[  111.450524]  [<ffffffffa03665e8>] ? 
tipc_link_build_proto_msg+0x398/0x4c0 [tipc]
[  111.451946]  [<ffffffffa0364920>] tipc_bearer_xmit_skb+0xa0/0xb0 [tipc]
[  111.453078]  [<ffffffffa036a60b>] tipc_link_proto_xmit+0x11b/0x160 [tipc]
[  111.454218]  [<ffffffffa036a4f0>] ? 
tipc_link_build_reset_msg+0x50/0x50 [tipc]
[  111.455542]  [<ffffffffa036c5be>] tipc_nl_link_set+0x1ee/0x3b0 [tipc]
[  111.456659]  [<ffffffffa036c3d0>] ? tipc_nl_parse_link_prop+0xd0/0xd0 
[tipc]
[  111.457831]  [<ffffffff82190a29>] ? is_ftrace_trampoline+0x59/0x90
[  111.458884]  [<ffffffff820b15a5>] ? __kernel_text_address+0x65/0x80
[  111.459931]  [<ffffffff824ba386>] ? nla_parse+0xb6/0x140
[  111.460892]  [<ffffffff827d20ee>] genl_family_rcv_msg+0x37e/0x5e0
[  111.461948]  [<ffffffffa0380005>] ? set_orig_addr.isra.53+0xe5/0x120 
[tipc]
[  111.463107]  [<ffffffff827d1d70>] ? genl_rcv+0x40/0x40
[  111.463987]  [<ffffffff82278864>] ? alloc_debug_processing+0x154/0x180
[  111.465048]  [<ffffffff8227a39d>] ? ___slab_alloc+0x43d/0x460
[  111.465986]  [<ffffffff82278864>] ? alloc_debug_processing+0x154/0x180
[  111.467045]  [<ffffffff827cde5c>] ? netlink_lookup+0x19c/0x220
[  111.468067]  [<ffffffff827d2428>] genl_rcv_msg+0xd8/0x110
[  111.468994]  [<ffffffff827d143b>] netlink_rcv_skb+0x14b/0x180
[  111.469939]  [<ffffffff827d2350>] ? genl_family_rcv_msg+0x5e0/0x5e0
[  111.470954]  [<ffffffff827d1d58>] genl_rcv+0x28/0x40
[  111.471798]  [<ffffffff827d0a27>] netlink_unicast+0x2e7/0x3a0
[  111.472806]  [<ffffffff827d0740>] ? netlink_attachskb+0x330/0x330
[  111.473845]  [<ffffffff8249b731>] ? copy_from_iter+0xf1/0x3b0
[  111.474847]  [<ffffffff827d0f8d>] netlink_sendmsg+0x4ad/0x620
[  111.475788]  [<ffffffff827d0ae0>] ? netlink_unicast+0x3a0/0x3a0
[  111.476793]  [<ffffffff822c0683>] ? __fdget+0x13/0x20
[  111.477723]  [<ffffffff82751575>] ? sockfd_lookup_light+0x95/0xb0
[  111.478773]  [<ffffffff827538fc>] SYSC_sendto+0x1bc/0x290
[  111.479659]  [<ffffffff82753740>] ? sock_write_iter+0x200/0x200
[  111.480692]  [<ffffffff822c0683>] ? __fdget+0x13/0x20
[  111.481559]  [<ffffffff82751575>] ? sockfd_lookup_light+0x95/0xb0
[  111.482591]  [<ffffffff827caf71>] ? netlink_getname+0xb1/0x110
[  111.483570]  [<ffffffff82750b0c>] ? move_addr_to_user+0x5c/0x70
[  111.484539]  [<ffffffff82751706>] ? SYSC_getsockname+0x176/0x190
[  111.485540]  [<ffffffff82751590>] ? sockfd_lookup_light+0xb0/0xb0
[  111.486558]  [<ffffffff82753225>] ? SYSC_bind+0xe5/0x180
[  111.487548]  [<ffffffff82753140>] ? __sock_recv_ts_and_drops+0x260/0x260
[  111.488700]  [<ffffffff822c132b>] ? fd_install+0x3b/0x50
[  111.489596]  [<ffffffff827514b4>] ? sock_map_fd+0x44/0x70
[  111.490553]  [<ffffffff82753f4c>] ? SyS_socket+0xcc/0x120
[  111.491437]  [<ffffffff82753e80>] ? move_addr_to_kernel+0x40/0x40
[  111.492505]  [<ffffffff820022b6>] ? exit_to_usermode_loop+0x86/0x120
[  111.493557]  [<ffffffff82002017>] ? trace_hardirqs_on_thunk+0x17/0x19
[  111.494629]  [<ffffffff827544ce>] SyS_sendto+0xe/0x10
[  111.495588]  [<ffffffff829299ae>] entry_SYSCALL_64_fastpath+0x12/0x6d
[  111.496697] 
==================================================================
[  111.498005] Disabling lock debugging due to kernel taint
[  111.499059] BUG: unable to handle kernel NULL pointer dereference at 
          (null)
[  111.500698] IP: [<ffffffffa0387fd2>] tipc_udp_send_msg+0x102/0x4f0 [tipc]
[  111.502027] PGD 4b01c067 PUD 1f0a5067 PMD 0
[  111.503053] Oops: 0000 [#1] SMP KASAN
[  111.503980] Modules linked in: ip6table_mangle ip6_tables 
iptable_mangle iptable_filter ip_tables x_tables tipc ip6_udp_tunnel 
udp_tunnel fuse isofs aesni_intel aes_x86_64 glue_helper lrw gf128mul 
ablk_helper cryptd ata_piix i6300esb sch_fq_codel 
nf_conntrack_proto_sctp nf_conntrack autofs4
[  111.509927] CPU: 3 PID: 2643 Comm: tipc Tainted: G    B 
4.4.97-pc64 #1
[  111.511249] Hardware name: Fedora Project OpenStack Nova, BIOS 
seabios-1.7.5-11.el7.tis.1 04/01/2014
[  111.512935] task: ffff880047ad5ac0 ti: ffff880026320000 task.ti: 
ffff880026320000
[  111.514283] RIP: 0010:[<ffffffffa0387fd2>]  [<ffffffffa0387fd2>] 
tipc_udp_send_msg+0x102/0x4f0 [tipc]
[  111.515960] RSP: 0018:ffff880026327528  EFLAGS: 00010292
[  111.516832] RAX: ffff880047ad5ac0 RBX: ffff880065711040 RCX: 
0000000000000000
[  111.517992] RDX: 1ffffffff06b9196 RSI: 0000000000000297 RDI: 
0000000000000297
[  111.519117] RBP: ffff8800263276f0 R08: 0000000000000000 R09: 
fffffbfff069f014
[  111.520228] R10: dffffc0000000001 R11: ffff88006bc02a00 R12: 
1ffff10004c64eb1
[  111.521361] R13: ffff88005ad07750 R14: 0000000000000000 R15: 
ffff88005154d9e0
[  111.522538] FS:  00007f467f3ac700(0000) GS:ffff88006c380000(0000) 
knlGS:0000000000000000
[  111.523960] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  111.524947] CR2: 0000000000000000 CR3: 000000001f076000 CR4: 
00000000001406e0
[  111.526084] Stack:
[  111.526551]  1ffff1000a2c11d8 ffff880026327550 ffffffff8227eb1e 
ffff880051608cc0
[  111.528272]  ffff88006bc02a00 ffff880026327560 ffffffff8227edfd 
ffff8800263275b0
[  111.529886]  ffffffff8227e04c ffff880026327590 ffffffff8227eb1e 
ffffffff832dfec0
[  111.531535] Call Trace:
[  111.532106]  [<ffffffff8227eb1e>] ? kasan_kmalloc+0x5e/0x70
[  111.533075]  [<ffffffff8227edfd>] ? kasan_slab_alloc+0xd/0x10
[  111.534041]  [<ffffffff8227e04c>] ? 
__kmalloc_node_track_caller+0xac/0x230
[  111.535102]  [<ffffffff8227eb1e>] ? kasan_kmalloc+0x5e/0x70
[  111.536047]  [<ffffffffa0387ed0>] ? tipc_udp_disable+0xe0/0xe0 [tipc]
[  111.537186]  [<ffffffff8227eb1e>] ? kasan_kmalloc+0x5e/0x70
[  111.538139]  [<ffffffff8227ef52>] ? kasan_krealloc+0x62/0x80
[  111.539106]  [<ffffffff8227ebf8>] ? memset+0x28/0x30
[  111.539946]  [<ffffffff8275fab3>] ? __alloc_skb+0x2b3/0x310
[  111.540876]  [<ffffffff8275f800>] ? skb_complete_tx_timestamp+0x110/0x110
[  111.541954]  [<ffffffff82147a16>] ? __module_text_address+0x16/0xa0
[  111.542978]  [<ffffffff8275e3fb>] ? skb_put+0x8b/0xd0
[  111.543914]  [<ffffffff8227ec76>] ? memcpy+0x36/0x40
[  111.544817]  [<ffffffffa03665e8>] ? 
tipc_link_build_proto_msg+0x398/0x4c0 [tipc]
[  111.546199]  [<ffffffffa0364920>] tipc_bearer_xmit_skb+0xa0/0xb0 [tipc]
[  111.547355]  [<ffffffffa036a60b>] tipc_link_proto_xmit+0x11b/0x160 [tipc]
[  111.548482]  [<ffffffffa036a4f0>] ? 
tipc_link_build_reset_msg+0x50/0x50 [tipc]
[  111.549763]  [<ffffffffa036c5be>] tipc_nl_link_set+0x1ee/0x3b0 [tipc]
[  111.550822]  [<ffffffffa036c3d0>] ? tipc_nl_parse_link_prop+0xd0/0xd0 
[tipc]
[  111.551921]  [<ffffffff82190a29>] ? is_ftrace_trampoline+0x59/0x90
[  111.552961]  [<ffffffff820b15a5>] ? __kernel_text_address+0x65/0x80
[  111.554010]  [<ffffffff824ba386>] ? nla_parse+0xb6/0x140
[  111.554906]  [<ffffffff827d20ee>] genl_family_rcv_msg+0x37e/0x5e0
[  111.555954]  [<ffffffffa0380005>] ? set_orig_addr.isra.53+0xe5/0x120 
[tipc]
[  111.557104]  [<ffffffff827d1d70>] ? genl_rcv+0x40/0x40
[  111.557949]  [<ffffffff82278864>] ? alloc_debug_processing+0x154/0x180
[  111.559030]  [<ffffffff8227a39d>] ? ___slab_alloc+0x43d/0x460
[  111.559983]  [<ffffffff82278864>] ? alloc_debug_processing+0x154/0x180
[  111.561058]  [<ffffffff827cde5c>] ? netlink_lookup+0x19c/0x220
[  111.562038]  [<ffffffff827d2428>] genl_rcv_msg+0xd8/0x110
[  111.562966]  [<ffffffff827d143b>] netlink_rcv_skb+0x14b/0x180
[  111.563930]  [<ffffffff827d2350>] ? genl_family_rcv_msg+0x5e0/0x5e0
[  111.564949]  [<ffffffff827d1d58>] genl_rcv+0x28/0x40
[  111.565818]  [<ffffffff827d0a27>] netlink_unicast+0x2e7/0x3a0
[  111.566759]  [<ffffffff827d0740>] ? netlink_attachskb+0x330/0x330
[  111.567765]  [<ffffffff8249b731>] ? copy_from_iter+0xf1/0x3b0
[  111.568707]  [<ffffffff827d0f8d>] netlink_sendmsg+0x4ad/0x620
[  111.569706]  [<ffffffff827d0ae0>] ? netlink_unicast+0x3a0/0x3a0
[  111.570658]  [<ffffffff822c0683>] ? __fdget+0x13/0x20
[  111.571548]  [<ffffffff82751575>] ? sockfd_lookup_light+0x95/0xb0
[  111.572541]  [<ffffffff827538fc>] SYSC_sendto+0x1bc/0x290
[  111.573459]  [<ffffffff82753740>] ? sock_write_iter+0x200/0x200
[  111.574435]  [<ffffffff822c0683>] ? __fdget+0x13/0x20
[  111.575330]  [<ffffffff82751575>] ? sockfd_lookup_light+0x95/0xb0
[  111.576354]  [<ffffffff827caf71>] ? netlink_getname+0xb1/0x110
[  111.577371]  [<ffffffff82750b0c>] ? move_addr_to_user+0x5c/0x70
[  111.578385]  [<ffffffff82751706>] ? SYSC_getsockname+0x176/0x190
[  111.579407]  [<ffffffff82751590>] ? sockfd_lookup_light+0xb0/0xb0
[  111.580431]  [<ffffffff82753225>] ? SYSC_bind+0xe5/0x180
[  111.581369]  [<ffffffff82753140>] ? __sock_recv_ts_and_drops+0x260/0x260
[  111.582518]  [<ffffffff822c132b>] ? fd_install+0x3b/0x50
[  111.583450]  [<ffffffff827514b4>] ? sock_map_fd+0x44/0x70
[  111.584417]  [<ffffffff82753f4c>] ? SyS_socket+0xcc/0x120
[  111.585353]  [<ffffffff82753e80>] ? move_addr_to_kernel+0x40/0x40
[  111.586405]  [<ffffffff820022b6>] ? exit_to_usermode_loop+0x86/0x120
[  111.587434]  [<ffffffff82002017>] ? trace_hardirqs_on_thunk+0x17/0x19
[  111.588511]  [<ffffffff827544ce>] SyS_sendto+0xe/0x10
[  111.589378]  [<ffffffff829299ae>] entry_SYSCALL_64_fastpath+0x12/0x6d
[  111.590420] Code: 00 00 e8 e2 64 ef e1 4c 89 ef 80 a3 93 00 00 00 f7 
e8 43 65 ef e1 4d 8b 7d 00 4d 85 ff 0f 84 db 03 00 00 4c 89 f7 e8 6e 63 
ef e1 <66> 41 83 3e 08 0f 84 80 01 00 00 48 8d bc 24 20 01 00 00 31 c0
[  111.598579] RIP  [<ffffffffa0387fd2>] tipc_udp_send_msg+0x102/0x4f0 
[tipc]
[  111.599831]  RSP <ffff880026327528>
[  111.600538] CR2: 0000000000000000
[  111.601202] ---[ end trace 827dd66f798de44a ]---
[  111.602025] Kernel panic - not syncing: Fatal exception in interrupt
[  111.614704] Kernel Offset: disabled
[  111.615249] Rebooting in 60 seconds..





[   31.985039] BUG: Bad page state in process ___ pfn:400c0
[   31.985680] page:ffffea0001003000 count:0 mapcount:0 
mapping:000000000000003c index:0x0
[   31.986619] flags: 0x10000(mappedtodisk)
[   31.987081] page dumped because: PAGE_FLAGS_CHECK_AT_PREP flag set
[   31.987701] bad because of flags: 0x10000(mappedtodisk)
[   31.988268] Modules linked in: iptable_filter ip_tables x_tables tipc ...
[   31.991804] CPU: 3 PID: 2716 Not tainted 4.9.52 #1
[   31.993608]  ffffc90003023b28 ffffffff822ee180 ffffea0001003000 
ffffffff827b76c8
[   31.994792]  ffffc90003023b50 ffffffff8215c5e4 0000000000010000 
ffffea0001000000
[   31.995986]  0000000000000009 ffffc90003023b60 ffffffff8215c71f 
ffffc90003023c28
[   31.997380] Call Trace:
[   31.997780]  [<ffffffff822ee180>] dump_stack+0x86/0xc6
[   31.998460]  [<ffffffff8215c5e4>] bad_page+0xc4/0x130
[   31.999160]  [<ffffffff8215c71f>] check_new_page_bad+0x5f/0x70
[   31.999968]  [<ffffffff8215fe5a>] get_page_from_freelist+0x7ca/0xb20
[   32.000782]  [<ffffffff8216123c>] __alloc_pages_nodemask+0xdc/0x220
[   32.001621]  [<ffffffff821a4c18>] alloc_fresh_huge_page+0x68/0xc0
[   32.002407]  [<ffffffff821a590f>] set_max_huge_pages+0x4df/0x530
[   32.003176]  [<ffffffff8230698c>] ? _kstrtoull+0x2c/0x70
[   32.003841]  [<ffffffff821a59ec>] nr_hugepages_store_common+0x8c/0xf0
[   32.004619]  [<ffffffff821c2626>] ? mem_cgroup_commit_charge+0x66/0x430
[   32.005384]  [<ffffffff821a5a83>] nr_hugepages_store+0x13/0x20
[   32.006176]  [<ffffffff822f02bf>] kobj_attr_store+0xf/0x20
[   32.006838]  [<ffffffff82237877>] sysfs_kf_write+0x37/0x40
[   32.007534]  [<ffffffff82236bcc>] kernfs_fop_write+0x11c/0x1b0
[   32.008258]  [<ffffffff821c7068>] __vfs_write+0x28/0x120
[   32.008931]  [<ffffffff820fb23d>] ? __audit_syscall_entry+0xad/0xf0
[   32.009681]  [<ffffffff821c7735>] vfs_write+0xb5/0x1a0
[   32.010308]  [<ffffffff821c8a96>] SyS_write+0x46/0xa0
[   32.010917]  [<ffffffff8204b8fa>] ? trace_do_page_fault+0x5a/0x140
[   32.011741]  [<ffffffff82002bfe>] do_syscall_64+0x7e/0x1a0
[   32.012476]  [<ffffffff825dc0c4>] entry_SYSCALL64_slow_path+0x25/0x25
[   32.013244] Disabling lock debugging due to kernel taint
[   34.055994] ip6_tables: (C) 2000-2006 Netfilter Core Team


-Tommi

Powered by blists - more mailing lists