netdev - Re: Kernel panic when using bridge

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 12 Apr 2011 09:31:09 +0200
From:	Eric Dumazet <eric.dumazet@...il.com>
To:	Scot Doyle <lkml@...tdoyle.com>
Cc:	Stephen Hemminger <shemminger@...tta.com>,
	Hiroaki SHIMODA <shimoda.hiroaki@...il.com>,
	netdev@...r.kernel.org
Subject: Re: Kernel panic when using bridge

Le mardi 12 avril 2011 à 02:02 -0500, Scot Doyle a écrit :
> On 04/12/2011 12:51 AM, Eric Dumazet wrote:
> >
> > Oh well, sorry (not enough time these days to even test patches)
> >
> > 	if (!skb_dst(skb)) {
> 
> --- br_netfilter.c.a    2011-04-01 02:37:53.000000000 -0500
> +++ br_netfilter.c.b    2011-04-12 00:29:00.000000000 -0500
> @@ -221,6 +221,7 @@ static int br_parse_ip_options(struct sk
>       struct ip_options *opt;
>       struct iphdr *iph;
>       struct net_device *dev = skb->dev;
> +    struct rtable *rt;
>       u32 len;
> 
>       iph = ip_hdr(skb);
> @@ -255,6 +256,16 @@ static int br_parse_ip_options(struct sk
>           return 0;
>       }
> 
> +    /* Associate bogus bridge route table */
> +    if (!skb_dst(skb)) {
> +        rt = bridge_parent_rtable(dev);
> +        if (!rt) {
> +            kfree_skb(skb);
> +            return 0;
> +        }
> +        skb_dst_set_noref(skb,&rt->dst);
> +    }
> +
>       opt->optlen = iph->ihl*4 - sizeof(struct iphdr);
>       if (ip_options_compile(dev_net(dev), opt, skb))
>           goto inhdr_error;
> 
> 
> Now we are making progress! With the patch above from Stephen and Eric, 
> I cannot make the kernel panic when sending packets to the IP address of 
> the bridge.
> 
> However, if a guest virtual machine is sharing the bridge with the host 
> via a tap device, I can cause a host panic by targeting the IP address 
> of the guest. Is this an unrelated problem?
> 
> Here are two kernel panics. The guest virtual machine was pingable 
> before being attacked with IP Stack Checker's tcpsic command. Spanning 
> Tree Protocol was off during the first panic and on during the second.
> 


I wonder if you are not running out of free stack space...

And it might be because of inet_getpeer() calling cleanup_once()

# objdump64 -d net/ipv4/inetpeer.o | scripts/checkstack.pl
0x0317 cleanup_once [inetpeer.o]:			344
0x03d6 cleanup_once [inetpeer.o]:			344
0x0680 inet_getpeer [inetpeer.o]:			344
0x071d inet_getpeer [inetpeer.o]:			344
0x0004 inet_initpeers [inetpeer.o]:			112


--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html