netdev - Crash in network stack

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:	Wed, 6 Jun 2012 02:28:01 +0000
From:	"Naveen B N (nbn)" <nbn@...co.com>
To:	"ipsec-tools-devel@...ts.sourceforge.net" 
	<ipsec-tools-devel@...ts.sourceforge.net>,
	"netdev@...r.kernel.org" <netdev@...r.kernel.org>
Subject: Crash in network stack

Hi All
I am trying to edit esp flow in kernel , I have edited the ip_rcv() , just to avoid xfrm look up
For ipsec processing I have a simple database for storing xfrm_state values.
In ip_rcv() I have decrypted the ESP packet and I am calling netif_rx(skb) , I am successfully 
Able to receive the packet in user space , where the user application is listening on Inner Ip 
Address. But kernel crashes if I send multiple packets . 
I am unable to figure out this , I am using  user mode kernel, host linux is 2.6.34 version, 
Same code base is used to build UML kernel, x86. 

I am attaching the net/ipv4/ip_input.c file , Please help me to figure out this crash.

Kernel panic - not syncing: Kernel mode signal 4
0823c748:  [<081beb4b>] dump_stack+0x1c/0x20
0823c760:  [<081beb84>] panic+0x35/0x9d
0823c788:  [<0805a107>] relay_signal+0x31/0x6c
0823c7a8:  [<08065a9a>] sig_handler_common+0x61/0x70
0823c820:  [<08065bc2>] sig_handler+0x31/0x3d
0823c82c:  [<08065d5b>] handle_signal+0x4f/0x7d
0823c84c:  [<080673f7>] hard_handler+0xf/0x14
0823c85c:  [<b783d400>] 0xb783d400
0823cb7c:  [<080b3772>] __kmalloc+0x70/0x9c
0823cb9c:  [<0816b95d>] __alloc_skb+0x52/0x11c
0823cbc8:  [<0816c344>] dev_alloc_skb+0x15/0x2c
0823cbe0:  [<0805e871>] uml_net_rx+0x19/0x9e
0823cbfc:  [<0805e9d9>] uml_net_interrupt+0x16/0x5c
0823cc08:  [<080947d0>] handle_IRQ_event+0x20/0xa7
0823cc24:  [<080948aa>] __do_IRQ+0x53/0x93
0823cc40:  [<080581a8>] do_IRQ+0x1f/0x34
0823cc50:  [<08058340>] sigio_handler+0x46/0x5c
0823cc68:  [<08065a9a>] sig_handler_common+0x61/0x70
0823cce0:  [<08065bc2>] sig_handler+0x31/0x3d
0823ccec:  [<08065d5b>] handle_signal+0x4f/0x7d
0823cd0c:  [<080673f7>] hard_handler+0xf/0x14
0823cd1c:  [<b783d400>] 0xb783d400



EIP: 0073:[<b7723861>] CPU: 0 Tainted: P           ESP: 007b:bfe1cbfc EFLAGS: 00000246
    Tainted: P
EAX: 00000000 EBX: 00006222 ECX: 00000013 EDX: 00006222
ESI: 0000621e EDI: 0000001c EBP: bfe1cc18 DS: 007b ES: 007b
0823c6f8:  [<0806aae7>] show_regs+0xc4/0xc9
0823c724:  [<0805a70a>] panic_exit+0x25/0x3b
0823c738:  [<08086063>] notifier_call_chain+0x27/0x4c
0823c760:  [<080860b6>] atomic_notifier_call_chain+0x15/0x17
0823c770:  [<081beb9f>] panic+0x50/0x9d
0823c788:  [<0805a107>] relay_signal+0x31/0x6c
0823c7a8:  [<08065a9a>] sig_handler_common+0x61/0x70
0823c820:  [<08065bc2>] sig_handler+0x31/0x3d
0823c82c:  [<08065d5b>] handle_signal+0x4f/0x7d
0823c84c:  [<080673f7>] hard_handler+0xf/0x14
0823c85c:  [<b783d400>] 0xb783d400
0823cb7c:  [<080b3772>] __kmalloc+0x70/0x9c
0823cb9c:  [<0816b95d>] __alloc_skb+0x52/0x11c
0823cbc8:  [<0816c344>] dev_alloc_skb+0x15/0x2c
0823cbe0:  [<0805e871>] uml_net_rx+0x19/0x9e
0823cbfc:  [<0805e9d9>] uml_net_interrupt+0x16/0x5c
0823cc08:  [<080947d0>] handle_IRQ_event+0x20/0xa7
0823cc24:  [<080948aa>] __do_IRQ+0x53/0x93
0823cc40:  [<080581a8>] do_IRQ+0x1f/0x34
0823cc50:  [<08058340>] sigio_handler+0x46/0x5c
0823cc68:  [<08065a9a>] sig_handler_common+0x61/0x70
0823cce0:  [<08065bc2>] sig_handler+0x31/0x3d
0823ccec:  [<08065d5b>] handle_signal+0x4f/0x7d
0823cd0c:  [<080673f7>] hard_handler+0xf/0x14
0823cd1c:  [<b783d400>] 0xb783d400


Thanks and Regards
Naveen

View attachment "ip_input.c" of type "text/plain" (24045 bytes)