lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Thu, 22 Dec 2011 10:04:34 +0000 From: Chris Boot <bootc@...tc.net> To: Eric Dumazet <eric.dumazet@...il.com> CC: lkml <linux-kernel@...r.kernel.org>, netdev <netdev@...r.kernel.org>, Steffen Klassert <steffen.klassert@...unet.com> Subject: Re: BUG: unable to handle kernel NULL pointer dereference in ipv6_select_ident On 22/12/2011 04:37, Eric Dumazet wrote: > Le mercredi 21 décembre 2011 à 23:12 +0000, Chris Boot a écrit : >> On 21 Dec 2011, at 21:58, Chris Boot wrote: >> >>> On 21/12/2011 20:52, Eric Dumazet wrote: >>>> Le mercredi 21 décembre 2011 à 21:28 +0100, Eric Dumazet a écrit : >>>>> Le mercredi 21 décembre 2011 à 20:05 +0000, Chris Boot a écrit : >>>>>> On 21/12/2011 18:00, Eric Dumazet wrote: >>>>>>> Le mercredi 21 décembre 2011 à 18:36 +0100, Eric Dumazet a écrit : >>>>>>> >>>>>>>> Good point, thats a different problem then, since 3.1 is not supposed to >>>>>>>> have this bug. >>>>>>>> >>>>>>>> It seems rt->rt6i_peer points to invalid memory in your crash. >>>>>>>> >>>>>>>> (RBX=00000000000001f4) >>>>>>>> >>>>>>>> 8b 83 a4 00 00 00 mov 0xa4(%rbx),%eax p->refcnt >>>>>>>> 1f4+a4 -> CR2=0000000000000298 >>>>>>>> >>>>>>> It would help if you can confirm latest linux tree can reproduce the >>>>>>> bug. >>>>>> Hi Eric, >>>>>> >>>>>> I just built a v3.2-rc6-140-gb9e26df with the same config as the Debian >>>>>> 3.1.0 kernel. I can reproduce the bug just as easily with this kernel as >>>>>> with the Debian kernel. Unfortunately I wasn't able to get an entire >>>>>> trace, for some reason it didn't appear to be printed to the serial port >>>>>> and hung after the (long) list of loaded kernel modules. The crash >>>>>> happens at the same offset: >>>>>> >>>>> Thanks ! >>>>> >>>>> Oh well, br_netfilter fake_rtable strikes again. >>>>> >>>>> I'll cook a patch in a couple of minutes... >>>>> >>>> Could you try following patch ? >>>> >>>> [snip] >>> Eric, >>> >>> It looks good! The rsync that caused the crash real quick hasn't done it at all with the patch applied. I'll keep testing it of course, but I think that's done it. >> No, sorry, false hope. The following does look rather different however: >> >> [snip] > This one is different, its not IPv6 related but IPv4 : > > fake_dst_ops lacks a .mtu() field > > Bug added in commit 618f9bc74a039da76 (net: Move mtu handling down to > the protocol depended handlers) > > Here is an updated patch, thanks again ! > > [snip] Eric, So far so good. I've had this running for several hours this morning with more of the prodding that would normally have crashed it, both IPv4 and IPv6, and it's holding up well. Thanks again, Chris -- Chris Boot bootc@...tc.net -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists