linux-kernel - Re: [net/ipvs] BUG: unable to handle kernel NULL pointer dereference at 00000004

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20140612034633.GH22273@verge.net.au>
Date:	Thu, 12 Jun 2014 12:46:33 +0900
From:	Simon Horman <horms@...ge.net.au>
To:	Jet Chen <jet.chen@...el.com>
Cc:	Julian Anastasov <ja@....bg>, Wensong Zhang <wensong@...ux-vs.org>,
	Fengguang Wu <fengguang.wu@...el.com>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: [net/ipvs] BUG: unable to handle kernel NULL pointer dereference
 at 00000004

On Wed, Jun 11, 2014 at 04:34:19PM +0800, Jet Chen wrote:
> On 06/11/2014 01:59 PM, Julian Anastasov wrote:
> > 
> > 	Hello,
> > 
> > On Wed, 11 Jun 2014, Jet Chen wrote:
> > 
> >> Hi Wensong,
> >>
> >> 0day kernel testing robot got the below dmesg.
> >>
> >> +-------------------------------------------------------+----+
> >> | boot_successes                                        | 26 |
> >> | boot_failures                                         | 4  |
> >> | BUG:unable_to_handle_kernel_NULL_pointer_dereference  | 4  |
> >> | Oops                                                  | 4  |
> >> | EIP_is_at_ip_vs_stop_estimator                        | 4  |
> >> | Kernel_panic-not_syncing:Fatal_exception_in_interrupt | 4  |
> >> | backtrace:cleanup_net                                 | 4  |
> >> +-------------------------------------------------------+----+
> >>
> >>
> >> [child0:2725] process_vm_readv (347) returned ENOSYS, marking as inactive.
> >> [child0:2725] uid changed! Was: 0, now -788547075
> >> Bailing main loop. Exit reason: UID changed.
> >> [   12.182233] BUG: unable to handle kernel NULL pointer dereference at 00000004
> >> [   12.183011] IP: [<4c2f6567>] ip_vs_stop_estimator+0x20/0x3e
> >> [   12.183011] *pdpt = 0000000000000000 *pde = f000ff53f000ff53 [   12.183011] Oops: 0002 [#1] DEBUG_PAGEALLOC
> >> [   12.183011] Modules linked in:
> >> [   12.183011] CPU: 0 PID: 57 Comm: kworker/u2:1 Not tainted 3.15.0-rc8 #1
> >> [   12.183011] Workqueue: netns cleanup_net
> >> [   12.183011] task: 528773f0 ti: 52878000 task.ti: 52878000
> >> [   12.183011] EIP: 0060:[<4c2f6567>] EFLAGS: 00010206 CPU: 0
> >> [   12.183011] EIP is at ip_vs_stop_estimator+0x20/0x3e
> >> [   12.183011] EAX: 00000000 EBX: 51c39a54 ECX: 00000000 EDX: 00000000
> > 
> > 	ip_vs_stop_estimator fails at list_del(&est->list)
> > on mov %eax,0x4(%edx) instruction and EDX is 0. It means,
> > this estimator was never started (initialized with
> > INIT_LIST_HEAD in ip_vs_start_estimator) or stopped
> > before with the same list_del.
> > 
> > 	At first look, it is strange but I think the reason
> > is the missing CONFIG_SYSCTL. ip_vs_control_net_cleanup
> > fails at ip_vs_stop_estimator(net, &ipvs->tot_stats)
> > because it is called not depending on CONFIG_SYSCTL but
> > without CONFIG_SYSCTL ip_vs_start_estimator was never
> > called.
> > 
> > 	Can you test such patch?
> 
> Julian, your patch works. Thanks.
> 
> Tested-by: Jet Chen <jet.chen@...el.com>

Thanks, Julian, should I take this one?
I'm assuming this problem has been present for quite a number of releases.

> > ipvs: stop tot_stats estimator only under CONFIG_SYSCTL
> > 
> > The tot_stats estimator is started only when CONFIG_SYSCTL
> > is defined. But it is stopped without checking CONFIG_SYSCTL.
> > Fix the crash by moving ip_vs_stop_estimator into
> > ip_vs_control_net_cleanup_sysctl.
> > 
> > Signed-off-by: Julian Anastasov <ja@....bg>
> > ---
> >  net/netfilter/ipvs/ip_vs_ctl.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> > 
> > diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
> > index c42e83d..581a658 100644
> > --- a/net/netfilter/ipvs/ip_vs_ctl.c
> > +++ b/net/netfilter/ipvs/ip_vs_ctl.c
> > @@ -3778,6 +3778,7 @@ static void __net_exit ip_vs_control_net_cleanup_sysctl(struct net *net)
> >  	cancel_delayed_work_sync(&ipvs->defense_work);
> >  	cancel_work_sync(&ipvs->defense_work.work);
> >  	unregister_net_sysctl_table(ipvs->sysctl_hdr);
> > +	ip_vs_stop_estimator(net, &ipvs->tot_stats);
> >  }
> >  
> >  #else
> > @@ -3840,7 +3841,6 @@ void __net_exit ip_vs_control_net_cleanup(struct net *net)
> >  	struct netns_ipvs *ipvs = net_ipvs(net);
> >  
> >  	ip_vs_trash_cleanup(net);
> > -	ip_vs_stop_estimator(net, &ipvs->tot_stats);
> >  	ip_vs_control_net_cleanup_sysctl(net);
> >  	remove_proc_entry("ip_vs_stats_percpu", net->proc_net);
> >  	remove_proc_entry("ip_vs_stats", net->proc_net);
> > 
> 
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/