linux-kernel - Re: Kernel crash on startup - bisected to commit 3b24d854cb35

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <CANn89iJ6sfeNgB4BBmAw5SewqSHe_50+6POLJn=fhTDnNcY6kQ@mail.gmail.com>
Date:	Fri, 8 Apr 2016 22:33:25 -0700
From:	Eric Dumazet <edumazet@...gle.com>
To:	Larry Finger <Larry.Finger@...inger.net>
Cc:	"David S. Miller" <davem@...emloft.net>,
	linux-next <linux-next@...r.kernel.org>,
	linux-netdev@...r.kernel.org, LKML <linux-kernel@...r.kernel.org>
Subject: Re: Kernel crash on startup - bisected to commit 3b24d854cb35

On Fri, Apr 8, 2016 at 10:28 PM, Larry Finger <Larry.Finger@...inger.net> wrote:
> Following a recent pull of the wireless-drivers-next repo. my system got a
> kernel panic on startup at native_apic_msr_write+0x27. The problem was
> bisected to commit 3b24d854cb35 ("tcp/dccp: do not touch listener sk_refcnt
> under synflood"). I am confident of the bisection as a kernel built with the
> previous commit (3a5d1c0) boots OK.
>
> I have not yet captured the entire traceback for the crash, but I do have a
> crappy photo of the screen that I have attached. The RIP is at
> native_apic_msr_write+0x27. As this crash is likely configuration dependent,
> a copy of my .config is also attached. Note that IPv6 is turned off on my
> machine.
>
> Please let me know if any other info is needed.

Can you double check you have this fix ?

commit 8501786929de4616b10b8059ad97abd304a7dddf
Author: Eric Dumazet <edumazet@...gle.com>
Date:   Wed Apr 6 22:07:34 2016 -0700

    tcp/dccp: fix inet_reuseport_add_sock()

    David Ahern reported panics in __inet_hash() caused by my recent commit.

    The reason is inet_reuseport_add_sock() was still using
    sk_nulls_for_each_rcu() instead of sk_for_each_rcu().
    SO_REUSEPORT enabled listeners were causing an instant crash.

    While chasing this bug, I found that I forgot to clear SOCK_RCU_FREE
    flag, as it is inherited from the parent at clone time.

    Fixes: 3b24d854cb35 ("tcp/dccp: do not touch listener sk_refcnt
under synflood")
    Signed-off-by: Eric Dumazet <edumazet@...gle.com>
    Reported-by: David Ahern <dsa@...ulusnetworks.com>
    Tested-by: David Ahern <dsa@...ulusnetworks.com>
    Signed-off-by: David S. Miller <davem@...emloft.net>