Message-ID: <AM4PR07MB1714F1520614415FEB38C60D9A2B0@AM4PR07MB1714.eurprd07.prod.outlook.com>
Date:   Mon, 13 Nov 2017 21:25:26 +0000
From:   Jon Maloy <jon.maloy@...csson.com>
To:     Tommi Rantala <tommi.t.rantala@...ia.com>,
        Ying Xue <ying.xue@...driver.com>,
        "David S. Miller" <davem@...emloft.net>,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>,
        "tipc-discussion@...ts.sourceforge.net" 
        <tipc-discussion@...ts.sourceforge.net>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: RE: tipc_udp_send_msg oops in 4.4 when setting link tolerance

Hi Tommi,
I am not sure, but is seems like the following patch is what you need:
commit 9b3009604b8e ("tipc: add net device to skb before UDP xmit")
This was applied in tipc 4.5.

Is this a stooping problem for you?

BR
///jon

> -----Original Message-----
> From: netdev-owner@...r.kernel.org [mailto:netdev-
> owner@...r.kernel.org] On Behalf Of Tommi Rantala
> Sent: Monday, November 13, 2017 11:23
> To: Jon Maloy <jon.maloy@...csson.com>; Ying Xue
> <ying.xue@...driver.com>; David S. Miller <davem@...emloft.net>;
> netdev@...r.kernel.org; tipc-discussion@...ts.sourceforge.net; linux-
> kernel@...r.kernel.org
> Subject: tipc_udp_send_msg oops in 4.4 when setting link tolerance
> 
> Hi,
> 
> I always get an instant TIPC oops in 4.4, when I try to set the link tolerance
> (with LINKNAME != "broadcast-link"):
> 
>   $ tipc link set tolerance 1000 link $LINKNAME
> 
> Any idea what's going on? Some tipc patch missing in 4.4?
> 
> In 4.9 the "tipc" command executes just fine, but I've seen a few times that
> later some random process crashes with "BUG: Bad page state". KASAN does
> not report anything before it happens.
> 
> 4.14 is OK, could not reproduce these problems with it.
> 
> 
> 
> 
> tipc_udp_send_msg+0x102/0x4f0
> 
> matches to:
> tipc_udp_send_msg at linux-stable/net/tipc/udp_media.c:172
> 
> static int tipc_udp_send_msg(struct net *net, struct sk_buff *skb,
>                               struct tipc_bearer *b,
>                               struct tipc_media_addr *dest) {
>          int ttl, err = 0;
>          struct udp_bearer *ub;
>          struct udp_media_addr *dst = (struct udp_media_addr *)&dest->value;
>          struct udp_media_addr *src = (struct udp_media_addr *)&b-
> >addr.value;
>          struct rtable *rt;
> 
>          if (skb_headroom(skb) < UDP_MIN_HEADROOM) {
>                  err = pskb_expand_head(skb, UDP_MIN_HEADROOM, 0,
> GFP_ATOMIC);
>                  if (err)
>                          goto tx_error;
>          }
> 
>          skb_set_inner_protocol(skb, htons(ETH_P_TIPC));
>          ub = rcu_dereference_rtnl(b->media_ptr);
>          if (!ub) {
>                  err = -ENODEV;
>                  goto tx_error;
>          }
>          if (dst->proto == htons(ETH_P_IP)) {   <------ HERE
> 
> 
> 
> [  111.423647]
> ==========================================================
> ========
> [  111.424826] BUG: KASAN: null-ptr-deref on address           (null)
> [  111.425538] Read of size 2 by task tipc/2643 [  111.426215] CPU: 3 PID: 2643
> Comm: tipc Not tainted 4.4.97-pc64 #1 [  111.428081]  0000000000000000
> ffff880026327478 ffffffff8248005e
> 0000000000000002
> [  111.429476]  ffff880047ad5ac0 ffff8800263274f8 ffffffff8227f5af
> 0000000265711040
> [  111.430728]  0000000000000000 0000000000000297 ffffffffa0387fd2
> 02090220ffffffff [  111.432051] Call Trace:
> [  111.432472]  [<ffffffff8248005e>] dump_stack+0x86/0xc8 [  111.433208]
> [<ffffffff8227f5af>] kasan_report.part.2+0x41f/0x520 [  111.434040]
> [<ffffffffa0387fd2>] ? tipc_udp_send_msg+0x102/0x4f0 [tipc] [  111.434908]
> [<ffffffff8227f965>] kasan_report+0x25/0x30 [  111.435647]
> [<ffffffff8227e3a6>] __asan_load2+0x66/0x70 [  111.436391]
> [<ffffffffa0387fd2>] tipc_udp_send_msg+0x102/0x4f0 [tipc] [  111.437334]
> [<ffffffff8227eb1e>] ? kasan_kmalloc+0x5e/0x70 [  111.438301]
> [<ffffffff8227edfd>] ? kasan_slab_alloc+0xd/0x10 [  111.439328]
> [<ffffffff8227e04c>] ?
> __kmalloc_node_track_caller+0xac/0x230
> [  111.440493]  [<ffffffff8227eb1e>] ? kasan_kmalloc+0x5e/0x70 [
> 111.441479]  [<ffffffffa0387ed0>] ? tipc_udp_disable+0xe0/0xe0 [tipc] [
> 111.442628]  [<ffffffff8227eb1e>] ? kasan_kmalloc+0x5e/0x70 [  111.443598]
> [<ffffffff8227ef52>] ? kasan_krealloc+0x62/0x80 [  111.444610]
> [<ffffffff8227ebf8>] ? memset+0x28/0x30 [  111.445539]  [<ffffffff8275fab3>]
> ? __alloc_skb+0x2b3/0x310 [  111.446560]  [<ffffffff8275f800>] ?
> skb_complete_tx_timestamp+0x110/0x110
> [  111.447695]  [<ffffffff82147a16>] ? __module_text_address+0x16/0xa0 [
> 111.448735]  [<ffffffff8275e3fb>] ? skb_put+0x8b/0xd0 [  111.449608]
> [<ffffffff8227ec76>] ? memcpy+0x36/0x40 [  111.450524]
> [<ffffffffa03665e8>] ?
> tipc_link_build_proto_msg+0x398/0x4c0 [tipc] [  111.451946]
> [<ffffffffa0364920>] tipc_bearer_xmit_skb+0xa0/0xb0 [tipc] [  111.453078]
> [<ffffffffa036a60b>] tipc_link_proto_xmit+0x11b/0x160 [tipc] [  111.454218]
> [<ffffffffa036a4f0>] ?
> tipc_link_build_reset_msg+0x50/0x50 [tipc] [  111.455542]
> [<ffffffffa036c5be>] tipc_nl_link_set+0x1ee/0x3b0 [tipc] [  111.456659]
> [<ffffffffa036c3d0>] ? tipc_nl_parse_link_prop+0xd0/0xd0 [tipc] [
> 111.457831]  [<ffffffff82190a29>] ? is_ftrace_trampoline+0x59/0x90 [
> 111.458884]  [<ffffffff820b15a5>] ? __kernel_text_address+0x65/0x80 [
> 111.459931]  [<ffffffff824ba386>] ? nla_parse+0xb6/0x140 [  111.460892]
> [<ffffffff827d20ee>] genl_family_rcv_msg+0x37e/0x5e0 [  111.461948]
> [<ffffffffa0380005>] ? set_orig_addr.isra.53+0xe5/0x120 [tipc] [  111.463107]
> [<ffffffff827d1d70>] ? genl_rcv+0x40/0x40 [  111.463987]
> [<ffffffff82278864>] ? alloc_debug_processing+0x154/0x180
> [  111.465048]  [<ffffffff8227a39d>] ? ___slab_alloc+0x43d/0x460 [
> 111.465986]  [<ffffffff82278864>] ? alloc_debug_processing+0x154/0x180
> [  111.467045]  [<ffffffff827cde5c>] ? netlink_lookup+0x19c/0x220 [
> 111.468067]  [<ffffffff827d2428>] genl_rcv_msg+0xd8/0x110 [  111.468994]
> [<ffffffff827d143b>] netlink_rcv_skb+0x14b/0x180 [  111.469939]
> [<ffffffff827d2350>] ? genl_family_rcv_msg+0x5e0/0x5e0 [  111.470954]
> [<ffffffff827d1d58>] genl_rcv+0x28/0x40 [  111.471798]  [<ffffffff827d0a27>]
> netlink_unicast+0x2e7/0x3a0 [  111.472806]  [<ffffffff827d0740>] ?
> netlink_attachskb+0x330/0x330 [  111.473845]  [<ffffffff8249b731>] ?
> copy_from_iter+0xf1/0x3b0 [  111.474847]  [<ffffffff827d0f8d>]
> netlink_sendmsg+0x4ad/0x620 [  111.475788]  [<ffffffff827d0ae0>] ?
> netlink_unicast+0x3a0/0x3a0 [  111.476793]  [<ffffffff822c0683>] ?
> __fdget+0x13/0x20 [  111.477723]  [<ffffffff82751575>] ?
> sockfd_lookup_light+0x95/0xb0 [  111.478773]  [<ffffffff827538fc>]
> SYSC_sendto+0x1bc/0x290 [  111.479659]  [<ffffffff82753740>] ?
> sock_write_iter+0x200/0x200 [  111.480692]  [<ffffffff822c0683>] ?
> __fdget+0x13/0x20 [  111.481559]  [<ffffffff82751575>] ?
> sockfd_lookup_light+0x95/0xb0 [  111.482591]  [<ffffffff827caf71>] ?
> netlink_getname+0xb1/0x110 [  111.483570]  [<ffffffff82750b0c>] ?
> move_addr_to_user+0x5c/0x70 [  111.484539]  [<ffffffff82751706>] ?
> SYSC_getsockname+0x176/0x190 [  111.485540]  [<ffffffff82751590>] ?
> sockfd_lookup_light+0xb0/0xb0 [  111.486558]  [<ffffffff82753225>] ?
> SYSC_bind+0xe5/0x180 [  111.487548]  [<ffffffff82753140>] ?
> __sock_recv_ts_and_drops+0x260/0x260
> [  111.488700]  [<ffffffff822c132b>] ? fd_install+0x3b/0x50 [  111.489596]
> [<ffffffff827514b4>] ? sock_map_fd+0x44/0x70 [  111.490553]
> [<ffffffff82753f4c>] ? SyS_socket+0xcc/0x120 [  111.491437]
> [<ffffffff82753e80>] ? move_addr_to_kernel+0x40/0x40 [  111.492505]
> [<ffffffff820022b6>] ? exit_to_usermode_loop+0x86/0x120 [  111.493557]
> [<ffffffff82002017>] ? trace_hardirqs_on_thunk+0x17/0x19 [  111.494629]
> [<ffffffff827544ce>] SyS_sendto+0xe/0x10 [  111.495588]
> [<ffffffff829299ae>] entry_SYSCALL_64_fastpath+0x12/0x6d
> [  111.496697]
> ==========================================================
> ========
> [  111.498005] Disabling lock debugging due to kernel taint [  111.499059]
> BUG: unable to handle kernel NULL pointer dereference at
>           (null)
> [  111.500698] IP: [<ffffffffa0387fd2>] tipc_udp_send_msg+0x102/0x4f0
> [tipc] [  111.502027] PGD 4b01c067 PUD 1f0a5067 PMD 0 [  111.503053] Oops:
> 0000 [#1] SMP KASAN [  111.503980] Modules linked in: ip6table_mangle
> ip6_tables iptable_mangle iptable_filter ip_tables x_tables tipc
> ip6_udp_tunnel udp_tunnel fuse isofs aesni_intel aes_x86_64 glue_helper
> lrw gf128mul ablk_helper cryptd ata_piix i6300esb sch_fq_codel
> nf_conntrack_proto_sctp nf_conntrack autofs4
> [  111.509927] CPU: 3 PID: 2643 Comm: tipc Tainted: G    B
> 4.4.97-pc64 #1
> [  111.511249] Hardware name: Fedora Project OpenStack Nova, BIOS
> seabios-1.7.5-11.el7.tis.1 04/01/2014
> [  111.512935] task: ffff880047ad5ac0 ti: ffff880026320000 task.ti:
> ffff880026320000
> [  111.514283] RIP: 0010:[<ffffffffa0387fd2>]  [<ffffffffa0387fd2>]
> tipc_udp_send_msg+0x102/0x4f0 [tipc]
> [  111.515960] RSP: 0018:ffff880026327528  EFLAGS: 00010292 [  111.516832]
> RAX: ffff880047ad5ac0 RBX: ffff880065711040 RCX:
> 0000000000000000
> [  111.517992] RDX: 1ffffffff06b9196 RSI: 0000000000000297 RDI:
> 0000000000000297
> [  111.519117] RBP: ffff8800263276f0 R08: 0000000000000000 R09:
> fffffbfff069f014
> [  111.520228] R10: dffffc0000000001 R11: ffff88006bc02a00 R12:
> 1ffff10004c64eb1
> [  111.521361] R13: ffff88005ad07750 R14: 0000000000000000 R15:
> ffff88005154d9e0
> [  111.522538] FS:  00007f467f3ac700(0000) GS:ffff88006c380000(0000)
> knlGS:0000000000000000
> [  111.523960] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [
> 111.524947] CR2: 0000000000000000 CR3: 000000001f076000 CR4:
> 00000000001406e0
> [  111.526084] Stack:
> [  111.526551]  1ffff1000a2c11d8 ffff880026327550 ffffffff8227eb1e
> ffff880051608cc0
> [  111.528272]  ffff88006bc02a00 ffff880026327560 ffffffff8227edfd
> ffff8800263275b0
> [  111.529886]  ffffffff8227e04c ffff880026327590 ffffffff8227eb1e
> ffffffff832dfec0
> [  111.531535] Call Trace:
> [  111.532106]  [<ffffffff8227eb1e>] ? kasan_kmalloc+0x5e/0x70 [
> 111.533075]  [<ffffffff8227edfd>] ? kasan_slab_alloc+0xd/0x10 [  111.534041]
> [<ffffffff8227e04c>] ?
> __kmalloc_node_track_caller+0xac/0x230
> [  111.535102]  [<ffffffff8227eb1e>] ? kasan_kmalloc+0x5e/0x70 [
> 111.536047]  [<ffffffffa0387ed0>] ? tipc_udp_disable+0xe0/0xe0 [tipc] [
> 111.537186]  [<ffffffff8227eb1e>] ? kasan_kmalloc+0x5e/0x70 [  111.538139]
> [<ffffffff8227ef52>] ? kasan_krealloc+0x62/0x80 [  111.539106]
> [<ffffffff8227ebf8>] ? memset+0x28/0x30 [  111.539946]  [<ffffffff8275fab3>]
> ? __alloc_skb+0x2b3/0x310 [  111.540876]  [<ffffffff8275f800>] ?
> skb_complete_tx_timestamp+0x110/0x110
> [  111.541954]  [<ffffffff82147a16>] ? __module_text_address+0x16/0xa0 [
> 111.542978]  [<ffffffff8275e3fb>] ? skb_put+0x8b/0xd0 [  111.543914]
> [<ffffffff8227ec76>] ? memcpy+0x36/0x40 [  111.544817]
> [<ffffffffa03665e8>] ?
> tipc_link_build_proto_msg+0x398/0x4c0 [tipc] [  111.546199]
> [<ffffffffa0364920>] tipc_bearer_xmit_skb+0xa0/0xb0 [tipc] [  111.547355]
> [<ffffffffa036a60b>] tipc_link_proto_xmit+0x11b/0x160 [tipc] [  111.548482]
> [<ffffffffa036a4f0>] ?
> tipc_link_build_reset_msg+0x50/0x50 [tipc] [  111.549763]
> [<ffffffffa036c5be>] tipc_nl_link_set+0x1ee/0x3b0 [tipc] [  111.550822]
> [<ffffffffa036c3d0>] ? tipc_nl_parse_link_prop+0xd0/0xd0 [tipc] [
> 111.551921]  [<ffffffff82190a29>] ? is_ftrace_trampoline+0x59/0x90 [
> 111.552961]  [<ffffffff820b15a5>] ? __kernel_text_address+0x65/0x80 [
> 111.554010]  [<ffffffff824ba386>] ? nla_parse+0xb6/0x140 [  111.554906]
> [<ffffffff827d20ee>] genl_family_rcv_msg+0x37e/0x5e0 [  111.555954]
> [<ffffffffa0380005>] ? set_orig_addr.isra.53+0xe5/0x120 [tipc] [  111.557104]
> [<ffffffff827d1d70>] ? genl_rcv+0x40/0x40 [  111.557949]
> [<ffffffff82278864>] ? alloc_debug_processing+0x154/0x180
> [  111.559030]  [<ffffffff8227a39d>] ? ___slab_alloc+0x43d/0x460 [
> 111.559983]  [<ffffffff82278864>] ? alloc_debug_processing+0x154/0x180
> [  111.561058]  [<ffffffff827cde5c>] ? netlink_lookup+0x19c/0x220 [
> 111.562038]  [<ffffffff827d2428>] genl_rcv_msg+0xd8/0x110 [  111.562966]
> [<ffffffff827d143b>] netlink_rcv_skb+0x14b/0x180 [  111.563930]
> [<ffffffff827d2350>] ? genl_family_rcv_msg+0x5e0/0x5e0 [  111.564949]
> [<ffffffff827d1d58>] genl_rcv+0x28/0x40 [  111.565818]  [<ffffffff827d0a27>]
> netlink_unicast+0x2e7/0x3a0 [  111.566759]  [<ffffffff827d0740>] ?
> netlink_attachskb+0x330/0x330 [  111.567765]  [<ffffffff8249b731>] ?
> copy_from_iter+0xf1/0x3b0 [  111.568707]  [<ffffffff827d0f8d>]
> netlink_sendmsg+0x4ad/0x620 [  111.569706]  [<ffffffff827d0ae0>] ?
> netlink_unicast+0x3a0/0x3a0 [  111.570658]  [<ffffffff822c0683>] ?
> __fdget+0x13/0x20 [  111.571548]  [<ffffffff82751575>] ?
> sockfd_lookup_light+0x95/0xb0 [  111.572541]  [<ffffffff827538fc>]
> SYSC_sendto+0x1bc/0x290 [  111.573459]  [<ffffffff82753740>] ?
> sock_write_iter+0x200/0x200 [  111.574435]  [<ffffffff822c0683>] ?
> __fdget+0x13/0x20 [  111.575330]  [<ffffffff82751575>] ?
> sockfd_lookup_light+0x95/0xb0 [  111.576354]  [<ffffffff827caf71>] ?
> netlink_getname+0xb1/0x110 [  111.577371]  [<ffffffff82750b0c>] ?
> move_addr_to_user+0x5c/0x70 [  111.578385]  [<ffffffff82751706>] ?
> SYSC_getsockname+0x176/0x190 [  111.579407]  [<ffffffff82751590>] ?
> sockfd_lookup_light+0xb0/0xb0 [  111.580431]  [<ffffffff82753225>] ?
> SYSC_bind+0xe5/0x180 [  111.581369]  [<ffffffff82753140>] ?
> __sock_recv_ts_and_drops+0x260/0x260
> [  111.582518]  [<ffffffff822c132b>] ? fd_install+0x3b/0x50 [  111.583450]
> [<ffffffff827514b4>] ? sock_map_fd+0x44/0x70 [  111.584417]
> [<ffffffff82753f4c>] ? SyS_socket+0xcc/0x120 [  111.585353]
> [<ffffffff82753e80>] ? move_addr_to_kernel+0x40/0x40 [  111.586405]
> [<ffffffff820022b6>] ? exit_to_usermode_loop+0x86/0x120 [  111.587434]
> [<ffffffff82002017>] ? trace_hardirqs_on_thunk+0x17/0x19 [  111.588511]
> [<ffffffff827544ce>] SyS_sendto+0xe/0x10 [  111.589378]
> [<ffffffff829299ae>] entry_SYSCALL_64_fastpath+0x12/0x6d
> [  111.590420] Code: 00 00 e8 e2 64 ef e1 4c 89 ef 80 a3 93 00 00 00 f7
> e8 43 65 ef e1 4d 8b 7d 00 4d 85 ff 0f 84 db 03 00 00 4c 89 f7 e8 6e 63 ef e1
> <66> 41 83 3e 08 0f 84 80 01 00 00 48 8d bc 24 20 01 00 00 31 c0 [  111.598579]
> RIP  [<ffffffffa0387fd2>] tipc_udp_send_msg+0x102/0x4f0 [tipc] [
> 111.599831]  RSP <ffff880026327528> [  111.600538] CR2: 0000000000000000 [
> 111.601202] ---[ end trace 827dd66f798de44a ]--- [  111.602025] Kernel panic -
> not syncing: Fatal exception in interrupt [  111.614704] Kernel Offset: disabled
> [  111.615249] Rebooting in 60 seconds..
> 
> 
> 
> 
> 
> [   31.985039] BUG: Bad page state in process ___ pfn:400c0
> [   31.985680] page:ffffea0001003000 count:0 mapcount:0
> mapping:000000000000003c index:0x0
> [   31.986619] flags: 0x10000(mappedtodisk)
> [   31.987081] page dumped because: PAGE_FLAGS_CHECK_AT_PREP flag set
> [   31.987701] bad because of flags: 0x10000(mappedtodisk)
> [   31.988268] Modules linked in: iptable_filter ip_tables x_tables tipc ...
> [   31.991804] CPU: 3 PID: 2716 Not tainted 4.9.52 #1
> [   31.993608]  ffffc90003023b28 ffffffff822ee180 ffffea0001003000
> ffffffff827b76c8
> [   31.994792]  ffffc90003023b50 ffffffff8215c5e4 0000000000010000
> ffffea0001000000
> [   31.995986]  0000000000000009 ffffc90003023b60 ffffffff8215c71f
> ffffc90003023c28
> [   31.997380] Call Trace:
> [   31.997780]  [<ffffffff822ee180>] dump_stack+0x86/0xc6
> [   31.998460]  [<ffffffff8215c5e4>] bad_page+0xc4/0x130
> [   31.999160]  [<ffffffff8215c71f>] check_new_page_bad+0x5f/0x70
> [   31.999968]  [<ffffffff8215fe5a>] get_page_from_freelist+0x7ca/0xb20
> [   32.000782]  [<ffffffff8216123c>] __alloc_pages_nodemask+0xdc/0x220
> [   32.001621]  [<ffffffff821a4c18>] alloc_fresh_huge_page+0x68/0xc0
> [   32.002407]  [<ffffffff821a590f>] set_max_huge_pages+0x4df/0x530
> [   32.003176]  [<ffffffff8230698c>] ? _kstrtoull+0x2c/0x70
> [   32.003841]  [<ffffffff821a59ec>] nr_hugepages_store_common+0x8c/0xf0
> [   32.004619]  [<ffffffff821c2626>] ?
> mem_cgroup_commit_charge+0x66/0x430
> [   32.005384]  [<ffffffff821a5a83>] nr_hugepages_store+0x13/0x20
> [   32.006176]  [<ffffffff822f02bf>] kobj_attr_store+0xf/0x20
> [   32.006838]  [<ffffffff82237877>] sysfs_kf_write+0x37/0x40
> [   32.007534]  [<ffffffff82236bcc>] kernfs_fop_write+0x11c/0x1b0
> [   32.008258]  [<ffffffff821c7068>] __vfs_write+0x28/0x120
> [   32.008931]  [<ffffffff820fb23d>] ? __audit_syscall_entry+0xad/0xf0
> [   32.009681]  [<ffffffff821c7735>] vfs_write+0xb5/0x1a0
> [   32.010308]  [<ffffffff821c8a96>] SyS_write+0x46/0xa0
> [   32.010917]  [<ffffffff8204b8fa>] ? trace_do_page_fault+0x5a/0x140
> [   32.011741]  [<ffffffff82002bfe>] do_syscall_64+0x7e/0x1a0
> [   32.012476]  [<ffffffff825dc0c4>] entry_SYSCALL64_slow_path+0x25/0x25
> [   32.013244] Disabling lock debugging due to kernel taint
> [   34.055994] ip6_tables: (C) 2000-2006 Netfilter Core Team
> 
> 
> -Tommi

Powered by blists - more mailing lists