linux-kernel - [Issue] iproute2: coredump problem with command ip link xstats

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20250619074552.1775627-1-zhongxuan2@huawei.com>
Date: Thu, 19 Jun 2025 15:45:52 +0800
From: z30015464 <zhongxuan2@...wei.com>
To: <netdev@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
	<stephen@...workplumber.org>, <dsahern@...il.com>
CC: <gaoxingwang1@...wei.com>, <yanan@...wei.com>, <tangce1@...wei.com>
Subject: [Issue] iproute2: coredump problem with command ip link xstats

Hello everyone,

I having an issues while using iprute2 6.15.0. When I created a bond and intended to use 'ip link xstats' command to query extended information, a stack overflow occurred, followed by a coredump. I couldn't identify the root cause through the code and need some help.

Example:
ifconfig eth1 up
modprobe bonding mode=4 max_bonds=1 lacp_rate=1 miimon=100
ip addr add 7.7.0.100/24 dev bond0
ip link xstats type bond dev bond0

Here is the result:
[root@...alhost /]# ip link xstats type bond
bond0
                    LACPDU Rx 0
                    LACPDU Tx 0
                    LACPDU Unknown type Rx 0
                    LACPDU Illegal Rx 0
                    Marker Rx 0
                    Marker Tx 0
                    Marker response Rx 0
                    Marker response Tx 0
                    Marker unknown type Rx 0
*** stack smashing detected ***: terminated
Aborted (core dumped)

Here is the result with valgrind:
[root@...alhost /]# valgrind ip link xstats type bond dev bond0
==242893== Memcheck, a memory error detector
==242893== Copyright (C) 2002-2022, and GNU GPL'd, by Julian Seward et al.
==242893== Using Valgrind-3.22.0 and LibVEX; rerun with -h for copyright info
==242893== Command: ip link xstats type bond dev bond0
==242893==
bond0
                    LACPDU Rx 0
                    LACPDU Tx 0
                    LACPDU Unknown type Rx 0
                    LACPDU Illegal Rx 0
                    Marker Rx 0
                    Marker Tx 0
                    Marker response Rx 0
                    Marker response Tx 0
                    Marker unknown type Rx 0
*** stack smashing detected ***: terminated
==242893==
==242893== Process terminating with default action of signal 6 (SIGABRT)
==242893==    at 0x498AB5C: __pthread_kill_implementation (pthread_kill.c:44)
==242893==    by 0x493CF45: raise (raise.c:26)
==242893==    by 0x492733B: abort (abort.c:79)
==242893==    by 0x49281A8: __libc_message.cold (libc_fatal.c:152)
==242893==    by 0x4A1621A: __fortify_fail (fortify_fail.c:24)
==242893==    by 0x4A17435: __stack_chk_fail (stack_chk_fail.c:24)
==242893==    by 0x157A81: bond_print_stats_attr (iplink_bond.c:877)
==242893==    by 0x157B02: bond_print_xstats (iplink_bond.c:895)
==242893==    by 0x1846A9: rtnl_dump_filter_l (libnetlink.c:926)
==242893==    by 0x185A01: rtnl_dump_filter_nc (libnetlink.c:969)
==242893==    by 0x16B0BF: iplink_ifla_xstats (iplink_xstats.c:71)
==242893==    by 0x118C3C: do_cmd (ip.c:131)
==242893==
==242893== HEAP SUMMARY:
==242893==     in use at exit: 33,878 bytes in 4 blocks
==242893==   total heap usage: 8 allocs, 4 frees, 66,755 bytes allocated
==242893==
==242893== LEAK SUMMARY:
==242893==    definitely lost: 0 bytes in 0 blocks
==242893==    indirectly lost: 0 bytes in 0 blocks
==242893==      possibly lost: 0 bytes in 0 blocks
==242893==    still reachable: 33,878 bytes in 4 blocks
==242893==         suppressed: 0 bytes in 0 blocks
==242893== Rerun with --leak-check=full to see details of leaked memory
==242893==
==242893== For lists of detected and suppressed errors, rerun with: -s
==242893== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 0 from 0)
Aborted (core dumped)

Through gdb debugging, __stack_chk_fail was triggered after the end of function bond_print_stats_attr function.
I first found this issue in version 6.6.0. After replacing package 6.15.0, the issue still persists. 
I also tried version 5.15.0 but there was no abnormality.
Maybe some modifications triggered this issue, but I cannot found the cause. I hope to get some helps.

Thank you very much.