| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20250626065519.753de723@hermes.local>
Date: Thu, 26 Jun 2025 06:55:41 -0700
From: Stephen Hemminger <stephen@...workplumber.org>
To: z30015464 <zhongxuan2@...wei.com>
Cc: <netdev@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
<dsahern@...il.com>, <gaoxingwang1@...wei.com>, <yanan@...wei.com>,
<tangce1@...wei.com>
Subject: Re: [Issue] iproute2: coredump problem with command ip link xstats
On Thu, 19 Jun 2025 15:45:52 +0800
z30015464 <zhongxuan2@...wei.com> wrote:
> Hello everyone,
>
> I having an issues while using iprute2 6.15.0. When I created a bond and intended to use 'ip link xstats' command to query extended information, a stack overflow occurred, followed by a coredump. I couldn't identify the root cause through the code and need some help.
>
> Example:
> ifconfig eth1 up
> modprobe bonding mode=4 max_bonds=1 lacp_rate=1 miimon=100
> ip addr add 7.7.0.100/24 dev bond0
> ip link xstats type bond dev bond0
>
> Here is the result:
> [root@...alhost /]# ip link xstats type bond
> bond0
> LACPDU Rx 0
> LACPDU Tx 0
> LACPDU Unknown type Rx 0
> LACPDU Illegal Rx 0
> Marker Rx 0
> Marker Tx 0
> Marker response Rx 0
> Marker response Tx 0
> Marker unknown type Rx 0
> *** stack smashing detected ***: terminated
> Aborted (core dumped)
>
> Here is the result with valgrind:
> [root@...alhost /]# valgrind ip link xstats type bond dev bond0
> ==242893== Memcheck, a memory error detector
> ==242893== Copyright (C) 2002-2022, and GNU GPL'd, by Julian Seward et al.
> ==242893== Using Valgrind-3.22.0 and LibVEX; rerun with -h for copyright info
> ==242893== Command: ip link xstats type bond dev bond0
> ==242893==
> bond0
> LACPDU Rx 0
> LACPDU Tx 0
> LACPDU Unknown type Rx 0
> LACPDU Illegal Rx 0
> Marker Rx 0
> Marker Tx 0
> Marker response Rx 0
> Marker response Tx 0
> Marker unknown type Rx 0
> *** stack smashing detected ***: terminated
> ==242893==
> ==242893== Process terminating with default action of signal 6 (SIGABRT)
> ==242893== at 0x498AB5C: __pthread_kill_implementation (pthread_kill.c:44)
> ==242893== by 0x493CF45: raise (raise.c:26)
> ==242893== by 0x492733B: abort (abort.c:79)
> ==242893== by 0x49281A8: __libc_message.cold (libc_fatal.c:152)
> ==242893== by 0x4A1621A: __fortify_fail (fortify_fail.c:24)
> ==242893== by 0x4A17435: __stack_chk_fail (stack_chk_fail.c:24)
> ==242893== by 0x157A81: bond_print_stats_attr (iplink_bond.c:877)
> ==242893== by 0x157B02: bond_print_xstats (iplink_bond.c:895)
> ==242893== by 0x1846A9: rtnl_dump_filter_l (libnetlink.c:926)
> ==242893== by 0x185A01: rtnl_dump_filter_nc (libnetlink.c:969)
> ==242893== by 0x16B0BF: iplink_ifla_xstats (iplink_xstats.c:71)
> ==242893== by 0x118C3C: do_cmd (ip.c:131)
> ==242893==
> ==242893== HEAP SUMMARY:
> ==242893== in use at exit: 33,878 bytes in 4 blocks
> ==242893== total heap usage: 8 allocs, 4 frees, 66,755 bytes allocated
> ==242893==
> ==242893== LEAK SUMMARY:
> ==242893== definitely lost: 0 bytes in 0 blocks
> ==242893== indirectly lost: 0 bytes in 0 blocks
> ==242893== possibly lost: 0 bytes in 0 blocks
> ==242893== still reachable: 33,878 bytes in 4 blocks
> ==242893== suppressed: 0 bytes in 0 blocks
> ==242893== Rerun with --leak-check=full to see details of leaked memory
> ==242893==
> ==242893== For lists of detected and suppressed errors, rerun with: -s
> ==242893== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 0 from 0)
> Aborted (core dumped)
>
> Through gdb debugging, __stack_chk_fail was triggered after the end of function bond_print_stats_attr function.
> I first found this issue in version 6.6.0. After replacing package 6.15.0, the issue still persists.
> I also tried version 5.15.0 but there was no abnormality.
> Maybe some modifications triggered this issue, but I cannot found the cause. I hope to get some helps.
>
> Thank you very much.
>
>
>
Thanks, fixed it with:
From e4d10d064f5dbc64e4d2d73074c33b54d06b4514 Mon Sep 17 00:00:00 2001
From: Stephen Hemminger <stephen@...workplumber.org>
Date: Thu, 26 Jun 2025 06:50:17 -0700
Subject: [PATCH] bond: fix stack smash in xstats
Building with stack smashing detection finds an off by one
in the bond xstats attribute parsing.
$ ip link xstats type bond dev bond0
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
bond0
LACPDU Rx 0
LACPDU Tx 0
LACPDU Unknown type Rx 0
LACPDU Illegal Rx 0
Marker Rx 0
Marker Tx 0
Marker response Rx 0
Marker response Tx 0
Marker unknown type Rx 0
*** stack smashing detected ***: terminated
Program received signal SIGABRT, Aborted.
Reported-by: z30015464 <zhongxuan2@...wei.com>
Fixes: 440c5075d662 ("ip: bond: add xstats support")
Cc: nikolay@...ulusnetworks.com
Signed-off-by: Stephen Hemminger <stephen@...workplumber.org>
---
ip/iplink_bond.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/ip/iplink_bond.c b/ip/iplink_bond.c
index 19af67d0..62dd907c 100644
--- a/ip/iplink_bond.c
+++ b/ip/iplink_bond.c
@@ -852,7 +852,7 @@ static void bond_print_stats_attr(struct rtattr *attr, int ifindex)
const char *ifname = "";
int rem;
- parse_rtattr(bondtb, LINK_XSTATS_TYPE_MAX+1, RTA_DATA(attr),
+ parse_rtattr(bondtb, LINK_XSTATS_TYPE_MAX, RTA_DATA(attr),
RTA_PAYLOAD(attr));
if (!bondtb[LINK_XSTATS_TYPE_BOND])
return;
--
2.47.2
Powered by blists - more mailing lists