netdev - Re: 2.6.29.1 pktgen crash

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20090521215915.GA32737@Chamillionaire.breakpoint.cc>
Date:	Thu, 21 May 2009 23:59:15 +0200
From:	Florian Westphal <fw@...len.de>
To:	Vladimir Ivashchenko <hazard@...ncoudi.com>
Cc:	netdev@...r.kernel.org
Subject: Re: 2.6.29.1 pktgen crash

Vladimir Ivashchenko <hazard@...ncoudi.com> wrote:
> The attached script leads to a crash when you run it for 2-3 times on 2.6.29.1. The server still remains reachable, but starts misbehaving.
>
> May 20 21:09:03 tshape-phome2 kernel: BUG: unable to handle kernel paging request at f8bbc008
> May 20 21:09:03 tshape-phome2 kernel: IP: [<f863ab01>] pktgen_remove_device+0x88/0xdc [pktgen]
> May 20 21:09:03 tshape-phome2 kernel: *pde = 31030067 *pte = 00000000 
> May 20 21:09:03 tshape-phome2 kernel: Oops: 0000 [#1] SMP 
[..]

This should fix it:

>From bca277bb59b865a4e9516953dfc9818af1a7deea Mon Sep 17 00:00:00 2001
From: Florian Westphal <fw@...len.de>
Date: Thu, 21 May 2009 23:52:17 +0200
Subject: [PATCH] pktgen: do not access flows[] beyond its length

typo -- pkt_dev->nflows is for stats only, the number of concurrent
flows is stored in cflows.

Reported-By: Vladimir Ivashchenko <hazard@...ncoudi.com>
Signed-off-by: Florian Westphal <fw@...len.de>
---
 net/core/pktgen.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index 3779c14..8445075 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -2447,7 +2447,7 @@ static inline void free_SAs(struct pktgen_dev *pkt_dev)
 	if (pkt_dev->cflows) {
 		/* let go of the SAs if we have them */
 		int i = 0;
-		for (;  i < pkt_dev->nflows; i++){
+		for (;  i < pkt_dev->cflows; i++) {
 			struct xfrm_state *x = pkt_dev->flows[i].x;
 			if (x) {
 				xfrm_state_put(x);
-- 
1.6.0.6

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html