netdev - Re: [net-2.6 PATCH] ipv6: fix missing in6_ifa

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 17 Nov 2010 16:20:30 +0100
From:	Anders Franzen <Anders.Franzen@...csson.com>
To:	Eric Dumazet <eric.dumazet@...il.com>
CC:	John Fastabend <john.r.fastabend@...el.com>,
	"davem@...emloft.net" <davem@...emloft.net>,
	"netdev@...r.kernel.org" <netdev@...r.kernel.org>,
	"shemminger@...tta.com" <shemminger@...tta.com>
Subject: Re: [net-2.6 PATCH] ipv6: fix missing in6_ifa_put in addrconf

Hi, I was hunting for a bug that a colleague discovered.
When we exit a network namespace, the ns was hanging with dangling
references to dev lo.

When I saw the patch below, I fetched the latest net-next from Daves
repository.

And the problem is gone. Was this really the fix, since it seems to me
that this is a fix to a recently added patch (dont remove address ....).

Did you fix anything else in the Ipv6 addrconf w.r.g dev_hold/dev_put?

netns still have problems with slab corruption during exit though:

 Nov 17 15:00:20 p04 user.err kernel: Slab corruption: size-4096
start=ffff88000612a000, len=4096
Nov 17 15:00:20 p04 user.err kernel: 020: 6b 6b 6b 6b 6b 6b
Nov 17 15:00:20 p04 user.info kernel:  6b 6b 00 00 00 00 00 00 00
Nov 17 15:00:20 p04 user.info kernel:  00

BR
  Anders


On Tue, 2010-11-16 at 07:37 +0100, Eric Dumazet wrote:
> Le lundi 15 novembre 2010 à 22:29 -0800, John Fastabend a écrit :
> > Fix ref count bug introduced by
> > 
> > commit 2de795707294972f6c34bae9de713e502c431296
> > Author: Lorenzo Colitti <lorenzo@...gle.com>
> > Date:   Wed Oct 27 18:16:49 2010 +0000
> > 
> > ipv6: addrconf: don't remove address state on ifdown if the address
> > is being kept
> > 
> > 
> > Fix logic so that addrconf_ifdown() decrements the inet6_ifaddr
> > refcnt correctly with in6_ifa_put().
> > 
> > Reported-by: Stephen Hemminger <shemminger@...tta.com>
> > Signed-off-by: John Fastabend <john.r.fastabend@...el.com>
> > ---
> > 
> >  net/ipv6/addrconf.c |    6 +++---
> >  1 files changed, 3 insertions(+), 3 deletions(-)
> > 
> > diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
> > index b41ce0f..aaa3ca4 100644
> > --- a/net/ipv6/addrconf.c
> > +++ b/net/ipv6/addrconf.c
> > @@ -2754,13 +2754,13 @@ static int addrconf_ifdown(struct net_device *dev, int how)
> >  			ifa->state = INET6_IFADDR_STATE_DEAD;
> >  			spin_unlock_bh(&ifa->state_lock);
> >  
> > -			if (state == INET6_IFADDR_STATE_DEAD) {
> > -				in6_ifa_put(ifa);
> > -			} else {
> > +			if (state != INET6_IFADDR_STATE_DEAD) {
> >  				__ipv6_ifa_notify(RTM_DELADDR, ifa);
> >  				atomic_notifier_call_chain(&inet6addr_chain,
> >  							   NETDEV_DOWN, ifa);
> >  			}
> > +
> > +			in6_ifa_put(ifa);
> >  			write_lock_bh(&idev->lock);
> >  		}
> >  	}
> > 
> 
> Acked-by: Eric Dumazet <eric.dumazet@...il.com>
> 
> Thanks again John
> 
> 
> --
> To unsubscribe from this list: send the line "unsubscribe netdev" in
> the body of a message to majordomo@...r.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html


--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html