| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20120810163112.GA32544@localhost>
Date: Sat, 11 Aug 2012 00:31:12 +0800
From: Fengguang Wu <fengguang.wu@...el.com>
To: Eric Dumazet <edumazet@...gle.com>
Cc: "David S. Miller" <davem@...emloft.net>, netdev@...r.kernel.org,
John Stultz <johnstul@...ibm.com>,
Paul Moore <paul@...l-moore.com>,
Eric Paris <eparis@...isplace.org>,
"Serge E. Hallyn" <serge@...lyn.com>
Subject: NULL pointer dereference BUG in ip_send_skb()
Hi Eric,
This line triggers a NULL deference since commit 3a7c384 ("ipv4: tcp:
unicast_sock should not land outside of TCP stack").
int ip_send_skb(struct sk_buff *skb)
{
==> struct net *net = sock_net(skb->sk);
[ 77.914805] md: autorun ...
[ 77.915703] md: ... autorun DONE.
[ 77.926545] BUG: unable to handle kernel NULL pointer dereference at 0000000000000030
[ 77.928884] IP: [<ffffffff8250e980>] ip_send_skb+0xf/0x3d
[ 77.929523] PGD 0
[ 77.929523] Oops: 0000 [#1] SMP DEBUG_PAGEALLOC
[ 77.929523] Modules linked in:
[ 77.929523] CPU 0
[ 77.929523] Pid: 171, comm: kworker/0:2 Not tainted 3.6.0-rc1+ #1720 Bochs Bochs
[ 77.929523] RIP: 0010:[<ffffffff8250e980>] [<ffffffff8250e980>] ip_send_skb+0xf/0x3d
[ 77.929523] RSP: 0018:ffff88001f203938 EFLAGS: 00010286
[ 77.929523] RAX: 0000000000000000 RBX: ffff88001f3d2580 RCX: ffff880012e75eb8
[ 77.929523] RDX: ffff88001f2039b8 RSI: ffff880012e9dd28 RDI: ffff880012903f00
[ 77.929523] RBP: ffff88001f203948 R08: 0000000000000000 R09: 0000000000000000
[ 77.929523] R10: ffff88001f3d2810 R11: ffff880012e75e00 R12: ffff880012e5cf00
[ 77.929523] R13: ffff880012903f00 R14: ffff88001f203a88 R15: ffff88001f3d2820
[ 77.929523] FS: 0000000000000000(0000) GS:ffff88001f200000(0000) knlGS:0000000000000000
[ 77.929523] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[ 77.929523] CR2: 0000000000000030 CR3: 0000000003614000 CR4: 00000000000006f0
[ 77.929523] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 77.929523] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[ 77.929523] Process kworker/0:2 (pid: 171, threadinfo ffff880013d9a000, task ffff880013d9c180)
[ 77.929523] Stack:
[ 77.929523] ffff880012e9dd28 ffff88001f3d2580 ffff88001f203958 ffffffff8250e9d7
[ 77.929523] ffff88001f203a58 ffffffff8250edcd ffff88001f2039a0 ffff88001f203998
[ 77.929523] ffff880000000040 ffffffff810d312d 000000000f02000a 0000001424c86afd
[ 77.929523] Call Trace:
[ 77.929523] <IRQ>
[ 77.929523] [<ffffffff8250e9d7>] ip_push_pending_frames+0x29/0x2f
[ 77.929523] [<ffffffff8250edcd>] ip_send_unicast_reply+0x297/0x2ce
[ 77.929523] [<ffffffff810d312d>] ? trace_hardirqs_off_caller+0x1f/0x9e
[ 77.929523] [<ffffffff810b9f00>] ? local_clock+0x25/0x52
[ 77.929523] [<ffffffff810d36ca>] ? lock_is_held+0x82/0x94
[ 77.929523] [<ffffffff82526999>] tcp_v4_send_ack+0x1f9/0x218
[ 77.929523] [<ffffffff810b9f16>] ? local_clock+0x3b/0x52
[ 77.929523] [<ffffffff82527ff2>] tcp_v4_rcv+0x6a7/0x754
[ 77.929523] [<ffffffff82509846>] ? __xfrm_policy_check2.constprop.8+0x5b/0x5b
[ 77.929523] [<ffffffff825099c1>] ip_local_deliver_finish+0x17b/0x20f
[ 77.929523] [<ffffffff8250988d>] ? ip_local_deliver_finish+0x47/0x20f
[ 77.929523] [<ffffffff82509ba1>] ip_local_deliver+0x53/0x84
[ 77.929523] [<ffffffff825094bf>] ? skb_dst.isra.5+0x37/0x5b
[ 77.929523] [<ffffffff810b9ef4>] ? local_clock+0x19/0x52
[ 77.929523] [<ffffffff825097b3>] ip_rcv_finish+0x2d0/0x308
[ 77.929523] [<ffffffff82509de2>] ip_rcv+0x210/0x26a
[ 77.929523] [<ffffffff8248253a>] ? rcu_lock_acquire+0x27/0x29
[ 77.929523] [<ffffffff82482513>] ? dev_seq_stop+0x10/0x10
[ 77.929523] [<ffffffff824868b9>] __netif_receive_skb+0x469/0x572
[ 77.929523] [<ffffffff82486b8a>] netif_receive_skb+0x65/0x9c
[ 77.929523] [<ffffffff824870e3>] ? __napi_gro_receive+0xf2/0xfe
[ 77.929523] [<ffffffff82486c4f>] napi_skb_finish+0x27/0x59
[ 77.929523] [<ffffffff824871e2>] napi_gro_receive+0x2f/0x34
[ 77.929523] [<ffffffff81caf06e>] e1000_receive_skb+0x57/0x60
[ 77.929523] [<ffffffff81cb1ebb>] e1000_clean_rx_irq+0x2f2/0x387
[ 77.929523] [<ffffffff81cafdb4>] e1000_clean+0x541/0x695
[ 77.929523] [<ffffffff810d6d1c>] ? mark_held_locks+0x71/0x99
[ 77.929523] [<ffffffff82487432>] ? net_rx_action+0x1ae/0x1ee
[ 77.929523] [<ffffffff82487337>] net_rx_action+0xb3/0x1ee
[ 77.929523] [<ffffffff81090178>] ? __do_softirq+0x83/0x1f5
[ 77.929523] [<ffffffff810901be>] __do_softirq+0xc9/0x1f5
[ 77.929523] [<ffffffff8286b3bc>] call_softirq+0x1c/0x30
[ 77.929523] <EOI>
[ 77.929523] [<ffffffff8104ac90>] do_softirq+0x4a/0xa2
[ 77.929523] [<ffffffff825184cc>] ? tcp_close+0x2e7/0x303
[ 77.929523] [<ffffffff8108fcfa>] _local_bh_enable_ip+0xa7/0xd8
[ 77.929523] [<ffffffff8108fd4d>] local_bh_enable+0x12/0x14
[ 77.929523] [<ffffffff825184cc>] tcp_close+0x2e7/0x303
[ 77.929523] [<ffffffff82535559>] inet_release+0x7e/0x85
[ 77.929523] [<ffffffff824739f4>] sock_release+0x1f/0x77
[ 77.929523] [<ffffffff82618a94>] xs_reset_transport+0xb8/0xc1
[ 77.929523] [<ffffffff82618ab0>] xs_close+0x13/0x42
[ 77.929523] [<ffffffff82618b04>] xs_destroy+0x25/0x59
[ 77.929523] [<ffffffff82616b17>] xprt_destroy+0x73/0x77
[ 77.929523] [<ffffffff82618196>] xprt_put+0x18/0x1a
[ 77.929523] [<ffffffff82615e6a>] rpc_free_client+0x8e/0xa0
[ 77.929523] [<ffffffff82615dab>] rpc_release_client+0x4f/0x80
[ 77.929523] [<ffffffff82616179>] rpc_task_release_client+0x4b/0x54
[ 77.929523] [<ffffffff8261b9cb>] rpc_release_resources_task+0x39/0x3e
[ 77.929523] [<ffffffff8261ce33>] __rpc_execute+0x12e/0x22b
[ 77.929523] [<ffffffff810d6e67>] ? trace_hardirqs_on_caller+0x123/0x17f
[ 77.929523] [<ffffffff8261cf58>] rpc_async_schedule+0x28/0x34
[ 77.929523] [<ffffffff810a1ecf>] process_one_work+0x1ef/0x3cc
[ 77.929523] [<ffffffff810a1e62>] ? process_one_work+0x182/0x3cc
[ 77.929523] [<ffffffff810d4d4c>] ? lock_acquired+0x1fa/0x22b
[ 77.929523] [<ffffffff8261cf30>] ? __rpc_execute+0x22b/0x22b
[ 77.929523] [<ffffffff810a2412>] worker_thread+0x1ac/0x250
[ 77.929523] [<ffffffff810a2266>] ? rescuer_thread+0x18b/0x18b
[ 77.929523] [<ffffffff810a8ec4>] kthread+0x8a/0x92
[ 77.929523] [<ffffffff8167be8e>] ? trace_hardirqs_on_thunk+0x3a/0x3f
[ 77.929523] [<ffffffff8286b2c4>] kernel_thread_helper+0x4/0x10
[ 77.929523] [<ffffffff82863930>] ? retint_restore_args+0x13/0x13
[ 77.929523] [<ffffffff810a8e3a>] ? __init_kthread_worker+0x5a/0x5a
[ 77.929523] [<ffffffff8286b2c0>] ? gs_change+0x13/0x13
[ 77.929523] Code: 87 84 fe ff ff e9 7a fe ff ff 48 83 c4 38 4c 89 e8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 55 48 89 e5 53 56 0f 1f 44 00 00 48 8b 47 18 <48> 8b 58 30 e8 d1 f1 ff ff 83 f8 00 74 1c 7e 0e 83 f8 02 75 04
[ 77.929523] RIP [<ffffffff8250e980>] ip_send_skb+0xf/0x3d
[ 77.929523] RSP <ffff88001f203938>
[ 77.929523] CR2: 0000000000000030
tree: git://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git master
head: 63d02d157ec4124990258d66517b6c11fd6df0cf
commit: 3a7c384ffd57ef5fbd95f48edaa2ca4eb3d9f2ee ipv4: tcp: unicast_sock should not land outside of TCP stack
Thanks,
Fengguang
View attachment "dmesg-kvm-waimea-4771-2012-08-10-17-39-13-3.6.0-rc1+-1720" of type "text/plain" (246340 bytes)
View attachment "config-3.6.0-rc1+" of type "text/plain" (123147 bytes)
Powered by blists - more mailing lists