netdev - Re: kernel panic in fib6_age (linux-3.6.6) and sugguested fix

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Thu, 07 Mar 2013 10:28:28 +0800
From:	snakky.zhang@...il.com
To:	Zhouyi Zhou <zhouzhouyi@...il.com>
CC:	netdev@...r.kernel.org
Subject: Re: kernel panic in fib6_age (linux-3.6.6) and sugguested fix

On 2013年03月06日 23:36, Zhouyi Zhou wrote:
> hi,
>    My linux-3.6.6 kernel panics very often during reboot.
>    I have reported in bugzilla.kernel.org as bug id 54731.
>
> Kernel panic backtrace (using remote gdb):
> #0  0xffffffff8176a91a in fib6_age (rt=0xffff8800571c6780, arg=0x0
> <irq_stack_union>) at net/ipv6/ip6_fib.c:1566
> #1  0xffffffff8176a461 in fib6_clean_node (w=0xffff8800655fb4e8) at
> net/ipv6/ip6_fib.c:1422
> #2  0xffffffff8176a266 in fib6_walk_continue (w=0xffff8800655fb4e8) at
> net/ipv6/ip6_fib.c:1362
> #3  0xffffffff8176a3d5 in fib6_walk (w=0xffff8800655fb4e8) at
> net/ipv6/ip6_fib.c:1406
> #4  0xffffffff8176a59d in fib6_clean_tree (net=0xffffffff81edb300 <init_net>,
> root=0xffff880036c41950
> ...
> gdb>p neigh
> (gdb) p neigh
> $18 = (struct neighbour *) 0xffffffffffffff97
>
>
>
> There are a lot of ipv6 nodes in my link local environment, and the kernel
> report IPv6: Neighbour table overflow constantly.
>
> I guess the cause of the panic is:
> dst_neigh_lookup calls ip6_neigh_lookup indirectly, and neigh_create return
> ENOBUFS in case of neighbour table full.
> 139 static struct neighbour *ip6_neigh_lookup(const struct dst_entry *dst,
> 140                                           struct sk_buff *skb,
> 141                                           const void *daddr)
> 142 {
> 143         struct rt6_info *rt = (struct rt6_info *) dst;
> 144         struct neighbour *n;
> 145
> 146         daddr = choose_neigh_daddr(rt, skb, daddr);
> 147         n = __ipv6_neigh_lookup(&nd_tbl, dst->dev, daddr);
> 148         if (n)
> 149                 return n;
> 150         return neigh_create(&nd_tbl, daddr, dst->dev);
> 151 }
>
> A possible fix may be:
>
>              neigh = dst_neigh_lookup(&rt->dst, &rt->rt6i_gateway);
> +           if (IS_ERR(neigh))
> +             return PTR_ERR(neigh);
>              else{
>                       neigh_flags = neigh->flags;
>                       neigh_release(neigh);
>              }
>
How about this one below? without modifying the return value:
                         __u8 neigh_flags = 0;

                         neigh = dst_neigh_lookup(&rt->dst, 
&rt->rt6i_gateway);
-                       if (neigh) {
+                       if (!IS_ERR(neigh)) {
                                 neigh_flags = neigh->flags;
                                 neigh_release(neigh);
                         }


Thanks
Xiao


> Thanks for your attention
>
> Zhouyi
> --
> To unsubscribe from this list: send the line "unsubscribe netdev" in
> the body of a message to majordomo@...r.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
>
>
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html