netdev - Re: oops in udpv6

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 17 Apr 2013 10:11:38 -0400
From:	Dave Jones <davej@...hat.com>
To:	Eric Dumazet <eric.dumazet@...il.com>
Cc:	netdev@...r.kernel.org
Subject: Re: oops in udpv6_sendmsg

On Tue, Apr 16, 2013 at 07:02:12PM -0700, Eric Dumazet wrote:

 > > rax is all kinds of crazy. 7ae9fffffff2b8ff doesn't look anything like an address.
 > 
 > rt->rt6i_idev contains garbage. It looks like a dst refcount issue.
 > 
 > Wow, it seems ip6_append_data() calls sock_alloc_send_skb() and can
 > release socket lock while waiting for buffer space.
 > 
 > This completely defeats corking, as another thread can mess with
 > cork->dst at the same time.
 > 
 > We need to hold dst before sleeping in sock_alloc_send_skb()

good news is that with some changes, I was able to make current
trinity reproduce this in seconds rather than hours..

./trinity -q -l off -n -c sendmsg -c connect 

on current tree seems to reliably trigger it for me.

	Dave 
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html