netdev - IPv6 FIB related crash with MACVLANs in 3.9.11+ kernel.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <52EFFE20.5080500@candelatech.com>
Date:	Mon, 03 Feb 2014 12:37:52 -0800
From:	Ben Greear <greearb@...delatech.com>
To:	netdev <netdev@...r.kernel.org>
Subject: IPv6 FIB related crash with MACVLANs in 3.9.11+ kernel.

The kernel has some additional patches, but not much to IPv6.

The bug is that when we have lots of mac-vlans on some ixgbe ports
(500 per interface in this case), and boot up the system with the ports unplugged,
we get this crash almost every time.  Boot-up is going to do normal bootup
stuff plus create and configure the 1000 mac-vlans, dump their routing
tables, etc.

We are using one routing table per network device, and some
ip rules.

If we plug in the ixgbe ports, we do not ever see a crash.

We have not yet tried reproducing it on other drivers, but I suspect
the issue is not related to ixgbe.

Any ideas on this one?


Reading symbols from /home/greearb/kernel/2.6/linux-3.9.x64/net/ipv6/ipv6.ko...done.
(gdb) l *(fib6_walk_continue+0xd3)
0x105c0 is in fib6_walk_continue (/home/greearb/git/linux-3.9.dev.y/net/ipv6/ip6_fib.c:1423).
1418				if (fn == w->root)
1419					return 0;
1420				pn = fn->parent;
1421				w->node = pn;
1422	#ifdef CONFIG_IPV6_SUBTREES
1423				if (FIB6_SUBTREE(pn) == fn) {
1424					WARN_ON(!(fn->fn_flags & RTN_ROOT));
1425					w->state = FWS_L;
1426					continue;
1427				}
(gdb)

[root@...forge-13100125 ~]# BUG: unable to handle kernel NULL pointer
dereference at 0000000000000018
IP: [<ffffffffa00a75c0>] fib6_walk_continue+0xd3/0x13c [ipv6]
PGD 4017c4067 PUD 3f3a94067 PMD 0
Oops: 0000 [#1] PREEMPT SMP
Modules linked in: nf_nat_ipv4 nf_nat fuse macvlan wanlink(O) pktgen
ip6table_filter ip6_tables ebtable_nat ebtables coretemp mperf intel_powerclamp
kvm_intel kvm iTCO_wdt iTCO_vendor_support microcode serio_raw joydev pcspkr
i2c_i801 lpc_ich e1000e ixgbe ptp pps_core mdio hwmon dca video shpchp uinput
ipv6 mgag200 i2c_algo_bit drm_kms_helper ttm drm i2c_core [last unloaded:
iptable_nat]
CPU 7
Pid: 26961, comm: ip Tainted: G         C O 3.9.11+ #134 Supermicro
X9SCI/X9SCA/X9SCI/X9SCA
RIP: 0010:[<ffffffffa00a75c0>]  [<ffffffffa00a75c0>]
fib6_walk_continue+0xd3/0x13c [ipv6]
RSP: 0018:ffff880400677a48  EFLAGS: 00010283
RAX: ffff8803f8b08698 RBX: ffff8803f88ea6c0 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffff880400677918 RDI: ffff8803f3dde058
RBP: ffff880400677a58 R08: ffff8803f3dde034 R09: ffff8803f3dde000
R10: ffffffff810ca37a R11: ffff88041d5adef8 R12: ffff8803f3a34500
R13: ffffffff81ab5780 R14: ffff8803f88ea6c0 R15: ffff88041bcfc200
FS:  00007f054b30b740(0000) GS:ffff88042fdc0000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000018 CR3: 00000003f3c8c000 CR4: 00000000001407e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process ip (pid: 26961, threadinfo ffff880400676000, task ffff8803ff90aee0)
Stack:
 ffff880400677aa8 ffff8803f248dd00 ffff880400677ad8 ffffffffa00a7815
 ffff8803ff90aee0 ffff88041bcfc214 0000000200000000 0000000200000020
 ffff8803f3a34500 ffff8803f248dd00 ffffffff81ab5780 0000000000000e70
Call Trace:
 [<ffffffffa00a7815>] inet6_dump_fib+0x179/0x211 [ipv6]
 [<ffffffff81535b19>] netlink_dump+0x6b/0x1b2
 [<ffffffff81535e2c>] netlink_recvmsg+0x1cc/0x322
 [<ffffffff815205d9>] ? rtnetlink_rcv+0x2b/0x2d
 [<ffffffff814ff3f5>] __sock_recvmsg+0x6a/0x77
 [<ffffffff814ff473>] sock_recvmsg+0x71/0x8a
 [<ffffffff8150aea1>] ? copy_from_user+0x9/0xb
 [<ffffffff8150b207>] ? verify_iovec+0x54/0xa8
 [<ffffffff81500f59>] ___sys_recvmsg+0x13b/0x20d
 [<ffffffff811602ca>] ? handle_mm_fault+0x536/0x550
 [<ffffffff815ce8a6>] ? __do_page_fault+0x307/0x389
 [<ffffffff81162789>] ? remove_vma+0x5d/0x65
 [<ffffffff8116467d>] ? do_munmap+0x332/0x34c
 [<ffffffff81501323>] __sys_recvmsg+0x42/0x60
 [<ffffffff8150135a>] sys_recvmsg+0x19/0x1b
 [<ffffffff815d1c99>] system_call_fastpath+0x16/0x1b
Code: 89 43 2c e9 61 ff ff ff 48 89 df ff 53 38 85 c0 75 7d ff 43 30 e9 4f ff
ff ff c6 43 28 04 48 3b 43 10 74 69 48 8b 10 48 89 53 18 <48> 39 42 18 75 20 f6
40 2a 02 75 11 be 90 05 00 00 48 c7 c7 2a
RIP  [<ffffffffa00a75c0>] fib6_walk_continue+0xd3/0x13c [ipv6]
 RSP <ffff880400677a48>
CR2: 0000000000000018

Thanks,
Ben

-- 
Ben Greear <greearb@...delatech.com>
Candela Technologies Inc  http://www.candelatech.com

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html