| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Mon, 03 Feb 2014 12:37:52 -0800
From: Ben Greear <greearb@...delatech.com>
To: netdev <netdev@...r.kernel.org>
Subject: IPv6 FIB related crash with MACVLANs in 3.9.11+ kernel.
The kernel has some additional patches, but not much to IPv6.
The bug is that when we have lots of mac-vlans on some ixgbe ports
(500 per interface in this case), and boot up the system with the ports unplugged,
we get this crash almost every time. Boot-up is going to do normal bootup
stuff plus create and configure the 1000 mac-vlans, dump their routing
tables, etc.
We are using one routing table per network device, and some
ip rules.
If we plug in the ixgbe ports, we do not ever see a crash.
We have not yet tried reproducing it on other drivers, but I suspect
the issue is not related to ixgbe.
Any ideas on this one?
Reading symbols from /home/greearb/kernel/2.6/linux-3.9.x64/net/ipv6/ipv6.ko...done.
(gdb) l *(fib6_walk_continue+0xd3)
0x105c0 is in fib6_walk_continue (/home/greearb/git/linux-3.9.dev.y/net/ipv6/ip6_fib.c:1423).
1418 if (fn == w->root)
1419 return 0;
1420 pn = fn->parent;
1421 w->node = pn;
1422 #ifdef CONFIG_IPV6_SUBTREES
1423 if (FIB6_SUBTREE(pn) == fn) {
1424 WARN_ON(!(fn->fn_flags & RTN_ROOT));
1425 w->state = FWS_L;
1426 continue;
1427 }
(gdb)
[root@...forge-13100125 ~]# BUG: unable to handle kernel NULL pointer
dereference at 0000000000000018
IP: [<ffffffffa00a75c0>] fib6_walk_continue+0xd3/0x13c [ipv6]
PGD 4017c4067 PUD 3f3a94067 PMD 0
Oops: 0000 [#1] PREEMPT SMP
Modules linked in: nf_nat_ipv4 nf_nat fuse macvlan wanlink(O) pktgen
ip6table_filter ip6_tables ebtable_nat ebtables coretemp mperf intel_powerclamp
kvm_intel kvm iTCO_wdt iTCO_vendor_support microcode serio_raw joydev pcspkr
i2c_i801 lpc_ich e1000e ixgbe ptp pps_core mdio hwmon dca video shpchp uinput
ipv6 mgag200 i2c_algo_bit drm_kms_helper ttm drm i2c_core [last unloaded:
iptable_nat]
CPU 7
Pid: 26961, comm: ip Tainted: G C O 3.9.11+ #134 Supermicro
X9SCI/X9SCA/X9SCI/X9SCA
RIP: 0010:[<ffffffffa00a75c0>] [<ffffffffa00a75c0>]
fib6_walk_continue+0xd3/0x13c [ipv6]
RSP: 0018:ffff880400677a48 EFLAGS: 00010283
RAX: ffff8803f8b08698 RBX: ffff8803f88ea6c0 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffff880400677918 RDI: ffff8803f3dde058
RBP: ffff880400677a58 R08: ffff8803f3dde034 R09: ffff8803f3dde000
R10: ffffffff810ca37a R11: ffff88041d5adef8 R12: ffff8803f3a34500
R13: ffffffff81ab5780 R14: ffff8803f88ea6c0 R15: ffff88041bcfc200
FS: 00007f054b30b740(0000) GS:ffff88042fdc0000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000018 CR3: 00000003f3c8c000 CR4: 00000000001407e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process ip (pid: 26961, threadinfo ffff880400676000, task ffff8803ff90aee0)
Stack:
ffff880400677aa8 ffff8803f248dd00 ffff880400677ad8 ffffffffa00a7815
ffff8803ff90aee0 ffff88041bcfc214 0000000200000000 0000000200000020
ffff8803f3a34500 ffff8803f248dd00 ffffffff81ab5780 0000000000000e70
Call Trace:
[<ffffffffa00a7815>] inet6_dump_fib+0x179/0x211 [ipv6]
[<ffffffff81535b19>] netlink_dump+0x6b/0x1b2
[<ffffffff81535e2c>] netlink_recvmsg+0x1cc/0x322
[<ffffffff815205d9>] ? rtnetlink_rcv+0x2b/0x2d
[<ffffffff814ff3f5>] __sock_recvmsg+0x6a/0x77
[<ffffffff814ff473>] sock_recvmsg+0x71/0x8a
[<ffffffff8150aea1>] ? copy_from_user+0x9/0xb
[<ffffffff8150b207>] ? verify_iovec+0x54/0xa8
[<ffffffff81500f59>] ___sys_recvmsg+0x13b/0x20d
[<ffffffff811602ca>] ? handle_mm_fault+0x536/0x550
[<ffffffff815ce8a6>] ? __do_page_fault+0x307/0x389
[<ffffffff81162789>] ? remove_vma+0x5d/0x65
[<ffffffff8116467d>] ? do_munmap+0x332/0x34c
[<ffffffff81501323>] __sys_recvmsg+0x42/0x60
[<ffffffff8150135a>] sys_recvmsg+0x19/0x1b
[<ffffffff815d1c99>] system_call_fastpath+0x16/0x1b
Code: 89 43 2c e9 61 ff ff ff 48 89 df ff 53 38 85 c0 75 7d ff 43 30 e9 4f ff
ff ff c6 43 28 04 48 3b 43 10 74 69 48 8b 10 48 89 53 18 <48> 39 42 18 75 20 f6
40 2a 02 75 11 be 90 05 00 00 48 c7 c7 2a
RIP [<ffffffffa00a75c0>] fib6_walk_continue+0xd3/0x13c [ipv6]
RSP <ffff880400677a48>
CR2: 0000000000000018
Thanks,
Ben
--
Ben Greear <greearb@...delatech.com>
Candela Technologies Inc http://www.candelatech.com
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists