netdev - kernel oops on gretap teardown

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Date:	Mon, 17 Mar 2014 11:03:32 +0000
From:	Alex Zeffertt <alex.zeffertt@...il.com>
To:	netdev@...r.kernel.org
Subject: kernel oops on gretap teardown

All,

I can reliably hang the kernel 3.11.0 kernel on my Ubuntu box by
shutting down multiple gretap interfaces (near) simultaneously.  The
gretap interfaces belong to LXC containers that are all running on the
same host, so they are all in different namespaces.

This crash only occurs if I shut down the containers (and therefore
the interfaces) forcibly using "lxc-stop -k".  If I omit the "-k" the
crash does not occur (and the shutdown takes *much* longer).

[  202.827256] BUG: unable to handle kernel NULL pointer dereference at 000000fc
[  202.828153] IP: [<f867c22a>] ip_tunnel_lookup+0x22a/0x2e0 [ip_tunnel]
[  202.831060] Call Trace:
[  202.831060]  [<f8685d66>] ipgre_rcv+0x86/0xe0 [ip_gre]
[  202.831060]  [<f86776a6>] gre_cisco_rcv+0x36/0x80 [gre]
[  202.831060]  [<f8677390>] gre_rcv+0x50/0x80 [gre]
[  202.831060]  [<c157d157>] ip_local_deliver_finish+0x97/0x220
[  202.831060]  [<c157d444>] ip_local_deliver+0x44/0x90

When I looked at the program counter in gdb I found that the crash was
due to the NULL pointer t->dev being dereferenced.  This lead me to
try the following patch, which "fixed" the problem.

 --- net/ipv4/ip_tunnel.c.orig 2014-03-14 14:22:08.254042459 +0000
+++ net/ipv4/ip_tunnel.c 2014-03-14 14:37:39.644441999 +0000
@@ -201,7 +201,7 @@
  goto skip_key_lookup;

  hlist_for_each_entry_rcu(t, head, hash_node) {
- if (t->parms.i_key != key ||
+ if (t->parms.i_key != key || !(t->dev) ||
     !(t->dev->flags & IFF_UP))
  continue;

However, I can't see where t->dev is getting cleared in the code.  Can
anybody suggest what the ultimate cause of the problem is?

Regards,

Alex
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html