netdev - Re: Netfilter: BUG: unable to handle kernel paging request, RIP: physdev

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20150914144516.GM24810@breakpoint.cc>
Date:	Mon, 14 Sep 2015 16:45:16 +0200
From:	Florian Westphal <fw@...len.de>
To:	Sander Eikelenboom <linux@...elenboom.it>
Cc:	Florian Westphal <fw@...len.de>, netdev@...r.kernel.org,
	netfilter@...r.kernel.org, Pablo Neira Ayuso <pablo@...filter.org>
Subject: Re: Netfilter: BUG: unable to handle kernel paging request, RIP:
 physdev_mt+0xd6/0x160

Sander Eikelenboom <linux@...elenboom.it> wrote:
> On 2015-09-13 20:06, Florian Westphal wrote:
> >Sander Eikelenboom <linux@...elenboom.it> wrote:
> >>Using a linux-4.3-rc1 kernel i encountered the splat below:
> >
> >Thanks for reporting this bug.
> >
> >>[  290.200642] BUG: unable to handle kernel paging request at
> >>000000000484195d
> >>[  290.211702] IP: [<ffffffff819bc3e6>] physdev_mt+0xd6/0x160
> >[..]
> >
> >>[  290.444088]  [<ffffffff81a4e6c0>] ipt_do_table+0x210/0x390
> >>[  290.461951]  [<ffffffff81a510ae>] iptable_filter_hook+0x2e/0x70
> >>[  290.470756]  [<ffffffff8199279c>] nf_iterate+0x4c/0x80
> >>[  290.479587]  [<ffffffff81992834>] nf_hook_slow+0x64/0xc0
> >>[  290.488341]  [<ffffffff81a06779>] ip_forward+0x369/0x3c0
> >>[  290.496927]  [<ffffffff81a06380>] ? ip_frag_mem+0x40/0x40
> >>[  290.505365]  [<ffffffff81a04961>] ip_rcv_finish+0x101/0x330
> >>[  290.513480]  [<ffffffff81a05001>] ip_rcv+0x291/0x390
> >>[  290.521562]  [<ffffffff81a04860>] ?
> >
> >Aye, ip forwarding of bridged packets with call-iptables=1 is broken.
> >
> >Please, could you try this patch?  It fixes this bug for me.
> 
> Hi Florian,
> 
> Works for me too, thx for the fix !

Sorry, I made this claim too early.

We cannot use this fix, since it will still cause kernel oops when using
-j NFQUEUE in PRE_ROUTING (We would bump refcnt on ->physoutdev, which is
garbage in this case).

Only option is to undo 72b1e5e4cac as follows:

diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -183,7 +183,8 @@ struct nf_bridge_info {
 		/* prerouting: detect dnat in orig/reply direction */
 		__be32          ipv4_daddr;
 		struct in6_addr ipv6_daddr;
-
+	};
+	union {
 		/* after prerouting + nat detected: store original source
 		 * mac since neigh resolution overwrites it, only used while
 		 * skb is out in neigh layer.

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html