netdev - Re: linux-next: BUG: unable to handle kernel NULL pointer dereference in __sk_mem_raise

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 14 Nov 2016 15:35:01 -0800
From:   Eric Dumazet <eric.dumazet@...il.com>
To:     Andrei Vagin <avagin@...il.com>
Cc:     Linux Kernel Network Developers <netdev@...r.kernel.org>,
        Paolo Abeni <pabeni@...hat.com>
Subject: Re: linux-next: BUG: unable to handle kernel NULL pointer
 dereference in __sk_mem_raise_allocated()

On Mon, 2016-11-14 at 15:24 -0800, Andrei Vagin wrote:
> Hi Paolo,
> 
> Our test system detected a kernel oops. Looks like a problem in the
> "udp: refactor memory accounting" series.
> 
> # good: [f970bd9e3a06f06df8d8ecf1f8ad2c8615cc17eb] udp: implement
> memory accounting helpers
> git bisect good f970bd9e3a06f06df8d8ecf1f8ad2c8615cc17eb
> # bad: [2d0e30c30f84d08dc16f0f2af41f1b8a85f0755e] bpf: add helper for
> retrieving current numa node id
> git bisect bad 2d0e30c30f84d08dc16f0f2af41f1b8a85f0755e
> # bad: [a10b91b8b81c29b87ff5a6d58c1402898337b956] Merge branch 'udpmem'
> git bisect bad a10b91b8b81c29b87ff5a6d58c1402898337b956
> # good: [850cbaddb52dfd4e0c7cabe2c168dd34b44ae0b9] udp: use it's own
> memory accounting schema
> git bisect good 850cbaddb52dfd4e0c7cabe2c168dd34b44ae0b9
> # first bad commit: [a10b91b8b81c29b87ff5a6d58c1402898337b956] Merge
> branch 'udpmem'
> 
> 
> [  112.472363] BUG: unable to handle kernel NULL pointer dereference
> at           (null)
> [  112.473360] IP: [<ffffffffb76f8031>] __sk_mem_raise_allocated+0x31/0x3f0
> [  112.474156] PGD 62a08067 [  112.474455] PUD 2b8bf067
> PMD 0 [  112.474856]
> [  112.475054] Oops: 0002 [#1] SMP
> [  112.475431] Modules linked in: nf_conntrack_netlink udp_diag
> tcp_diag inet_diag netlink_diag af_packet_diag unix_diag binfmt_misc
> nf_conntrack_ipv6 nf_defrag_ipv6 nf_conntrack_ipv4 nf_defrag_ipv4
> xt_conntrack nf_conntrack nfnetlink ip6table_filter ip6_tables ppdev
> sunrpc crc32c_intel joydev virtio_balloon virtio_net i2c_piix4
> parport_pc parport acpi_cpufreq tpm_tis tpm_tis_core tpm virtio_blk
> serio_raw virtio_pci virtio_ring virtio ata_generic pata_acpi
> [  112.480594] CPU: 1 PID: 7405 Comm: socket_udplite Not tainted 4.8.0+ #84
> [  112.481377] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),
> BIOS 1.9.1-1.fc24 04/01/2014
> [  112.482375] task: ffff928a5b5fa540 task.stack: ffffb3b484a0c000
> [  112.483059] RIP: 0010:[<ffffffffb76f8031>]  [<ffffffffb76f8031>]
> __sk_mem_raise_allocated+0x31/0x3f0
> [  112.484135] RSP: 0018:ffff928abfd03b18  EFLAGS: 00010296
> [  112.484758] RAX: 0000000000000001 RBX: ffff928aa293cfc0 RCX: 0000000000000001
> [  112.485585] RDX: 0000000000000000 RSI: 0000000000001000 RDI: ffff928aa293cfc0
> [  112.486414] RBP: ffff928abfd03b48 R08: 0de4c53600000000 R09: 0000000000000000
> [  112.487241] R10: 000000006226b971 R11: 0000000000000000 R12: ffff928aa293cfc0
> [  112.488064] R13: 0000000000000001 R14: ffffffffb7f0d5a0 R15: 0000000000001000
> [  112.488893] FS:  00007f058067a700(0000) GS:ffff928abfd00000(0000)
> knlGS:0000000000000000
> [  112.489807] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [  112.490447] CR2: 0000000000000000 CR3: 000000002b8f5000 CR4: 00000000000006e0
> [  112.491248] DR0: 00000000000100a0 DR1: 0000000000000000 DR2: 0000000000000000
> [  112.492025] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
> [  112.492808] Stack:
> [  112.493038]  0000000100000300 ffff928aa293cfc0 ffff928a651b9c00
> 0000000000000300
> [  112.493912]  ffff928aa293d108 0000000000001000 ffff928abfd03b88
> ffffffffb779e094
> [  112.494782]  ffff928abfd03b70 ffff928a651b9c00 ffff928aa293cfc0
> 0000000000000000

Thanks for the report.

I guess following patch would be needed ?

diff --git a/net/ipv4/udplite.c b/net/ipv4/udplite.c
index af817158d830c0da080935ba29e012dffbb89112..12604c0371c451efcc9aad278bb86be9ac4bb813 100644
--- a/net/ipv4/udplite.c
+++ b/net/ipv4/udplite.c
@@ -54,6 +54,7 @@ struct proto 	udplite_prot = {
 	.hash		   = udp_lib_hash,
 	.unhash		   = udp_lib_unhash,
 	.get_port	   = udp_v4_get_port,
+	.memory_allocated  = &udp_memory_allocated,
 	.obj_size	   = sizeof(struct udp_sock),
 	.h.udp_table	   = &udplite_table,
 #ifdef CONFIG_COMPAT
diff --git a/net/ipv6/udplite.c b/net/ipv6/udplite.c
index 47d0d2b87106558fece3496479198005c55b99e7..946025c888cc9519fb3523edbbe8afbb18273326 100644
--- a/net/ipv6/udplite.c
+++ b/net/ipv6/udplite.c
@@ -49,6 +49,7 @@ struct proto udplitev6_prot = {
 	.hash		   = udp_lib_hash,
 	.unhash		   = udp_lib_unhash,
 	.get_port	   = udp_v6_get_port,
+	.memory_allocated  = &udp_memory_allocated,
 	.obj_size	   = sizeof(struct udp6_sock),
 	.h.udp_table	   = &udplite_table,
 #ifdef CONFIG_COMPAT