netdev - Re: flow cache removed = xfrm doesnt work

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 30 Nov 2017 11:20:51 +0100
From:   Steffen Klassert <steffen.klassert@...unet.com>
To:     Tomas Charvat <tc@...ello.cz>
CC:     David Miller <davem@...emloft.net>, <fw@...len.de>,
        <netdev@...r.kernel.org>
Subject: Re: flow cache removed = xfrm doesnt work

On Mon, Nov 27, 2017 at 05:46:28PM +0100, Tomas Charvat wrote:
> Gentoo-sources has no change vs vanilla in ipsec. However here is result
> from Vanila 4.14.2 with OFFLOAD=N
> 
> [ 2338.440735] BUG: unable to handle kernel NULL pointer dereference at
> 0000000000000018
> [ 2338.440830] IP: xfrm_output_resume+0x211/0x460
> [ 2338.440897] PGD 0 P4D 0
> [ 2338.440960] Oops: 0000 [#1] SMP
> [ 2338.441025] CPU: 0 PID: 31977 Comm: stunnel Not tainted 4.14.2 #2
> [ 2338.441098] Hardware name: Supermicro H8DGU/H8DGU, BIOS 3.5c      
> 03/18/2016
> [ 2338.441174] task: ffff98c4dc0ee4c0 task.stack: ffffb41460d84000
> [ 2338.441248] RIP: 0010:xfrm_output_resume+0x211/0x460
> [ 2338.441343] RSP: 0018:ffffb41460d87900 EFLAGS: 00010246
> [ 2338.441413] RAX: 0000000000000000 RBX: ffff98c54090e2e0 RCX:
> 0000000000000000
> [ 2338.441489] RDX: 000000000000001b RSI: 0000000000000000 RDI:
> 0000000000000000
> [ 2338.441565] RBP: ffffb41460d87960 R08: ffffb41460d87780 R09:
> ffff98c54b94ec50
> [ 2338.441640] R10: ffff98c4d6bd38cc R11: 0000000000000000 R12:
> ffffffff8cb0f740
> [ 2338.441716] R13: ffff98c54b94e400 R14: ffff98c54b94e43c R15:
> ffffb41460d87b28
> [ 2338.441792] FS:  00007ec52f91c700(0000) GS:ffff98c54fc00000(0000)
> knlGS:0000000000000000
> [ 2338.441871] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 2338.441942] CR2: 0000000000000018 CR3: 000000100a5e6000 CR4:
> 00000000000406f0
> [ 2338.442018] Call Trace:
> [ 2338.442083]  ? skb_checksum+0x3f/0x60
> [ 2338.442227]  ? reqsk_fastopen_remove+0x160/0x160
> [ 2338.442374]  ? skb_panic+0x70/0x70
> [ 2338.442546]  xfrm_output+0x6a/0x110
> [ 2338.442689]  xfrm6_output_finish+0x38/0x40
> [ 2338.442834]  __xfrm6_output+0x57/0x1e0
> [ 2338.442978]  xfrm6_output+0x9e/0x110
> [ 2338.443121]  ? xfrm6_local_rxpmtu+0x90/0x90
> [ 2338.443267]  ip6_xmit+0x297/0x550
> [ 2338.443409]  ? ip6_dst_check+0xd7/0xf0
> [ 2338.443555]  ? __ip6_append_data.isra.42+0xc00/0xc00
> [ 2338.443705]  inet6_csk_xmit+0xaa/0x100
> [ 2338.443880]  tcp_transmit_skb+0x57f/0xa00
> [ 2338.444038]  tcp_write_xmit+0x1cd/0xf90
> [ 2338.444183]  __tcp_push_pending_frames+0x3f/0xb0
> [ 2338.444330]  tcp_push+0xf6/0x120
> [ 2338.444471]  tcp_sendmsg_locked+0x672/0xe30
> [ 2338.444617]  tcp_sendmsg+0x3a/0x60
> [ 2338.444760]  inet_sendmsg+0x3b/0xb0
> [ 2338.444904]  sock_sendmsg+0x48/0x60
> [ 2338.445070]  sock_write_iter+0x8d/0x100
> [ 2338.445216]  __vfs_write+0x154/0x1b0
> [ 2338.445359]  vfs_write+0xcd/0x1c0
> [ 2338.445501]  SyS_write+0x62/0xd0
> [ 2338.445643]  entry_SYSCALL_64_fastpath+0x13/0x94
> [ 2338.445789] RIP: 0033:0x7ec52eb3336d
> [ 2338.445930] RSP: 002b:00007ec52f91bd40 EFLAGS: 00000293 ORIG_RAX:
> 0000000000000001
> [ 2338.446189] RAX: ffffffffffffffda RBX: 00007ec520011010 RCX:
> 00007ec52eb3336d
> [ 2338.446341] RDX: 000000000000001c RSI: 000056f01370b5a0 RDI:
> 0000000000000003
> [ 2338.446495] RBP: 0000000000000000 R08: 0000000000000000 R09:
> 0000000000000000
> [ 2338.446647] R10: 0000000000000000 R11: 0000000000000293 R12:
> 000056f011c8010c
> [ 2338.446800] R13: 00007ec520010fc0 R14: 000056f013706da0 R15:
> 0000000000000047
> [ 2338.446952] Code: f6 0f 8f b9 fe ff ff 31 f6 85 d2 0f 8f af fe ff ff
> e9 bb fe ff ff 85 f6 89 f0 0f 85 d6 fe ff ff 48 8b 7b 58 48 89 f8 48 83
> e0 fe <4c> 8b 70 18 4d 85 f6 0f 84 a3 01 00 00 41 8b 86 80 00 00 00 85

When I look at this code, I'd say it tries to dereference dst->child
and dst is a NULL pointer. Unfortunately I don't see how this can
happen. I need to find a way to reproduce this.

Can you show me your policy and SA database, i.e.
'ip x s' and 'ip x p'?

Also, please show /proc/crypto