netdev - Re: 4.15.13 kernel panic, ip_rcv_finish, nf_xfrm_me

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20181209183257.z2yn5zggcgumbvgd@breakpoint.cc>
Date:   Sun, 9 Dec 2018 19:32:57 +0100
From:   Florian Westphal <fw@...len.de>
To:     Martin Zaharinov <micron10@...il.com>
Cc:     nuclearcat@...learcat.com, netdev@...r.kernel.org
Subject: Re: 4.15.13 kernel panic, ip_rcv_finish, nf_xfrm_me_harder warnings
 continue to fill dmesg

Martin Zaharinov <micron10@...il.com> wrote:
> I use latest kernel 4.19.8 and have same problem see down
> i use pppoe with 1k+ users if i activate shaper with hfsc and imq machine crash and reboot 
> after stop shaper for test mashine only send in dmesg bug error mesg.

dst_hold use there sure looks fishy.  Can you try this patch?

diff --git a/net/netfilter/nf_nat_core.c b/net/netfilter/nf_nat_core.c
index e2b196054dfc..22f18444c95e 100644
--- a/net/netfilter/nf_nat_core.c
+++ b/net/netfilter/nf_nat_core.c
@@ -117,8 +117,10 @@ int nf_xfrm_me_harder(struct net *net, struct sk_buff *skb, unsigned int family)
 	dst = skb_dst(skb);
 	if (dst->xfrm)
 		dst = ((struct xfrm_dst *)dst)->route;
-	dst_hold(dst);
-
+	if (!dst_hold_safe(dst)) {
+		pr_warn_ratelimited("dst_hold_safe failure\n");
+		return -EHOSTUNREACH;
+	}
 	if (sk && !net_eq(net, sock_net(sk)))
 		sk = NULL;