netdev - Re: [PATCH net v2] ipv6: Handle race in addrconf_dad

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <3dc05826-4661-8a8e-0c15-1a711ec84d07@gmail.com>
Date:   Wed, 2 Oct 2019 15:21:52 -0700
From:   Eric Dumazet <eric.dumazet@...il.com>
To:     David Ahern <dsahern@...il.com>,
        Eric Dumazet <eric.dumazet@...il.com>,
        David Ahern <dsahern@...nel.org>, davem@...emloft.net,
        jakub.kicinski@...ronome.com
Cc:     netdev@...r.kernel.org, rajendra.dendukuri@...adcom.com
Subject: Re: [PATCH net v2] ipv6: Handle race in addrconf_dad_work



On 10/2/19 3:13 PM, David Ahern wrote:
> On 10/2/19 3:23 PM, Eric Dumazet wrote:
>>
>>
>> On 10/2/19 2:08 PM, Eric Dumazet wrote:
>>>
>>>
>>> On 10/1/19 11:18 AM, Eric Dumazet wrote:
>>>>
>>>>
>>>> On 9/30/19 8:28 PM, David Ahern wrote:
>>>>> From: David Ahern <dsahern@...il.com>
>>>>>
>>>>> Rajendra reported a kernel panic when a link was taken down:
>>>>>
>>>>> [ 6870.263084] BUG: unable to handle kernel NULL pointer dereference at 00000000000000a8
>>>>> [ 6870.271856] IP: [<ffffffff8efc5764>] __ipv6_ifa_notify+0x154/0x290
>>>>>
>>>>> <snip>
>>>>>
>>>>
>>>> Reviewed-by: Eric Dumazet <edumazet@...gle.com>
>>>>
>>>> Thanks !
>>>>
>>>
>>> Apparently this patch causes problems. I yet have to make an analysis.
> 
> Ugh. I presume syzbot? can you forward the stack trace?

No syzbot this time, but complete lack of connectivity on some of my test hosts.

Incoming IPv6 packets go to ip6_forward() (!!!) and are dropped there.

There seems to be something missing.

ifp->state stays at INET6_IFADDR_STATE_PREDAD instead of INET6_IFADDR_STATE_DAD