| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20250611210629.3099711-1-kuni1840@gmail.com> Date: Wed, 11 Jun 2025 14:03:20 -0700 From: Kuniyuki Iwashima <kuni1840@...il.com> To: kuba@...nel.org Cc: davem@...emloft.net, dsahern@...il.com, edumazet@...gle.com, horms@...nel.org, idosch@...dia.com, kuniyu@...gle.com, mlxsw@...dia.com, netdev@...r.kernel.org, pabeni@...hat.com, petrm@...dia.com, razor@...ckwall.org Subject: Re: [PATCH net-next 00/14] ipmr, ip6mr: Allow MC-routing locally-generated MC packets From: Jakub Kicinski <kuba@...nel.org> Date: Wed, 11 Jun 2025 13:23:20 -0700 > On Wed, 11 Jun 2025 17:30:15 +0200 Petr Machata wrote: > > Could it actually have been caused by another test? The howto page > > mentions that the CI is running the tests one at a time, so I don't > > suppose that's a possibility. > > > > I'll try to run a more fuller suite tomorrow and star at the code a bit > > to see if I might be missing an error branch or something. > > We also hit a crash in ipv6 fcnal.sh, too. Looks like this is either a > kmemleak false positive or possibly related to the rtnl changes in ipv6. > Either way I it's not related to you changes, sorry about that! :( > > [ 2900.792890] BUG: kernel NULL pointer dereference, address: 0000000000000108 > [ 2900.792961] #PF: supervisor read access in kernel mode > [ 2900.793017] #PF: error_code(0x0000) - not-present page > [ 2900.793053] PGD 8fd6067 P4D 8fd6067 PUD 6402067 PMD 0 > [ 2900.793097] Oops: Oops: 0000 [#1] SMP NOPTI > [ 2900.793127] CPU: 0 UID: 0 PID: 15652 Comm: nettest Not tainted 6.15.0-virtme #1 PREEMPT(voluntary) > [ 2900.793200] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 > [ 2900.793245] RIP: 0010:ip6_pol_route+0x286/0x4a0 fwiw, my local syzkaller had the same splat on 6a325aed130b, where my IPv6 series hadn't landed, and syzbot had a similar one on f1b785f4c787, where my RTNL work was on the prep stage, so I think this is an old? bug :) I'll see if the .syz repro in the report still works on the latest. syzbot: https://lore.kernel.org/netdev/67a21f26.050a0220.163cdc.0068.GAE@google.com/ syzkaller: ---8<--- BUG: unable to handle page fault for address: 00007f93e4d51a23 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 12cd4c067 P4D 125130067 PUD 0 Oops: Oops: 0000 [#1] SMP CPU: 1 UID: 0 PID: 2259 Comm: syz.2.555 Not tainted 6.15.0-rc1-00220-g6a325aed130b #2 PREEMPT(voluntary) fb2957dd255dfc2983199dfa2ccdedc09370f316 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 RIP: 0010:arch_atomic_read arch/x86/include/asm/atomic.h:23 [inline] RIP: 0010:raw_atomic_read include/linux/atomic/atomic-arch-fallback.h:457 [inline] RIP: 0010:atomic_read include/linux/atomic/atomic-instrumented.h:33 [inline] RIP: 0010:rt_genid_ipv6 include/net/net_namespace.h:537 [inline] RIP: 0010:rt6_is_valid net/ipv6/route.c:1435 [inline] RIP: 0010:rt6_get_pcpu_route net/ipv6/route.c:1445 [inline] RIP: 0010:ip6_pol_route+0x301/0x9d0 net/ipv6/route.c:2298 Code: a9 fe 4d 85 ff 4c 8b 74 24 10 74 3b 41 8b 9f 98 00 00 00 31 ff 89 de e8 3d 37 a9 fe 85 db 74 33 49 8b 07 48 8b 80 08 01 00 00 <8b> a8 24 0a 00 00 89 df 89 ee e8 f0 34 a9 fe 39 eb 75 20 e8 67 33 RSP: 0018:ffa0000000c3ba20 EFLAGS: 00010202 RAX: 00007f93e4d50fff RBX: 000000001ac62540 RCX: 0000000000000002 RDX: ff11000005e99700 RSI: 000000001ac62540 RDI: 0000000000000000 RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000 R10: 00000000ffff0000 R11: 0000000000000002 R12: ffffffff829af127 R13: 0000000000000000 R14: ff110001053e2580 R15: ff1100012505f400 FS: 00007f190e8276c0(0000) GS:ff110001b79d2000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f93e4d51a23 CR3: 000000011d7b5004 CR4: 0000000000771ef0 DR0: 0000000080000001 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000600 PKRU: 80000000 Call Trace: <TASK> pol_lookup_func include/net/ip6_fib.h:616 [inline] fib6_rule_lookup+0xe8/0x2a0 net/ipv6/fib6_rules.c:120 ip6_route_output_flags_noref net/ipv6/route.c:2673 [inline] ip6_route_output_flags+0x188/0x260 net/ipv6/route.c:2685 ip6_route_output include/net/ip6_route.h:93 [inline] ip6_dst_lookup_tail+0x9a/0x7d0 net/ipv6/ip6_output.c:1128 ip6_dst_lookup_flow+0x47/0xe0 net/ipv6/ip6_output.c:1259 tcp_v6_connect+0x50c/0x8e0 net/ipv6/tcp_ipv6.c:277 mptcp_connect+0x389/0x680 net/mptcp/protocol.c:3683 __inet_stream_connect+0x11f/0x5c0 net/ipv4/af_inet.c:677 inet_stream_connect+0x36/0x50 net/ipv4/af_inet.c:748 __sys_connect_file net/socket.c:2038 [inline] __sys_connect+0x17b/0x220 net/socket.c:2057 __do_sys_connect net/socket.c:2063 [inline] __se_sys_connect net/socket.c:2060 [inline] __x64_sys_connect+0x1c/0x20 net/socket.c:2060 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xc8/0x1a0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x7f19101bd169 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f190e827038 EFLAGS: 00000246 ORIG_RAX: 000000000000002a RAX: ffffffffffffffda RBX: 00007f19103d5fa0 RCX: 00007f19101bd169 RDX: 000000000000001c RSI: 0000200000000000 RDI: 0000000000000004 RBP: 00007f191023e730 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f19103d5fa0 R15: 00007f19104ffa28 </TASK> Modules linked in: CR2: 00007f93e4d51a23 ---[ end trace 0000000000000000 ]--- RIP: 0010:arch_atomic_read arch/x86/include/asm/atomic.h:23 [inline] RIP: 0010:raw_atomic_read include/linux/atomic/atomic-arch-fallback.h:457 [inline] RIP: 0010:atomic_read include/linux/atomic/atomic-instrumented.h:33 [inline] RIP: 0010:rt_genid_ipv6 include/net/net_namespace.h:537 [inline] RIP: 0010:rt6_is_valid net/ipv6/route.c:1435 [inline] RIP: 0010:rt6_get_pcpu_route net/ipv6/route.c:1445 [inline] RIP: 0010:ip6_pol_route+0x301/0x9d0 net/ipv6/route.c:2298 Code: a9 fe 4d 85 ff 4c 8b 74 24 10 74 3b 41 8b 9f 98 00 00 00 31 ff 89 de e8 3d 37 a9 fe 85 db 74 33 49 8b 07 48 8b 80 08 01 00 00 <8b> a8 24 0a 00 00 89 df 89 ee e8 f0 34 a9 fe 39 eb 75 20 e8 67 33 RSP: 0018:ffa0000000c3ba20 EFLAGS: 00010202 RAX: 00007f93e4d50fff RBX: 000000001ac62540 RCX: 0000000000000002 RDX: ff11000005e99700 RSI: 000000001ac62540 RDI: 0000000000000000 RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000 R10: 00000000ffff0000 R11: 0000000000000002 R12: ffffffff829af127 R13: 0000000000000000 R14: ff110001053e2580 R15: ff1100012505f400 FS: 00007f190e8276c0(0000) GS:ff110001b79d2000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f93e4d51a23 CR3: 000000011d7b5004 CR4: 0000000000771ef0 DR0: 0000000080000001 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000600 PKRU: 80000000 ---------------- Code disassembly (best guess): 0: a9 fe 4d 85 ff test $0xff854dfe,%eax 5: 4c 8b 74 24 10 mov 0x10(%rsp),%r14 a: 74 3b je 0x47 c: 41 8b 9f 98 00 00 00 mov 0x98(%r15),%ebx 13: 31 ff xor %edi,%edi 15: 89 de mov %ebx,%esi 17: e8 3d 37 a9 fe call 0xfea93759 1c: 85 db test %ebx,%ebx 1e: 74 33 je 0x53 20: 49 8b 07 mov (%r15),%rax 23: 48 8b 80 08 01 00 00 mov 0x108(%rax),%rax * 2a: 8b a8 24 0a 00 00 mov 0xa24(%rax),%ebp <-- trapping instruction 30: 89 df mov %ebx,%edi 32: 89 ee mov %ebp,%esi 34: e8 f0 34 a9 fe call 0xfea93529 39: 39 eb cmp %ebp,%ebx 3b: 75 20 jne 0x5d 3d: e8 .byte 0xe8 3e: 67 addr32 3f: 33 .byte 0x33 ---8<---
Powered by blists - more mailing lists