* [Patch net] ipv6: reorder icmpv6_init() and ip6_mr_init()
@ 2017-03-05 20:34 Cong Wang
2017-03-06 13:25 ` Andrey Konovalov
2017-03-07 22:57 ` David Miller
0 siblings, 2 replies; 3+ messages in thread
From: Cong Wang @ 2017-03-05 20:34 UTC (permalink / raw)
To: netdev; +Cc: andreyknvl, Cong Wang
Andrey reported the following kernel crash:
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] SMP KASAN
Dumping ftrace buffer:
(ftrace buffer empty)
Modules linked in:
CPU: 0 PID: 14446 Comm: syz-executor6 Not tainted 4.10.0+ #82
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
task: ffff88001f311700 task.stack: ffff88001f6e8000
RIP: 0010:ip6mr_sk_done+0x15a/0x3d0 net/ipv6/ip6mr.c:1618
RSP: 0018:ffff88001f6ef418 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: 1ffff10003edde8c RCX: ffffc900043ee000
RDX: 0000000000000004 RSI: ffffffff83e3b3f8 RDI: 0000000000000020
RBP: ffff88001f6ef508 R08: fffffbfff0dcc5d8 R09: 0000000000000000
R10: ffffffff86e62ec0 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: ffff88001f6ef4e0 R15: ffff8800380a0040
FS: 00007f7a52cec700(0000) GS:ffff88003ec00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000061c500 CR3: 000000001f1ae000 CR4: 00000000000006f0
DR0: 0000000020000000 DR1: 0000000020000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
rawv6_close+0x4c/0x80 net/ipv6/raw.c:1217
inet_release+0xed/0x1c0 net/ipv4/af_inet.c:425
inet6_release+0x50/0x70 net/ipv6/af_inet6.c:432
sock_release+0x8d/0x1e0 net/socket.c:597
__sock_create+0x39d/0x880 net/socket.c:1226
sock_create_kern+0x3f/0x50 net/socket.c:1243
inet_ctl_sock_create+0xbb/0x280 net/ipv4/af_inet.c:1526
icmpv6_sk_init+0x163/0x500 net/ipv6/icmp.c:954
ops_init+0x10a/0x550 net/core/net_namespace.c:115
setup_net+0x261/0x660 net/core/net_namespace.c:291
copy_net_ns+0x27e/0x540 net/core/net_namespace.c:396
9pnet_virtio: no channels available for device ./file1
create_new_namespaces+0x437/0x9b0 kernel/nsproxy.c:106
unshare_nsproxy_namespaces+0xae/0x1e0 kernel/nsproxy.c:205
SYSC_unshare kernel/fork.c:2281 [inline]
SyS_unshare+0x64e/0x1000 kernel/fork.c:2231
entry_SYSCALL_64_fastpath+0x1f/0xc2
This is because net->ipv6.mr6_tables is not initialized at that point,
ip6mr_rules_init() is not called yet, therefore on the error path when
we iterator the list, we trigger this oops. Fix this by reordering
ip6mr_rules_init() before icmpv6_sk_init().
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
---
net/ipv6/af_inet6.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index 04db406..a9a9553 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -920,12 +920,12 @@ static int __init inet6_init(void)
err = register_pernet_subsys(&inet6_net_ops);
if (err)
goto register_pernet_fail;
- err = icmpv6_init();
- if (err)
- goto icmp_fail;
err = ip6_mr_init();
if (err)
goto ipmr_fail;
+ err = icmpv6_init();
+ if (err)
+ goto icmp_fail;
err = ndisc_init();
if (err)
goto ndisc_fail;
@@ -1061,10 +1061,10 @@ static int __init inet6_init(void)
ndisc_cleanup();
ndisc_fail:
ip6_mr_cleanup();
-ipmr_fail:
- icmpv6_cleanup();
icmp_fail:
unregister_pernet_subsys(&inet6_net_ops);
+ipmr_fail:
+ icmpv6_cleanup();
register_pernet_fail:
sock_unregister(PF_INET6);
rtnl_unregister_all(PF_INET6);
--
2.5.5
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [Patch net] ipv6: reorder icmpv6_init() and ip6_mr_init()
2017-03-05 20:34 [Patch net] ipv6: reorder icmpv6_init() and ip6_mr_init() Cong Wang
@ 2017-03-06 13:25 ` Andrey Konovalov
2017-03-07 22:57 ` David Miller
1 sibling, 0 replies; 3+ messages in thread
From: Andrey Konovalov @ 2017-03-06 13:25 UTC (permalink / raw)
To: Cong Wang; +Cc: netdev
On Sun, Mar 5, 2017 at 9:34 PM, Cong Wang <xiyou.wangcong@gmail.com> wrote:
> Andrey reported the following kernel crash:
>
> kasan: GPF could be caused by NULL-ptr deref or user memory access
> general protection fault: 0000 [#1] SMP KASAN
> Dumping ftrace buffer:
> (ftrace buffer empty)
> Modules linked in:
> CPU: 0 PID: 14446 Comm: syz-executor6 Not tainted 4.10.0+ #82
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
> task: ffff88001f311700 task.stack: ffff88001f6e8000
> RIP: 0010:ip6mr_sk_done+0x15a/0x3d0 net/ipv6/ip6mr.c:1618
> RSP: 0018:ffff88001f6ef418 EFLAGS: 00010202
> RAX: dffffc0000000000 RBX: 1ffff10003edde8c RCX: ffffc900043ee000
> RDX: 0000000000000004 RSI: ffffffff83e3b3f8 RDI: 0000000000000020
> RBP: ffff88001f6ef508 R08: fffffbfff0dcc5d8 R09: 0000000000000000
> R10: ffffffff86e62ec0 R11: 0000000000000000 R12: 0000000000000000
> R13: 0000000000000000 R14: ffff88001f6ef4e0 R15: ffff8800380a0040
> FS: 00007f7a52cec700(0000) GS:ffff88003ec00000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 000000000061c500 CR3: 000000001f1ae000 CR4: 00000000000006f0
> DR0: 0000000020000000 DR1: 0000000020000000 DR2: 0000000000000000
> DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
> Call Trace:
> rawv6_close+0x4c/0x80 net/ipv6/raw.c:1217
> inet_release+0xed/0x1c0 net/ipv4/af_inet.c:425
> inet6_release+0x50/0x70 net/ipv6/af_inet6.c:432
> sock_release+0x8d/0x1e0 net/socket.c:597
> __sock_create+0x39d/0x880 net/socket.c:1226
> sock_create_kern+0x3f/0x50 net/socket.c:1243
> inet_ctl_sock_create+0xbb/0x280 net/ipv4/af_inet.c:1526
> icmpv6_sk_init+0x163/0x500 net/ipv6/icmp.c:954
> ops_init+0x10a/0x550 net/core/net_namespace.c:115
> setup_net+0x261/0x660 net/core/net_namespace.c:291
> copy_net_ns+0x27e/0x540 net/core/net_namespace.c:396
> 9pnet_virtio: no channels available for device ./file1
> create_new_namespaces+0x437/0x9b0 kernel/nsproxy.c:106
> unshare_nsproxy_namespaces+0xae/0x1e0 kernel/nsproxy.c:205
> SYSC_unshare kernel/fork.c:2281 [inline]
> SyS_unshare+0x64e/0x1000 kernel/fork.c:2231
> entry_SYSCALL_64_fastpath+0x1f/0xc2
>
> This is because net->ipv6.mr6_tables is not initialized at that point,
> ip6mr_rules_init() is not called yet, therefore on the error path when
> we iterator the list, we trigger this oops. Fix this by reordering
> ip6mr_rules_init() before icmpv6_sk_init().
>
> Reported-by: Andrey Konovalov <andreyknvl@google.com>
> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
> ---
> net/ipv6/af_inet6.c | 10 +++++-----
> 1 file changed, 5 insertions(+), 5 deletions(-)
>
> diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
> index 04db406..a9a9553 100644
> --- a/net/ipv6/af_inet6.c
> +++ b/net/ipv6/af_inet6.c
> @@ -920,12 +920,12 @@ static int __init inet6_init(void)
> err = register_pernet_subsys(&inet6_net_ops);
> if (err)
> goto register_pernet_fail;
> - err = icmpv6_init();
> - if (err)
> - goto icmp_fail;
> err = ip6_mr_init();
> if (err)
> goto ipmr_fail;
> + err = icmpv6_init();
> + if (err)
> + goto icmp_fail;
> err = ndisc_init();
> if (err)
> goto ndisc_fail;
> @@ -1061,10 +1061,10 @@ static int __init inet6_init(void)
> ndisc_cleanup();
> ndisc_fail:
> ip6_mr_cleanup();
> -ipmr_fail:
> - icmpv6_cleanup();
> icmp_fail:
> unregister_pernet_subsys(&inet6_net_ops);
> +ipmr_fail:
> + icmpv6_cleanup();
> register_pernet_fail:
> sock_unregister(PF_INET6);
> rtnl_unregister_all(PF_INET6);
> --
> 2.5.5
>
Thanks!
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [Patch net] ipv6: reorder icmpv6_init() and ip6_mr_init()
2017-03-05 20:34 [Patch net] ipv6: reorder icmpv6_init() and ip6_mr_init() Cong Wang
2017-03-06 13:25 ` Andrey Konovalov
@ 2017-03-07 22:57 ` David Miller
1 sibling, 0 replies; 3+ messages in thread
From: David Miller @ 2017-03-07 22:57 UTC (permalink / raw)
To: xiyou.wangcong; +Cc: netdev, andreyknvl
From: Cong Wang <xiyou.wangcong@gmail.com>
Date: Sun, 5 Mar 2017 12:34:53 -0800
> Andrey reported the following kernel crash:
...
> This is because net->ipv6.mr6_tables is not initialized at that point,
> ip6mr_rules_init() is not called yet, therefore on the error path when
> we iterator the list, we trigger this oops. Fix this by reordering
> ip6mr_rules_init() before icmpv6_sk_init().
>
> Reported-by: Andrey Konovalov <andreyknvl@google.com>
> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Applied, thanks.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2017-03-07 22:59 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-03-05 20:34 [Patch net] ipv6: reorder icmpv6_init() and ip6_mr_init() Cong Wang
2017-03-06 13:25 ` Andrey Konovalov
2017-03-07 22:57 ` David Miller
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.