* Fw: [BUG] 2.6.20 Oopses in xfrm_audit_log
@ 2007-02-12 22:21 Andrew Morton
2007-02-12 22:49 ` David Miller
0 siblings, 1 reply; 12+ messages in thread
From: Andrew Morton @ 2007-02-12 22:21 UTC (permalink / raw)
To: netdev; +Cc: Charles-Edouard Ruault
Begin forwarded message:
Date: Mon, 12 Feb 2007 15:16:04 +0100
From: Charles-Edouard Ruault <ce@ruault.com>
To: linux-kernel@vger.kernel.org, linux-net@vger.kernel.org
Subject: [BUG] 2.6.20 Oopses in xfrm_audit_log
Hi All,
i upgraded to vanilla kernel 2.6.20 and while i was using strongswan
2.8.2 to setup an IPSEC VPN i got the following kernel Ooops.
I had successfully established the same tunnel a few times, but key
renegotiation caused a problem ( both ends did not renegotiate at the
same time so the tunnel was frozen ), i decided to kill the tunnel and
start a new one ( using ipsec auto --down tunnel & ipsec auto --up
tunnel ), while i was doing so, i got the oops.
BUG: unable to handle kernel NULL pointer dereference at virtual address
00000188
printing eip:
c02fb85c
*pde = 00000000
Oops: 0000 [#1]
PREEMPT
Modules linked in: xfrm4_mode_tunnel usblp deflate zlib_deflate twofish
twofish_common serpent blowfish des cbc ecb blkcipher xcbc sha256 sha1
crypto_null xfrm4_tunnel tunnel4 ipcomp esp4 ah4 af_key autofs4 asb100
hwmon_vid hidp rfcomm l2cap bluetooth sunrpc nf_conntrack_netbios_ns
ipt_LOG xt_limit xt_mark xt_state xt_tcpudp iptable_filter
ipt_MASQUERADE iptable_nat nf_nat nf_conntrack_ipv4 xt_MARK
iptable_mangle ip_tables x_tables binfmt_misc sd_mod ipv6 sg hfsplus
video button ac lp parport_pc parport floppy nvram usb_storage scsi_mod
libusual usbhid hid ehci_hcd snd_via82xx snd_ac97_codec ac97_bus
ohci1394 snd_seq_dummy uhci_hcd ieee1394 snd_seq_oss snd_seq_midi_event
snd_seq snd_pcm_oss snd_mixer_oss snd_pcm snd_timer snd_page_alloc
snd_mpu401_uart snd_rawmidi snd_seq_device snd via_agp agpgart
i2c_viapro soundcore eepro100 i2c_core b44 pcspkr mii shpchp usbcore dm_mod
CPU: 0
EIP: 0060:[<c02fb85c>] Not tainted VLI
EFLAGS: 00010246 (2.6.20 #1)
EIP is at xfrm_audit_log+0x4cc/0x580
eax: ecb71061 ebx: c039d160 ecx: 00000000 edx: 00000021
esi: 000001f4 edi: 00000255 ebp: 00000000 esp: e8cd5a18
ds: 007b es: 007b ss: 0068
Process pluto (pid: 27486, ti=e8cd4000 task=d3557070 task.ti=e8cd4000)
Stack: c17d2ea0 c0354bf1 e183f9c0 00000003 c03ac59c e1399800 00000001
00000003
f8d0a450 00000000 00000001 00000286 e8cd5a6c c011506b 00000000
00000286
f73cb8c0 00000246 c17d2ea0 00000000 00000000 f73cb8c0 f8d03c67
00000000
Call Trace:
[<c011506b>] __wake_up+0x4b/0x80
[<f8d03c67>] pfkey_broadcast+0x137/0x1b0 [af_key]
[<f8d03e5f>] pfkey_send_policy_notify+0xef/0x1a0 [af_key]
[<c011d90e>] local_bh_enable+0x2e/0xa0
[<c0306107>] xfrm_get_policy+0x2b7/0x2f0
[<c0305e50>] xfrm_get_policy+0x0/0x2f0
[<c0304702>] xfrm_user_rcv_msg+0x102/0x1b0
[<c0304600>] xfrm_user_rcv_msg+0x0/0x1b0
[<c02b3782>] netlink_run_queue+0x82/0x120
[<c03045e8>] xfrm_netlink_rcv+0x28/0x40
[<c02b3d42>] netlink_data_ready+0x12/0x50
[<c02b2931>] netlink_sendskb+0x21/0x40
[<c02b3c50>] netlink_sendmsg+0x230/0x310
[<c02993cd>] sock_aio_write+0x11d/0x130
[<c01d538a>] avc_has_perm+0x5a/0x70
[<c0163ed5>] do_sync_write+0xd5/0x120
[<c012c960>] autoremove_wake_function+0x0/0x50
[<c01648c7>] vfs_write+0x177/0x180
[<c0164ea1>] sys_write+0x41/0x70
[<c0102f14>] syscall_call+0x7/0xb
=======================
Code: 8b 44 24 70 c1 e2 08 c1 e8 08 09 c2 0f b7 c2 89 44 24 08 8b 44 24
48 89 04 24 e8 10 eb e3 ff e9 bc fc ff ff 8b 8c 24 c0 00 00 00 <8b> 91
88 01 00 00 0f b7 99 82 00 00 00 85 d2 0f 85 64 fc ff ff
EIP: [<c02fb85c>] xfrm_audit_log+0x4cc/0x580 SS:ESP 0068:e8cd5a18
I'm running a vanilla 2.6.20 kernel on a Fedora Core 5 box on an athlon
processor:
cat /proc/cpuinfo
processor : 0
vendor_id : AuthenticAMD
cpu family : 6
model : 8
model name : AMD Athlon(TM) XP 2400+
stepping : 1
cpu MHz : 2000.256
cache size : 256 KB
fdiv_bug : no
hlt_bug : no
f00f_bug : no
coma_bug : no
fpu : yes
fpu_exception : yes
cpuid level : 1
wp : yes
flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge
mca cmov pat pse36 mmx fxsr sse syscall mmxext 3dnowext 3dnow ts
bogomips : 4003.78
clflush size : 32
uname -a
Linux machine 2.6.20 #1 PREEMPT Sat Feb 10 13:48:56 CET 2007 i686 athlon
i386 GNU/Linux
Please CC me in follow ups since i do not subscribe to the list.
Thanks
--
Charles-Edouard Ruault
GPG key Id E4D2B80C
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [BUG] 2.6.20 Oopses in xfrm_audit_log
2007-02-12 22:21 Fw: [BUG] 2.6.20 Oopses in xfrm_audit_log Andrew Morton
@ 2007-02-12 22:49 ` David Miller
2007-02-12 23:01 ` Andrew Morton
0 siblings, 1 reply; 12+ messages in thread
From: David Miller @ 2007-02-12 22:49 UTC (permalink / raw)
To: akpm; +Cc: netdev, ce
Andrew, we're already discussing a fix for this in another
thread today:
commit 13fcfbb0675bf87da694f55dec11cada489a205c
Author: David S. Miller <davem@sunset.davemloft.net>
Date: Mon Feb 12 13:53:54 2007 -0800
[XFRM]: Fix OOPSes in xfrm_audit_log().
Make sure that this function is called correctly, and
add BUG() checking to ensure the arguments are sane.
Based upon a patch by Joy Latten.
Signed-off-by: David S. Miller <davem@davemloft.net>
diff --git a/net/key/af_key.c b/net/key/af_key.c
index f3a026f..1c58204 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -2297,16 +2297,17 @@ static int pfkey_spddelete(struct sock *sk, struct sk_buff *skb, struct sadb_msg
&sel, tmp.security, 1);
security_xfrm_policy_free(&tmp);
- xfrm_audit_log(audit_get_loginuid(current->audit_context), 0,
- AUDIT_MAC_IPSEC_DELSPD, (xp) ? 1 : 0, xp, NULL);
-
if (xp == NULL)
return -ENOENT;
- err = 0;
+ err = security_xfrm_policy_delete(xp);
- if ((err = security_xfrm_policy_delete(xp)))
+ xfrm_audit_log(audit_get_loginuid(current->audit_context), 0,
+ AUDIT_MAC_IPSEC_DELSPD, err ? 0 : 1, xp, NULL);
+
+ if (err)
goto out;
+
c.seq = hdr->sadb_msg_seq;
c.pid = hdr->sadb_msg_pid;
c.event = XFRM_MSG_DELPOLICY;
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index a24f385..c394b41 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -1997,9 +1997,14 @@ void xfrm_audit_log(uid_t auid, u32 sid, int type, int result,
if (audit_enabled == 0)
return;
+ BUG_ON((type == AUDIT_MAC_IPSEC_ADDSA ||
+ type == AUDIT_MAC_IPSEC_DELSA) && !x);
+ BUG_ON((type == AUDIT_MAC_IPSEC_ADDSPD ||
+ type == AUDIT_MAC_IPSEC_DELSPD) && !xp);
+
audit_buf = audit_log_start(current->audit_context, GFP_ATOMIC, type);
if (audit_buf == NULL)
- return;
+ return;
switch(type) {
case AUDIT_MAC_IPSEC_ADDSA:
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index d55436d..2567453 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -1273,10 +1273,6 @@ static int xfrm_get_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
xp = xfrm_policy_bysel_ctx(type, p->dir, &p->sel, tmp.security, delete);
security_xfrm_policy_free(&tmp);
}
- if (delete)
- xfrm_audit_log(NETLINK_CB(skb).loginuid, NETLINK_CB(skb).sid,
- AUDIT_MAC_IPSEC_DELSPD, (xp) ? 1 : 0, xp, NULL);
-
if (xp == NULL)
return -ENOENT;
@@ -1292,8 +1288,14 @@ static int xfrm_get_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
MSG_DONTWAIT);
}
} else {
- if ((err = security_xfrm_policy_delete(xp)) != 0)
+ err = security_xfrm_policy_delete(xp);
+
+ xfrm_audit_log(NETLINK_CB(skb).loginuid, NETLINK_CB(skb).sid,
+ AUDIT_MAC_IPSEC_DELSPD, err ? 0 : 1, xp, NULL);
+
+ if (err != 0)
goto out;
+
c.data.byid = p->index;
c.event = nlh->nlmsg_type;
c.seq = nlh->nlmsg_seq;
^ permalink raw reply related [flat|nested] 12+ messages in thread
* Re: [BUG] 2.6.20 Oopses in xfrm_audit_log
2007-02-12 22:49 ` David Miller
@ 2007-02-12 23:01 ` Andrew Morton
0 siblings, 0 replies; 12+ messages in thread
From: Andrew Morton @ 2007-02-12 23:01 UTC (permalink / raw)
To: David Miller; +Cc: netdev, ce
> On Mon, 12 Feb 2007 14:49:38 -0800 (PST) David Miller <davem@davemloft.net> wrote:
> Andrew, we're already discussing a fix for this in another
> thread today:
Yeah, I noticed. Vitimised again by those darn MUA vendors and/or
users who bust their In-Reply-To/References headers :(
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [BUG] 2.6.20 Oopses in xfrm_audit_log
2007-02-12 17:44 Joy Latten
` (3 preceding siblings ...)
2007-02-15 8:22 ` Charles-Edouard Ruault
@ 2007-02-26 10:36 ` Charles-Edouard Ruault
4 siblings, 0 replies; 12+ messages in thread
From: Charles-Edouard Ruault @ 2007-02-26 10:36 UTC (permalink / raw)
To: Joy Latten; +Cc: davem, herbert, linux-kernel, linux-net
Joy Latten wrote:
>> i upgraded to vanilla kernel 2.6.20 and while i was using strongswan
>> 2.8.2 to setup an IPSEC VPN i got the following kernel Ooops.
>> I had successfully established the same tunnel a few times, but key
>> renegotiation caused a problem ( both ends did not renegotiate at the
>> same time so the tunnel was frozen ), i decided to kill the tunnel and
>> start a new one ( using ipsec auto --down tunnel & ipsec auto --up
>> tunnel ), while i was doing so, i got the oops.
>>
>> BUG: unable to handle kernel NULL pointer dereference at virtual address
>> 00000188
>> printing eip:
>> c02fb85c
>> *pde = 00000000
>> Oops: 0000 [#1]
>> PREEMPT
>> Modules linked in: xfrm4_mode_tunnel usblp deflate zlib_deflate twofish
>> twofish_common serpent blowfish des cbc ecb blkcipher xcbc sha256 sha1
>> crypto_null xfrm4_tunnel tunnel4 ipcomp esp4 ah4 af_key autofs4 asb100
>> hwmon_vid hidp rfcomm l2cap bluetooth sunrpc nf_conntrack_netbios_ns
>> ipt_LOG xt_limit xt_mark xt_state xt_tcpudp iptable_filter
>> ipt_MASQUERADE iptable_nat nf_nat nf_conntrack_ipv4 xt_MARK
>> iptable_mangle ip_tables x_tables binfmt_misc sd_mod ipv6 sg hfsplus
>> video button ac lp parport_pc parport floppy nvram usb_storage scsi_mod
>> libusual usbhid hid ehci_hcd snd_via82xx snd_ac97_codec ac97_bus
>> ohci1394 snd_seq_dummy uhci_hcd ieee1394 snd_seq_oss snd_seq_midi_event
>> snd_seq snd_pcm_oss snd_mixer_oss snd_pcm snd_timer snd_page_alloc
>> snd_mpu401_uart snd_rawmidi snd_seq_device snd via_agp agpgart
>> i2c_viapro soundcore eepro100 i2c_core b44 pcspkr mii shpchp usbcore dm_mod
>> CPU: 0
>> EIP: 0060:[<c02fb85c>] Not tainted VLI
>> EFLAGS: 00010246 (2.6.20 #1)
>> EIP is at xfrm_audit_log+0x4cc/0x580
>> eax: ecb71061 ebx: c039d160 ecx: 00000000 edx: 00000021
>> esi: 000001f4 edi: 00000255 ebp: 00000000 esp: e8cd5a18
>> ds: 007b es: 007b ss: 0068
>> Process pluto (pid: 27486, ti=e8cd4000 task=d3557070 task.ti=e8cd4000)
>> Stack: c17d2ea0 c0354bf1 e183f9c0 00000003 c03ac59c e1399800 00000001
>> 00000003
>> f8d0a450 00000000 00000001 00000286 e8cd5a6c c011506b 00000000
>> 00000286
>> f73cb8c0 00000246 c17d2ea0 00000000 00000000 f73cb8c0 f8d03c67
>> 00000000
>> Call Trace:
>> [<c011506b>] __wake_up+0x4b/0x80
>> [<f8d03c67>] pfkey_broadcast+0x137/0x1b0 [af_key]
>> [<f8d03e5f>] pfkey_send_policy_notify+0xef/0x1a0 [af_key]
>> [<c011d90e>] local_bh_enable+0x2e/0xa0
>> [<c0306107>] xfrm_get_policy+0x2b7/0x2f0
>> [<c0305e50>] xfrm_get_policy+0x0/0x2f0
>> [<c0304702>] xfrm_user_rcv_msg+0x102/0x1b0
>> [<c0304600>] xfrm_user_rcv_msg+0x0/0x1b0
>> [<c02b3782>] netlink_run_queue+0x82/0x120
>> [<c03045e8>] xfrm_netlink_rcv+0x28/0x40
>> [<c02b3d42>] netlink_data_ready+0x12/0x50
>> [<c02b2931>] netlink_sendskb+0x21/0x40
>> [<c02b3c50>] netlink_sendmsg+0x230/0x310
>> [<c02993cd>] sock_aio_write+0x11d/0x130
>> [<c01d538a>] avc_has_perm+0x5a/0x70
>> [<c0163ed5>] do_sync_write+0xd5/0x120
>> [<c012c960>] autoremove_wake_function+0x0/0x50
>> [<c01648c7>] vfs_write+0x177/0x180
>> [<c0164ea1>] sys_write+0x41/0x70
>> [<c0102f14>] syscall_call+0x7/0xb
>> =======================
>> Code: 8b 44 24 70 c1 e2 08 c1 e8 08 09 c2 0f b7 c2 89 44 24 08 8b 44 24
>> 48 89 04 24 e8 10 eb e3 ff e9 bc fc ff ff 8b 8c 24 c0 00 00 00 <8b> 91
>> 88 01 00 00 0f b7 99 82 00 00 00 85 d2 0f 85 64 fc ff ff
>> EIP: [<c02fb85c>] xfrm_audit_log+0x4cc/0x580 SS:ESP 0068:e8cd5a18
>>
>>
>>
>
> This is similar to another bug reported last month.
> Here is the patch I sent out then. Please let me know
> how it goes.
>
> Regards,
> Joy
>
> Signed-off-by: Joy Latten <latten@austin.ibm.com>
>
>
> diff -urpN linux-2.6.19.orig/net/xfrm/xfrm_policy.c linux-2.6.19/net/xfrm/xfrm_policy.c
> --- linux-2.6.19.orig/net/xfrm/xfrm_policy.c 2007-01-02 14:24:14.000000000 -0600
> +++ linux-2.6.19/net/xfrm/xfrm_policy.c 2007-01-02 14:28:24.000000000 -0600
> @@ -2003,6 +2003,9 @@ void xfrm_audit_log(uid_t auid, u32 sid,
> if (audit_enabled == 0)
> return;
>
> + if ((x == NULL) && (xp == NULL))
> + return;
> +
> audit_buf = audit_log_start(current->audit_context, GFP_ATOMIC, type);
> if (audit_buf == NULL)
> return;
> diff -urpN linux-2.6.19.orig/net/xfrm/xfrm_user.c linux-2.6.19/net/xfrm/xfrm_user.c
> --- linux-2.6.19.orig/net/xfrm/xfrm_user.c 2007-01-02 14:24:14.000000000 -0600
> +++ linux-2.6.19/net/xfrm/xfrm_user.c 2007-01-02 14:28:14.000000000 -0600
> @@ -1268,10 +1268,6 @@ static int xfrm_get_policy(struct sk_buf
> xp = xfrm_policy_bysel_ctx(type, p->dir, &p->sel, tmp.security, delete);
> security_xfrm_policy_free(&tmp);
> }
> - if (delete)
> - xfrm_audit_log(NETLINK_CB(skb).loginuid, NETLINK_CB(skb).sid,
> - AUDIT_MAC_IPSEC_DELSPD, (xp) ? 1 : 0, xp, NULL);
> -
> if (xp == NULL)
> return -ENOENT;
>
> @@ -1289,6 +1285,10 @@ static int xfrm_get_policy(struct sk_buf
> } else {
> if ((err = security_xfrm_policy_delete(xp)) != 0)
> goto out;
> +
> + xfrm_audit_log(NETLINK_CB(skb).loginuid, NETLINK_CB(skb).sid,
> + AUDIT_MAC_IPSEC_DELSPD, (xp) ? 1 : 0, xp, NULL);
> +
> c.data.byid = p->index;
> c.event = nlh->nlmsg_type;
> c.seq = nlh->nlmsg_seq;
>
Joy,
a quick email to let you know that i got the oops again this morning
with a 2.6.20 patched with the above fix.
I'm going to rebuild a vanilla kernel patched with the patched sent by
David Miller in follow up to your previous conversation.
Here's the dump:
BUG: unable to handle kernel NULL pointer dereference at virtual address
00000188
printing eip:
c02fb85c
*pde = 00000000
Oops: 0000 [#1]
PREEMPT
Modules linked in: stir4200 irda crc_ccitt ppdev vmnet(P) vmmon(P) loop
usblp nls_iso8859_1 nls_cp437 vfat fat xfrm4_mode_tunnel deflate
zlib_deflate twofish twofish_common serpent blowfish des cbc ecb
blkcipher xcbc sha256 sha1 crypto_null xfrm4_tunnel tunnel4 ipcomp esp4
ah4 af_key autofs4 asb100 hwmon_vid hidp rfcomm l2cap bluetooth sunrpc
nf_conntrack_netbios_ns ipt_LOG xt_limit xt_mark xt_state xt_tcpudp
iptable_filter ipt_MASQUERADE iptable_nat nf_nat nf_conntrack_ipv4
xt_MARK iptable_mangle ip_tables x_tables binfmt_misc ipv6 sd_mod sg
hfsplus video button ac lp parport_pc parport floppy nvram usb_storage
scsi_mod libusual usbhid hid ehci_hcd snd_via82xx snd_ac97_codec
uhci_hcd ac97_bus ohci1394 snd_seq_dummy ieee1394 snd_seq_oss
snd_seq_midi_event snd_seq snd_pcm_oss snd_mixer_oss snd_pcm snd_timer
snd_page_alloc snd_mpu401_uart snd_rawmidi snd_seq_device snd shpchp
i2c_viapro b44 soundcore pcspkr i2c_core eepro100 mii via_agp agpgart
usbcore dm_mod
CPU: 0
EIP: 0060:[<c02fb85c>] Tainted: P M VLI
EFLAGS: 00010246 (2.6.20 #1)
EIP is at xfrm_audit_log+0x4cc/0x580
eax: c4f3a86b ebx: c039d160 ecx: 00000000 edx: 00000023
esi: ffffffff edi: 00000031 ebp: 00000000 esp: deb71a18
ds: 007b es: 007b ss: 0068
Process pluto (pid: 3847, ti=deb70000 task=e1b82050 task.ti=deb70000)
Stack: c17d2e60 c0354bf1 ecce48e0 00000003 c03ac59c e18b2400 00000001
00000003
f8ce1450 00000000 00000001 00000286 deb71a6c c011506b 00000000
00000286
efdde780 00000246 c17d2e60 00000000 00000000 efdde780 f8cdac67
00000000
Call Trace:
[<c011506b>] __wake_up+0x4b/0x80
[<f8cdac67>] pfkey_broadcast+0x137/0x1b0 [af_key]
[<f8cdae5f>] pfkey_send_policy_notify+0xef/0x1a0 [af_key]
[<c011d90e>] local_bh_enable+0x2e/0xa0
[<c0306107>] xfrm_get_policy+0x2b7/0x2f0
[<c0305e50>] xfrm_get_policy+0x0/0x2f0
[<c0304702>] xfrm_user_rcv_msg+0x102/0x1b0
[<c0304600>] xfrm_user_rcv_msg+0x0/0x1b0
[<c02b3782>] netlink_run_queue+0x82/0x120
[<c03045e8>] xfrm_netlink_rcv+0x28/0x40
[<c02b3d42>] netlink_data_ready+0x12/0x50
[<c02b2931>] netlink_sendskb+0x21/0x40
[<c02b3c50>] netlink_sendmsg+0x230/0x310
[<c02993cd>] sock_aio_write+0x11d/0x130
[<c01d538a>] avc_has_perm+0x5a/0x70
[<c0163ed5>] do_sync_write+0xd5/0x120
[<c012c960>] autoremove_wake_function+0x0/0x50
[<c01648c7>] vfs_write+0x177/0x180
[<c0164ea1>] sys_write+0x41/0x70
[<c0102f14>] syscall_call+0x7/0xb
=======================
Code: 8b 44 24 70 c1 e2 08 c1 e8 08 09 c2 0f b7 c2 89 44 24 08 8b 44 24
48 89 04 24 e8 10 eb e3 ff e9 bc fc ff ff 8b 8c 24 c0 00 00 00 <8b> 91
88 01 00 00 0f b7 99 82 00 00 00 85 d2 0f 85 64 fc ff ff
EIP: [<c02fb85c>] xfrm_audit_log+0x4cc/0x580 SS:ESP 0068:deb71a18
--
Charles-Edouard Ruault
GPG key Id E4D2B80C
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [BUG] 2.6.20 Oopses in xfrm_audit_log
2007-02-12 17:44 Joy Latten
` (2 preceding siblings ...)
2007-02-12 21:46 ` David Miller
@ 2007-02-15 8:22 ` Charles-Edouard Ruault
2007-02-26 10:36 ` Charles-Edouard Ruault
4 siblings, 0 replies; 12+ messages in thread
From: Charles-Edouard Ruault @ 2007-02-15 8:22 UTC (permalink / raw)
To: Joy Latten; +Cc: davem, herbert, linux-kernel, linux-net
Joy Latten wrote:
>> i upgraded to vanilla kernel 2.6.20 and while i was using strongswan
>> 2.8.2 to setup an IPSEC VPN i got the following kernel Ooops.
>> I had successfully established the same tunnel a few times, but key
>> renegotiation caused a problem ( both ends did not renegotiate at the
>> same time so the tunnel was frozen ), i decided to kill the tunnel and
>> start a new one ( using ipsec auto --down tunnel & ipsec auto --up
>> tunnel ), while i was doing so, i got the oops.
>>
>> BUG: unable to handle kernel NULL pointer dereference at virtual address
>> 00000188
>> printing eip:
>> c02fb85c
>> *pde = 00000000
>> Oops: 0000 [#1]
>> PREEMPT
>> Modules linked in: xfrm4_mode_tunnel usblp deflate zlib_deflate twofish
>> twofish_common serpent blowfish des cbc ecb blkcipher xcbc sha256 sha1
>> crypto_null xfrm4_tunnel tunnel4 ipcomp esp4 ah4 af_key autofs4 asb100
>> hwmon_vid hidp rfcomm l2cap bluetooth sunrpc nf_conntrack_netbios_ns
>> ipt_LOG xt_limit xt_mark xt_state xt_tcpudp iptable_filter
>> ipt_MASQUERADE iptable_nat nf_nat nf_conntrack_ipv4 xt_MARK
>> iptable_mangle ip_tables x_tables binfmt_misc sd_mod ipv6 sg hfsplus
>> video button ac lp parport_pc parport floppy nvram usb_storage scsi_mod
>> libusual usbhid hid ehci_hcd snd_via82xx snd_ac97_codec ac97_bus
>> ohci1394 snd_seq_dummy uhci_hcd ieee1394 snd_seq_oss snd_seq_midi_event
>> snd_seq snd_pcm_oss snd_mixer_oss snd_pcm snd_timer snd_page_alloc
>> snd_mpu401_uart snd_rawmidi snd_seq_device snd via_agp agpgart
>> i2c_viapro soundcore eepro100 i2c_core b44 pcspkr mii shpchp usbcore dm_mod
>> CPU: 0
>> EIP: 0060:[<c02fb85c>] Not tainted VLI
>> EFLAGS: 00010246 (2.6.20 #1)
>> EIP is at xfrm_audit_log+0x4cc/0x580
>> eax: ecb71061 ebx: c039d160 ecx: 00000000 edx: 00000021
>> esi: 000001f4 edi: 00000255 ebp: 00000000 esp: e8cd5a18
>> ds: 007b es: 007b ss: 0068
>> Process pluto (pid: 27486, ti=e8cd4000 task=d3557070 task.ti=e8cd4000)
>> Stack: c17d2ea0 c0354bf1 e183f9c0 00000003 c03ac59c e1399800 00000001
>> 00000003
>> f8d0a450 00000000 00000001 00000286 e8cd5a6c c011506b 00000000
>> 00000286
>> f73cb8c0 00000246 c17d2ea0 00000000 00000000 f73cb8c0 f8d03c67
>> 00000000
>> Call Trace:
>> [<c011506b>] __wake_up+0x4b/0x80
>> [<f8d03c67>] pfkey_broadcast+0x137/0x1b0 [af_key]
>> [<f8d03e5f>] pfkey_send_policy_notify+0xef/0x1a0 [af_key]
>> [<c011d90e>] local_bh_enable+0x2e/0xa0
>> [<c0306107>] xfrm_get_policy+0x2b7/0x2f0
>> [<c0305e50>] xfrm_get_policy+0x0/0x2f0
>> [<c0304702>] xfrm_user_rcv_msg+0x102/0x1b0
>> [<c0304600>] xfrm_user_rcv_msg+0x0/0x1b0
>> [<c02b3782>] netlink_run_queue+0x82/0x120
>> [<c03045e8>] xfrm_netlink_rcv+0x28/0x40
>> [<c02b3d42>] netlink_data_ready+0x12/0x50
>> [<c02b2931>] netlink_sendskb+0x21/0x40
>> [<c02b3c50>] netlink_sendmsg+0x230/0x310
>> [<c02993cd>] sock_aio_write+0x11d/0x130
>> [<c01d538a>] avc_has_perm+0x5a/0x70
>> [<c0163ed5>] do_sync_write+0xd5/0x120
>> [<c012c960>] autoremove_wake_function+0x0/0x50
>> [<c01648c7>] vfs_write+0x177/0x180
>> [<c0164ea1>] sys_write+0x41/0x70
>> [<c0102f14>] syscall_call+0x7/0xb
>> =======================
>> Code: 8b 44 24 70 c1 e2 08 c1 e8 08 09 c2 0f b7 c2 89 44 24 08 8b 44 24
>> 48 89 04 24 e8 10 eb e3 ff e9 bc fc ff ff 8b 8c 24 c0 00 00 00 <8b> 91
>> 88 01 00 00 0f b7 99 82 00 00 00 85 d2 0f 85 64 fc ff ff
>> EIP: [<c02fb85c>] xfrm_audit_log+0x4cc/0x580 SS:ESP 0068:e8cd5a18
>>
>>
>>
>
> This is similar to another bug reported last month.
> Here is the patch I sent out then. Please let me know
> how it goes.
>
> Regards,
> Joy
>
> Signed-off-by: Joy Latten <latten@austin.ibm.com>
>
>
> diff -urpN linux-2.6.19.orig/net/xfrm/xfrm_policy.c linux-2.6.19/net/xfrm/xfrm_policy.c
> --- linux-2.6.19.orig/net/xfrm/xfrm_policy.c 2007-01-02 14:24:14.000000000 -0600
> +++ linux-2.6.19/net/xfrm/xfrm_policy.c 2007-01-02 14:28:24.000000000 -0600
> @@ -2003,6 +2003,9 @@ void xfrm_audit_log(uid_t auid, u32 sid,
> if (audit_enabled == 0)
> return;
>
> + if ((x == NULL) && (xp == NULL))
> + return;
> +
> audit_buf = audit_log_start(current->audit_context, GFP_ATOMIC, type);
> if (audit_buf == NULL)
> return;
> diff -urpN linux-2.6.19.orig/net/xfrm/xfrm_user.c linux-2.6.19/net/xfrm/xfrm_user.c
> --- linux-2.6.19.orig/net/xfrm/xfrm_user.c 2007-01-02 14:24:14.000000000 -0600
> +++ linux-2.6.19/net/xfrm/xfrm_user.c 2007-01-02 14:28:14.000000000 -0600
> @@ -1268,10 +1268,6 @@ static int xfrm_get_policy(struct sk_buf
> xp = xfrm_policy_bysel_ctx(type, p->dir, &p->sel, tmp.security, delete);
> security_xfrm_policy_free(&tmp);
> }
> - if (delete)
> - xfrm_audit_log(NETLINK_CB(skb).loginuid, NETLINK_CB(skb).sid,
> - AUDIT_MAC_IPSEC_DELSPD, (xp) ? 1 : 0, xp, NULL);
> -
> if (xp == NULL)
> return -ENOENT;
>
> @@ -1289,6 +1285,10 @@ static int xfrm_get_policy(struct sk_buf
> } else {
> if ((err = security_xfrm_policy_delete(xp)) != 0)
> goto out;
> +
> + xfrm_audit_log(NETLINK_CB(skb).loginuid, NETLINK_CB(skb).sid,
> + AUDIT_MAC_IPSEC_DELSPD, (xp) ? 1 : 0, xp, NULL);
> +
> c.data.byid = p->index;
> c.event = nlh->nlmsg_type;
> c.seq = nlh->nlmsg_seq;
>
Hi Joy,
just to let you know that since i've applied you patch, everything is
running smoothly for me.
Thanks again.
--
Charles-Edouard Ruault
GPG key Id E4D2B80C
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [BUG] 2.6.20 Oopses in xfrm_audit_log
2007-02-12 21:46 ` David Miller
@ 2007-02-13 1:02 ` James Morris
0 siblings, 0 replies; 12+ messages in thread
From: James Morris @ 2007-02-13 1:02 UTC (permalink / raw)
To: David Miller; +Cc: latten, ce, herbert, linux-kernel, linux-net
On Mon, 12 Feb 2007, David Miller wrote:
> Thus, below is the patch I will use to fix this bug:
>
> 1) Calling xfrm_audit_log() with a NULL object is a BUG()
> 2) Setting "result" based upon NULL'ness of the object makes no
> sense, either set it to "1" in these cases or use an appropriate
> error check.
>
> How does this look to others?
Looks good to me.
--
James Morris
<jmorris@namei.org>
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [BUG] 2.6.20 Oopses in xfrm_audit_log
2007-02-12 17:44 Joy Latten
2007-02-12 20:50 ` [BUG] " David Miller
2007-02-12 21:04 ` Charles-Edouard Ruault
@ 2007-02-12 21:46 ` David Miller
2007-02-13 1:02 ` James Morris
2007-02-15 8:22 ` Charles-Edouard Ruault
2007-02-26 10:36 ` Charles-Edouard Ruault
4 siblings, 1 reply; 12+ messages in thread
From: David Miller @ 2007-02-12 21:46 UTC (permalink / raw)
To: latten; +Cc: ce, herbert, linux-kernel, linux-net
From: Joy Latten <latten@austin.ibm.com>
Date: Mon, 12 Feb 2007 11:44:30 -0600
> This is similar to another bug reported last month.
> Here is the patch I sent out then. Please let me know
> how it goes.
>
> Signed-off-by: Joy Latten <latten@austin.ibm.com>
This whole interface is a complete mess.
Calling xfrm_audit_log() without the proper object being non-NULL
should be a bug. And that's exactly what you fixed in the xfrm_user
case, so there is zero reason to silently allow this condition, we
should just BUG() on it.
But the logging function has this "result" thing, that in some cases
is set to 1 if "xp" or "x" is not-NULL by the callers, this is just
silly.
You can't log the event if the proper object is NULL, so the "result"
parameter and log information is useless in those cases.
Also, you missed the same exact identical bug in the AF_KEY code.
Thus, below is the patch I will use to fix this bug:
1) Calling xfrm_audit_log() with a NULL object is a BUG()
2) Setting "result" based upon NULL'ness of the object makes no
sense, either set it to "1" in these cases or use an appropriate
error check.
How does this look to others?
diff --git a/net/key/af_key.c b/net/key/af_key.c
index f3a026f..1c58204 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -2297,16 +2297,17 @@ static int pfkey_spddelete(struct sock *sk, struct sk_buff *skb, struct sadb_msg
&sel, tmp.security, 1);
security_xfrm_policy_free(&tmp);
- xfrm_audit_log(audit_get_loginuid(current->audit_context), 0,
- AUDIT_MAC_IPSEC_DELSPD, (xp) ? 1 : 0, xp, NULL);
-
if (xp == NULL)
return -ENOENT;
- err = 0;
+ err = security_xfrm_policy_delete(xp);
- if ((err = security_xfrm_policy_delete(xp)))
+ xfrm_audit_log(audit_get_loginuid(current->audit_context), 0,
+ AUDIT_MAC_IPSEC_DELSPD, err ? 0 : 1, xp, NULL);
+
+ if (err)
goto out;
+
c.seq = hdr->sadb_msg_seq;
c.pid = hdr->sadb_msg_pid;
c.event = XFRM_MSG_DELPOLICY;
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index a24f385..c394b41 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -1997,9 +1997,14 @@ void xfrm_audit_log(uid_t auid, u32 sid, int type, int result,
if (audit_enabled == 0)
return;
+ BUG_ON((type == AUDIT_MAC_IPSEC_ADDSA ||
+ type == AUDIT_MAC_IPSEC_DELSA) && !x);
+ BUG_ON((type == AUDIT_MAC_IPSEC_ADDSPD ||
+ type == AUDIT_MAC_IPSEC_DELSPD) && !xp);
+
audit_buf = audit_log_start(current->audit_context, GFP_ATOMIC, type);
if (audit_buf == NULL)
- return;
+ return;
switch(type) {
case AUDIT_MAC_IPSEC_ADDSA:
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index d55436d..2567453 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -1273,10 +1273,6 @@ static int xfrm_get_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
xp = xfrm_policy_bysel_ctx(type, p->dir, &p->sel, tmp.security, delete);
security_xfrm_policy_free(&tmp);
}
- if (delete)
- xfrm_audit_log(NETLINK_CB(skb).loginuid, NETLINK_CB(skb).sid,
- AUDIT_MAC_IPSEC_DELSPD, (xp) ? 1 : 0, xp, NULL);
-
if (xp == NULL)
return -ENOENT;
@@ -1292,8 +1288,14 @@ static int xfrm_get_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
MSG_DONTWAIT);
}
} else {
- if ((err = security_xfrm_policy_delete(xp)) != 0)
+ err = security_xfrm_policy_delete(xp);
+
+ xfrm_audit_log(NETLINK_CB(skb).loginuid, NETLINK_CB(skb).sid,
+ AUDIT_MAC_IPSEC_DELSPD, err ? 0 : 1, xp, NULL);
+
+ if (err != 0)
goto out;
+
c.data.byid = p->index;
c.event = nlh->nlmsg_type;
c.seq = nlh->nlmsg_seq;
^ permalink raw reply related [flat|nested] 12+ messages in thread
* Re: [BUG] 2.6.20 Oopses in xfrm_audit_log
2007-02-12 18:20 ` Alexey Dobriyan
@ 2007-02-12 21:14 ` Charles-Edouard Ruault
0 siblings, 0 replies; 12+ messages in thread
From: Charles-Edouard Ruault @ 2007-02-12 21:14 UTC (permalink / raw)
To: Alexey Dobriyan; +Cc: netdev
[-- Attachment #1: Type: text/plain, Size: 4834 bytes --]
Alexey Dobriyan wrote:
> [removing l-k from CC, and switching to netdev]
>
> Please, send your .config.
> Is it reproducible?
>
> On Mon, Feb 12, 2007 at 03:16:04PM +0100, Charles-Edouard Ruault wrote:
>
>> i upgraded to vanilla kernel 2.6.20 and while i was using strongswan
>> 2.8.2 to setup an IPSEC VPN i got the following kernel Ooops.
>> I had successfully established the same tunnel a few times, but key
>> renegotiation caused a problem ( both ends did not renegotiate at the
>> same time so the tunnel was frozen ), i decided to kill the tunnel and
>> start a new one ( using ipsec auto --down tunnel & ipsec auto --up
>> tunnel ), while i was doing so, i got the oops.
>>
>> BUG: unable to handle kernel NULL pointer dereference at virtual address
>> 00000188
>> printing eip:
>> c02fb85c
>> *pde = 00000000
>> Oops: 0000 [#1]
>> PREEMPT
>> Modules linked in: xfrm4_mode_tunnel usblp deflate zlib_deflate twofish
>> twofish_common serpent blowfish des cbc ecb blkcipher xcbc sha256 sha1
>> crypto_null xfrm4_tunnel tunnel4 ipcomp esp4 ah4 af_key autofs4 asb100
>> hwmon_vid hidp rfcomm l2cap bluetooth sunrpc nf_conntrack_netbios_ns
>> ipt_LOG xt_limit xt_mark xt_state xt_tcpudp iptable_filter
>> ipt_MASQUERADE iptable_nat nf_nat nf_conntrack_ipv4 xt_MARK
>> iptable_mangle ip_tables x_tables binfmt_misc sd_mod ipv6 sg hfsplus
>> video button ac lp parport_pc parport floppy nvram usb_storage scsi_mod
>> libusual usbhid hid ehci_hcd snd_via82xx snd_ac97_codec ac97_bus
>> ohci1394 snd_seq_dummy uhci_hcd ieee1394 snd_seq_oss snd_seq_midi_event
>> snd_seq snd_pcm_oss snd_mixer_oss snd_pcm snd_timer snd_page_alloc
>> snd_mpu401_uart snd_rawmidi snd_seq_device snd via_agp agpgart
>> i2c_viapro soundcore eepro100 i2c_core b44 pcspkr mii shpchp usbcore dm_mod
>> CPU: 0
>> EIP: 0060:[<c02fb85c>] Not tainted VLI
>> EFLAGS: 00010246 (2.6.20 #1)
>> EIP is at xfrm_audit_log+0x4cc/0x580
>> eax: ecb71061 ebx: c039d160 ecx: 00000000 edx: 00000021
>> esi: 000001f4 edi: 00000255 ebp: 00000000 esp: e8cd5a18
>> ds: 007b es: 007b ss: 0068
>> Process pluto (pid: 27486, ti=e8cd4000 task=d3557070 task.ti=e8cd4000)
>> Stack: c17d2ea0 c0354bf1 e183f9c0 00000003 c03ac59c e1399800 00000001
>> 00000003
>> f8d0a450 00000000 00000001 00000286 e8cd5a6c c011506b 00000000
>> 00000286
>> f73cb8c0 00000246 c17d2ea0 00000000 00000000 f73cb8c0 f8d03c67
>> 00000000
>> Call Trace:
>> [<c011506b>] __wake_up+0x4b/0x80
>> [<f8d03c67>] pfkey_broadcast+0x137/0x1b0 [af_key]
>> [<f8d03e5f>] pfkey_send_policy_notify+0xef/0x1a0 [af_key]
>> [<c011d90e>] local_bh_enable+0x2e/0xa0
>> [<c0306107>] xfrm_get_policy+0x2b7/0x2f0
>> [<c0305e50>] xfrm_get_policy+0x0/0x2f0
>> [<c0304702>] xfrm_user_rcv_msg+0x102/0x1b0
>> [<c0304600>] xfrm_user_rcv_msg+0x0/0x1b0
>> [<c02b3782>] netlink_run_queue+0x82/0x120
>> [<c03045e8>] xfrm_netlink_rcv+0x28/0x40
>> [<c02b3d42>] netlink_data_ready+0x12/0x50
>> [<c02b2931>] netlink_sendskb+0x21/0x40
>> [<c02b3c50>] netlink_sendmsg+0x230/0x310
>> [<c02993cd>] sock_aio_write+0x11d/0x130
>> [<c01d538a>] avc_has_perm+0x5a/0x70
>> [<c0163ed5>] do_sync_write+0xd5/0x120
>> [<c012c960>] autoremove_wake_function+0x0/0x50
>> [<c01648c7>] vfs_write+0x177/0x180
>> [<c0164ea1>] sys_write+0x41/0x70
>> [<c0102f14>] syscall_call+0x7/0xb
>> =======================
>> Code: 8b 44 24 70 c1 e2 08 c1 e8 08 09 c2 0f b7 c2 89 44 24 08 8b 44 24
>> 48 89 04 24 e8 10 eb e3 ff e9 bc fc ff ff 8b 8c 24 c0 00 00 00 <8b> 91
>> 88 01 00 00 0f b7 99 82 00 00 00 85 d2 0f 85 64 fc ff ff
>> EIP: [<c02fb85c>] xfrm_audit_log+0x4cc/0x580 SS:ESP 0068:e8cd5a18
>>
>> I'm running a vanilla 2.6.20 kernel on a Fedora Core 5 box on an athlon
>> processor:
>> cat /proc/cpuinfo
>> processor : 0
>> vendor_id : AuthenticAMD
>> cpu family : 6
>> model : 8
>> model name : AMD Athlon(TM) XP 2400+
>> stepping : 1
>> cpu MHz : 2000.256
>> cache size : 256 KB
>> fdiv_bug : no
>> hlt_bug : no
>> f00f_bug : no
>> coma_bug : no
>> fpu : yes
>> fpu_exception : yes
>> cpuid level : 1
>> wp : yes
>> flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge
>> mca cmov pat pse36 mmx fxsr sse syscall mmxext 3dnowext 3dnow ts
>> bogomips : 4003.78
>> clflush size : 32
>>
>> uname -a
>> Linux machine 2.6.20 #1 PREEMPT Sat Feb 10 13:48:56 CET 2007 i686 athlon
>> i386 GNU/Linux
>>
>> Please CC me in follow ups since i do not subscribe to the list.
>>
>
>
here's my config.gz attached.
I don't know if it's reproducible, i have not had the time to reboot &
try again yet ....
I just applied the patch that Joy sent. I'm trying with the patched
kernel and let the list know if it happens again.
--
Charles-Edouard Ruault
PGP Key ID E4D2B80C
[-- Attachment #2: config.gz --]
[-- Type: application/x-gzip, Size: 12809 bytes --]
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [BUG] 2.6.20 Oopses in xfrm_audit_log
2007-02-12 17:44 Joy Latten
2007-02-12 20:50 ` [BUG] " David Miller
@ 2007-02-12 21:04 ` Charles-Edouard Ruault
2007-02-12 21:46 ` David Miller
` (2 subsequent siblings)
4 siblings, 0 replies; 12+ messages in thread
From: Charles-Edouard Ruault @ 2007-02-12 21:04 UTC (permalink / raw)
To: Joy Latten; +Cc: davem, herbert, linux-kernel, linux-net
Joy Latten wrote:
>> i upgraded to vanilla kernel 2.6.20 and while i was using strongswan
>> 2.8.2 to setup an IPSEC VPN i got the following kernel Ooops.
>> I had successfully established the same tunnel a few times, but key
>> renegotiation caused a problem ( both ends did not renegotiate at the
>> same time so the tunnel was frozen ), i decided to kill the tunnel and
>> start a new one ( using ipsec auto --down tunnel & ipsec auto --up
>> tunnel ), while i was doing so, i got the oops.
>>
>> BUG: unable to handle kernel NULL pointer dereference at virtual address
>> 00000188
>> printing eip:
>> c02fb85c
>> *pde = 00000000
>> Oops: 0000 [#1]
>> PREEMPT
>> Modules linked in: xfrm4_mode_tunnel usblp deflate zlib_deflate twofish
>> twofish_common serpent blowfish des cbc ecb blkcipher xcbc sha256 sha1
>> crypto_null xfrm4_tunnel tunnel4 ipcomp esp4 ah4 af_key autofs4 asb100
>> hwmon_vid hidp rfcomm l2cap bluetooth sunrpc nf_conntrack_netbios_ns
>> ipt_LOG xt_limit xt_mark xt_state xt_tcpudp iptable_filter
>> ipt_MASQUERADE iptable_nat nf_nat nf_conntrack_ipv4 xt_MARK
>> iptable_mangle ip_tables x_tables binfmt_misc sd_mod ipv6 sg hfsplus
>> video button ac lp parport_pc parport floppy nvram usb_storage scsi_mod
>> libusual usbhid hid ehci_hcd snd_via82xx snd_ac97_codec ac97_bus
>> ohci1394 snd_seq_dummy uhci_hcd ieee1394 snd_seq_oss snd_seq_midi_event
>> snd_seq snd_pcm_oss snd_mixer_oss snd_pcm snd_timer snd_page_alloc
>> snd_mpu401_uart snd_rawmidi snd_seq_device snd via_agp agpgart
>> i2c_viapro soundcore eepro100 i2c_core b44 pcspkr mii shpchp usbcore dm_mod
>> CPU: 0
>> EIP: 0060:[<c02fb85c>] Not tainted VLI
>> EFLAGS: 00010246 (2.6.20 #1)
>> EIP is at xfrm_audit_log+0x4cc/0x580
>> eax: ecb71061 ebx: c039d160 ecx: 00000000 edx: 00000021
>> esi: 000001f4 edi: 00000255 ebp: 00000000 esp: e8cd5a18
>> ds: 007b es: 007b ss: 0068
>> Process pluto (pid: 27486, ti=e8cd4000 task=d3557070 task.ti=e8cd4000)
>> Stack: c17d2ea0 c0354bf1 e183f9c0 00000003 c03ac59c e1399800 00000001
>> 00000003
>> f8d0a450 00000000 00000001 00000286 e8cd5a6c c011506b 00000000
>> 00000286
>> f73cb8c0 00000246 c17d2ea0 00000000 00000000 f73cb8c0 f8d03c67
>> 00000000
>> Call Trace:
>> [<c011506b>] __wake_up+0x4b/0x80
>> [<f8d03c67>] pfkey_broadcast+0x137/0x1b0 [af_key]
>> [<f8d03e5f>] pfkey_send_policy_notify+0xef/0x1a0 [af_key]
>> [<c011d90e>] local_bh_enable+0x2e/0xa0
>> [<c0306107>] xfrm_get_policy+0x2b7/0x2f0
>> [<c0305e50>] xfrm_get_policy+0x0/0x2f0
>> [<c0304702>] xfrm_user_rcv_msg+0x102/0x1b0
>> [<c0304600>] xfrm_user_rcv_msg+0x0/0x1b0
>> [<c02b3782>] netlink_run_queue+0x82/0x120
>> [<c03045e8>] xfrm_netlink_rcv+0x28/0x40
>> [<c02b3d42>] netlink_data_ready+0x12/0x50
>> [<c02b2931>] netlink_sendskb+0x21/0x40
>> [<c02b3c50>] netlink_sendmsg+0x230/0x310
>> [<c02993cd>] sock_aio_write+0x11d/0x130
>> [<c01d538a>] avc_has_perm+0x5a/0x70
>> [<c0163ed5>] do_sync_write+0xd5/0x120
>> [<c012c960>] autoremove_wake_function+0x0/0x50
>> [<c01648c7>] vfs_write+0x177/0x180
>> [<c0164ea1>] sys_write+0x41/0x70
>> [<c0102f14>] syscall_call+0x7/0xb
>> =======================
>> Code: 8b 44 24 70 c1 e2 08 c1 e8 08 09 c2 0f b7 c2 89 44 24 08 8b 44 24
>> 48 89 04 24 e8 10 eb e3 ff e9 bc fc ff ff 8b 8c 24 c0 00 00 00 <8b> 91
>> 88 01 00 00 0f b7 99 82 00 00 00 85 d2 0f 85 64 fc ff ff
>> EIP: [<c02fb85c>] xfrm_audit_log+0x4cc/0x580 SS:ESP 0068:e8cd5a18
>>
>>
>>
>
> This is similar to another bug reported last month.
> Here is the patch I sent out then. Please let me know
> how it goes.
>
> Regards,
> Joy
>
> Signed-off-by: Joy Latten <latten@austin.ibm.com>
>
>
> diff -urpN linux-2.6.19.orig/net/xfrm/xfrm_policy.c linux-2.6.19/net/xfrm/xfrm_policy.c
> --- linux-2.6.19.orig/net/xfrm/xfrm_policy.c 2007-01-02 14:24:14.000000000 -0600
> +++ linux-2.6.19/net/xfrm/xfrm_policy.c 2007-01-02 14:28:24.000000000 -0600
> @@ -2003,6 +2003,9 @@ void xfrm_audit_log(uid_t auid, u32 sid,
> if (audit_enabled == 0)
> return;
>
> + if ((x == NULL) && (xp == NULL))
> + return;
> +
> audit_buf = audit_log_start(current->audit_context, GFP_ATOMIC, type);
> if (audit_buf == NULL)
> return;
> diff -urpN linux-2.6.19.orig/net/xfrm/xfrm_user.c linux-2.6.19/net/xfrm/xfrm_user.c
> --- linux-2.6.19.orig/net/xfrm/xfrm_user.c 2007-01-02 14:24:14.000000000 -0600
> +++ linux-2.6.19/net/xfrm/xfrm_user.c 2007-01-02 14:28:14.000000000 -0600
> @@ -1268,10 +1268,6 @@ static int xfrm_get_policy(struct sk_buf
> xp = xfrm_policy_bysel_ctx(type, p->dir, &p->sel, tmp.security, delete);
> security_xfrm_policy_free(&tmp);
> }
> - if (delete)
> - xfrm_audit_log(NETLINK_CB(skb).loginuid, NETLINK_CB(skb).sid,
> - AUDIT_MAC_IPSEC_DELSPD, (xp) ? 1 : 0, xp, NULL);
> -
> if (xp == NULL)
> return -ENOENT;
>
> @@ -1289,6 +1285,10 @@ static int xfrm_get_policy(struct sk_buf
> } else {
> if ((err = security_xfrm_policy_delete(xp)) != 0)
> goto out;
> +
> + xfrm_audit_log(NETLINK_CB(skb).loginuid, NETLINK_CB(skb).sid,
> + AUDIT_MAC_IPSEC_DELSPD, (xp) ? 1 : 0, xp, NULL);
> +
> c.data.byid = p->index;
> c.event = nlh->nlmsg_type;
> c.seq = nlh->nlmsg_seq;
>
Thanks for the quick reply & for the patch.
I'm recompiling as i write this email. I'll let you know if i experience
the problem again !
Regards.
--
Charles-Edouard Ruault
PGP Key ID E4D2B80C
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [BUG] 2.6.20 Oopses in xfrm_audit_log
2007-02-12 17:44 Joy Latten
@ 2007-02-12 20:50 ` David Miller
2007-02-12 21:04 ` Charles-Edouard Ruault
` (3 subsequent siblings)
4 siblings, 0 replies; 12+ messages in thread
From: David Miller @ 2007-02-12 20:50 UTC (permalink / raw)
To: latten; +Cc: ce, herbert, linux-kernel, linux-net
From: Joy Latten <latten@austin.ibm.com>
Date: Mon, 12 Feb 2007 11:44:30 -0600
> This is similar to another bug reported last month.
> Here is the patch I sent out then. Please let me know
> how it goes.
>
> Regards,
> Joy
>
> Signed-off-by: Joy Latten <latten@austin.ibm.com>
This one is my bad, I should have gotten around to properly
reviewing this patch before 2.6.20-final went out. I'll
up the priority on this one to make sure it gets into -stable
and mainline soon.
Thanks for resending Joy.
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [BUG] 2.6.20 Oopses in xfrm_audit_log
2007-02-12 14:16 Charles-Edouard Ruault
@ 2007-02-12 18:20 ` Alexey Dobriyan
2007-02-12 21:14 ` Charles-Edouard Ruault
0 siblings, 1 reply; 12+ messages in thread
From: Alexey Dobriyan @ 2007-02-12 18:20 UTC (permalink / raw)
To: Charles-Edouard Ruault; +Cc: netdev
[removing l-k from CC, and switching to netdev]
Please, send your .config.
Is it reproducible?
On Mon, Feb 12, 2007 at 03:16:04PM +0100, Charles-Edouard Ruault wrote:
> i upgraded to vanilla kernel 2.6.20 and while i was using strongswan
> 2.8.2 to setup an IPSEC VPN i got the following kernel Ooops.
> I had successfully established the same tunnel a few times, but key
> renegotiation caused a problem ( both ends did not renegotiate at the
> same time so the tunnel was frozen ), i decided to kill the tunnel and
> start a new one ( using ipsec auto --down tunnel & ipsec auto --up
> tunnel ), while i was doing so, i got the oops.
>
> BUG: unable to handle kernel NULL pointer dereference at virtual address
> 00000188
> printing eip:
> c02fb85c
> *pde = 00000000
> Oops: 0000 [#1]
> PREEMPT
> Modules linked in: xfrm4_mode_tunnel usblp deflate zlib_deflate twofish
> twofish_common serpent blowfish des cbc ecb blkcipher xcbc sha256 sha1
> crypto_null xfrm4_tunnel tunnel4 ipcomp esp4 ah4 af_key autofs4 asb100
> hwmon_vid hidp rfcomm l2cap bluetooth sunrpc nf_conntrack_netbios_ns
> ipt_LOG xt_limit xt_mark xt_state xt_tcpudp iptable_filter
> ipt_MASQUERADE iptable_nat nf_nat nf_conntrack_ipv4 xt_MARK
> iptable_mangle ip_tables x_tables binfmt_misc sd_mod ipv6 sg hfsplus
> video button ac lp parport_pc parport floppy nvram usb_storage scsi_mod
> libusual usbhid hid ehci_hcd snd_via82xx snd_ac97_codec ac97_bus
> ohci1394 snd_seq_dummy uhci_hcd ieee1394 snd_seq_oss snd_seq_midi_event
> snd_seq snd_pcm_oss snd_mixer_oss snd_pcm snd_timer snd_page_alloc
> snd_mpu401_uart snd_rawmidi snd_seq_device snd via_agp agpgart
> i2c_viapro soundcore eepro100 i2c_core b44 pcspkr mii shpchp usbcore dm_mod
> CPU: 0
> EIP: 0060:[<c02fb85c>] Not tainted VLI
> EFLAGS: 00010246 (2.6.20 #1)
> EIP is at xfrm_audit_log+0x4cc/0x580
> eax: ecb71061 ebx: c039d160 ecx: 00000000 edx: 00000021
> esi: 000001f4 edi: 00000255 ebp: 00000000 esp: e8cd5a18
> ds: 007b es: 007b ss: 0068
> Process pluto (pid: 27486, ti=e8cd4000 task=d3557070 task.ti=e8cd4000)
> Stack: c17d2ea0 c0354bf1 e183f9c0 00000003 c03ac59c e1399800 00000001
> 00000003
> f8d0a450 00000000 00000001 00000286 e8cd5a6c c011506b 00000000
> 00000286
> f73cb8c0 00000246 c17d2ea0 00000000 00000000 f73cb8c0 f8d03c67
> 00000000
> Call Trace:
> [<c011506b>] __wake_up+0x4b/0x80
> [<f8d03c67>] pfkey_broadcast+0x137/0x1b0 [af_key]
> [<f8d03e5f>] pfkey_send_policy_notify+0xef/0x1a0 [af_key]
> [<c011d90e>] local_bh_enable+0x2e/0xa0
> [<c0306107>] xfrm_get_policy+0x2b7/0x2f0
> [<c0305e50>] xfrm_get_policy+0x0/0x2f0
> [<c0304702>] xfrm_user_rcv_msg+0x102/0x1b0
> [<c0304600>] xfrm_user_rcv_msg+0x0/0x1b0
> [<c02b3782>] netlink_run_queue+0x82/0x120
> [<c03045e8>] xfrm_netlink_rcv+0x28/0x40
> [<c02b3d42>] netlink_data_ready+0x12/0x50
> [<c02b2931>] netlink_sendskb+0x21/0x40
> [<c02b3c50>] netlink_sendmsg+0x230/0x310
> [<c02993cd>] sock_aio_write+0x11d/0x130
> [<c01d538a>] avc_has_perm+0x5a/0x70
> [<c0163ed5>] do_sync_write+0xd5/0x120
> [<c012c960>] autoremove_wake_function+0x0/0x50
> [<c01648c7>] vfs_write+0x177/0x180
> [<c0164ea1>] sys_write+0x41/0x70
> [<c0102f14>] syscall_call+0x7/0xb
> =======================
> Code: 8b 44 24 70 c1 e2 08 c1 e8 08 09 c2 0f b7 c2 89 44 24 08 8b 44 24
> 48 89 04 24 e8 10 eb e3 ff e9 bc fc ff ff 8b 8c 24 c0 00 00 00 <8b> 91
> 88 01 00 00 0f b7 99 82 00 00 00 85 d2 0f 85 64 fc ff ff
> EIP: [<c02fb85c>] xfrm_audit_log+0x4cc/0x580 SS:ESP 0068:e8cd5a18
>
> I'm running a vanilla 2.6.20 kernel on a Fedora Core 5 box on an athlon
> processor:
> cat /proc/cpuinfo
> processor : 0
> vendor_id : AuthenticAMD
> cpu family : 6
> model : 8
> model name : AMD Athlon(TM) XP 2400+
> stepping : 1
> cpu MHz : 2000.256
> cache size : 256 KB
> fdiv_bug : no
> hlt_bug : no
> f00f_bug : no
> coma_bug : no
> fpu : yes
> fpu_exception : yes
> cpuid level : 1
> wp : yes
> flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge
> mca cmov pat pse36 mmx fxsr sse syscall mmxext 3dnowext 3dnow ts
> bogomips : 4003.78
> clflush size : 32
>
> uname -a
> Linux machine 2.6.20 #1 PREEMPT Sat Feb 10 13:48:56 CET 2007 i686 athlon
> i386 GNU/Linux
>
> Please CC me in follow ups since i do not subscribe to the list.
^ permalink raw reply [flat|nested] 12+ messages in thread
* [BUG] 2.6.20 Oopses in xfrm_audit_log
@ 2007-02-12 14:16 Charles-Edouard Ruault
2007-02-12 18:20 ` Alexey Dobriyan
0 siblings, 1 reply; 12+ messages in thread
From: Charles-Edouard Ruault @ 2007-02-12 14:16 UTC (permalink / raw)
To: linux-kernel, linux-net
Hi All,
i upgraded to vanilla kernel 2.6.20 and while i was using strongswan
2.8.2 to setup an IPSEC VPN i got the following kernel Ooops.
I had successfully established the same tunnel a few times, but key
renegotiation caused a problem ( both ends did not renegotiate at the
same time so the tunnel was frozen ), i decided to kill the tunnel and
start a new one ( using ipsec auto --down tunnel & ipsec auto --up
tunnel ), while i was doing so, i got the oops.
BUG: unable to handle kernel NULL pointer dereference at virtual address
00000188
printing eip:
c02fb85c
*pde = 00000000
Oops: 0000 [#1]
PREEMPT
Modules linked in: xfrm4_mode_tunnel usblp deflate zlib_deflate twofish
twofish_common serpent blowfish des cbc ecb blkcipher xcbc sha256 sha1
crypto_null xfrm4_tunnel tunnel4 ipcomp esp4 ah4 af_key autofs4 asb100
hwmon_vid hidp rfcomm l2cap bluetooth sunrpc nf_conntrack_netbios_ns
ipt_LOG xt_limit xt_mark xt_state xt_tcpudp iptable_filter
ipt_MASQUERADE iptable_nat nf_nat nf_conntrack_ipv4 xt_MARK
iptable_mangle ip_tables x_tables binfmt_misc sd_mod ipv6 sg hfsplus
video button ac lp parport_pc parport floppy nvram usb_storage scsi_mod
libusual usbhid hid ehci_hcd snd_via82xx snd_ac97_codec ac97_bus
ohci1394 snd_seq_dummy uhci_hcd ieee1394 snd_seq_oss snd_seq_midi_event
snd_seq snd_pcm_oss snd_mixer_oss snd_pcm snd_timer snd_page_alloc
snd_mpu401_uart snd_rawmidi snd_seq_device snd via_agp agpgart
i2c_viapro soundcore eepro100 i2c_core b44 pcspkr mii shpchp usbcore dm_mod
CPU: 0
EIP: 0060:[<c02fb85c>] Not tainted VLI
EFLAGS: 00010246 (2.6.20 #1)
EIP is at xfrm_audit_log+0x4cc/0x580
eax: ecb71061 ebx: c039d160 ecx: 00000000 edx: 00000021
esi: 000001f4 edi: 00000255 ebp: 00000000 esp: e8cd5a18
ds: 007b es: 007b ss: 0068
Process pluto (pid: 27486, ti=e8cd4000 task=d3557070 task.ti=e8cd4000)
Stack: c17d2ea0 c0354bf1 e183f9c0 00000003 c03ac59c e1399800 00000001
00000003
f8d0a450 00000000 00000001 00000286 e8cd5a6c c011506b 00000000
00000286
f73cb8c0 00000246 c17d2ea0 00000000 00000000 f73cb8c0 f8d03c67
00000000
Call Trace:
[<c011506b>] __wake_up+0x4b/0x80
[<f8d03c67>] pfkey_broadcast+0x137/0x1b0 [af_key]
[<f8d03e5f>] pfkey_send_policy_notify+0xef/0x1a0 [af_key]
[<c011d90e>] local_bh_enable+0x2e/0xa0
[<c0306107>] xfrm_get_policy+0x2b7/0x2f0
[<c0305e50>] xfrm_get_policy+0x0/0x2f0
[<c0304702>] xfrm_user_rcv_msg+0x102/0x1b0
[<c0304600>] xfrm_user_rcv_msg+0x0/0x1b0
[<c02b3782>] netlink_run_queue+0x82/0x120
[<c03045e8>] xfrm_netlink_rcv+0x28/0x40
[<c02b3d42>] netlink_data_ready+0x12/0x50
[<c02b2931>] netlink_sendskb+0x21/0x40
[<c02b3c50>] netlink_sendmsg+0x230/0x310
[<c02993cd>] sock_aio_write+0x11d/0x130
[<c01d538a>] avc_has_perm+0x5a/0x70
[<c0163ed5>] do_sync_write+0xd5/0x120
[<c012c960>] autoremove_wake_function+0x0/0x50
[<c01648c7>] vfs_write+0x177/0x180
[<c0164ea1>] sys_write+0x41/0x70
[<c0102f14>] syscall_call+0x7/0xb
=======================
Code: 8b 44 24 70 c1 e2 08 c1 e8 08 09 c2 0f b7 c2 89 44 24 08 8b 44 24
48 89 04 24 e8 10 eb e3 ff e9 bc fc ff ff 8b 8c 24 c0 00 00 00 <8b> 91
88 01 00 00 0f b7 99 82 00 00 00 85 d2 0f 85 64 fc ff ff
EIP: [<c02fb85c>] xfrm_audit_log+0x4cc/0x580 SS:ESP 0068:e8cd5a18
I'm running a vanilla 2.6.20 kernel on a Fedora Core 5 box on an athlon
processor:
cat /proc/cpuinfo
processor : 0
vendor_id : AuthenticAMD
cpu family : 6
model : 8
model name : AMD Athlon(TM) XP 2400+
stepping : 1
cpu MHz : 2000.256
cache size : 256 KB
fdiv_bug : no
hlt_bug : no
f00f_bug : no
coma_bug : no
fpu : yes
fpu_exception : yes
cpuid level : 1
wp : yes
flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge
mca cmov pat pse36 mmx fxsr sse syscall mmxext 3dnowext 3dnow ts
bogomips : 4003.78
clflush size : 32
uname -a
Linux machine 2.6.20 #1 PREEMPT Sat Feb 10 13:48:56 CET 2007 i686 athlon
i386 GNU/Linux
Please CC me in follow ups since i do not subscribe to the list.
Thanks
--
Charles-Edouard Ruault
GPG key Id E4D2B80C
^ permalink raw reply [flat|nested] 12+ messages in thread
end of thread, other threads:[~2007-02-26 10:36 UTC | newest]
Thread overview: 12+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2007-02-12 22:21 Fw: [BUG] 2.6.20 Oopses in xfrm_audit_log Andrew Morton
2007-02-12 22:49 ` David Miller
2007-02-12 23:01 ` Andrew Morton
-- strict thread matches above, loose matches on Subject: below --
2007-02-12 17:44 Joy Latten
2007-02-12 20:50 ` [BUG] " David Miller
2007-02-12 21:04 ` Charles-Edouard Ruault
2007-02-12 21:46 ` David Miller
2007-02-13 1:02 ` James Morris
2007-02-15 8:22 ` Charles-Edouard Ruault
2007-02-26 10:36 ` Charles-Edouard Ruault
2007-02-12 14:16 Charles-Edouard Ruault
2007-02-12 18:20 ` Alexey Dobriyan
2007-02-12 21:14 ` Charles-Edouard Ruault
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.