Re: [Bugme-new] [Bug 8961] New: BUG triggered by oidentd in netlink code

Re: [Bugme-new] [Bug 8961] New: BUG triggered by oidentd in netlink code

[Athanasius]

[-- Attachment #1: Type: text/plain, Size: 863 bytes --]

On Fri, Aug 31, 2007 at 01:05:04PM +0200, Patrick McHardy wrote:
> Seems to be a bug introduced by the netlink_run_queue conversion,
> since there is no locking and netlink_run_queue doesn't check
> for NULL results from skb_dequeue, it might pass NULL to
> netlink_rcv_skb, which crashes.
> 
> Does this patch help?

  I'll compile up a new kernel, likely 2.6.22.6, plus this patch, and
reboot to it tonight.  I still don't know *exactly* how to trigger the
bug on demand though, it's not reocurred since I posted the bug report
(but had happened about a week before as well).

thanks,

-Ath
-- 
- Athanasius = Athanasius(at)miggy.org / http://www.miggy.org/
                  Finger athan(at)fysh.org for PGP key
	   "And it's me who is my enemy. Me who beats me up.
Me who makes the monsters. Me who strips my confidence." Paula Cole - ME

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: [Bugme-new] [Bug 8961] New: BUG triggered by oidentd in netlink code

[Patrick McHardy]

Athanasius wrote:
>   I'll compile up a new kernel, likely 2.6.22.6, plus this patch, and
> reboot to it tonight.  I still don't know *exactly* how to trigger the
> bug on demand though, it's not reocurred since I posted the bug report
> (but had happened about a week before as well).


Thanks. I'm not sure either, it would require two concurrent requests
to be processed, but AFAICS oidentd only uses a single netlink socket.
Perhaps multiple running instances or something else using the inet_diag
interface?

You might be able to trigger it without this patch by running
"while true; do ss -tn; done" while doing ident queries, but
just running the while loop a couple of times in parallel
doesn't seem to trigger it here.

Re: [Bugme-new] [Bug 8961] New: BUG triggered by oidentd in netlink code

[Athanasius]

[-- Attachment #1: Type: text/plain, Size: 1574 bytes --]

On Sat, Sep 01, 2007 at 06:38:23PM +0200, Patrick McHardy wrote:
> Athanasius wrote:
> >  I'll compile up a new kernel, likely 2.6.22.6, plus this patch, and
> >reboot to it tonight.  I still don't know *exactly* how to trigger the
> >bug on demand though, it's not reocurred since I posted the bug report
> >(but had happened about a week before as well).
> 
> Thanks. I'm not sure either, it would require two concurrent requests
> to be processed, but AFAICS oidentd only uses a single netlink socket.
> Perhaps multiple running instances or something else using the inet_diag
> interface?
> 
> You might be able to trigger it without this patch by running
> "while true; do ss -tn; done" while doing ident queries, but
> just running the while loop a couple of times in parallel
> doesn't seem to trigger it here.

  I went for setting up a dummy listener in inetd, using tcpd, and
setting hosts.allow to specify myuser@ip.  Then a few while loops
spamming it with connections using nc.

  Anyway, on the old kernel that managed to trigger the BUG twice in
about 30 minutes.  I'm now on 2.6.22.6 plus your patch and coming up on
an hour (55+ mins) of the same and no sign of the BUG.

  So that looks like fixed to me.  I'll weigh in again if the daily
logcheck throws up another.

-Ath
-- 
- Athanasius = Athanasius(at)miggy.org / http://www.miggy.org/
                  Finger athan(at)fysh.org for PGP key
	   "And it's me who is my enemy. Me who beats me up.
Me who makes the monsters. Me who strips my confidence." Paula Cole - ME

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: [Bugme-new] [Bug 8961] New: BUG triggered by oidentd in netlink code

[Patrick McHardy]

Athanasius wrote:
> On Sat, Sep 01, 2007 at 06:38:23PM +0200, Patrick McHardy wrote:
>>
>> You might be able to trigger it without this patch by running
>> "while true; do ss -tn; done" while doing ident queries, but
>> just running the while loop a couple of times in parallel
>> doesn't seem to trigger it here.
> 
>   I went for setting up a dummy listener in inetd, using tcpd, and
> setting hosts.allow to specify myuser@ip.  Then a few while loops
> spamming it with connections using nc.
> 
>   Anyway, on the old kernel that managed to trigger the BUG twice in
> about 30 minutes.  I'm now on 2.6.22.6 plus your patch and coming up on
> an hour (55+ mins) of the same and no sign of the BUG.
> 
>   So that looks like fixed to me.  I'll weigh in again if the daily
> logcheck throws up another.


Thanks a lot for testing, I'll send a version for current -rc
upstream tommorrow.

Re: [Bugme-new] [Bug 8961] New: BUG triggered by oidentd in netlink code

[Herbert Xu]

Patrick McHardy <kaber@trash.net> wrote:
> 
> Thanks. I'm not sure either, it would require two concurrent requests
> to be processed, but AFAICS oidentd only uses a single netlink socket.
> Perhaps multiple running instances or something else using the inet_diag
> interface?

Since identd serves requests from the outside world it is
quite possible for two identd instances to run simultaneously
serving two requests.

I'm not familiar with oidentd but this is certainly pidentd
works.

Cheers,
-- 
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

Re: [Bugme-new] [Bug 8961] New: BUG triggered by oidentd in netlink code

[Patrick McHardy]

Herbert Xu wrote:
> Patrick McHardy <kaber@trash.net> wrote:
>   
>> Thanks. I'm not sure either, it would require two concurrent requests
>> to be processed, but AFAICS oidentd only uses a single netlink socket.
>> Perhaps multiple running instances or something else using the inet_diag
>> interface?
>>     
>
> Since identd serves requests from the outside world it is
> quite possible for two identd instances to run simultaneously
> serving two requests.
>
> I'm not familiar with oidentd but this is certainly pidentd
> works.

Right, I forgot about inetd. Thanks Herbert :)