lkml.org 
[lkml]   [2002]   [Jun]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
Subject[PATCH][2.5.22] OOPS in tcp_v6_get_port

Sorry for the repeat email but this bug is also in 2.5.22 and my patch is still
valid, although I'm not entirely sure it is the correct fix for the problem?

-- From Previous email --
2.5.21 and 2.5.22 OOPS at boot on my test machine, the decoded OOPS is attached.
Also attached is a program that triggers the bug, it emulates the behavior
of bind on my test machine and binds to two ports one IPv4 and one IPv6
with the same port number but different IP addresses.

The bug appears to be the IPv6 TCP code, in net/ipv6/tcp_ipv6.c
Line 149:
struct ipv6_pinfo *np2 = inet6_sk(sk2);

if (sk != sk2 &&
sk->bound_dev_if == sk2->bound_dev_if) {
if (!sk_reuse ||
!sk2->reuse ||
sk2->state == TCP_LISTEN) {
/* NOTE: IPv6 tw bucket have different format */
if (!inet_sk(sk2)->rcv_saddr ||
addr_type == IPV6_ADDR_ANY ||
!ipv6_addr_cmp(&np->rcv_saddr,
sk2->state != TCP_TIME_WAIT ?
BUG --> &np2->rcv_saddr :
&((struct tcp_tw_bucket*)sk)->v6_rcv_saddr) ||
(addr_type==IPV6_ADDR_MAPPED && sk2->family==AF_INET &&
inet_sk(sk)->rcv_saddr ==
inet_sk(sk2)->rcv_saddr))
break;
}
}
}

np2 can be NULL if the socket is an IPv4 socket, since IPv6 and IPv4
share the port address space. While the test of !inet_sk(sk2-)->rcv_addr
_should_ prevent this it is not assured in C that the conditions to an if
statement will be evaluated in the order written? At least my gcc
(2.95.4 from compiled from CVS) doesn't think so :-).

I propose a diff similar to the one below to fix the problem maybe?

Many thanks,
Carl Ritson
critson@perlfu.co.uk

--- orig/net/ipv6/tcp_ipv6.c Sat Jun 15 19:23:44 2002
+++ linux/net/ipv6/tcp_ipv6.c Sat Jun 15 19:21:46 2002
@@ -156,14 +156,16 @@
/* NOTE: IPv6 tw bucket have different format */
if (!inet_sk(sk2)->rcv_saddr ||
addr_type == IPV6_ADDR_ANY ||
- !ipv6_addr_cmp(&np->rcv_saddr,
- sk2->state != TCP_TIME_WAIT ?
- &np2->rcv_saddr :
- &((struct tcp_tw_bucket*)sk)->v6_rcv_saddr) ||
(addr_type==IPV6_ADDR_MAPPED && sk2->family==AF_INET &&
inet_sk(sk)->rcv_saddr ==
inet_sk(sk2)->rcv_saddr))
break;
+ if (np2 != NULL)
+ if (!ipv6_addr_cmp(&np->rcv_saddr,
+ sk2->state != TCP_TIME_WAIT ?
+ &np2->rcv_saddr :
+ &((struct tcp_tw_bucket*)sk)->v6_rcv_saddr))
+ break;
}
}
}
ksymoops 2.4.4 on i686 2.4.19-pre8-ac2. Options used
-v /usr/src/linux-2.5.21/vmlinux (specified)
-K (specified)
-L (specified)
-o /lib/modules/2.5.21/ (specified)
-m /boot/System.map-2.5.21 (specified)

No modules in ksyms, skipping objects
Unable to handle kernel NULL pointer dereference at virtual address 00000010
c027244e
*pde = 00000000
Oops: 0000
CPU: 0
EIP: 0010:[<c027244e>] Not tainted
Using defaults from ksymoops -t elf32-i386 -a i386
EFLAGS: 00010246
eax: cfd68b28 ebx: cea60360 ecx: 00000010 edx: cfd68a0a
esi: cfd68de8 edi: 00000010 ebp: cf9cf260 esp: ce8a7e98
ds: 0018 es: 0018 ss: 0018
Stack: ce8a7f1c cfd68ac0 cfd68de8 c0341908 cfd68de8 0100007f 00000011 00000001
cfd68ac0 cfd21dc8 03b93874 c0260f81 cfd68ac0 000003b9 ce8a7a40 ce8a7f14
0000001c 40263874 00000011 03b919c8 0600007f cfd68dd8 cfd68bf8 c02227c0
Call Trace: [<c0260f81>] [<c02227c0>] [c0223629>] [<c0221cf5>] [<c0222d2e>]
[<c0222d50>] [<c02232a0>] [<c0106a17>]
Code: f3 a6 74 2c 81 7c 24 18 00 10 00 00 75 17 66 83 7b 1c 02 75

>>EIP; c027244e <tcp_v6_get_port+1ae/2d4> <=====
Trace; c0260f81 <inet6_bind+2b1/3d8>
Trace; c02227c0 <sys_bind+54/74>
Trace; c0222d50 <sys_setsockopt+6c/78>
Trace; c02232a0 <sys_socketcall+74/1fc>
Trace; c0106a17 <syscall_call+7/b>
Code; c027244e <tcp_v6_get_port+1ae/2d4>
00000000 <_EIP>:
Code; c027244e <tcp_v6_get_port+1ae/2d4> <=====
0: f3 a6 repz cmpsb %es:(%edi),%ds:(%esi) <=====
Code; c0272450 <tcp_v6_get_port+1b0/2d4>
2: 74 2c je 30 <_EIP+0x30> c027247e <tcp_v6_get_port+1de/2d4>
Code; c0272452 <tcp_v6_get_port+1b2/2d4>
4: 81 7c 24 18 00 10 00 cmpl $0x1000,0x18(%esp,1)
Code; c0272459 <tcp_v6_get_port+1b9/2d4>
b: 00
Code; c027245a <tcp_v6_get_port+1ba/2d4>
c: 75 17 jne 25 <_EIP+0x25> c0272473 <tcp_v6_get_port+1d3/2d4>
Code; c027245c <tcp_v6_get_port+1bc/2d4>
e: 66 83 7b 1c 02 cmpw $0x2,0x1c(%ebx)
Code; c0272461 <tcp_v6_get_port+1c1/2d4>
13: 75 00 jne 15 <_EIP+0x15> c0272463 <tcp_v6_get_port+1c3/2d4>

#include <stdlib.h>
#include <stdio.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>

const unsigned short bind_port = 4500;

int do_ipv4_bind(char *ip, const unsigned short port) {
struct sockaddr_in addr;
int sock;
int ret;

memset(&addr, 0x00, sizeof(addr));
addr.sin_family = AF_INET;
addr.sin_port = htons(port);
inet_pton(AF_INET, ip, &(addr.sin_addr));

ret = socket(PF_INET, SOCK_STREAM, 0);
if(ret == -1) {
return ret;
} else {
sock = ret;
}
ret = bind(sock, (struct sockaddr *)&addr, sizeof(addr));
if(ret == -1) {
return ret;
} else {
return sock;
}
}

int do_ipv6_bind(char *ip, const unsigned short port) {
struct sockaddr_in6 addr;
int sock;
int ret;

memset(&addr, 0x00, sizeof(addr));
addr.sin6_family = AF_INET6;
addr.sin6_port = htons(port);
inet_pton(AF_INET6, ip, &(addr.sin6_addr));

ret = socket(PF_INET6, SOCK_STREAM, 0);
if(ret == -1) {
return ret;
} else {
sock = ret;
}

ret = bind(sock, (struct sockaddr *)&addr, sizeof(addr));
if(ret == -1) {
return ret;
} else {
return sock;
}
}

int main(void) {
int ipv4_sock = 0;
int ipv6_sock = 0;
ipv4_sock = do_ipv4_bind("127.0.0.1", bind_port);
ipv6_sock = do_ipv6_bind("::1", bind_port);
if(ipv4_sock < 0) {
printf("ipv4 bind failed\n");
} else {
printf("ipv4 bind succeeded\n");
close(ipv4_sock);
}
if(ipv6_sock < 0) {
printf("ipv6 bind failed\n");
} else {
printf("ipv6 bind succeeded\n");
close(ipv6_sock);
}
return 0;
}
\
 
 \ /
  Last update: 2005-03-22 13:26    [W:0.080 / U:0.048 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site