lkml.org 
[lkml]   [2017]   [Mar]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    SubjectRe: net: heap out-of-bounds in fib6_clean_node/rt6_fill_node/fib6_age/fib6_prune_clone
    From
    Date
    On 3/7/17 1:43 AM, Dmitry Vyukov wrote:
    > This is on c1ae3cfa0e89fa1a7ecc4c99031f5e9ae99d9201. No other kernel
    > output from your patch (pr_err).
    >
    > ------------[ cut here ]------------
    > WARNING: CPU: 1 PID: 30179 at net/ipv6/ip6_fib.c:158
    > rt6_rcu_free+0x61/0x70 net/ipv6/ip6_fib.c:158
    > Kernel panic - not syncing: panic_on_warn set ...

    you have panic_on_warn set ...

    >
    > CPU: 1 PID: 30179 Comm: syz-executor3 Not tainted 4.11.0-rc1+ #310
    > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
    > Call Trace:
    > __dump_stack lib/dump_stack.c:16 [inline]
    > dump_stack+0x2fb/0x3fd lib/dump_stack.c:52
    > panic+0x20f/0x426 kernel/panic.c:180
    > __warn+0x1c4/0x1e0 kernel/panic.c:541
    > warn_slowpath_null+0x2c/0x40 kernel/panic.c:584
    > rt6_rcu_free+0x61/0x70 net/ipv6/ip6_fib.c:158

    and this is my WARN_ON in rt6_rcu_free which is showing an additional
    change is needed

    > rt6_release+0x1ee/0x290 net/ipv6/ip6_fib.c:189
    > fib6_add_rt2node net/ipv6/ip6_fib.c:922 [inline]

    in fib6_add_rt2node for the route replace path (whitespace damaged on
    the copy-paste):

    @@ -916,6 +919,7 @@ static int fib6_add_rt2node(struct fib6_node *fn,
    struct rt6_info *rt,
    }
    nsiblings = iter->rt6i_nsiblings;
    fib6_purge_rt(iter, fn, info->nl_net);
    + iter->dst.flags &= ~DST_IN_FIB;
    rt6_release(iter);

    if (nsiblings) {
    @@ -926,6 +930,7 @@ static int fib6_add_rt2node(struct fib6_node *fn,
    struct rt6_info *rt,
    if (rt6_qualify_for_ecmp(iter)) {
    *ins = iter->dst.rt6_next;
    fib6_purge_rt(iter, fn,
    info->nl_net);
    + iter->dst.flags &= ~DST_IN_FIB;
    rt6_release(iter);
    nsiblings--;
    } else {
    \
     
     \ /
      Last update: 2017-03-07 19:29    [W:5.090 / U:0.196 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site