Messages in this thread | | | From | Kuniyuki Iwashima <> | Subject | Re: [PATCH] ipv6: delay procfs initialization after the ipv6 structs are ready | Date | Wed, 20 Mar 2024 15:18:13 -0700 |
| |
From: Nicolas Cavallari <nicolas.cavallari@green-communications.fr> Date: Wed, 20 Mar 2024 18:17:36 +0100 > procfs files are created before the structure they reference are > initialized. For example, if6_proc_init() creates procfs files that > access structures initialized by addrconf_init(). > > If ipv6 is compiled as a module and a program manages to open an ipv6 > procfs file during the loading of the module, it can oops the kernel. > > It appears that we were unlucky enough to reproduce this problem > multiple times already, out of maybe 100 boots: > > NET: Registered PF_INET6 protocol family > 8<--- cut here --- > pwm-backlight backlight: supply power not found, using dummy regulator > Segment Routing with IPv6 > In-situ OAM (IOAM) with IPv6 > Unable to handle kernel NULL pointer dereference at virtual address > 00000000 > mt7915e 0000:03:00.0 wlp3s0: renamed from wlan0 > [00000000] *pgd=00000000 > Internal error: Oops: 5 [#1] SMP ARM > Modules linked in: ipv6 mt7915e mt76_connac_lib mt76 dw_hdmi_imx > mac80211 dw_hdmi drm_display_helper imxdrm drm_dma_helper > drm_kms_helper snd_soc_imx_sgtl5000 syscopyarea sysfillrect sysimgblt > fb_sys_fops imx_ipu_v3 snd_soc_fsl_asoc_card cfg80211 snd_soc_sgtl5000 > drm libarc4 snd_soc_fsl_ssi snd_soc_simple_card_utils imx_pcm_dma > snd_soc_core rfkill snd_pcm_dmaengine snd_pcm > drm_panel_orientation_quirks cfbfillrect cfbimgblt cfbcopyarea > snd_timer snd egalax_ts snd_soc_imx_audmux soundcore flexcan mux_mmio > imx2_wdt mux_core can_dev pwm_bl > CPU: 2 PID: 850 Comm: snmpd Not tainted 6.1.14 #1 > Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree) > PC is at if6_seq_start+0x2c/0x98 [ipv6] > LR is at init_net+0x0/0xc00 > [...] > if6_seq_start [ipv6] from seq_read_iter+0xb4/0x510 > seq_read_iter from seq_read+0x80/0xac > seq_read from proc_reg_read+0xac/0x100 > proc_reg_read from vfs_read+0xb0/0x284 > vfs_read from ksys_read+0x64/0xec > ksys_read from ret_fast_syscall+0x0/0x54 > Exception stack(0xf0e31fa8 to 0xf0e31ff0) > 1fa0: b67fd0b0 be8a666b 0000000a b67fd148 00000400 > 00000000 > 1fc0: b67fd0b0 be8a666b 00000001 00000003 be8a67ec 00000000 b6d7e000 > b6c9954a > 1fe0: b6d7eb30 be8a6638 b6ef11b4 b6ef0ddc > Code: e5931004 e35100ff ca000014 e59e25dc (e7920101) > ---[ end trace 0000000000000000 ]--- > > Signed-off-by: Nicolas Cavallari <nicolas.cavallari@green-communications.fr>
Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>
| |