Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755956AbdDES7l (ORCPT ); Wed, 5 Apr 2017 14:59:41 -0400 Received: from smtp.codeaurora.org ([198.145.29.96]:42594 "EHLO smtp.codeaurora.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751065AbdDES7b (ORCPT ); Wed, 5 Apr 2017 14:59:31 -0400 MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII; format=flowed Content-Transfer-Encoding: 7bit Date: Wed, 05 Apr 2017 12:59:29 -0600 From: Subash Abhinov Kasiviswanathan To: Eric Dumazet Cc: Cong Wang , Eric Dumazet , Andrey Konovalov , "David S. Miller" , netdev , LKML , Dmitry Vyukov , Kostya Serebryany , syzkaller , netdev-owner@vger.kernel.org Subject: Re: net/ipv4: use-after-free in ipv4_mtu In-Reply-To: <1491360338.10124.39.camel@edumazet-glaptop3.roam.corp.google.com> References:

<1491360338.10124.39.camel@edumazet-glaptop3.roam.corp.google.com> Message-ID: User-Agent: Roundcube Webmail/1.2.1 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 4047 Lines: 105 > > Interesting. I might had too many beers tonight, but ... > > refcount was removed in 2860583fe840 many months later > > -static void rt_init_metrics(struct rtable *rt, struct fib_info *fi) > -{ > - if (fi->fib_metrics != (u32 *) dst_default_metrics) { > - rt->fi = fi; > - atomic_inc(&fi->fib_clntref); > - } > - dst_init_metrics(&rt->dst, fi->fib_metrics, true); > -} > - > static struct fib_nh_exception *find_exception(struct fib_nh *nh, > __be32 daddr) > { > struct fnhe_hash_bucket *hash = nh->nh_exceptions; > @@ -1261,7 +1239,7 @@ static void rt_set_nexthop(struct rtable *rt, > __be32 daddr, > rt->rt_gateway = nh->nh_gw; > if (unlikely(fnhe)) > rt_bind_exception(rt, fnhe, daddr); > - rt_init_metrics(rt, fi); > + dst_init_metrics(&rt->dst, fi->fib_metrics, true); > #ifdef CONFIG_IP_ROUTE_CLASSID > rt->dst.tclassid = nh->nh_tclassid; > #endif Hi Eric I encountered a crash on 4.4 kernel pointing to ipv4_mtu. Is the crash similar to this one? (target is ARM64 Android, was seen on a stability rack, so no reproducer unfortunately) <6> Kernel BUG at 00000000000005dc [verbose debug info unavailable] <6> Internal error: Oops - BUG: 0 [#1] PREEMPT SMP <6> CPU: 1 PID: 4649 Comm: iperf Tainted: G W O 4.4.21+ #1 <6> task: ffffffef02242f00 ti: ffffffef021b8000 task.ti: ffffffef021b8000 <2> PC is at 0x5dc <2> LR is at ipv4_mtu+0x70/0x84 <2> pc : [<00000000000005dc>] lr : [] pstate: a0000145 <2> sp : ffffffef021bb9b0 <2> x29: ffffffef021bb9b0 x28: 0000000000000000 <2> x27: ffffffef318122c0 x26: 00000000000005be <2> x25: ffffffef31812678 x24: ffffffef31812678 <2> x23: ffffffef8794c000 x22: ffffff9bd43f4380 <2> x21: ffffffef318122c0 x20: ffffffef6aef6ac0 <2> x19: ffffffef05026ac0 x18: 0000000001026749 <2> x17: 0000007fabaf145c x16: ffffff9bd1fe72bc <2> x15: 00368fbefea52a8e x14: 3736353433323130 <2> x13: 3938373635343332 x12: 0000000000000003 <2> x11: 0000000000000028 x10: 0101010101010101 <2> x9 : 0000000000000001 x8 : 0000000000000098 <2> x7 : ffffff9bd2c8cbc0 x6 : 0000000000000000 <2> x5 : ffffffef68481c00 x4 : 00000000ffffefbf <2> x3 : 0000000000000000 x2 : 0000000000000000 <2> x1 : 000000000000ef7f x0 : 0000000001280058 <2> LR: 0xffffff9bd2c35a78: <2> 5a78 b7f80241 f9401661 927ef421 b9400422 2a0203e0 350001a2 f9400e60 b9400021 <2> 5a98 b9422800 361000c1 39428e61 34000081 7109001f 52804801 1a819000 529fffe1 <2> 5ab8 6b01001f 1a819000 f9400bf3 a8c27bfd d65f03c0 a9ba7bfd 910003fd a90153f3 <2> 5ad8 a9025bf5 a90363f7 a9046bf9 aa0003f3 aa1e03e0 f9002fa1 2a0203f8 2a0303f9 <2> SP: 0xffffffef021bb970: <2> b970 d2c35ab8 ffffff9b 021bb9b0 ffffffef 000005dc 00000000 a0000145 00000000 <2> b990 6aef6ac0 ffffffef 6aef6ac0 ffffffef 00000000 00000080 d2c015b0 ffffff9b <2> b9b0 021bb9d0 ffffffef d2c3e4d4 ffffff9b 6aef6ac0 ffffffef 021bba18 ffffffef <2> b9d0 021bba20 ffffffef d2c3f05c ffffff9b d37d9418 ffffff9b 6aef6ac0 ffffffef <2> <6> Process iperf (pid: 4649, stack limit = 0xffffffef021b8020) <2> Call trace: <2> [<00000000000005dc>] 0x5dc <2> [] ip_finish_output+0xbc/0x1dc <2> [] ip_output+0xe8/0x15c <2> [] ip_local_out+0x58/0x68 <2> [] ip_send_skb+0x2c/0xa8 <2> [] udp_send_skb+0x194/0x29c <2> [] udp_sendmsg+0x4e0/0x700 <2> [] inet_sendmsg+0x98/0xc8 <2> [] sock_sendmsg+0x48/0x60 <2> [] sock_write_iter+0x94/0xc0 <2> [] __vfs_write+0xc0/0xf0 <2> [] vfs_write+0xb8/0x150 <2> [] SyS_write+0x58/0x94 <2> [] el0_svc_naked+0x24/0x28 <6> Code: bad PC value <6> ---[ end trace debf337ba02da94f ]--- <6> Kernel panic - not syncing: Fatal exception -- The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum, a Linux Foundation Collaborative Project