| Message ID | 1362368217-30984-1-git-send-email-amwang@redhat.com |
|---|---|
| State | Changes Requested, archived |
| Delegated to: | David Miller |
| Headers | show |
On Mon, 2013-03-04 at 11:36 +0800, Cong Wang wrote: > From: Cong Wang <amwang@redhat.com> > > A NULL-deref bug was reported in: > https://bugzilla.kernel.org/show_bug.cgi?id=54281 > when deleting a vlan interface: > > # ip link del em1.57 > BUG: unable to handle kernel NULL pointer dereference at (null) > IP: [<ffffffffa03c356f>] garp_uninit_applicant+0x2f/0xd0 [garp] > ... > > This is probably app->pdu is NULL'ed in garp_pdu_rcv() > in BH, while garp_uninit_applicant() only holds rtnl lock > which is not enough to prevent this. > > OTOH, garp_pdu_queue() should ways be called with the spin lock. > > > Reported-by: bugs@syam.in I can't reproduce it locally, so please help to test it. I only did compiling test. Thanks! -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
On Mon, 2013-03-04 at 11:36 +0800, Cong Wang wrote: > From: Cong Wang <amwang@redhat.com> > > A NULL-deref bug was reported in: > https://bugzilla.kernel.org/show_bug.cgi?id=54281 > when deleting a vlan interface: > > # ip link del em1.57 > BUG: unable to handle kernel NULL pointer dereference at (null) > IP: [<ffffffffa03c356f>] garp_uninit_applicant+0x2f/0xd0 [garp] > ... > > This is probably app->pdu is NULL'ed in garp_pdu_rcv() > in BH, while garp_uninit_applicant() only holds rtnl lock > which is not enough to prevent this. > > OTOH, garp_pdu_queue() should ways be called with the spin lock. > > > Reported-by: bugs@syam.in > Cc: bugs@syam.in > Cc: David Ward <david.ward@ll.mit.edu> > Cc: Stephen Hemminger <stephen@networkplumber.org> > Cc: David S. Miller <davem@davemloft.net> > Signed-off-by: Cong Wang <amwang@redhat.com> > > --- > diff --git a/net/802/garp.c b/net/802/garp.c > index 8456f5d..5d9630a 100644 > --- a/net/802/garp.c > +++ b/net/802/garp.c > @@ -609,8 +609,12 @@ void garp_uninit_applicant(struct net_device *dev, struct garp_application *appl > /* Delete timer and generate a final TRANSMIT_PDU event to flush out > * all pending messages before the applicant is gone. */ > del_timer_sync(&app->join_timer); > + > + spin_lock_bh(&app->lock); > garp_gid_event(app, GARP_EVENT_TRANSMIT_PDU); > garp_pdu_queue(app); > + spin_unlock_bh(&app->lock); > + > garp_queue_xmit(app); > > dev_mc_del(dev, appl->proto.group_address); Nope this patch doesnt solve the problem Crash is in : 49 8b 1c c6 mov (%r14,%rax,8),%rbx Thats because r14 (port) is NULL -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
On Sun, 2013-03-03 at 21:26 -0800, Eric Dumazet wrote: > > Nope this patch doesnt solve the problem > > Crash is in : > > 49 8b 1c c6 mov (%r14,%rax,8),%rbx > > Thats because r14 (port) is NULL > > > Hmm, but I can't see how it can be NULL, the only place of NULL'ing it is inside garp_release_port(), right after the piece of code that I patched. Thanks! -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
On Mon, 2013-03-04 at 17:55 +0800, Cong Wang wrote: > On Sun, 2013-03-03 at 21:26 -0800, Eric Dumazet wrote: > > > > Nope this patch doesnt solve the problem > > > > Crash is in : > > > > 49 8b 1c c6 mov (%r14,%rax,8),%rbx > > > > Thats because r14 (port) is NULL > > > > > > > > Hmm, but I can't see how it can be NULL, the only place of NULL'ing it > is inside garp_release_port(), right after the piece of code that I > patched. > > Thanks! > Maybe port is NULL from the beginning. Try to inject memory allocations error in garp_init_port() -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/net/802/garp.c b/net/802/garp.c index 8456f5d..5d9630a 100644 --- a/net/802/garp.c +++ b/net/802/garp.c @@ -609,8 +609,12 @@ void garp_uninit_applicant(struct net_device *dev, struct garp_application *appl /* Delete timer and generate a final TRANSMIT_PDU event to flush out * all pending messages before the applicant is gone. */ del_timer_sync(&app->join_timer); + + spin_lock_bh(&app->lock); garp_gid_event(app, GARP_EVENT_TRANSMIT_PDU); garp_pdu_queue(app); + spin_unlock_bh(&app->lock); + garp_queue_xmit(app); dev_mc_del(dev, appl->proto.group_address);