mirror of https://lore.kernel.org/lkml/
 help / color / mirror / Atom feed
* ip6_gre: paninc in ip6gre_header
@ 2023-05-27  8:51 gaoxingwang
  2023-05-27  9:01 ` Eric Dumazet
  0 siblings, 1 reply; 9+ messages in thread
From: gaoxingwang @ 2023-05-27  8:51 UTC (permalink / raw)
  To: netdev, linux-kernel, davem, dsahern, yoshfuji
  Cc: pabeni, edumazet, liaichun, yanan

Hello:
  I am doing some fuzz test for kernel, the following crash was triggered.
  My kernel version is 5.10.0.Have you encountered similar problems?
  If there is a fix, please let me know. 
  Thank you very much.

skbuff: skb_under_panic: text:ffffffff8ad94c6b len:-2047924812 put:-2047924888 head:ffff888034c9c000 data:ffff887faeda9bf8 tail:0x1ac end:0xec0 dev:team1
------------[ cut here ]------------
kernel BUG at net/core/skbuff.c:110!
invalid opcode: 0000 [#1] SMP KASAN PTI
CPU: 1 PID: 1546 Comm: syz-fuzzer Not tainted 5.10.0 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014
RIP: 0010:skb_panic+0x171/0x183 net/core/skbuff.c:110
Code: f5 4c 8b 4c 24 10 41 56 8b 4b 70 45 89 e8 4c 89 e2 41 57 48 89 ee 48 c7 c7 20 f2 2d 8e ff 74 24 10 ff 74 24 20 e8 da 59 62 ff <0f> 0b 48 c7 c7 00 2f 5e 92 48 83 c4 20 e8 cb 6f 6d ff e8 9c c5 5b
RSP: 0000:ffff8880bcc096f0 EFLAGS: 00010282
RAX: 0000000000000099 RBX: ffff88801e080f00 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff815ffb62 RDI: ffffed10179812d0
RBP: ffffffff8e2df720 R08: 0000000000000099 R09: ffffed1017981267
R10: ffff8880bcc09337 R11: ffffed1017981266 R12: ffffffff8ad94c6b
R13: 0000000085ef2568 R14: ffff888062b8c000 R15: 0000000000000ec0
FS:  000000c01741c490(0000) GS:ffff8880bcc00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000c021635000 CR3: 000000001fdb6000 CR4: 0000000000150ee0
Call Trace:
 <IRQ>
 skb_under_panic net/core/skbuff.c:120 [inline]
 skb_push.cold+0x24/0x24 net/core/skbuff.c:1942
 ip6gre_header+0xcb/0xaf0 net/ipv6/ip6_gre.c:1380
 dev_hard_header include/linux/netdevice.h:3210 [inline]
 neigh_connected_output+0x2a4/0x400 net/core/neighbour.c:1541
 neigh_output include/net/neighbour.h:524 [inline]
 ip6_finish_output2+0xa20/0x1d20 net/ipv6/ip6_output.c:145
 __ip6_finish_output net/ipv6/ip6_output.c:210 [inline]
 __ip6_finish_output+0x35d/0x920 net/ipv6/ip6_output.c:189
 ip6_finish_output+0x38/0x1c0 net/ipv6/ip6_output.c:220
 NF_HOOK_COND include/linux/netfilter.h:293 [inline]
 ip6_output+0x1cc/0x400 net/ipv6/ip6_output.c:243
 dst_output include/net/dst.h:453 [inline]
 NF_HOOK include/linux/netfilter.h:304 [inline]
 mld_sendpack+0x5ca/0xb80 net/ipv6/mcast.c:1679
 mld_send_cr net/ipv6/mcast.c:1975 [inline]
 mld_ifc_timer_expire+0x3c0/0x810 net/ipv6/mcast.c:2474
 call_timer_fn+0x3f/0x200 kernel/time/timer.c:1414
 expire_timers+0x21c/0x3b0 kernel/time/timer.c:1459
 __run_timers kernel/time/timer.c:1753 [inline]
 run_timer_softirq+0x2ad/0x7f0 kernel/time/timer.c:1766
 __do_softirq+0x19b/0x612 kernel/softirq.c:322
 asm_call_irq_on_stack+0x12/0x20
 </IRQ>
 __run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline]
 run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline]
 do_softirq_own_stack+0x37/0x50 arch/x86/kernel/irq_64.c:77
 invoke_softirq kernel/softirq.c:417 [inline]
 __irq_exit_rcu kernel/softirq.c:447 [inline]
 irq_exit_rcu+0x1a2/0x240 kernel/softirq.c:459
 sysvec_apic_timer_interrupt+0x36/0x80 arch/x86/kernel/apic/apic.c:1116
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:635
RIP: 0033:0x41e83e
Code: 44 89 c1 45 89 d5 41 d3 ea 41 0f ba e2 04 0f 83 ec 00 00 00 48 89 44 24 58 41 0f a3 cd 0f 83 87 00 00 00 4e 8d 14 20 4d 8b 12 <66> 90 4d 85 d2 74 79 4d 89 d5 4d 29 e2 4c 39 d2 77 6e 89 4c 24 3c
RSP: 002b:000000c002629e88 EFLAGS: 00000207
RAX: 0000000000000008 RBX: 000000c000041698 RCX: 0000000000000001
RDX: 0000000000000040 RSI: 0000000000203002 RDI: 000000c0205f4800
RBP: 000000c002629f10 R08: 0000000000000001 R09: 00007f954fcd92d0
R10: 000000c00350bee0 R11: 00007f954fe52fff R12: 000000c0090c5a00
R13: 00000000000000fa R14: 000000c007b66ea0 R15: ffffffffffffffff
Modules linked in:
kernel fault(0x1) notification starting on CPU 1
kernel fault(0x1) notification finished on CPU 1
---[ end trace 854b3d6f97989351 ]---
RIP: 0010:skb_panic+0x171/0x183 net/core/skbuff.c:110
Code: f5 4c 8b 4c 24 10 41 56 8b 4b 70 45 89 e8 4c 89 e2 41 57 48 89 ee 48 c7 c7 20 f2 2d 8e ff 74 24 10 ff 74 24 20 e8 da 59 62 ff <0f> 0b 48 c7 c7 00 2f 5e 92 48 83 c4 20 e8 cb 6f 6d ff e8 9c c5 5b
RSP: 0000:ffff8880bcc096f0 EFLAGS: 00010282
RAX: 0000000000000099 RBX: ffff88801e080f00 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff815ffb62 RDI: ffffed10179812d0
RBP: ffffffff8e2df720 R08: 0000000000000099 R09: ffffed1017981267
R10: ffff8880bcc09337 R11: ffffed1017981266 R12: ffffffff8ad94c6b
R13: 0000000085ef2568 R14: ffff888062b8c000 R15: 0000000000000ec0
FS:  000000c01741c490(0000) GS:ffff8880bcc00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000c021635000 CR3: 000000001fdb6000 CR4: 0000000000150ee0

^ permalink raw reply	[flat|nested] 9+ messages in thread
* [Discuss]iproute2: ipv6 route add fail
@ 2024-01-05  9:42 gaoxingwang
  2024-01-22  4:10 ` David Ahern
  0 siblings, 1 reply; 9+ messages in thread
From: gaoxingwang @ 2024-01-05  9:42 UTC (permalink / raw)
  To: netdev, linux-kernel, davem, dsahern, edumazet, kuba; +Cc: liaichun, yanan

Hello everyone,

Here is a particular problem with routing.
Sometimes users can run the ip -6 route command to add a route whose destination address is the same as the gateway address, and it can be successfully added. However, adding another route with the same gateway address will fail later.

Example:
# ip -6 route add 2409:8080:5a0a:60c7::7/128 via 2409:8080:5a0a:60c7::7 dev eth2
# ip -6 route add 2409:8080:5a0a:60c7::8/128 via 2409:8080:5a0a:60c7::7 dev eth2
RTNETLINK answers: No route to host

Does the kernel not support this application scenario?
Or should the kernel not allow routes with the same destination address as the gateway address to be added so that other more meaningful routes can be added successfully?

This question puzzles me, thank you very much if your can reply.

Best regards,
Xingwang

^ permalink raw reply	[flat|nested] 9+ messages in thread
end of thread, other threads:[~2024-01-23  4:59 UTC | newest]

Thread overview: 9+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-05-27  8:51 ip6_gre: paninc in ip6gre_header gaoxingwang
2023-05-27  9:01 ` Eric Dumazet
2023-05-28 12:53   ` gaoxingwang
2023-05-30  3:21   ` gaoxingwang
2023-05-30  6:57     ` Eric Dumazet
2024-01-23  3:08       ` [Discuss]iproute2: ipv6 route add fail gaoxingwang
2024-01-23  4:59         ` David Ahern
2024-01-05  9:42 gaoxingwang
2024-01-22  4:10 ` David Ahern

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®