From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755897AbdCGSnt (ORCPT ); Tue, 7 Mar 2017 13:43:49 -0500 Received: from mail-pg0-f54.google.com ([74.125.83.54]:33414 "EHLO mail-pg0-f54.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755577AbdCGSnn (ORCPT ); Tue, 7 Mar 2017 13:43:43 -0500 Subject: Re: net: heap out-of-bounds in fib6_clean_node/rt6_fill_node/fib6_age/fib6_prune_clone To: Dmitry Vyukov References: <1488658514.9415.356.camel@edumazet-glaptop3.roam.corp.google.com> <4e4d7d51-82de-b21e-cb5d-d804f7b88999@cumulusnetworks.com> <14c01aea-6c2f-6ba5-6aee-52c55f410da7@cumulusnetworks.com> <2b60b1b8-4766-0e36-f6fb-79914bf1925d@cumulusnetworks.com> Cc: Eric Dumazet , Mahesh Bandewar , Eric Dumazet , David Miller , Alexey Kuznetsov , James Morris , Hideaki YOSHIFUJI , Patrick McHardy , netdev , LKML , Cong Wang , syzkaller From: David Ahern Message-ID: <328b1fa7-2d97-6ae3-3b87-e33a0d564ad9@cumulusnetworks.com> Date: Tue, 7 Mar 2017 11:43:01 -0700 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:45.0) Gecko/20100101 Thunderbird/45.7.1 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/mixed; boundary="------------8C1EEB2AC812F41C57ABCF58" Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org This is a multi-part message in MIME format. --------------8C1EEB2AC812F41C57ABCF58 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit On 3/7/17 11:13 AM, Dmitry Vyukov wrote: >> on this warning: >> >> /* dst.next really should not be set at this point */ >> if (rt->dst.next && rt->dst.next->ops->family != AF_INET6) { >> pr_warn("fib6_add: adding rt with bad next -- family %d dst >> flags %x\n", >> rt->dst.next->ops->family, rt->dst.next->flags); >> >> WARN_ON(1); >> } >> >> You should have seen the pr_warn in the log preceding the WARN_ON dump. > > Right. They all have the same "IPv6: fib6_add: adding rt with bad next > -- family 2 dst flags 6" remove the previous changes and try the attached. --------------8C1EEB2AC812F41C57ABCF58 Content-Type: text/plain; charset=UTF-8; x-mac-type="0"; x-mac-creator="0"; name="ipv6-debug.patch" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="ipv6-debug.patch" ZGlmZiAtLWdpdCBhL2luY2x1ZGUvbmV0L2RzdC5oIGIvaW5jbHVkZS9uZXQvZHN0LmgKaW5k ZXggMDQ5YWYzM2RhM2I2Li5kMTY0ZWI4Y2VhYjggMTAwNjQ0Ci0tLSBhL2luY2x1ZGUvbmV0 L2RzdC5oCisrKyBiL2luY2x1ZGUvbmV0L2RzdC5oCkBAIC01OCw2ICs1OCw3IEBAIHN0cnVj dCBkc3RfZW50cnkgewogI2RlZmluZSBEU1RfWEZSTV9UVU5ORUwJCTB4MDA4MAogI2RlZmlu ZSBEU1RfWEZSTV9RVUVVRQkJMHgwMTAwCiAjZGVmaW5lIERTVF9NRVRBREFUQQkJMHgwMjAw CisjZGVmaW5lIERTVF9JTl9GSUIJCTB4MDQwMAogCiAJc2hvcnQJCQllcnJvcjsKIApkaWZm IC0tZ2l0IGEvaW5jbHVkZS9uZXQvZHN0X29wcy5oIGIvaW5jbHVkZS9uZXQvZHN0X29wcy5o CmluZGV4IGM4NGIzMjg3ZTM4Yi4uY2QwZGY4Zjc2NDIwIDEwMDY0NAotLS0gYS9pbmNsdWRl L25ldC9kc3Rfb3BzLmgKKysrIGIvaW5jbHVkZS9uZXQvZHN0X29wcy5oCkBAIC0xNSw2ICsx NSw3IEBAIHN0cnVjdCBkc3Rfb3BzIHsKIAl1bnNpZ25lZCBzaG9ydAkJZmFtaWx5OwogCXVu c2lnbmVkIGludAkJZ2NfdGhyZXNoOwogCisJdm9pZAkJCSgqZHVtcCkoc3RydWN0IGRzdF9l bnRyeSAqKTsKIAlpbnQJCQkoKmdjKShzdHJ1Y3QgZHN0X29wcyAqb3BzKTsKIAlzdHJ1Y3Qg ZHN0X2VudHJ5ICoJKCpjaGVjaykoc3RydWN0IGRzdF9lbnRyeSAqLCBfX3UzMiBjb29raWUp OwogCXVuc2lnbmVkIGludAkJKCpkZWZhdWx0X2Fkdm1zcykoY29uc3Qgc3RydWN0IGRzdF9l bnRyeSAqKTsKZGlmZiAtLWdpdCBhL25ldC9jb3JlL2RzdC5jIGIvbmV0L2NvcmUvZHN0LmMK aW5kZXggOTYwZTUwM2I1YTUyLi5jOTg0NDdmZTg1MTAgMTAwNjQ0Ci0tLSBhL25ldC9jb3Jl L2RzdC5jCisrKyBiL25ldC9jb3JlL2RzdC5jCkBAIC0yMzIsNiArMjMyLDkgQEAgdm9pZCBf X2RzdF9mcmVlKHN0cnVjdCBkc3RfZW50cnkgKmRzdCkKIHsKIAlzcGluX2xvY2tfYmgoJmRz dF9nYXJiYWdlLmxvY2spOwogCV9fX2RzdF9mcmVlKGRzdCk7CitpZiAoZHN0LT5mbGFncyAm IERTVF9JTl9GSUIpCisJcHJfd2FybigiZHN0ICVwIGlzIG1hcmtlZCBhcyBpbiBmaWJcbiIs IGRzdCk7CisvL1dBUk5fT04oZHN0LT5mbGFncyAmIERTVF9JTl9GSUIpOwogCWRzdC0+bmV4 dCA9IGRzdF9nYXJiYWdlLmxpc3Q7CiAJZHN0X2dhcmJhZ2UubGlzdCA9IGRzdDsKIAlpZiAo ZHN0X2dhcmJhZ2UudGltZXJfaW5jID4gRFNUX0dDX0lOQykgewpkaWZmIC0tZ2l0IGEvbmV0 L2lwdjYvaXA2X2ZpYi5jIGIvbmV0L2lwdjYvaXA2X2ZpYi5jCmluZGV4IGU0MjY2NzQ2ZTRh Mi4uZDQ1MzlkOWE0NjNlIDEwMDY0NAotLS0gYS9uZXQvaXB2Ni9pcDZfZmliLmMKKysrIGIv bmV0L2lwdjYvaXA2X2ZpYi5jCkBAIC0xNTUsNiArMTU1LDcgQEAgc3RhdGljIHZvaWQgbm9k ZV9mcmVlKHN0cnVjdCBmaWI2X25vZGUgKmZuKQogCiBzdGF0aWMgdm9pZCBydDZfcmN1X2Zy ZWUoc3RydWN0IHJ0Nl9pbmZvICpydCkKIHsKK1dBUk5fT04ocnQtPmRzdC5mbGFncyAmIERT VF9JTl9GSUIpOwogCWNhbGxfcmN1KCZydC0+ZHN0LnJjdV9oZWFkLCBkc3RfcmN1X2ZyZWUp OwogfQogCkBAIC04NzgsNiArODc5LDcgQEAgc3RhdGljIGludCBmaWI2X2FkZF9ydDJub2Rl KHN0cnVjdCBmaWI2X25vZGUgKmZuLCBzdHJ1Y3QgcnQ2X2luZm8gKnJ0LAogCQkJcmV0dXJu IGVycjsKIAogCQlydC0+ZHN0LnJ0Nl9uZXh0ID0gaXRlcjsKKwkJcnQtPmRzdC5mbGFncyB8 PSBEU1RfSU5fRklCOwogCQkqaW5zID0gcnQ7CiAJCXJ0LT5ydDZpX25vZGUgPSBmbjsKIAkJ YXRvbWljX2luYygmcnQtPnJ0NmlfcmVmKTsKQEAgLTkwNyw2ICs5MDksNyBAQCBzdGF0aWMg aW50IGZpYjZfYWRkX3J0Mm5vZGUoc3RydWN0IGZpYjZfbm9kZSAqZm4sIHN0cnVjdCBydDZf aW5mbyAqcnQsCiAJCSppbnMgPSBydDsKIAkJcnQtPnJ0Nmlfbm9kZSA9IGZuOwogCQlydC0+ ZHN0LnJ0Nl9uZXh0ID0gaXRlci0+ZHN0LnJ0Nl9uZXh0OworCQlydC0+ZHN0LmZsYWdzIHw9 IERTVF9JTl9GSUI7CiAJCWF0b21pY19pbmMoJnJ0LT5ydDZpX3JlZik7CiAJCWlmICghaW5m by0+c2tpcF9ub3RpZnkpCiAJCQlpbmV0Nl9ydF9ub3RpZnkoUlRNX05FV1JPVVRFLCBydCwg aW5mbywgTkxNX0ZfUkVQTEFDRSk7CkBAIC05MTYsNiArOTE5LDcgQEAgc3RhdGljIGludCBm aWI2X2FkZF9ydDJub2RlKHN0cnVjdCBmaWI2X25vZGUgKmZuLCBzdHJ1Y3QgcnQ2X2luZm8g KnJ0LAogCQl9CiAJCW5zaWJsaW5ncyA9IGl0ZXItPnJ0NmlfbnNpYmxpbmdzOwogCQlmaWI2 X3B1cmdlX3J0KGl0ZXIsIGZuLCBpbmZvLT5ubF9uZXQpOworCQlpdGVyLT5kc3QuZmxhZ3Mg Jj0gfkRTVF9JTl9GSUI7CiAJCXJ0Nl9yZWxlYXNlKGl0ZXIpOwogCiAJCWlmIChuc2libGlu Z3MpIHsKQEAgLTkyNiw2ICs5MzAsNyBAQCBzdGF0aWMgaW50IGZpYjZfYWRkX3J0Mm5vZGUo c3RydWN0IGZpYjZfbm9kZSAqZm4sIHN0cnVjdCBydDZfaW5mbyAqcnQsCiAJCQkJaWYgKHJ0 Nl9xdWFsaWZ5X2Zvcl9lY21wKGl0ZXIpKSB7CiAJCQkJCSppbnMgPSBpdGVyLT5kc3QucnQ2 X25leHQ7CiAJCQkJCWZpYjZfcHVyZ2VfcnQoaXRlciwgZm4sIGluZm8tPm5sX25ldCk7CisJ CQkJCWl0ZXItPmRzdC5mbGFncyAmPSB+RFNUX0lOX0ZJQjsKIAkJCQkJcnQ2X3JlbGVhc2Uo aXRlcik7CiAJCQkJCW5zaWJsaW5ncy0tOwogCQkJCX0gZWxzZSB7CkBAIC05NzQsNiArOTc5 LDIxIEBAIGludCBmaWI2X2FkZChzdHJ1Y3QgZmliNl9ub2RlICpyb290LCBzdHJ1Y3QgcnQ2 X2luZm8gKnJ0LAogCQkJICFhdG9taWNfcmVhZCgmcnQtPmRzdC5fX3JlZmNudCkpKQogCQly ZXR1cm4gLUVJTlZBTDsKIAoraWYgKHJ0LT5kc3Qub3BzLT5mYW1pbHkgIT0gQUZfSU5FVDYp IHsKKwlwcl93YXJuKCJmaWI2X2FkZDogYWRkaW5nIHJ0IHdpdGggZmFtaWx5IGlzICVkIGRz dCBmbGFncyAleFxuIiwKKwkJcnQtPmRzdC5vcHMtPmZhbWlseSwgcnQtPmRzdC5mbGFncyk7 CisKKwlXQVJOX09OKDEpOworfQorLyogZHN0Lm5leHQgcmVhbGx5IHNob3VsZCBub3QgYmUg c2V0IGF0IHRoaXMgcG9pbnQgKi8KK2lmIChydC0+ZHN0Lm5leHQgJiYgcnQtPmRzdC5uZXh0 LT5vcHMtPmZhbWlseSAhPSBBRl9JTkVUNikgeworCXByX3dhcm4oImZpYjZfYWRkOiBhZGRp bmcgcnQgd2l0aCBiYWQgbmV4dCAtLSBmYW1pbHkgJWQgZHN0IGZsYWdzICV4XG4iLAorCQly dC0+ZHN0Lm5leHQtPm9wcy0+ZmFtaWx5LCBydC0+ZHN0Lm5leHQtPmZsYWdzKTsKKworCWlm IChydC0+ZHN0Lm9wcy0+ZHVtcCkKKwkJcnQtPmRzdC5vcHMtPmR1bXAoJnJ0LT5kc3QpOwor fQorCiAJaWYgKGluZm8tPm5saCkgewogCQlpZiAoIShpbmZvLT5ubGgtPm5sbXNnX2ZsYWdz ICYgTkxNX0ZfQ1JFQVRFKSkKIAkJCWFsbG93X2NyZWF0ZSA9IDA7CkBAIC0xNDQ0LDYgKzE0 NjQsNyBAQCBzdGF0aWMgdm9pZCBmaWI2X2RlbF9yb3V0ZShzdHJ1Y3QgZmliNl9ub2RlICpm biwgc3RydWN0IHJ0Nl9pbmZvICoqcnRwLAogCXJlYWRfdW5sb2NrKCZuZXQtPmlwdjYuZmli Nl93YWxrZXJfbG9jayk7CiAKIAlydC0+ZHN0LnJ0Nl9uZXh0ID0gTlVMTDsKKwlydC0+ZHN0 LmZsYWdzICY9IH5EU1RfSU5fRklCOwogCiAJLyogSWYgaXQgd2FzIGxhc3Qgcm91dGUsIGV4 cHVuZ2UgaXRzIHJhZGl4IHRyZWUgbm9kZSAqLwogCWlmICghZm4tPmxlYWYpIHsKZGlmZiAt LWdpdCBhL25ldC9pcHY2L3JvdXRlLmMgYi9uZXQvaXB2Ni9yb3V0ZS5jCmluZGV4IDIyOWJm Y2M0NTFlZi4uZTgzYjVlZjdmYmNkIDEwMDY0NAotLS0gYS9uZXQvaXB2Ni9yb3V0ZS5jCisr KyBiL25ldC9pcHY2L3JvdXRlLmMKQEAgLTIzOCwxMCArMjM4LDIyIEBAIHN0YXRpYyB2b2lk IGlwNl9jb25maXJtX25laWdoKGNvbnN0IHN0cnVjdCBkc3RfZW50cnkgKmRzdCwgY29uc3Qg dm9pZCAqZGFkZHIpCiAJX19pcHY2X2NvbmZpcm1fbmVpZ2goZGV2LCBkYWRkcik7CiB9CiAK K3N0YXRpYyB2b2lkIGlwNl9kc3RfZHVtcChzdHJ1Y3QgZHN0X2VudHJ5ICpkc3QpCit7CisJ c3RydWN0IHJ0Nl9pbmZvICpydCA9IChzdHJ1Y3QgcnQ2X2luZm8gKikgZHN0OworCisJcHJf d2FybigicnQgJXA6IGRldiAlcyBndyAlcEk2YyBkc3QgJXBJNmMvJWQgc3JjICVwSTZjIHBy ZWZzcmMgJXBJNmMgZmxhZ3MgJXggcnQ2aV9uc2libGluZ3MgJXVcbiIsCisJCXJ0LCBydC0+ cnQ2aV9pZGV2ID8gcnQtPnJ0NmlfaWRldi0+ZGV2LT5uYW1lIDogIjx1bmtub3duPiIsCisJ CSZydC0+cnQ2aV9nYXRld2F5LCAmcnQtPnJ0NmlfZHN0LmFkZHIsIHJ0LT5ydDZpX2RzdC5w bGVuLAorCQkmcnQtPnJ0Nmlfc3JjLmFkZHIsICZydC0+cnQ2aV9wcmVmc3JjLmFkZHIsCisJ CXJ0LT5ydDZpX2ZsYWdzLCBydC0+cnQ2aV9uc2libGluZ3MpOworfQorCiBzdGF0aWMgc3Ry dWN0IGRzdF9vcHMgaXA2X2RzdF9vcHNfdGVtcGxhdGUgPSB7CiAJLmZhbWlseQkJCT0JQUZf SU5FVDYsCiAJLmdjCQkJPQlpcDZfZHN0X2djLAogCS5nY190aHJlc2gJCT0JMTAyNCwKKwku ZHVtcAkJCT0JaXA2X2RzdF9kdW1wLAogCS5jaGVjawkJCT0JaXA2X2RzdF9jaGVjaywKIAku ZGVmYXVsdF9hZHZtc3MJCT0JaXA2X2RlZmF1bHRfYWR2bXNzLAogCS5tdHUJCQk9CWlwNl9t dHUsCkBAIC0xMTM1LDYgKzExNDcsOCBAQCBzdHJ1Y3QgcnQ2X2luZm8gKmlwNl9wb2xfcm91 dGUoc3RydWN0IG5ldCAqbmV0LCBzdHJ1Y3QgZmliNl90YWJsZSAqdGFibGUsCiAKIAkJZHN0 X2hvbGQoJnVuY2FjaGVkX3J0LT5kc3QpOwogCisJCXVuY2FjaGVkX3J0LT5kc3QuZmxhZ3Mg Jj0gfkRTVF9JTl9GSUI7CisKIAkJdHJhY2VfZmliNl90YWJsZV9sb29rdXAobmV0LCB1bmNh Y2hlZF9ydCwgdGFibGUtPnRiNl9pZCwgZmw2KTsKIAkJcmV0dXJuIHVuY2FjaGVkX3J0Owog CkBAIC0xMTYwLDYgKzExNzQsNyBAQCBzdHJ1Y3QgcnQ2X2luZm8gKmlwNl9wb2xfcm91dGUo c3RydWN0IG5ldCAqbmV0LCBzdHJ1Y3QgZmliNl90YWJsZSAqdGFibGUsCiAJCQlkc3RfcmVs ZWFzZSgmcnQtPmRzdCk7CiAJCX0KIAorCQlwY3B1X3J0LT5kc3QuZmxhZ3MgJj0gfkRTVF9J Tl9GSUI7CiAJCXRyYWNlX2ZpYjZfdGFibGVfbG9va3VwKG5ldCwgcGNwdV9ydCwgdGFibGUt PnRiNl9pZCwgZmw2KTsKIAkJcmV0dXJuIHBjcHVfcnQ7CiAK --------------8C1EEB2AC812F41C57ABCF58--