Attachment 156871 Details for Bug 244026 – Example program that can reproduce the kernel crash

Example program that can reproduce the kernel crash

routeexample.c (text/x-csrc), 2.70 KB, created by Chris Lalancette on 2007-06-13 13:25:49 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Chris Lalancette

Created: 2007-06-13 13:25:49 UTC

Size: 2.70 KB

patch

obsolete

>/**
> * Simple example for demonstrating 'NLM_F_ECHO bug'.
> */
>
>#include <stdio.h>
>#include <stdlib.h>
>#include <string.h>
>#include <errno.h>
>#include <sys/types.h>
>#include <sys/socket.h>
>#include <arpa/inet.h>
>#include <netinet/in.h>
>#include <linux/types.h>
>#include <linux/socket.h>
>#include <linux/netlink.h>
>#include <linux/rtnetlink.h>
>
>int main(void)
>{
>    int status;
>    int fd;
>    struct sockaddr_nl snl = { AF_NETLINK, 0, 0, RTMGRP_IPV4_ROUTE };
>    struct
>    {
>        struct nlmsghdr hdr;
>        struct rtmsg    msg;
>        char            buf[254];
>    }                   msg;
>    struct in_addr      dst;
>    int                 iface;
>    struct rtattr       *rtattr;
>    ssize_t             ssize;
>
>    /* Put some reasonable values here */
>    inet_pton(AF_INET, "99.99.99.0", &dst);
>    iface = 2;
>
>    fd = socket(PF_NETLINK, SOCK_DGRAM, NETLINK_ROUTE);
>    if (fd < 0)
>    {
>        perror("socket");
>        exit(EXIT_FAILURE);
>    }
>
>    status = bind(fd, (struct sockaddr *)&snl, sizeof(snl));
>    if (status < 0)
>    {
>        perror("bind");
>        exit(EXIT_FAILURE);
>    }
>
>    /* Header */
>    memset(&msg, 0, sizeof(msg));
>    msg.hdr.nlmsg_len = NLMSG_LENGTH(sizeof(struct rtmsg));
>    /* With NLM_F_ECHO the kernel crashes, without it id doesn't */
>    msg.hdr.nlmsg_flags = NLM_F_REQUEST | NLM_F_REPLACE | NLM_F_CREATE | NLM_F_ECHO;
>    msg.hdr.nlmsg_type = RTM_NEWROUTE;
>
>    /* Route message */
>    msg.msg.rtm_family = AF_INET;
>    msg.msg.rtm_dst_len = 24;
>    msg.msg.rtm_src_len = 0;
>    msg.msg.rtm_tos = 0;
>    msg.msg.rtm_table = 254;
>    msg.msg.rtm_protocol = RTPROT_STATIC;
>    msg.msg.rtm_scope = RT_SCOPE_UNIVERSE;
>    msg.msg.rtm_type = RTN_UNICAST;
>    msg.msg.rtm_flags = RTM_F_NOTIFY;
>
>    /* Destination */
>    rtattr = (struct rtattr *)((char *)&msg + NLMSG_ALIGN(msg.hdr.nlmsg_len));
>    rtattr->rta_len = RTA_LENGTH(sizeof(dst));
>    rtattr->rta_type = RTA_DST;
>    *(struct in_addr *)RTA_DATA(rtattr) = dst;
>    msg.hdr.nlmsg_len += RTA_SPACE(sizeof(dst));
>
>    /* Interface */
>    rtattr = (struct rtattr *)((char *)&msg + NLMSG_ALIGN(msg.hdr.nlmsg_len));
>    rtattr->rta_len = RTA_LENGTH(sizeof(iface));
>    rtattr->rta_type = RTA_OIF;
>    *(int *)RTA_DATA(rtattr) = iface;
>    msg.hdr.nlmsg_len += RTA_SPACE(sizeof(iface));
>
>    /* Send */
>    ssize = send(fd,
>                 &msg,
>                 msg.hdr.nlmsg_len,
>                 MSG_NOSIGNAL);
>    if (ssize < 0)
>    {
>        perror("send");
>        exit(EXIT_FAILURE);
>    }
>
>    /* Receive */
>    ssize = recv(fd,
>                 &msg,
>                 sizeof(msg),
>                 0);
>    if (ssize < 0)
>    {
>        perror("recv");
>        exit(EXIT_FAILURE);
>    }
>    printf("Received %zd bytes\n", ssize);
>
>    return EXIT_SUCCESS;
>}
>

Actions: View

Attachments on bug 244026: 156871 | 156874 | 156875