Bug 1139173
| Summary: | backport: ip -s xfrm state crashes with segfault | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Jan Tluka <jtluka> |
| Component: | iproute | Assignee: | Pavel Šimerda (pavlix) <psimerda> |
| Status: | CLOSED ERRATA | QA Contact: | Jaroslav Aster <jaster> |
| Severity: | high | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 7.1 | CC: | ebenes, jaster, j.vandeville, ksrot, psimerda, thozza, tis |
| Target Milestone: | rc | Keywords: | EasyFix |
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | iproute-3.10.0-25.el7 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2015-11-19 14:39:18 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 1110700, 1191021 | ||
|
Description
Jan Tluka
2014-09-08 10:01:50 UTC
I've the same problem
ip -s xfrm state
src 192.168.42.40 dst 192.168.42.7
proto esp spi 0xa77f7409(2810147849) reqid 16385(0x00004001) mode tunnel
Segmentation fault
Reproduced. From the source code: __u32 extra_flags = *(__u32 *)RTA_DATA(tb[XFRMA_SA_EXTRA_FLAGS]); The tb[XFRMA_SA_EXTRA_FLAGS] pointer is NULL which is then dereferenced. The easiest fix would be to check the pointer but I will check upstream first. commit 1ed509bb522225050edfa1ed7ddc7255e9a18bd5
Author: Thomas Egerer <thomas.egerer>
Date: Thu Aug 29 14:00:36 2013 +0200
ip/xfrm: Fix potential SIGSEGV when printing extra flags
The git-commit dc8867d0, that added support for displaying the
extra-flags of a state, introduced a potential segfault.
Trying to show a state without the extra-flag attribute and show_stats
enabled, would cause the NULL pointer in tb[XFRMA_SA_EXTRA_FLAGS] to be
dereferenced.
Signed-off-by: Thomas Egerer <thomas.egerer>
diff --git a/ip/ipxfrm.c b/ip/ipxfrm.c
index 0a3a9fb..411d9d5 100644
--- a/ip/ipxfrm.c
+++ b/ip/ipxfrm.c
@@ -856,7 +856,7 @@ void xfrm_state_info_print(struct xfrm_usersa_info *xsinfo,
if (flags)
fprintf(fp, "%x", flags);
}
- if (show_stats > 0 || tb[XFRMA_SA_EXTRA_FLAGS]) {
+ if (show_stats > 0 && tb[XFRMA_SA_EXTRA_FLAGS]) {
__u32 extra_flags = *(__u32 *)RTA_DATA(tb[XFRMA_SA_EXTRA_FLAGS]);
fprintf(fp, "extra_flag ");
# ip -s xfrm state
src 192.168.10.2 dst 192.168.10.1
proto esp spi 0x00000001(1) reqid 0(0x00000000) mode transport
replay-window 0 seq 0x00000000 flag (0x00000000)
enc cbc(des3_ede) 0x112233445566778811223344556677881122334455667788 (192 bits)
sel src 0.0.0.0/0 dst 0.0.0.0/0 uid 0
lifetime config:
limit: soft (INF)(bytes), hard (INF)(bytes)
limit: soft (INF)(packets), hard (INF)(packets)
expire add: soft 0(sec), hard 0(sec)
expire use: soft 0(sec), hard 0(sec)
lifetime current:
0(bytes), 0(packets)
add 2015-04-28 13:21:10 use -
stats:
replay-window 0 replay 0 failed 0
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2015-2117.html |