Bug 1352177
Summary: | :BUG: unable to handle kernel NULL pointer dereference in copy_tree+0x14d/0x320 | ||
---|---|---|---|
Product: | [Fedora] Fedora | Reporter: | Andrew Vagin <avagin> |
Component: | kernel | Assignee: | Kernel Maintainer List <kernel-maint> |
Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
Severity: | unspecified | Docs Contact: | |
Priority: | unspecified | ||
Version: | 24 | CC: | gansalmon, itamar, jonathan, kernel-maint, madhu.chinakonda, mchehab, ptikhomirov |
Target Milestone: | --- | ||
Target Release: | --- | ||
Hardware: | Unspecified | ||
OS: | Unspecified | ||
Whiteboard: | |||
Fixed In Version: | Doc Type: | If docs needed, set a value | |
Doc Text: | Story Points: | --- | |
Clone Of: | Environment: | ||
Last Closed: | 2016-07-14 11:18:22 UTC | Type: | Bug |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: |
Description
Andrew Vagin
2016-07-02 01:04:24 UTC
The problem was triggered in our criu tests, I so I discovered the real problem of it all. In Linux v4.3 commit df2cf4a78e48 ("IGMP: Inhibit reports for local multicast groups") sysctl igmp_link_local_mcast_reports was introduced in ipv4_net_table. And in ipv4_net_table it's data was initialized to point on sysctl_igmp_llm_reports variable. That was so before commit 87a8a2ae65b7 ("igmp: Namespaceify igmp_llm_reports sysctl knob"). So next it's data pointer is shifted to the offset of current netnamespace relative to init_net in ipv4_sysctl_init_net function. But that is completely wrong if variable is not net-namespaced, so we get random kernel address and can write/read to/from it one int, that can lead to memory corruption and crashes in random places in kernel. So conclusion is: we can not touch /proc/sys/net/ipv4/igmp_link_local_mcast_reports in v4.3-v4.5 between those two patches. Simple reproduction(kernel-4.5.7-202.fc23.x86_64): while :; do unshare -n sysctl -w net.ipv4.igmp_link_local_mcast_reports=268435456; done So if 87a8a2ae65b7 is the fix, then the kernel in updates-testing for F24 shouldn't have this problem. Can someone test and confirm? > Can someone test and confirm?
Checked on my F24:
[root@localhost ~]# uname -r
4.6.3-300.fc24.x86_64
I ran these night:
[root@localhost ~]# time while :; do unshare -n sysctl -w net.ipv4.igmp_link_local_mcast_reports=268435456; done
net.ipv4.igmp_link_local_mcast_reports = 268435456
... (for 357846 times)
And everything is OK: no crash, no panic and no warnings.
Great, thank you for testing and the great analysis. Much appreciated. |