Re: flow cache removed = xfrm doesnt work
4 messages,
2 authors,
2018-01-19 · open the first message on its own page
Cc netdev@vger.kernel.org, remove stable@vger.kernel.org from Cc.
On Mon, Nov 27, 2017 at 01:36:50PM +0100, Tomas Charvat wrote: It was on gentoo-sources-4.14.2 (almost vanila), config is attached.
Could you please test with a vanilla v4.14.2 from kernel.org with
the referred patch?
If the problem is still there, please try to disable:
CONFIG_INET_ESP_OFFLOAD
CONFIG_INET6_ESP_OFFLOAD
These are quite new, so might cause problems.
Gentoo-sources has no change vs vanilla in ipsec. However here is result
from Vanila 4.14.2 with OFFLOAD=N
[ 2338.440735] BUG: unable to handle kernel NULL pointer dereference at
0000000000000018
[ 2338.440830] IP: xfrm_output_resume+0x211/0x460
[ 2338.440897] PGD 0 P4D 0
[ 2338.440960] Oops: 0000 [#1] SMP
[ 2338.441025] CPU: 0 PID: 31977 Comm: stunnel Not tainted 4.14.2 #2
[ 2338.441098] Hardware name: Supermicro H8DGU/H8DGU, BIOS 3.5c
03/18/2016
[ 2338.441174] task: ffff98c4dc0ee4c0 task.stack: ffffb41460d84000
[ 2338.441248] RIP: 0010:xfrm_output_resume+0x211/0x460
[ 2338.441343] RSP: 0018:ffffb41460d87900 EFLAGS: 00010246
[ 2338.441413] RAX: 0000000000000000 RBX: ffff98c54090e2e0 RCX:
0000000000000000
[ 2338.441489] RDX: 000000000000001b RSI: 0000000000000000 RDI:
0000000000000000
[ 2338.441565] RBP: ffffb41460d87960 R08: ffffb41460d87780 R09:
ffff98c54b94ec50
[ 2338.441640] R10: ffff98c4d6bd38cc R11: 0000000000000000 R12:
ffffffff8cb0f740
[ 2338.441716] R13: ffff98c54b94e400 R14: ffff98c54b94e43c R15:
ffffb41460d87b28
[ 2338.441792] FS: 00007ec52f91c700(0000) GS:ffff98c54fc00000(0000)
knlGS:0000000000000000
[ 2338.441871] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 2338.441942] CR2: 0000000000000018 CR3: 000000100a5e6000 CR4:
00000000000406f0
[ 2338.442018] Call Trace:
[ 2338.442083] ? skb_checksum+0x3f/0x60
[ 2338.442227] ? reqsk_fastopen_remove+0x160/0x160
[ 2338.442374] ? skb_panic+0x70/0x70
[ 2338.442546] xfrm_output+0x6a/0x110
[ 2338.442689] xfrm6_output_finish+0x38/0x40
[ 2338.442834] __xfrm6_output+0x57/0x1e0
[ 2338.442978] xfrm6_output+0x9e/0x110
[ 2338.443121] ? xfrm6_local_rxpmtu+0x90/0x90
[ 2338.443267] ip6_xmit+0x297/0x550
[ 2338.443409] ? ip6_dst_check+0xd7/0xf0
[ 2338.443555] ? __ip6_append_data.isra.42+0xc00/0xc00
[ 2338.443705] inet6_csk_xmit+0xaa/0x100
[ 2338.443880] tcp_transmit_skb+0x57f/0xa00
[ 2338.444038] tcp_write_xmit+0x1cd/0xf90
[ 2338.444183] __tcp_push_pending_frames+0x3f/0xb0
[ 2338.444330] tcp_push+0xf6/0x120
[ 2338.444471] tcp_sendmsg_locked+0x672/0xe30
[ 2338.444617] tcp_sendmsg+0x3a/0x60
[ 2338.444760] inet_sendmsg+0x3b/0xb0
[ 2338.444904] sock_sendmsg+0x48/0x60
[ 2338.445070] sock_write_iter+0x8d/0x100
[ 2338.445216] __vfs_write+0x154/0x1b0
[ 2338.445359] vfs_write+0xcd/0x1c0
[ 2338.445501] SyS_write+0x62/0xd0
[ 2338.445643] entry_SYSCALL_64_fastpath+0x13/0x94
[ 2338.445789] RIP: 0033:0x7ec52eb3336d
[ 2338.445930] RSP: 002b:00007ec52f91bd40 EFLAGS: 00000293 ORIG_RAX:
0000000000000001
[ 2338.446189] RAX: ffffffffffffffda RBX: 00007ec520011010 RCX:
00007ec52eb3336d
[ 2338.446341] RDX: 000000000000001c RSI: 000056f01370b5a0 RDI:
0000000000000003
[ 2338.446495] RBP: 0000000000000000 R08: 0000000000000000 R09:
0000000000000000
[ 2338.446647] R10: 0000000000000000 R11: 0000000000000293 R12:
000056f011c8010c
[ 2338.446800] R13: 00007ec520010fc0 R14: 000056f013706da0 R15:
0000000000000047
[ 2338.446952] Code: f6 0f 8f b9 fe ff ff 31 f6 85 d2 0f 8f af fe ff ff
e9 bb fe ff ff 85 f6 89 f0 0f 85 d6 fe ff ff 48 8b 7b 58 48 89 f8 48 83
e0 fe <4c> 8b 70 18 4d 85 f6 0f 84 a3 01 00 00 41 8b 86 80 00 00 00 85
[ 2338.447330] RIP: xfrm_output_resume+0x211/0x460 RSP: ffffb41460d87900
[ 2338.447505] CR2: 0000000000000018
[ 2338.447748] ---[ end trace ed1d8c14abc8e6d6 ]---
Tomas Charvat
EXCELLO | Virusfree
w: www.virusfree.cz
e: tc@excello.cz
On 11/27/2017 01:49 PM, Steffen Klassert wrote: Cc netdev@vger.kernel.org, remove stable@vger.kernel.org from Cc.
On Mon, Nov 27, 2017 at 01:36:50PM +0100, Tomas Charvat wrote: quoted It was on gentoo-sources-4.14.2 (almost vanila), config is attached. Could you please test with a vanilla v4.14.2 from kernel.org with
the referred patch?
If the problem is still there, please try to disable:
CONFIG_INET_ESP_OFFLOAD
CONFIG_INET6_ESP_OFFLOAD
These are quite new, so might cause problems.
On Mon, Nov 27, 2017 at 05:46:28PM +0100, Tomas Charvat wrote: Gentoo-sources has no change vs vanilla in ipsec. However here is result
from Vanila 4.14.2 with OFFLOAD=N
[ 2338.440735] BUG: unable to handle kernel NULL pointer dereference at
0000000000000018
[ 2338.440830] IP: xfrm_output_resume+0x211/0x460
[ 2338.440897] PGD 0 P4D 0
[ 2338.440960] Oops: 0000 [#1] SMP
[ 2338.441025] CPU: 0 PID: 31977 Comm: stunnel Not tainted 4.14.2 #2
[ 2338.441098] Hardware name: Supermicro H8DGU/H8DGU, BIOS 3.5c
03/18/2016
[ 2338.441174] task: ffff98c4dc0ee4c0 task.stack: ffffb41460d84000
[ 2338.441248] RIP: 0010:xfrm_output_resume+0x211/0x460
[ 2338.441343] RSP: 0018:ffffb41460d87900 EFLAGS: 00010246
[ 2338.441413] RAX: 0000000000000000 RBX: ffff98c54090e2e0 RCX:
0000000000000000
[ 2338.441489] RDX: 000000000000001b RSI: 0000000000000000 RDI:
0000000000000000
[ 2338.441565] RBP: ffffb41460d87960 R08: ffffb41460d87780 R09:
ffff98c54b94ec50
[ 2338.441640] R10: ffff98c4d6bd38cc R11: 0000000000000000 R12:
ffffffff8cb0f740
[ 2338.441716] R13: ffff98c54b94e400 R14: ffff98c54b94e43c R15:
ffffb41460d87b28
[ 2338.441792] FS: 00007ec52f91c700(0000) GS:ffff98c54fc00000(0000)
knlGS:0000000000000000
[ 2338.441871] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 2338.441942] CR2: 0000000000000018 CR3: 000000100a5e6000 CR4:
00000000000406f0
[ 2338.442018] Call Trace:
[ 2338.442083] ? skb_checksum+0x3f/0x60
[ 2338.442227] ? reqsk_fastopen_remove+0x160/0x160
[ 2338.442374] ? skb_panic+0x70/0x70
[ 2338.442546] xfrm_output+0x6a/0x110
[ 2338.442689] xfrm6_output_finish+0x38/0x40
[ 2338.442834] __xfrm6_output+0x57/0x1e0
[ 2338.442978] xfrm6_output+0x9e/0x110
[ 2338.443121] ? xfrm6_local_rxpmtu+0x90/0x90
[ 2338.443267] ip6_xmit+0x297/0x550
[ 2338.443409] ? ip6_dst_check+0xd7/0xf0
[ 2338.443555] ? __ip6_append_data.isra.42+0xc00/0xc00
[ 2338.443705] inet6_csk_xmit+0xaa/0x100
[ 2338.443880] tcp_transmit_skb+0x57f/0xa00
[ 2338.444038] tcp_write_xmit+0x1cd/0xf90
[ 2338.444183] __tcp_push_pending_frames+0x3f/0xb0
[ 2338.444330] tcp_push+0xf6/0x120
[ 2338.444471] tcp_sendmsg_locked+0x672/0xe30
[ 2338.444617] tcp_sendmsg+0x3a/0x60
[ 2338.444760] inet_sendmsg+0x3b/0xb0
[ 2338.444904] sock_sendmsg+0x48/0x60
[ 2338.445070] sock_write_iter+0x8d/0x100
[ 2338.445216] __vfs_write+0x154/0x1b0
[ 2338.445359] vfs_write+0xcd/0x1c0
[ 2338.445501] SyS_write+0x62/0xd0
[ 2338.445643] entry_SYSCALL_64_fastpath+0x13/0x94
[ 2338.445789] RIP: 0033:0x7ec52eb3336d
[ 2338.445930] RSP: 002b:00007ec52f91bd40 EFLAGS: 00000293 ORIG_RAX:
0000000000000001
[ 2338.446189] RAX: ffffffffffffffda RBX: 00007ec520011010 RCX:
00007ec52eb3336d
[ 2338.446341] RDX: 000000000000001c RSI: 000056f01370b5a0 RDI:
0000000000000003
[ 2338.446495] RBP: 0000000000000000 R08: 0000000000000000 R09:
0000000000000000
[ 2338.446647] R10: 0000000000000000 R11: 0000000000000293 R12:
000056f011c8010c
[ 2338.446800] R13: 00007ec520010fc0 R14: 000056f013706da0 R15:
0000000000000047
[ 2338.446952] Code: f6 0f 8f b9 fe ff ff 31 f6 85 d2 0f 8f af fe ff ff
e9 bb fe ff ff 85 f6 89 f0 0f 85 d6 fe ff ff 48 8b 7b 58 48 89 f8 48 83
e0 fe <4c> 8b 70 18 4d 85 f6 0f 84 a3 01 00 00 41 8b 86 80 00 00 00 85
When I look at this code, I'd say it tries to dereference dst->child
and dst is a NULL pointer. Unfortunately I don't see how this can
happen. I need to find a way to reproduce this.
Can you show me your policy and SA database, i.e.
'ip x s' and 'ip x p'?
Also, please show /proc/crypto
Ok I have tried 4.14.14 and got following after 1 hour or so. It was
not fatal, system kept going.
[ 2833.840452] BUG: unable to handle kernel NULL pointer dereference at
0000000000000018
[ 2833.840549] IP: xfrm_output_resume+0x20a/0x460
[ 2833.840618] PGD 0 P4D 0
[ 2833.840682] Oops: 0000 [#1] SMP NOPTI
[ 2833.840752] CPU: 81 PID: 121868 Comm: spamd child Not tainted
4.14.14-gentoo #2
[ 2833.840831] Hardware name: Supermicro AS -1123US-TR4/H11DSU-iN, BIOS
1.0a 09/25/2017
[ 2833.840911] task: ffff891d1d5b8600 task.stack: ffff980cde96c000
[ 2833.840987] RIP: 0010:xfrm_output_resume+0x20a/0x460
[ 2833.841058] RSP: 0018:ffff980cde96fb70 EFLAGS: 00010246
[ 2833.841129] RAX: 0000000000000000 RBX: ffff891b1e0a48e0 RCX:
0000000000000000
[ 2833.841207] RDX: 0000000000000005 RSI: 0000000000000000 RDI:
0000000000000000
[ 2833.841285] RBP: ffffffffb1f11300 R08: ffff980cde96fa20 R09:
ffff891b199ba450
[ 2833.841363] R10: ffff891b1d5b30c4 R11: 0000000000000000 R12:
ffff891b1e0f7400
[ 2833.841441] R13: ffff891b1e0f743c R14: 0000000000000020 R15:
000000000001f000
[ 2833.841519] FS: 00007fe90028e700(0000) GS:ffff891b1fc40000(0000)
knlGS:0000000000000000
[ 2833.841601] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 2833.841673] CR2: 0000000000000018 CR3: 0000800dcc944000 CR4:
00000000001406e0
[ 2833.841908] Call Trace:
[ 2833.842141] ? skb_checksum_help+0x83/0x1b0
[ 2833.842382] ? xfrm_output+0x1c9/0x210
[ 2833.842626] xfrm6_output+0x91/0x110
[ 2833.842904] ? xfrm6_local_rxpmtu+0x80/0x80
[ 2833.843200] tcp_transmit_skb+0x541/0x990
[ 2833.843488] tcp_write_xmit+0x1bc/0xf90
[ 2833.843743] ? _copy_from_iter_full+0x93/0x230
[ 2833.843955] __tcp_push_pending_frames+0x28/0x90
[ 2833.844115] tcp_sendmsg_locked+0x65c/0xe40
[ 2833.844351] tcp_sendmsg+0x2e/0x50
[ 2833.844565] sock_sendmsg+0x3e/0x50
[ 2833.844784] sock_write_iter+0x82/0xf0
[ 2833.845011] __vfs_write+0x129/0x190
[ 2833.845233] vfs_write+0xc3/0x1c0
[ 2833.845500] SyS_write+0x5f/0xd0
[ 2833.845709] entry_SYSCALL_64_fastpath+0x19/0x72
[ 2833.845932] RIP: 0033:0x7fe8ff9b9b80
[ 2833.846148] RSP: 002b:00007ffd441632c8 EFLAGS: 00000246
[ 2833.846148] Code: b0 fe ff ff 31 f6 85 d2 0f 8f a6 fe ff ff 0f 1f 00
e9 af fe ff ff 85 f6 89 f0 0f 85 cc fe ff ff 48 8b 7b 58 48 89 f8 48 83
e0 fe <4c> 8b 68 18 4d 85 ed 0f 84 ad 01 00 00 41 8b 85 80 00 00 00 85
[ 2833.846987] RIP: xfrm_output_resume+0x20a/0x460 RSP:
ffff980cde96fb70
[ 2833.847280] CR2: 0000000000000018
[ 2833.847532] ---[ end trace 504f6c380fc3f734 ]---