OOPS, ip -f inet6 route get fec0::1, linux-2.6.26, ip6_route_output, rt6_fill_node+0x175

Folks

Looks like we have an issue with linux-2.6.26 & ipv6

Scenario: no ipv6 default route set.

Repro: Enter command

# ip -f inet6 route get fec0::1

And we get BUG: unable to handle kernel NULL pointer deref....

This has been an issue since linux-2.6.26-rc4. It's taken a while to
nail it. We are currently testing linux-2.6.26.2.

This appears to have been an issue in the past. This is where I got the
magic ip route command from.

http://www.ussg.iu.edu/hypermail/linux/kernel/0510.2/0522.html

http://www.ussg.iu.edu/hypermail/linux/kernel/0510.2/0535.html

http://www.ussg.iu.edu/hypermail/linux/kernel/0510.2/1522.html

~ # ip -f inet6 route get fec0::1

Produces, with linux-2.6.26.2,

BUG: unable to handle kernel NULL pointer dereference at 00000000

IP: [<c0369b85>] rt6_fill_node+0x175/0x3b0

*pdpt = 0000000036466001 *pde = 0000000000000000

Oops: 0000 [#1] SMP

Modules linked in: pcnet32 smsc47m192 i2c_i801 i2c_dev i2c_core r8169
coretemp i
t87 hwmon_vid lcm e1000e



Pid: 3033, comm: ip Not tainted (2.6.26.2 #1)

EIP: 0060:[<c0369b85>] EFLAGS: 00010246 CPU: 1

EIP is at rt6_fill_node+0x175/0x3b0

EAX: 00000000 EBX: f7115bbc ECX: 00000000 EDX: f7115c60

ESI: f7c1f100 EDI: f7548f00 EBP: f7115bdc ESP: f7115ba4

DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068

Process ip (pid: 3033, ti=f7114000 task=f64cbc50 task.ti=f7114000)

Stack: f7115bbc 00000000 f7115c54 f7115bc0 f7115c60 f6d75078 00000000
f7115bdc
c036a5f0 c036b360 00000000 f75487a0 00000000 f7548f00 f7115c9c
c036c30e
f7115c70 00000000 00000018 00000bd9 489b2024 00000000 00000000
00000000
Call Trace:

[<c036a5f0>] ? ip6_route_output+0x50/0xa0

[<c036b360>] ? ip6_pol_route_output+0x0/0x20

[<c036c30e>] ? inet6_rtm_getroute+0x16e/0x200

[<c036c1a0>] ? inet6_rtm_getroute+0x0/0x200

[<c030ef19>] ? rtnetlink_rcv_msg+0x1b9/0x1f0

[<c030ed60>] ? rtnetlink_rcv_msg+0x0/0x1f0

[<c031426d>] ? netlink_rcv_skb+0x8d/0xb0

[<c030ed57>] ? rtnetlink_rcv+0x17/0x20

[<c031402d>] ? netlink_unicast+0x23d/0x270

[<c030162a>] ? memcpy_fromiovec+0x4a/0x70

[<c0314811>] ? netlink_sendmsg+0x1c1/0x290

[<c02fa165>] ? sock_sendmsg+0xc5/0xf0

[<c01363a0>] ? autoremove_wake_function+0x0/0x50

[<c01363a0>] ? autoremove_wake_function+0x0/0x50

[<c02fa165>] ? sock_sendmsg+0xc5/0xf0

[<c0217f37>] ? copy_from_user+0x37/0x70

[<c03018ec>] ? verify_iovec+0x2c/0x90

[<c02fa29a>] ? sys_sendmsg+0x10a/0x220

[<c015ab08>] ? __inc_zone_page_state+0x18/0x20

[<c01642ed>] ? __page_set_anon_rmap+0x2d/0x40

[<c0164325>] ? page_add_new_anon_rmap+0x25/0x30

[<c015eda6>] ? handle_mm_fault+0x606/0x750

[<c0160f5e>] ? vma_adjust+0xfe/0x410

[<c0113156>] ? do_page_fault+0x126/0x830

[<c02fb343>] ? sys_socketcall+0x233/0x260

[<c0102f39>] ? sysenter_past_esp+0x6a/0x91

=======================

Code: 62 01 00 00 c6 43 01 80 8b 45 0c 85 c0 0f 85 13 02 00 00 8b 45 d8
85 c0 74
3c 8b 86 88 00 00 00 8d 5d e0 31 c9 89 1c 24 8b 55 d8 <8b> 00 e8 d4 e3
ff ff 85
c0 75 20 b9 10 00 00 00 ba 07 00 00 00

EIP: [<c0369b85>] rt6_fill_node+0x175/0x3b0 SS:ESP 0068:f7115ba4

---[ end trace e9f2563374550ae8 ]---


I will look into producing a patch.

Best regards

John Gumb
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

Relevant Pages

  • Re: Update: WIndows process table and process image.
    ... Now it kills the parent process before the child processes. ... The new code seems fixed the bug. ... Kernel mode code normally do not reference to other kernel ... This command will display stack trace ...
    (microsoft.public.win32.programmer.kernel)
  • Re: binaries not portable from Debian to RedHat
    ... Threads are KSEs handled by the kernel. ... changed or ps was find, either way, the bug was fixed. ... The 'ps' command should hide ...
    (comp.os.linux.development.apps)
  • Re: 2.6.18-mm2 -- EIP: [] klist_node_init+0x2b/0x3a SS:ESP 0068:f63a5f80
    ... with this kernel build (this failed with 2.6.18-mm2 previously, ... thought it was related to the BUG). ... command 'ADD_NETWORK' ...
    (Linux-Kernel)
  • Re: New 2.6.24.2 SG_IO SCSI problems
    ... During reads I get these kernel messages. ... partially overwritten by another patch and that caused a new bug). ... When sending a SCSI command to a tape drive via the SCSI Generic ...
    (Linux-Kernel)
  • Re: [PATCH 1/2] LogFS proper
    ... Please comment the structure with kernel doc comments and avoid the tail ... Do enums have a significant ... Also the BUG itself will give you enough clue where it happened, ... which leaves only the prepared filesystem image to worry about. ...
    (Linux-Kernel)