Bug 257302
| Summary: | net/syncthing: Panic in in6_getmulti at /usr/src/sys/netinet6/in6_mcast.c:451 | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Base System | Reporter: | Alex Vasylenko <lxv> | ||||
| Component: | kern | Assignee: | Andrey V. Elsukov <ae> | ||||
| Status: | Closed FIXED | ||||||
| Severity: | Affects Some People | CC: | ae, donner, net, shurd, swills | ||||
| Priority: | --- | Keywords: | crash | ||||
| Version: | 12.2-STABLE | Flags: | koobs:
mfc-stable13+
koobs: mfc-stable12+ koobs: mfc-stable11? |
||||
| Hardware: | amd64 | ||||||
| OS: | Any | ||||||
| See Also: | https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=257322 | ||||||
| Attachments: |
|
||||||
|
Description
Alex Vasylenko
2021-07-21 01:50:39 UTC
^Triage: Request feedback from Stephen who may be able to shed light on this area of the code I was mistaken attributing this to mcast join on ipfw0 -- my simple program doing just that worked fine. Although it's unclear what user code is doing, we could look at crash dump to understand what's going on in the kernel Thanks Alex. It's fine for the summary to be the first relevent frame in the backtrace for now, unless/until isolated further. And thank you for your report The following golang program reproduces the issue, no root required; it was a mcast join on ipfw0 after all, but has to be an IPv6 join.
$ cat mcast6_join.go
package main
import (
"fmt"
"net"
"golang.org/x/net/ipv6"
)
func main() {
addr := "[ff12::8384]:21027"
gaddr, err := net.ResolveUDPAddr("udp6", addr)
if err != nil {
fmt.Println(err)
return
}
conn, err := net.ListenPacket("udp6", addr)
if err != nil {
fmt.Println(err)
return
}
defer conn.Close()
intf, err := net.InterfaceByName("ipfw0")
if err != nil {
fmt.Println(err)
return
}
pconn := ipv6.NewPacketConn(conn)
result := pconn.JoinGroup(intf, &net.UDPAddr{IP: gaddr.IP})
if result != nil {
fmt.Println("IPv6 join", intf.Name, "failed:", result)
} else {
fmt.Println("IPv6 join", intf.Name, "success")
}
}
net/syncthing has something like the above in https://github.com/syncthing/syncthing/blob/main/lib/beacon/multicast.go#L101 (except they perform join on all interfaces in a loop ignoring multicast flag, but that's beside the point)
A relevant part from vmcore that I failed to include in the original report was this:
(kgdb) f 14
#14 0xffffffff80c584d6 in sosetopt (so=0xfffff80012986a38, sopt=0xfffffe005c3cfb98) at /usr/src/sys/kern/uipc_socket.c:2761
2761 error = (*so->so_proto->pr_ctloutput)(so, sopt);
(kgdb) set print pretty
(kgdb) p *sopt
$1 = {
sopt_dir = SOPT_SET,
sopt_level = 41,
sopt_name = 80,
sopt_val = 0xc000320900,
sopt_valsize = 136,
sopt_td = 0xfffff800126f9000
}
optname 80 is MCAST_JOIN_GROUP
(In reply to Alex Vasylenko from comment #0) >Jul 20 13:43:02 foam kernel: fault virtual address = 0x28 >Jul 20 13:43:02 foam kernel: fault code = supervisor read data, page not present >#9 0xffffffff80e04a0e in in6_getmulti (ifp=<optimized out>, group=0xfffffe005c3cf118, pinm=<optimized out>) at /usr/src/sys/netinet6/in6_mcast.c:451 It is NULL pointer dereference in the line: inm->in6m_mli = MLD_IFINFO(ifp); MLD_IFINFO() macro tries to dereference if_afdata[AF_INET6]->mld_info. 0x28 corresponds to mld_ifinfo field: (kgdb) p/x offsetof(struct in6_ifextra, mld_ifinfo) $1 = 0x28 ipfw0 interface does not have properly initialized if_afdata since IFT_PFLOG interfaces do not support IPv6 (look at in6_domifattach()). Thus I think we need to add somewhere the check that adapter doesn't support IPv6 multicasts. Created attachment 226609 [details]
proposed patch (untested)
Can you try this patch?
Is this the same issue that was originally reported in bug #200846 ? (In reply to Steve Wills from comment #7) looks similar - it has to do with local peer discovery as in that report (In reply to Andrey V. Elsukov from comment #5) Thanks Andrey - the patch works. My test program now runs to completion: % ./SyncThingPanic IPv6 join ipfw0 failed: setsockopt: operation not supported by device % uname -r 13.0-STABLE A commit in branch main references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=d477a7feed177d0ad5c12bc6e2cce804d427ed38 commit d477a7feed177d0ad5c12bc6e2cce804d427ed38 Author: Andrey V. Elsukov <ae@FreeBSD.org> AuthorDate: 2021-08-05 08:51:46 +0000 Commit: Andrey V. Elsukov <ae@FreeBSD.org> CommitDate: 2021-08-06 09:57:59 +0000 Fix panic in IPv6 multicast code. Add check that ifp supports IPv6 multicasts in in6_getmulti. This fixes panic when user application tries to join into multicast group on an interface that doesn't support IPv6 multicasts, like IFT_PFLOG interfaces. PR: 257302 Reviewed by: melifaro MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D31420 sys/netinet6/in6_mcast.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) A commit in branch stable/13 references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=40ec2323e689e2b9bcede8e2f217b689e64f621f commit 40ec2323e689e2b9bcede8e2f217b689e64f621f Author: Andrey V. Elsukov <ae@FreeBSD.org> AuthorDate: 2021-08-05 08:51:46 +0000 Commit: Andrey V. Elsukov <ae@FreeBSD.org> CommitDate: 2021-08-13 07:31:11 +0000 Fix panic in IPv6 multicast code. Add check that ifp supports IPv6 multicasts in in6_getmulti. This fixes panic when user application tries to join into multicast group on an interface that doesn't support IPv6 multicasts, like IFT_PFLOG interfaces. PR: 257302 Reviewed by: melifaro Differential Revision: https://reviews.freebsd.org/D31420 (cherry picked from commit d477a7feed177d0ad5c12bc6e2cce804d427ed38) sys/netinet6/in6_mcast.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) A commit in branch stable/12 references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=6144be57c0ab08ddeb1a729f698f0997fe142b96 commit 6144be57c0ab08ddeb1a729f698f0997fe142b96 Author: Andrey V. Elsukov <ae@FreeBSD.org> AuthorDate: 2021-08-05 08:51:46 +0000 Commit: Andrey V. Elsukov <ae@FreeBSD.org> CommitDate: 2021-08-13 07:37:39 +0000 Fix panic in IPv6 multicast code. Add check that ifp supports IPv6 multicasts in in6_getmulti. This fixes panic when user application tries to join into multicast group on an interface that doesn't support IPv6 multicasts, like IFT_PFLOG interfaces. PR: 257302 Reviewed by: melifaro Differential Revision: https://reviews.freebsd.org/D31420 (cherry picked from commit d477a7feed177d0ad5c12bc6e2cce804d427ed38) sys/netinet6/in6_mcast.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) Fixed in main, stable/13 and stable/12. Thanks! |
