Subject: Re: [PATCH net-next v2] ipv6: enable anycast addresses as source addresses in ICMPv6 error messages

From: Nicolas Dichtel <[email-masked]>
Date: Fri, 07 Feb 2014 10:33:29 +0100

Le 06/02/2014 15:30, François-Xavier Le Bail a écrit :
>> From: Nicolas Dichtel <[email-masked]>
>
>> To: François-Xavier Le Bail <[email-masked]>; "[email-masked]" <[email-masked]>
>> Cc: David Stevens <[email-masked]>; Bill Fink <[email-masked]>; Hannes Frederic Sowa <[email-masked]>; David S. Miller <[email-masked]>; Alexey Kuznetsov <[email-masked]>; James Morris <[email-masked]>; Hideaki Yoshifuji <[email-masked]>; Patrick McHardy <[email-masked]>
>> Sent: Thursday, February 6, 2014 3:01 PM
>> Subject: Re: [PATCH net-next v2] ipv6: enable anycast addresses as source addresses in ICMPv6 error messages
>>
>> Le 06/02/2014 13:38, François-Xavier Le Bail a écrit :
>>>>   From: Nicolas Dichtel <[email-masked]>
>>>
>>>
>>>>   Subject: Re: [PATCH net-next v2] ipv6: enable anycast addresses as
>> source addresses in ICMPv6 error messages
>>>>
>>>>   Le 19/01/2014 17:00, Francois-Xavier Le Bail a écrit :
>>>>
>>>>>     - Uses ipv6_anycast_destination() in icmp6_send().
>>>>>
>>>>>     Suggested-by: Bill Fink <[email-masked]>
>>>>>     Signed-off-by: Francois-Xavier Le Bail
>> <[email-masked]>
>>>>   This patch causes an Oops on my target.
>>>
>>>   What is your target ?
>> x86 32bits
>>
>>>
>>>>   Here is the step to reproduce it:
>>>>   modprobe sit
>>>>   ip link add sit1 type sit remote 10.16.0.121 local 10.16.0.249
>>>>   ip l s sit1 up
>>>>   ip -6 a a dev sit1 2001:1234::123 remote 2001:1234::121
>>>>   ping6 2001:1234::121
>>>
>>>   I cannot reproduce this in my target (updated net-next x86_64) and
>>>   iproute2 from git.
>> I use linus tree (3.14-rc1+).
>>
>>>   Can you send me your config file ?
>> See attachment.
>>
>>
>>>
>>>>   The problem is that ipv6_anycast_destination() uses unconditionally
>>>>   skb_dst(skb), which is NULL in this case.
>>>>
>>>>   Not sure what is the best way to fix this, any suggestions?
>>>
>>>   I will try to reproduce first and see.
>> Note that the peer was not set up, hence the ping didn't work.
>> ipip6_err() calls ipip6_err_gen_icmpv6_unreach() which will drop the dst
>> before calling icmpv6_send().
>>
>>
>> Here is the backtrace:
>> [  387.786155] BUG: unable to handle kernel NULL pointer dereference at 00000096
>> [  387.787291] IP: [<c12f1568>] icmp6_send+0x79/0x596
>
> [...]
>
>> [  387.790055]  [<f85ce03b>] ? tunnel64_err+0x16/0x25 [tunnel4]
>
> Thanks for these informations.
>
> Can you test an alternative replacing:
>
> test on: ipv6_anycast_destination(skb)
> by
> test on: ipv6_chk_acast_addr_src(net, skb->dev, &hdr->daddr)
It's ok with this function. Do you submit the corresponding patch?