FC2 Kernel bug in ipv6 using 2.6.8-1.521smp

[Stephen Smalley]

On Wed, 2006-01-11 at 11:59 +0100, Hans Kristian Rosbach wrote:
> Dunno whether this is of any value to anyone, but I thought
> I'd just post it here just in case someone is actually looking
> for info on this bug.
> 
> 
> 
> Linux version 2.6.8-1.521smp (bhcompile at tweety.build.redhat.com) (gcc
> version 3.3.3 20040412 (Red Hat Linux 3.3.3-7)) #1 SMP Mon Aug 16
> 09:25:06 EDT 2004
> 
> (These icmpv6 stuff are repeated hundreds of times)
> icmpv6_send: addr_any/mcast source
> icmpv6_send: addr_any/mcast source
> icmpv6_send: addr_any/mcast source
> ------------[ cut here ]------------
> kernel BUG at net/ipv6/exthdrs_core.c:79!
> invalid operand: 0000 [#1]
> SMP
> Modules linked in: md5 ipv6 autofs4 sunrpc e1000 floppy sg microcode
> dm_mod uhci_hcd ehci_hcd button battery asus_acpi ac ext3 jbd raid1
> ata_piix libata sd_mod scsi_mod
> CPU:    0
> EIP:    0060:[<022d34e4>]    Not tainted
> EFLAGS: 00010282   (2.6.8-1.521smp)
> EIP is at ipv6_skip_exthdr+0x42/0xce
> eax: fffffff2   ebx: 00000000   ecx: 00000002   edx: 3ecda180
> esi: 00000060   edi: 00000013   ebp: 3ecda180   esp: 412b6afc
> ds: 007b   es: 007b   ss: 0068
> Process named (pid: 2156, threadinfo=412b6000 task=3e47ecb0)
> Stack: 412b6b2f 00000000 00000028 412b6b78 412b6c04 3ecda180 021b092c
> 0000004b
>        00000000 412b6bdc 00000000 412b6b78 002b6b7c 00000000 00000000
> 0000892f
>        412b6b70 412b6b74 021b15fd 00100000 00000000 00000060 40003300
> 00000000
> Call Trace:
>  [<021b092c>] selinux_parse_skb_ipv6+0x7c/0xf3
>  [<021b15fd>] selinux_ip_postroute_last+0x20b/0x21d
>  [<021b09e8>] selinux_parse_skb+0x45/0x69
>  [<021b14ec>] selinux_ip_postroute_last+0xfa/0x21d

Looks similar to:
http://marc.theaimsgroup.com/?l=linux-netdev&m=111416982405807&w=2

which was fixed by:
http://marc.theaimsgroup.com/?l=git-commits-head&m=111444145104674&w=2

That fix went into Linux 2.6.12.  

-- 
Stephen Smalley
National Security Agency