Modify

Opened 22 months ago

Last modified 17 months ago

#22211 new defect

Kernel problem with radius requests

Reported by: tk@… Owned by: developers
Priority: normal Milestone:
Component: kernel Version: Chaos Calmer 15.05
Keywords: kernel, radiusd, freeradius, loop, Cc:

Description

When radiusd is getting requests via network, it will crash and loops with messages like this:

Mon Apr 11 18:33:59 2016 : Info: Ready to process requests.
Mon Apr 11 18:33:59 2016 : Info: Ready to process requests.
Mon Apr 11 18:33:59 2016 : Info: Ready to process requests.

strace on the radiusd pid looks like this:

 _newselect(9, [3 5 6 8], NULL, NULL, NULL) = 1 (in [5])
recvfrom(5, 0x7f809f04, 4, 2, 0x7f809e80, 0x7f809f00) = -1 EFAULT (Bad address)

It seems, there is something bad with the kernel and memory addresses passed to a system call.

About the setup:

freeradius 2.2.8-1 is running on TP-Link Archer C7 with CC 15.05.1. Another Archer C7 node tries to authneticate a client via WPA2-enterprise. Such request is running on the Archer C7 with radiusd. After the first request, radiusd hangs in a loop. WPA2-enterprise requests from the same node where the radiusd is running are just fine.

Attachments (0)

Change History (11)

comment:1 Changed 22 months ago by kraut

With the help of jow_laptop i got a little bit deeper into this, thanks! From this bug-report https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1508510 i found this patch: http://people.canonical.com/~henrix/LP1508510/v1/amd64/0001-Revert-net-Fix-skb-csum-races-when-peeking.patch

I'm not sure, if this is the same bug as in the openwrt kernel source code:

__sum16 __skb_checksum_complete_head(struct sk_buff *skb, int len)
{
        __sum16 sum;
 
        sum = csum_fold(skb_checksum(skb, 0, len, skb->csum));
        if (likely(!sum)) {
                if (unlikely(skb->ip_summed == CHECKSUM_COMPLETE) &&
                    !skb->csum_complete_sw)
                        netdev_rx_csum_fault(skb->dev);
        }
        if (!skb_shared(skb))
                skb->csum_valid = !sum;
        return sum;
}
EXPORT_SYMBOL(__skb_checksum_complete_head);

comment:2 Changed 22 months ago by kraut

Is anybody there who can help me with this? Actually i'm stuck. With the kernel in trunk it works like a charm, but there i got a major bug with hostapd and more then one ssid on one radio.

comment:3 Changed 22 months ago by anonymous

I'm getting the same infinite loop with freeradius2 on my WNDR3700v2 after upgrading to CC 15.05.1. With the previous CC release it worked like a charm. Would be nice to get that fixed soon.

comment:4 Changed 21 months ago by Zilli

Same here. Had to downgrade back to 15.05.

comment:5 Changed 21 months ago by anonymous

I hit this issue when TL-WR1043NDv2 running freeradius2 and when the radius requests were coming in as tagged packets from a Archer C7 router. WPA2-enterprise requests from a wifi client directly associated to TL-WR1043NDv2 (running freeradius2) works fine. I had to downgrade to 15.05 to get this working properly.

comment:6 Changed 21 months ago by lkmikkel

I also see this problem after upgrading to CC 15.05.1 on WNDR3800.

comment:7 Changed 21 months ago by openwrt-dev@…

Same bug on WNDR3800.

comment:8 Changed 20 months ago by anonymous

I have the same problem. Is there a solution except downgrading?

comment:9 Changed 19 months ago by mail@…

same here, on 15.01, a WDR4300 and freeradius2 2.2.8-2. anything new on this?

comment:10 Changed 18 months ago by gstitt

Same problem with wdr3600 and wdr4300.

comment:11 Changed 17 months ago by mazdac@…

got this same problem on my TD-W8970 using Chaos Calmer 15.05.1 / LuCI 15.05-149-g0d8bbd2 Release (git-15.363.78009-956be55)

Add Comment

Modify Ticket

Action
as new .
Author


E-mail address and user name can be saved in the Preferences.

 
Note: See TracTickets for help on using tickets.