Closed EvgeniiMekhanik closed 1 week ago
listen 192.168.122.100:443 proto=h2,https;
listen 192.168.122.100:80 proto=http;
access_log on;
client_tbl_size 134217728;
block_action attack reply;
block_action error reply;
tls_certificate /home/tempesta/certs/tempesta.kinescope.io.pem;
tls_certificate_key /home/tempesta/certs/tempesta.kinescope.io.key;
srv_group main {
server 192.168.122.1:443;
}
srv_group http {
server 192.168.122.1:80;
}
vhost main {
proxy_pass main;
}
vhost http {
proxy_pass http;
}
http_chain {
mark == 1 -> http;
-> main;
}
duplicated with https://github.com/tempesta-tech/tempesta/issues/2206.
[12622.176271] BUG: kernel NULL pointer dereference, address: 0000000000000008
[12622.183542] #PF: supervisor read access in kernel mode
[12622.185797] #PF: error_code(0x0000) - not-present page
[12622.188109] PGD 0 P4D 0
[12622.190019] Oops: 0000 [#1] SMP PTI
[12622.191983] CPU: 15 PID: 0 Comm: swapper/15 Tainted: G OE 5.10.35+ #4
[12622.194615] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014
[12622.197185] RIP: 0010:tfw_hpack_decode+0xcbf/0x2300 [tempesta_fw]
[12622.199473] Code: 4c 03 65 90 eb 1d 83 c3 01 49 83 c4 70 41 83 ee 01 39 5d a0 0f 84 6c 0a 00 00 45 39 ef 0f 83 0d 0a 00 00 49 8b 34 24 44 89 c7 <2b> 7e 08 41 01 fd 41 f6 44 24 1c 01 74 ce 49 8b 79 50 4c 89 4d 88
[12622.204951] RSP: 0018:ffffa4cc40458718 EFLAGS: 00010282
[12622.207185] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 000000000000009d
[12622.209526] RDX: 0000000000000f63 RSI: 0000000000000000 RDI: 00000000ffffffe0
[12622.212066] RBP: ffffa4cc404587b8 R08: 00000000ffffffe0 R09: ffff99046ed208f8
[12622.214523] R10: 0000000000000000 R11: ffff9903eb78610b R12: ffff9903ebd62010
[12622.216944] R13: 0000000000000fd7 R14: 0000000000000021 R15: 0000000000000f63
[12622.219317] FS: 0000000000000000(0000) GS:ffff99072f9c0000(0000) knlGS:0000000000000000
[12622.221814] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[12622.223963] CR2: 0000000000000008 CR3: 00000001b1112002 CR4: 0000000000770ee0
[12622.226304] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[12622.228598] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[12622.230889] PKRU: 55555554
[12622.232572] Call Trace:
[12622.234222] <IRQ>
[12622.235749] tfw_h2_parse_req+0x1a6/0x320 [tempesta_fw]
[12622.237680] ss_skb_process+0xf5/0x140 [tempesta_fw]
[12622.239553] ? h2_set_hdr_x_method_override+0x20/0x20 [tempesta_fw]
[12622.241582] ? h2_set_hdr_x_method_override+0x20/0x20 [tempesta_fw]
[12622.243604] tfw_http_req_process+0x9b/0xa60 [tempesta_fw]
[12622.245370] ? tfw_pool_alloc_pages+0x53/0x60 [tempesta_fw]
[12622.247286] ? __get_free_pages+0x11/0x40
[12622.248974] ? tfw_pool_alloc_pages+0x53/0x60 [tempesta_fw]
[12622.249300] [tempesta fw] 172.115.248.175 "player-metrics.kinescope.io.vhost_main" "POST /v1/batch/gzip?referrer=https%3A%2F%2Frevitonica.ru%2F HTTP/2.0" 200 0 "https://kinescope.io/" "Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36"
[12622.250871] ? __tfw_pool_new+0x24/0x70 [tempesta_fw]
[12622.259429] tfw_http_msg_process_generic+0x1c3/0x900 [tempesta_fw]
[12622.261407] ? __put_page+0x4f/0x90
[12622.262967] ? memcpy_fast+0xe/0x10 [tempesta_lib]
[12622.264648] tfw_h2_frame_process+0x42b/0x6b0 [tempesta_fw]
[12622.266039] [tempesta fw] 188.170.83.37 "player-metrics.kinescope.io.vhost_main"
0x1544f is in tfw_hpack_decode (/home/tempesta/tempesta/fw/hpack.c:832).
827 "maximum allowed decreased size: %u\n", __func__,
828 curr, early, count, window);
829
830 cp = entries + early;
831 do {
832 size -= HPACK_ENTRY_OVERHEAD + cp->hdr->len;
833 T_DBG3("%s: dropped index: %u\n", __func__,
834 early);
835 if (cp->last)
836 tfw_pool_clean_single(tbl->h_pool,
Fixed by #2208
The problem was in memory corruption in hpack, which corrupt memory in random place.
e42225f5