From: Jamal Hadi Salim <jhs@mojatatu.com>
To: Jakub Kicinski <kuba@kernel.org>
Cc: davem@davemloft.net, netdev@vger.kernel.org, edumazet@google.com,
pabeni@redhat.com,
Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>,
Davide Caratti <dcaratti@redhat.com>,
xiyou.wangcong@gmail.com, jiri@resnulli.us,
shmulik.ladkani@gmail.com
Subject: Re: [PATCH net] net/sched: act_mirred: use the backlog for mirred ingress
Date: Mon, 12 Feb 2024 10:11:25 -0500 [thread overview]
Message-ID: <CAM0EoMnYyyf7Zpa9eUFBU1vzx5QrUhFfXSFH4_utXOPU4+YFxQ@mail.gmail.com> (raw)
In-Reply-To: <CAM0EoM=kcqwC1fYhHcPoLgNMrM_7tnjucNvri8f4U7ymaRXmEQ@mail.gmail.com>
[-- Attachment #1: Type: text/plain, Size: 4490 bytes --]
On Mon, Feb 12, 2024 at 9:51 AM Jamal Hadi Salim <jhs@mojatatu.com> wrote:
>
> On Fri, Feb 9, 2024 at 6:54 PM Jakub Kicinski <kuba@kernel.org> wrote:
> >
> > The test Davide added in commit ca22da2fbd69 ("act_mirred: use the backlog
> > for nested calls to mirred ingress") hangs our testing VMs every 10 or so
> > runs, with the familiar tcp_v4_rcv -> tcp_v4_rcv deadlock reported by
> > lockdep.
> >
> > In the past there was a concern that the backlog indirection will
> > lead to loss of error reporting / less accurate stats. But the current
> > workaround does not seem to address the issue.
> >
>
> Let us run some basic tests on this first - it's a hairy spot. Also,
Something broke.
Create a ns. Put one half of veth into the namespace. Create a filter
inside the net ns.
at_ns$ tc qdisc add dev port0 ingress_block 21 clsact
at_ns$ tc filter add block 21 egress protocol ip prio 10 matchall
action mirred ingress redirect dev port0
Send a ping from host:
at_host@ ping 10.0.0.2 -c 1 -I <vethportonhostside>
And.. hits uaf.... see attached.
Sorry, no time to look at it right now but one of us
(Victor/Pedro/myself) will look later unless someone else beats us to
it.
cheers,
jamal
> IIRC Cong had some reservations about this in the past. Can't remember
> what they were.
> cheers,
> jamal
>
>
> > Fixes: 53592b364001 ("net/sched: act_mirred: Implement ingress actions")
> > Cc: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
> > Suggested-by: Davide Caratti <dcaratti@redhat.com>
> > Link: https://lore.kernel.org/netdev/33dc43f587ec1388ba456b4915c75f02a8aae226.1663945716.git.dcaratti@redhat.com/
> > Signed-off-by: Jakub Kicinski <kuba@kernel.org>
> > ---
> > CC: jhs@mojatatu.com
> > CC: xiyou.wangcong@gmail.com
> > CC: jiri@resnulli.us
> > CC: shmulik.ladkani@gmail.com
> > ---
> > net/sched/act_mirred.c | 14 +++++---------
> > .../testing/selftests/net/forwarding/tc_actions.sh | 3 ---
> > 2 files changed, 5 insertions(+), 12 deletions(-)
> >
> > diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c
> > index 93a96e9d8d90..35c366f043d9 100644
> > --- a/net/sched/act_mirred.c
> > +++ b/net/sched/act_mirred.c
> > @@ -232,18 +232,14 @@ static int tcf_mirred_init(struct net *net, struct nlattr *nla,
> > return err;
> > }
> >
> > -static bool is_mirred_nested(void)
> > -{
> > - return unlikely(__this_cpu_read(mirred_nest_level) > 1);
> > -}
> > -
> > -static int tcf_mirred_forward(bool want_ingress, struct sk_buff *skb)
> > +static int
> > +tcf_mirred_forward(bool at_ingress, bool want_ingress, struct sk_buff *skb)
> > {
> > int err;
> >
> > if (!want_ingress)
> > err = tcf_dev_queue_xmit(skb, dev_queue_xmit);
> > - else if (is_mirred_nested())
> > + else if (!at_ingress)
> > err = netif_rx(skb);
> > else
> > err = netif_receive_skb(skb);
> > @@ -319,9 +315,9 @@ static int tcf_mirred_to_dev(struct sk_buff *skb, struct tcf_mirred *m,
> >
> > skb_set_redirected(skb_to_send, skb_to_send->tc_at_ingress);
> >
> > - err = tcf_mirred_forward(want_ingress, skb_to_send);
> > + err = tcf_mirred_forward(at_ingress, want_ingress, skb_to_send);
> > } else {
> > - err = tcf_mirred_forward(want_ingress, skb_to_send);
> > + err = tcf_mirred_forward(at_ingress, want_ingress, skb_to_send);
> > }
> >
> > if (err) {
> > diff --git a/tools/testing/selftests/net/forwarding/tc_actions.sh b/tools/testing/selftests/net/forwarding/tc_actions.sh
> > index b0f5e55d2d0b..589629636502 100755
> > --- a/tools/testing/selftests/net/forwarding/tc_actions.sh
> > +++ b/tools/testing/selftests/net/forwarding/tc_actions.sh
> > @@ -235,9 +235,6 @@ mirred_egress_to_ingress_tcp_test()
> > check_err $? "didn't mirred redirect ICMP"
> > tc_check_packets "dev $h1 ingress" 102 10
> > check_err $? "didn't drop mirred ICMP"
> > - local overlimits=$(tc_rule_stats_get ${h1} 101 egress .overlimits)
> > - test ${overlimits} = 10
> > - check_err $? "wrong overlimits, expected 10 got ${overlimits}"
> >
> > tc filter del dev $h1 egress protocol ip pref 100 handle 100 flower
> > tc filter del dev $h1 egress protocol ip pref 101 handle 101 flower
> > --
> > 2.43.0
> >
[-- Attachment #2: mirred_ingress_bug.txt --]
[-- Type: text/plain, Size: 26164 bytes --]
[ 252.615958] Packet exceeded mirred recursion limit on dev port0
[ 252.616534] ==================================================================
[ 252.616911] BUG: KASAN: slab-use-after-free in tc_run+0x50a/0x5b0
[ 252.617241] Read of size 4 at addr ffff88800d453584 by task ping/548
[ 252.617475] CPU: 8 PID: 548 Comm: ping Not tainted 6.8.0-rc3-00862-g0f37666d87d2-dirty #147
[ 252.617475] Call Trace:
[ 252.617475] <IRQ>
[ 252.617475] dump_stack_lvl+0x64/0xb0
[ 252.617475] print_report+0xcf/0x620
[ 252.617475] ? tc_run+0x50a/0x5b0
[ 252.617475] ? kasan_complete_mode_report_info+0x7c/0x200
[ 252.617475] ? tc_run+0x50a/0x5b0
[ 252.617475] kasan_report+0xc9/0x110
[ 252.617475] ? tc_run+0x50a/0x5b0
[ 252.617475] __asan_report_load4_noabort+0x14/0x20
[ 252.617475] tc_run+0x50a/0x5b0
[ 252.617475] ? __pfx_tc_run+0x10/0x10
[ 252.617475] ? debug_smp_processor_id+0x17/0x20
[ 252.617475] ? rcu_lockdep_current_cpu_online+0x3e/0x150
[ 252.617475] __netif_receive_skb_core.constprop.0+0x12e1/0x3910
[ 252.617475] ? kvm_sched_clock_read+0x11/0x20
[ 252.617475] ? __lock_acquire+0xcf0/0x6760
[ 252.617475] ? __pfx___netif_receive_skb_core.constprop.0+0x10/0x10
[ 252.617475] ? __pfx___lock_acquire+0x10/0x10
[ 252.617475] __netif_receive_skb_one_core+0xb4/0x1c0
[ 252.617475] ? __pfx___netif_receive_skb_one_core+0x10/0x10
[ 252.617475] ? __pfx_lock_acquire+0x10/0x10
[ 252.617475] __netif_receive_skb+0x21/0x1b0
[ 252.617475] netif_receive_skb+0xf9/0x4f0
[ 252.617475] ? __pfx_netif_receive_skb+0x10/0x10
[ 252.617475] tcf_mirred_to_dev+0x7dc/0xdd0
[ 252.617475] tcf_mirred_act+0x3d1/0xe50
[ 252.617475] ? __pfx_tcf_mirred_act+0x10/0x10
[ 252.617475] tcf_action_exec+0x561/0x870
[ 252.617475] mall_classify+0x168/0x240
[ 252.617475] __tcf_classify.constprop.0+0x50c/0x660
[ 252.617475] tcf_classify+0x6e/0xa0
[ 252.617475] ? __pfx_tcf_classify+0x10/0x10
[ 252.617475] ? debug_smp_processor_id+0x17/0x20
[ 252.617475] ? rcu_lockdep_current_cpu_online+0x3e/0x150
[ 252.617475] tc_run+0x31b/0x5b0
[ 252.617475] ? __pfx_tc_run+0x10/0x10
[ 252.617475] ? debug_smp_processor_id+0x17/0x20
[ 252.617475] ? rcu_lockdep_current_cpu_online+0x3e/0x150
[ 252.617475] __netif_receive_skb_core.constprop.0+0x12e1/0x3910
[ 252.617475] ? kvm_sched_clock_read+0x11/0x20
[ 252.617475] ? __lock_acquire+0xcf0/0x6760
[ 252.617475] ? __pfx___netif_receive_skb_core.constprop.0+0x10/0x10
[ 252.617475] ? __pfx___lock_acquire+0x10/0x10
[ 252.617475] __netif_receive_skb_one_core+0xb4/0x1c0
[ 252.617475] ? __pfx___netif_receive_skb_one_core+0x10/0x10
[ 252.617475] ? __pfx_lock_acquire+0x10/0x10
[ 252.617475] __netif_receive_skb+0x21/0x1b0
[ 252.617475] netif_receive_skb+0xf9/0x4f0
[ 252.617475] ? __pfx_netif_receive_skb+0x10/0x10
[ 252.617475] ? __kasan_check_read+0x11/0x20
[ 252.617475] tcf_mirred_to_dev+0x7dc/0xdd0
[ 252.617475] tcf_mirred_act+0x3d1/0xe50
[ 252.617475] ? __kasan_check_read+0x11/0x20
[ 252.617475] ? __pfx_tcf_mirred_act+0x10/0x10
[ 252.617475] ? __kasan_check_read+0x11/0x20
[ 252.617475] ? mark_lock.part.0+0xfa/0x31a0
[ 252.617475] ? __pfx_mark_lock.part.0+0x10/0x10
[ 252.617475] tcf_action_exec+0x561/0x870
[ 252.617475] mall_classify+0x168/0x240
[ 252.617475] ? mark_lock.part.0+0xfa/0x31a0
[ 252.617475] __tcf_classify.constprop.0+0x50c/0x660
[ 252.617475] tcf_classify+0x6e/0xa0
[ 252.617475] ? __pfx_tcf_classify+0x10/0x10
[ 252.617475] ? debug_smp_processor_id+0x17/0x20
[ 252.617475] ? rcu_lockdep_current_cpu_online+0x3e/0x150
[ 252.617475] tc_run+0x31b/0x5b0
[ 252.617475] ? __pfx_tc_run+0x10/0x10
[ 252.617475] ? debug_smp_processor_id+0x17/0x20
[ 252.617475] ? rcu_lockdep_current_cpu_online+0x3e/0x150
[ 252.617475] __netif_receive_skb_core.constprop.0+0x12e1/0x3910
[ 252.617475] ? __kasan_check_read+0x11/0x20
[ 252.617475] ? kvm_sched_clock_read+0x11/0x20
[ 252.617475] ? __lock_acquire+0xcf0/0x6760
[ 252.617475] ? __pfx___netif_receive_skb_core.constprop.0+0x10/0x10
[ 252.617475] ? __pfx___lock_acquire+0x10/0x10
[ 252.617475] ? __pfx_mark_lock.part.0+0x10/0x10
[ 252.617475] ? __kasan_check_read+0x11/0x20
[ 252.617475] __netif_receive_skb_one_core+0xb4/0x1c0
[ 252.617475] ? __pfx___netif_receive_skb_one_core+0x10/0x10
[ 252.617475] ? __pfx_lock_acquire+0x10/0x10
[ 252.617475] ? __kasan_check_read+0x11/0x20
[ 252.617475] ? __lock_acquire+0xd9f/0x6760
[ 252.617475] __netif_receive_skb+0x21/0x1b0
[ 252.617475] netif_receive_skb+0xf9/0x4f0
[ 252.617475] ? __pfx_netif_receive_skb+0x10/0x10
[ 252.617475] ? __pfx___lock_acquire+0x10/0x10
[ 252.617475] tcf_mirred_to_dev+0x7dc/0xdd0
[ 252.617475] tcf_mirred_act+0x3d1/0xe50
[ 252.617475] ? __pfx_tcf_mirred_act+0x10/0x10
[ 252.617475] ? update_stack_state+0x2d4/0x600
[ 252.617475] ? __kasan_check_read+0x11/0x20
[ 252.617475] tcf_action_exec+0x561/0x870
[ 252.617475] mall_classify+0x168/0x240
[ 252.617475] __tcf_classify.constprop.0+0x50c/0x660
[ 252.617475] tcf_classify+0x6e/0xa0
[ 252.617475] ? __pfx_tcf_classify+0x10/0x10
[ 252.617475] ? debug_smp_processor_id+0x17/0x20
[ 252.617475] ? rcu_lockdep_current_cpu_online+0x3e/0x150
[ 252.617475] tc_run+0x31b/0x5b0
[ 252.617475] ? __pfx_tc_run+0x10/0x10
[ 252.617475] ? debug_smp_processor_id+0x17/0x20
[ 252.617475] ? rcu_lockdep_current_cpu_online+0x3e/0x150
[ 252.617475] __netif_receive_skb_core.constprop.0+0x12e1/0x3910
[ 252.617475] ? kvm_sched_clock_read+0x11/0x20
[ 252.617475] ? kvm_sched_clock_read+0x11/0x20
[ 252.617475] ? __lock_acquire+0xcf0/0x6760
[ 252.617475] ? __pfx___netif_receive_skb_core.constprop.0+0x10/0x10
[ 252.617475] ? __pfx___lock_acquire+0x10/0x10
[ 252.617475] __netif_receive_skb_one_core+0xb4/0x1c0
[ 252.617475] ? __pfx___netif_receive_skb_one_core+0x10/0x10
[ 252.617475] ? __pfx_lock_acquire+0x10/0x10
[ 252.617475] ? _raw_spin_unlock_irq+0x28/0x60
[ 252.617475] ? process_backlog+0x416/0x5c0
[ 252.617475] ? __this_cpu_preempt_check+0x13/0x20
[ 252.617475] __netif_receive_skb+0x21/0x1b0
[ 252.617475] process_backlog+0xd7/0x5c0
[ 252.617475] __napi_poll.constprop.0+0xae/0x590
[ 252.617475] ? net_rx_action+0x252/0xb40
[ 252.617475] net_rx_action+0x47c/0xb40
[ 252.617475] ? __pfx_net_rx_action+0x10/0x10
[ 252.617475] ? irq_exit_rcu+0xb4/0x120
[ 252.617475] ? __this_cpu_preempt_check+0x13/0x20
[ 252.617475] __do_softirq+0x1c3/0x853
[ 252.617475] ? __dev_queue_xmit+0x9b3/0x3550
[ 252.617475] do_softirq+0xb5/0xf0
[ 252.617475] </IRQ>
[ 252.617475] <TASK>
[ 252.617475] __local_bh_enable_ip+0x104/0x130
[ 252.617475] ? __dev_queue_xmit+0x9b3/0x3550
[ 252.617475] __dev_queue_xmit+0x9c8/0x3550
[ 252.617475] ? __pfx_mark_lock.part.0+0x10/0x10
[ 252.617475] ? __pfx___dev_queue_xmit+0x10/0x10
[ 252.617475] ? __this_cpu_preempt_check+0x13/0x20
[ 252.617475] ? neigh_resolve_output+0x5bd/0x7b0
[ 252.617475] ? ip_finish_output2+0x6ac/0x1f40
[ 252.617475] ? __this_cpu_preempt_check+0x13/0x20
[ 252.617475] ? eth_header+0x16e/0x1b0
[ 252.617475] neigh_resolve_output+0x431/0x7b0
[ 252.617475] ip_finish_output2+0x6ac/0x1f40
[ 252.617475] ? __kasan_check_read+0x11/0x20
[ 252.617475] ? selinux_ip_postroute+0x357/0x400
[ 252.617475] ? __pfx_selinux_ip_postroute+0x10/0x10
[ 252.617475] ? __get_random_u32_below+0x17/0x70
[ 252.617475] ? __pfx_ip_finish_output2+0x10/0x10
[ 252.617475] ? __this_cpu_preempt_check+0x13/0x20
[ 252.617475] __ip_finish_output+0x6ea/0xed0
[ 252.617475] ? __ip_finish_output+0x6ea/0xed0
[ 252.617475] ip_finish_output+0x2b/0x260
[ 252.617475] ip_output+0x175/0x500
[ 252.617475] ? __pfx_ip_output+0x10/0x10
[ 252.617475] ? __ip_make_skb+0xdb5/0x2060
[ 252.617475] ? __pfx_ip_finish_output+0x10/0x10
[ 252.617475] ip_push_pending_frames+0x249/0x480
[ 252.617475] raw_sendmsg+0xf13/0x2d30
[ 252.617475] ? __kasan_check_read+0x11/0x20
[ 252.617475] ? __lock_acquire+0x1af0/0x6760
[ 252.617475] ? check_preemption_disabled+0x70/0xf0
[ 252.617475] ? __pfx_raw_sendmsg+0x10/0x10
[ 252.617475] ? mark_lock.part.0+0xfa/0x31a0
[ 252.617475] ? kvm_sched_clock_read+0x11/0x20
[ 252.617475] ? __pfx_sock_has_perm+0x10/0x10
[ 252.617475] ? __pfx_lock_release+0x10/0x10
[ 252.617475] ? __might_fault+0xc9/0x180
[ 252.617475] inet_sendmsg+0xd5/0x100
[ 252.617475] ? inet_sendmsg+0xd5/0x100
[ 252.617475] __sys_sendto+0x3be/0x510
[ 252.617475] ? __pfx___sys_sendto+0x10/0x10
[ 252.617475] ? do_user_addr_fault+0x401/0xb70
[ 252.617475] ? __this_cpu_preempt_check+0x13/0x20
[ 252.617475] ? __pfx_lock_release+0x10/0x10
[ 252.617475] ? __pfx___up_read+0x10/0x10
[ 252.617475] ? irqentry_exit_to_user_mode+0x8d/0x1d0
[ 252.617475] ? irqentry_exit+0x6b/0x90
[ 252.617475] ? debug_smp_processor_id+0x17/0x20
[ 252.617475] __x64_sys_sendto+0xe0/0x1a0
[ 252.617475] ? do_syscall_64+0x2a/0x140
[ 252.617475] ? trace_hardirqs_on+0x22/0x120
[ 252.617475] do_syscall_64+0x6d/0x140
[ 252.617475] entry_SYSCALL_64_after_hwframe+0x6e/0x76
[ 252.617475] RIP: 0033:0x7f1d7a8a4b93
[ 252.617475] Code: 8b 15 71 72 0c 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 80 3d 51 fa 0c 00 00 41 89 ca 74 14 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 75 c3 0f 1f 40 00 55 48 83 ec 30 44 89 4c 24
[ 252.617475] RSP: 002b:00007fffe5c7c578 EFLAGS: 00000202 ORIG_RAX: 000000000000002c
[ 252.617475] RAX: ffffffffffffffda RBX: 000055c8f446f340 RCX: 00007f1d7a8a4b93
[ 252.617475] RDX: 0000000000000040 RSI: 000055c8f62889c0 RDI: 0000000000000003
[ 252.617475] RBP: 000055c8f62889c0 R08: 000055c8f44715c0 R09: 0000000000000010
[ 252.617475] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000040
[ 252.617475] R13: 00007fffe5c7dc60 R14: 0000001d00000001 R15: 000055c8f4472680
[ 252.617475] </TASK>
[ 252.617475] Allocated by task 548:
[ 252.617475] kasan_save_stack+0x28/0x50
[ 252.617475] kasan_save_track+0x14/0x40
[ 252.617475] kasan_save_alloc_info+0x65/0x80
[ 252.617475] __kasan_slab_alloc+0x8d/0x90
[ 252.617475] kmem_cache_alloc_node+0x115/0x310
[ 252.617475] __alloc_skb+0x20b/0x2c0
[ 252.617475] __ip_append_data+0x27f8/0x3de0
[ 252.617475] ip_append_data+0xd4/0x190
[ 252.617475] raw_sendmsg+0xa91/0x2d30
[ 252.617475] inet_sendmsg+0xd5/0x100
[ 252.617475] __sys_sendto+0x3be/0x510
[ 252.617475] __x64_sys_sendto+0xe0/0x1a0
[ 252.617475] do_syscall_64+0x6d/0x140
[ 252.617475] entry_SYSCALL_64_after_hwframe+0x6e/0x76
[ 252.617475] Freed by task 548:
[ 252.617475] kasan_save_stack+0x28/0x50
[ 252.617475] kasan_save_track+0x14/0x40
[ 252.617475] kasan_save_free_info+0x41/0x60
[ 252.617475] poison_slab_object+0x10e/0x190
[ 252.617475] __kasan_slab_free+0x38/0x90
[ 252.617475] kmem_cache_free+0x106/0x3e0
[ 252.617475] kfree_skbmem+0x9e/0x150
[ 252.617475] kfree_skb_reason+0x118/0x370
[ 252.617475] __netif_receive_skb_core.constprop.0+0x1a4e/0x3910
[ 252.617475] __netif_receive_skb_one_core+0xb4/0x1c0
[ 252.617475] __netif_receive_skb+0x21/0x1b0
[ 252.617475] netif_receive_skb+0xf9/0x4f0
[ 252.617475] tcf_mirred_to_dev+0x7dc/0xdd0
[ 252.617475] tcf_mirred_act+0x3d1/0xe50
[ 252.617475] tcf_action_exec+0x561/0x870
[ 252.617475] mall_classify+0x168/0x240
[ 252.617475] __tcf_classify.constprop.0+0x50c/0x660
[ 252.617475] tcf_classify+0x6e/0xa0
[ 252.617475] tc_run+0x31b/0x5b0
[ 252.617475] __netif_receive_skb_core.constprop.0+0x12e1/0x3910
[ 252.617475] __netif_receive_skb_one_core+0xb4/0x1c0
[ 252.617475] __netif_receive_skb+0x21/0x1b0
[ 252.617475] netif_receive_skb+0xf9/0x4f0
[ 252.617475] tcf_mirred_to_dev+0x7dc/0xdd0
[ 252.617475] tcf_mirred_act+0x3d1/0xe50
[ 252.617475] tcf_action_exec+0x561/0x870
[ 252.617475] mall_classify+0x168/0x240
[ 252.617475] __tcf_classify.constprop.0+0x50c/0x660
[ 252.617475] tcf_classify+0x6e/0xa0
[ 252.617475] tc_run+0x31b/0x5b0
[ 252.617475] __netif_receive_skb_core.constprop.0+0x12e1/0x3910
[ 252.617475] __netif_receive_skb_one_core+0xb4/0x1c0
[ 252.617475] __netif_receive_skb+0x21/0x1b0
[ 252.617475] netif_receive_skb+0xf9/0x4f0
[ 252.617475] tcf_mirred_to_dev+0x7dc/0xdd0
[ 252.617475] tcf_mirred_act+0x3d1/0xe50
[ 252.617475] tcf_action_exec+0x561/0x870
[ 252.617475] mall_classify+0x168/0x240
[ 252.617475] __tcf_classify.constprop.0+0x50c/0x660
[ 252.617475] tcf_classify+0x6e/0xa0
[ 252.617475] tc_run+0x31b/0x5b0
[ 252.617475] __netif_receive_skb_core.constprop.0+0x12e1/0x3910
[ 252.617475] __netif_receive_skb_one_core+0xb4/0x1c0
[ 252.617475] __netif_receive_skb+0x21/0x1b0
[ 252.617475] netif_receive_skb+0xf9/0x4f0
[ 252.617475] tcf_mirred_to_dev+0x7dc/0xdd0
[ 252.617475] tcf_mirred_act+0x3d1/0xe50
[ 252.617475] tcf_action_exec+0x561/0x870
[ 252.617475] mall_classify+0x168/0x240
[ 252.617475] __tcf_classify.constprop.0+0x50c/0x660
[ 252.617475] tcf_classify+0x6e/0xa0
[ 252.617475] tc_run+0x31b/0x5b0
[ 252.617475] __netif_receive_skb_core.constprop.0+0x12e1/0x3910
[ 252.617475] __netif_receive_skb_one_core+0xb4/0x1c0
[ 252.617475] __netif_receive_skb+0x21/0x1b0
[ 252.617475] process_backlog+0xd7/0x5c0
[ 252.617475] __napi_poll.constprop.0+0xae/0x590
[ 252.617475] net_rx_action+0x47c/0xb40
[ 252.617475] __do_softirq+0x1c3/0x853
[ 252.617475] The buggy address belongs to the object at ffff88800d453540
which belongs to the cache skbuff_head_cache of size 224
[ 252.617475] The buggy address is located 68 bytes inside of
freed 224-byte region [ffff88800d453540, ffff88800d453620)
[ 252.617475] The buggy address belongs to the physical page:
[ 252.617475] page:00000000848240a3 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88800d453b80 pfn:0xd452
[ 252.617475] head:00000000848240a3 order:1 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 252.617475] flags: 0x100000000000840(slab|head|node=0|zone=1)
[ 252.617475] page_type: 0xffffffff()
[ 252.617475] raw: 0100000000000840 ffff88800244e3c0 dead000000000100 dead000000000122
[ 252.617475] raw: ffff88800d453b80 0000000080190004 00000001ffffffff 0000000000000000
[ 252.617475] page dumped because: kasan: bad access detected
[ 252.617475] Memory state around the buggy address:
[ 252.617475] ffff88800d453480: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
[ 252.617475] ffff88800d453500: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
[ 252.617475] >ffff88800d453580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 252.617475] ^
[ 252.617475] ffff88800d453600: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc
[ 252.617475] ffff88800d453680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 252.617475] ==================================================================
[ 252.684330] Disabling lock debugging due to kernel taint
[ 252.684601] ------------[ cut here ]------------
[ 252.684839] refcount_t: underflow; use-after-free.
[ 252.685141] WARNING: CPU: 8 PID: 548 at lib/refcount.c:28 refcount_warn_saturate+0xd4/0x190
[ 252.685567] Modules linked in:
[ 252.685728] CPU: 8 PID: 548 Comm: ping Tainted: G B 6.8.0-rc3-00862-g0f37666d87d2-dirty #147
[ 252.686214] RIP: 0010:refcount_warn_saturate+0xd4/0x190
[ 252.686501] Code: cc cc cc cc 0f b6 05 26 19 f7 02 3c 01 0f 87 d1 3e 68 01 84 c0 75 e4 48 c7 c7 e0 33 83 97 c6 05 0c 19 f7 02 01 e8 2c ed f0 fe <0f> 0b eb cd 0f b6 05 fa 18 f7 02 3c 01 0f 87 a7 3e 68 01 84 c0 75
[ 252.687439] RSP: 0018:ffff888038a08480 EFLAGS: 00010286
[ 252.687699] RAX: 0000000000000000 RBX: ffff88801110829c RCX: 0000000000000000
[ 252.688057] RDX: 0000000000000103 RSI: 0000000000000004 RDI: 0000000000000001
[ 252.688457] RBP: ffff888038a08490 R08: 0000000000000001 R09: ffffed100717d139
[ 252.688804] R10: ffff888038be89cb R11: 0000000063666572 R12: 0000000000000003
[ 252.689163] R13: 0000000000000340 R14: ffff888011108060 R15: ffff88801110829c
[ 252.689545] FS: 00007f1d7a5e2c40(0000) GS:ffff888038a00000(0000) knlGS:0000000000000000
[ 252.689927] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 252.690210] CR2: 00007f1d7a85e0d0 CR3: 000000000b184000 CR4: 0000000000750ef0
[ 252.690584] PKRU: 55555554
[ 252.690731] Call Trace:
[ 252.690871] <IRQ>
[ 252.690988] ? show_regs+0x6a/0x80
[ 252.691155] ? __warn+0xcf/0x2c0
[ 252.691327] ? refcount_warn_saturate+0xd4/0x190
[ 252.691585] ? report_bug+0x341/0x3d0
[ 252.691777] ? handle_bug+0x40/0x80
[ 252.691966] ? exc_invalid_op+0x19/0x50
[ 252.692153] ? asm_exc_invalid_op+0x1b/0x20
[ 252.692409] ? refcount_warn_saturate+0xd4/0x190
[ 252.692646] sock_wfree+0x596/0x770
[ 252.692816] ? __netif_receive_skb_core.constprop.0+0x1a4e/0x3910
[ 252.693138] skb_release_head_state+0x7e/0x1e0
[ 252.693388] kfree_skb_reason+0xd3/0x370
[ 252.693576] __netif_receive_skb_core.constprop.0+0x1a4e/0x3910
[ 252.693889] ? kvm_sched_clock_read+0x11/0x20
[ 252.694112] ? __lock_acquire+0xcf0/0x6760
[ 252.694315] ? __pfx___netif_receive_skb_core.constprop.0+0x10/0x10
[ 252.694650] ? __pfx___lock_acquire+0x10/0x10
[ 252.694871] __netif_receive_skb_one_core+0xb4/0x1c0
[ 252.695119] ? __pfx___netif_receive_skb_one_core+0x10/0x10
[ 252.695415] ? __pfx_lock_acquire+0x10/0x10
[ 252.695630] __netif_receive_skb+0x21/0x1b0
[ 252.695833] netif_receive_skb+0xf9/0x4f0
[ 252.696040] ? __pfx_netif_receive_skb+0x10/0x10
[ 252.696274] tcf_mirred_to_dev+0x7dc/0xdd0
[ 252.696495] tcf_mirred_act+0x3d1/0xe50
[ 252.696687] ? __pfx_tcf_mirred_act+0x10/0x10
[ 252.696901] tcf_action_exec+0x561/0x870
[ 252.697108] mall_classify+0x168/0x240
[ 252.697305] __tcf_classify.constprop.0+0x50c/0x660
[ 252.697569] tcf_classify+0x6e/0xa0
[ 252.697758] ? __pfx_tcf_classify+0x10/0x10
[ 252.697963] ? debug_smp_processor_id+0x17/0x20
[ 252.698176] ? rcu_lockdep_current_cpu_online+0x3e/0x150
[ 252.698456] tc_run+0x31b/0x5b0
[ 252.698605] ? __pfx_tc_run+0x10/0x10
[ 252.698799] ? debug_smp_processor_id+0x17/0x20
[ 252.699007] ? rcu_lockdep_current_cpu_online+0x3e/0x150
[ 252.699242] __netif_receive_skb_core.constprop.0+0x12e1/0x3910
[ 252.699535] ? kvm_sched_clock_read+0x11/0x20
[ 252.699754] ? __lock_acquire+0xcf0/0x6760
[ 252.699950] ? __pfx___netif_receive_skb_core.constprop.0+0x10/0x10
[ 252.700239] ? __pfx___lock_acquire+0x10/0x10
[ 252.700478] __netif_receive_skb_one_core+0xb4/0x1c0
[ 252.700721] ? __pfx___netif_receive_skb_one_core+0x10/0x10
[ 252.701006] ? __pfx_lock_acquire+0x10/0x10
[ 252.701193] __netif_receive_skb+0x21/0x1b0
[ 252.701415] netif_receive_skb+0xf9/0x4f0
[ 252.701595] ? __pfx_netif_receive_skb+0x10/0x10
[ 252.701811] ? __kasan_check_read+0x11/0x20
[ 252.702013] tcf_mirred_to_dev+0x7dc/0xdd0
[ 252.702189] tcf_mirred_act+0x3d1/0xe50
[ 252.702370] ? __kasan_check_read+0x11/0x20
[ 252.702579] ? __pfx_tcf_mirred_act+0x10/0x10
[ 252.702782] ? __kasan_check_read+0x11/0x20
[ 252.702978] ? mark_lock.part.0+0xfa/0x31a0
[ 252.703176] ? __pfx_mark_lock.part.0+0x10/0x10
[ 252.703407] tcf_action_exec+0x561/0x870
[ 252.703594] mall_classify+0x168/0x240
[ 252.703789] ? mark_lock.part.0+0xfa/0x31a0
[ 252.704000] __tcf_classify.constprop.0+0x50c/0x660
[ 252.704238] tcf_classify+0x6e/0xa0
[ 252.704437] ? __pfx_tcf_classify+0x10/0x10
[ 252.704641] ? debug_smp_processor_id+0x17/0x20
[ 252.704854] ? rcu_lockdep_current_cpu_online+0x3e/0x150
[ 252.705105] tc_run+0x31b/0x5b0
[ 252.705264] ? __pfx_tc_run+0x10/0x10
[ 252.705469] ? debug_smp_processor_id+0x17/0x20
[ 252.705680] ? rcu_lockdep_current_cpu_online+0x3e/0x150
[ 252.705932] __netif_receive_skb_core.constprop.0+0x12e1/0x3910
[ 252.706192] ? __kasan_check_read+0x11/0x20
[ 252.706398] ? kvm_sched_clock_read+0x11/0x20
[ 252.706631] ? __lock_acquire+0xcf0/0x6760
[ 252.706830] ? __pfx___netif_receive_skb_core.constprop.0+0x10/0x10
[ 252.707137] ? __pfx___lock_acquire+0x10/0x10
[ 252.707373] ? __pfx_mark_lock.part.0+0x10/0x10
[ 252.707604] ? __kasan_check_read+0x11/0x20
[ 252.707793] __netif_receive_skb_one_core+0xb4/0x1c0
[ 252.708024] ? __pfx___netif_receive_skb_one_core+0x10/0x10
[ 252.708278] ? __pfx_lock_acquire+0x10/0x10
[ 252.708515] ? __kasan_check_read+0x11/0x20
[ 252.708721] ? __lock_acquire+0xd9f/0x6760
[ 252.708901] __netif_receive_skb+0x21/0x1b0
[ 252.709082] netif_receive_skb+0xf9/0x4f0
[ 252.709279] ? __pfx_netif_receive_skb+0x10/0x10
[ 252.709524] ? __pfx___lock_acquire+0x10/0x10
[ 252.709764] tcf_mirred_to_dev+0x7dc/0xdd0
[ 252.709958] tcf_mirred_act+0x3d1/0xe50
[ 252.710130] ? __pfx_tcf_mirred_act+0x10/0x10
[ 252.710331] ? update_stack_state+0x2d4/0x600
[ 252.710595] ? __kasan_check_read+0x11/0x20
[ 252.710792] tcf_action_exec+0x561/0x870
[ 252.710973] mall_classify+0x168/0x240
[ 252.711156] __tcf_classify.constprop.0+0x50c/0x660
[ 252.711390] tcf_classify+0x6e/0xa0
[ 252.711566] ? __pfx_tcf_classify+0x10/0x10
[ 252.711762] ? debug_smp_processor_id+0x17/0x20
[ 252.711980] ? rcu_lockdep_current_cpu_online+0x3e/0x150
[ 252.712212] tc_run+0x31b/0x5b0
[ 252.712369] ? __pfx_tc_run+0x10/0x10
[ 252.712541] ? debug_smp_processor_id+0x17/0x20
[ 252.712746] ? rcu_lockdep_current_cpu_online+0x3e/0x150
[ 252.713001] __netif_receive_skb_core.constprop.0+0x12e1/0x3910
[ 252.713272] ? kvm_sched_clock_read+0x11/0x20
[ 252.713518] ? kvm_sched_clock_read+0x11/0x20
[ 252.713739] ? __lock_acquire+0xcf0/0x6760
[ 252.713928] ? __pfx___netif_receive_skb_core.constprop.0+0x10/0x10
[ 252.714228] ? __pfx___lock_acquire+0x10/0x10
[ 252.714460] __netif_receive_skb_one_core+0xb4/0x1c0
[ 252.714720] ? __pfx___netif_receive_skb_one_core+0x10/0x10
[ 252.714958] ? __pfx_lock_acquire+0x10/0x10
[ 252.715164] ? _raw_spin_unlock_irq+0x28/0x60
[ 252.715388] ? process_backlog+0x416/0x5c0
[ 252.715596] ? __this_cpu_preempt_check+0x13/0x20
[ 252.715834] __netif_receive_skb+0x21/0x1b0
[ 252.716024] process_backlog+0xd7/0x5c0
[ 252.716230] __napi_poll.constprop.0+0xae/0x590
[ 252.716469] ? net_rx_action+0x252/0xb40
[ 252.716702] net_rx_action+0x47c/0xb40
[ 252.716884] ? __pfx_net_rx_action+0x10/0x10
[ 252.717083] ? irq_exit_rcu+0xb4/0x120
[ 252.717263] ? __this_cpu_preempt_check+0x13/0x20
[ 252.717516] __do_softirq+0x1c3/0x853
[ 252.717702] ? __dev_queue_xmit+0x9b3/0x3550
[ 252.717900] do_softirq+0xb5/0xf0
[ 252.718062] </IRQ>
[ 252.718166] <TASK>
[ 252.718290] __local_bh_enable_ip+0x104/0x130
[ 252.718516] ? __dev_queue_xmit+0x9b3/0x3550
[ 252.718737] __dev_queue_xmit+0x9c8/0x3550
[ 252.718927] ? __pfx_mark_lock.part.0+0x10/0x10
[ 252.719139] ? __pfx___dev_queue_xmit+0x10/0x10
[ 252.719398] ? __this_cpu_preempt_check+0x13/0x20
[ 252.719632] ? neigh_resolve_output+0x5bd/0x7b0
[ 252.719828] ? ip_finish_output2+0x6ac/0x1f40
[ 252.720034] ? __this_cpu_preempt_check+0x13/0x20
[ 252.720261] ? eth_header+0x16e/0x1b0
[ 252.720487] neigh_resolve_output+0x431/0x7b0
[ 252.720694] ip_finish_output2+0x6ac/0x1f40
[ 252.720906] ? __kasan_check_read+0x11/0x20
[ 252.721105] ? selinux_ip_postroute+0x357/0x400
[ 252.721313] ? __pfx_selinux_ip_postroute+0x10/0x10
[ 252.721558] ? __get_random_u32_below+0x17/0x70
[ 252.721796] ? __pfx_ip_finish_output2+0x10/0x10
[ 252.722011] ? __this_cpu_preempt_check+0x13/0x20
[ 252.722243] __ip_finish_output+0x6ea/0xed0
[ 252.722463] ? __ip_finish_output+0x6ea/0xed0
[ 252.722675] ip_finish_output+0x2b/0x260
[ 252.722859] ip_output+0x175/0x500
[ 252.723040] ? __pfx_ip_output+0x10/0x10
[ 252.723237] ? __ip_make_skb+0xdb5/0x2060
[ 252.723448] ? __pfx_ip_finish_output+0x10/0x10
[ 252.723666] ip_push_pending_frames+0x249/0x480
[ 252.723869] raw_sendmsg+0xf13/0x2d30
[ 252.724044] ? __kasan_check_read+0x11/0x20
[ 252.724240] ? __lock_acquire+0x1af0/0x6760
[ 252.724454] ? check_preemption_disabled+0x70/0xf0
[ 252.724688] ? __pfx_raw_sendmsg+0x10/0x10
[ 252.724867] ? mark_lock.part.0+0xfa/0x31a0
[ 252.725069] ? kvm_sched_clock_read+0x11/0x20
[ 252.725270] ? __pfx_sock_has_perm+0x10/0x10
[ 252.725501] ? __pfx_lock_release+0x10/0x10
[ 252.725698] ? __might_fault+0xc9/0x180
[ 252.725877] inet_sendmsg+0xd5/0x100
[ 252.726042] ? inet_sendmsg+0xd5/0x100
[ 252.726219] __sys_sendto+0x3be/0x510
[ 252.726399] ? __pfx___sys_sendto+0x10/0x10
[ 252.726609] ? do_user_addr_fault+0x401/0xb70
[ 252.726842] ? __this_cpu_preempt_check+0x13/0x20
[ 252.727048] ? __pfx_lock_release+0x10/0x10
[ 252.727252] ? __pfx___up_read+0x10/0x10
[ 252.727457] ? irqentry_exit_to_user_mode+0x8d/0x1d0
[ 252.727701] ? irqentry_exit+0x6b/0x90
[ 252.727872] ? debug_smp_processor_id+0x17/0x20
[ 252.728109] __x64_sys_sendto+0xe0/0x1a0
[ 252.728294] ? do_syscall_64+0x2a/0x140
[ 252.728495] ? trace_hardirqs_on+0x22/0x120
[ 252.728706] do_syscall_64+0x6d/0x140
[ 252.728873] entry_SYSCALL_64_after_hwframe+0x6e/0x76
[ 252.729106] RIP: 0033:0x7f1d7a8a4b93
[ 252.729279] Code: 8b 15 71 72 0c 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 80 3d 51 fa 0c 00 00 41 89 ca 74 14 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 75 c3 0f 1f 40 00 55 48 83 ec 30 44 89 4c 24
[ 252.730188] RSP: 002b:00007fffe5c7c578 EFLAGS: 00000202 ORIG_RAX: 000000000000002c
[ 252.730558] RAX: ffffffffffffffda RBX: 000055c8f446f340 RCX: 00007f1d7a8a4b93
[ 252.730886] RDX: 0000000000000040 RSI: 000055c8f62889c0 RDI: 0000000000000003
[ 252.731222] RBP: 000055c8f62889c0 R08: 000055c8f44715c0 R09: 0000000000000010
[ 252.731580] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000040
[ 252.731934] R13: 00007fffe5c7dc60 R14: 0000001d00000001 R15: 000055c8f4472680
[ 252.732261] </TASK>
[ 252.732393] irq event stamp: 9034
[ 252.732572] hardirqs last enabled at (9034): [<ffffffff972f451a>] irqentry_exit+0x3a/0x90
[ 252.732938] hardirqs last disabled at (9033): [<ffffffff972f3030>] sysvec_apic_timer_interrupt+0x10/0xc0
[ 252.733390] softirqs last enabled at (8974): [<ffffffff966d2c63>] __dev_queue_xmit+0x9b3/0x3550
[ 252.733810] softirqs last disabled at (8975): [<ffffffff94b922d5>] do_softirq+0xb5/0xf0
[ 252.734195] ---[ end trace 0000000000000000 ]---
next prev parent reply other threads:[~2024-02-12 15:11 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-02-09 23:54 [PATCH net] net/sched: act_mirred: use the backlog for mirred ingress Jakub Kicinski
2024-02-12 14:51 ` Jamal Hadi Salim
2024-02-12 15:02 ` Jakub Kicinski
2024-02-12 15:11 ` Jamal Hadi Salim [this message]
2024-02-13 11:06 ` Paolo Abeni
2024-02-14 0:27 ` Jakub Kicinski
2024-02-14 3:40 ` Jakub Kicinski
2024-02-14 15:11 ` Jamal Hadi Salim
2024-02-14 15:28 ` Jamal Hadi Salim
2024-02-14 16:10 ` Davide Caratti
2024-02-15 0:31 ` Jakub Kicinski
2024-02-15 17:55 ` Davide Caratti
-- strict thread matches above, loose matches on Subject: below --
2022-09-23 15:11 Davide Caratti
2022-09-25 18:08 ` Cong Wang
2022-10-04 17:40 ` Davide Caratti
2022-10-16 17:28 ` Cong Wang
2022-11-18 23:07 ` Peilin Ye
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAM0EoMnYyyf7Zpa9eUFBU1vzx5QrUhFfXSFH4_utXOPU4+YFxQ@mail.gmail.com \
--to=jhs@mojatatu.com \
--cc=davem@davemloft.net \
--cc=dcaratti@redhat.com \
--cc=edumazet@google.com \
--cc=jiri@resnulli.us \
--cc=kuba@kernel.org \
--cc=marcelo.leitner@gmail.com \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=shmulik.ladkani@gmail.com \
--cc=xiyou.wangcong@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).