* [syzbot] WARNING: ODEBUG bug in route4_destroy
@ 2021-09-04 16:46 syzbot
2022-06-14 14:35 ` Zhen Chen
0 siblings, 1 reply; 12+ messages in thread
From: syzbot @ 2021-09-04 16:46 UTC (permalink / raw)
To: davem, jhs, jiri, kuba, linux-kernel, netdev, syzkaller-bugs,
xiyou.wangcong
Hello,
syzbot found the following issue on:
HEAD commit: 57f780f1c433 atlantic: Fix driver resume flow.
git tree: net
console output: https://syzkaller.appspot.com/x/log.txt?x=162590a5300000
kernel config: https://syzkaller.appspot.com/x/.config?x=765eea9a273a8879
dashboard link: https://syzkaller.appspot.com/bug?extid=2e3efb5eb71cb5075ba7
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.1
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11979286300000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=14391933300000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+2e3efb5eb71cb5075ba7@syzkaller.appspotmail.com
------------[ cut here ]------------
ODEBUG: activate active (active state 1) object type: rcu_head hint: 0x0
WARNING: CPU: 0 PID: 8461 at lib/debugobjects.c:505 debug_print_object+0x16e/0x250 lib/debugobjects.c:505
Modules linked in:
CPU: 0 PID: 8461 Comm: syz-executor318 Not tainted 5.14.0-rc7-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:debug_print_object+0x16e/0x250 lib/debugobjects.c:505
Code: ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 af 00 00 00 48 8b 14 dd e0 c8 e3 89 4c 89 ee 48 c7 c7 e0 bc e3 89 e8 f0 de 0d 05 <0f> 0b 83 05 95 53 92 09 01 48 83 c4 18 5b 5d 41 5c 41 5d 41 5e c3
RSP: 0018:ffffc9000160efb0 EFLAGS: 00010286
RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000000
RDX: ffff8880224a8000 RSI: ffffffff815d85b5 RDI: fffff520002c1de8
RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000
R10: ffffffff815d23ee R11: 0000000000000000 R12: ffffffff898d3320
R13: ffffffff89e3c3a0 R14: 0000000000000000 R15: ffffffff898d3320
FS: 00007f00d3339700(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f00d3318718 CR3: 0000000018f1d000 CR4: 00000000001506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
debug_object_activate+0x2da/0x3e0 lib/debugobjects.c:672
debug_rcu_head_queue kernel/rcu/rcu.h:176 [inline]
__call_rcu kernel/rcu/tree.c:3013 [inline]
call_rcu+0x2c/0x750 kernel/rcu/tree.c:3109
queue_rcu_work+0x82/0xa0 kernel/workqueue.c:1754
route4_queue_work net/sched/cls_route.c:272 [inline]
route4_destroy+0x4b9/0x9a0 net/sched/cls_route.c:299
tcf_proto_destroy+0x6a/0x2d0 net/sched/cls_api.c:297
tcf_proto_put+0x8c/0xc0 net/sched/cls_api.c:309
tcf_chain_flush+0x21a/0x360 net/sched/cls_api.c:615
tcf_block_flush_all_chains net/sched/cls_api.c:1016 [inline]
__tcf_block_put+0x15a/0x510 net/sched/cls_api.c:1178
tcf_block_put_ext net/sched/cls_api.c:1383 [inline]
tcf_block_put_ext net/sched/cls_api.c:1375 [inline]
tcf_block_put+0xde/0x130 net/sched/cls_api.c:1393
drr_destroy_qdisc+0x44/0x1d0 net/sched/sch_drr.c:458
qdisc_destroy+0xc4/0x4d0 net/sched/sch_generic.c:1025
qdisc_put+0xcd/0xe0 net/sched/sch_generic.c:1044
notify_and_destroy net/sched/sch_api.c:1006 [inline]
qdisc_graft+0xc7c/0x1260 net/sched/sch_api.c:1078
tc_modify_qdisc+0xba4/0x1a60 net/sched/sch_api.c:1674
rtnetlink_rcv_msg+0x413/0xb80 net/core/rtnetlink.c:5575
netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2504
netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline]
netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1340
netlink_sendmsg+0x86d/0xdb0 net/netlink/af_netlink.c:1929
sock_sendmsg_nosec net/socket.c:703 [inline]
sock_sendmsg+0xcf/0x120 net/socket.c:723
____sys_sendmsg+0x6e8/0x810 net/socket.c:2394
___sys_sendmsg+0xf3/0x170 net/socket.c:2448
__sys_sendmsg+0xe5/0x1b0 net/socket.c:2477
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x445ef9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 11 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f00d3339308 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00000000004cb468 RCX: 0000000000445ef9
RDX: 0000000000000000 RSI: 0000000020000040 RDI: 0000000000000004
RBP: 00000000004cb460 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000008 R11: 0000000000000246 R12: 00000000004cb46c
R13: 000000000049b074 R14: 6d32cc5e8ead0600 R15: 0000000000022000
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [syzbot] WARNING: ODEBUG bug in route4_destroy
2021-09-04 16:46 [syzbot] WARNING: ODEBUG bug in route4_destroy syzbot
@ 2022-06-14 14:35 ` Zhen Chen
2022-06-14 14:46 ` Dan Carpenter
0 siblings, 1 reply; 12+ messages in thread
From: Zhen Chen @ 2022-06-14 14:35 UTC (permalink / raw)
To: syzbot
Cc: davem, jhs, jiri, kuba, linux-kernel, netdev, syzkaller-bugs,
xiyou.wangcong
On 21/9/5 0:46, syzbot wrote:
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: 57f780f1c433 atlantic: Fix driver resume flow.
> git tree: net
> console output: https://syzkaller.appspot.com/x/log.txt?x=162590a5300000
> kernel config: https://syzkaller.appspot.com/x/.config?x=765eea9a273a8879
> dashboard link: https://syzkaller.appspot.com/bug?extid=2e3efb5eb71cb5075ba7
> compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.1
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11979286300000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=14391933300000
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+2e3efb5eb71cb5075ba7@syzkaller.appspotmail.com
>
> ------------[ cut here ]------------
> ODEBUG: activate active (active state 1) object type: rcu_head hint: 0x0
> WARNING: CPU: 0 PID: 8461 at lib/debugobjects.c:505 debug_print_object+0x16e/0x250 lib/debugobjects.c:505
> Modules linked in:
> CPU: 0 PID: 8461 Comm: syz-executor318 Not tainted 5.14.0-rc7-syzkaller #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
> RIP: 0010:debug_print_object+0x16e/0x250 lib/debugobjects.c:505
> Code: ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 af 00 00 00 48 8b 14 dd e0 c8 e3 89 4c 89 ee 48 c7 c7 e0 bc e3 89 e8 f0 de 0d 05 <0f> 0b 83 05 95 53 92 09 01 48 83 c4 18 5b 5d 41 5c 41 5d 41 5e c3
> RSP: 0018:ffffc9000160efb0 EFLAGS: 00010286
> RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000000
> RDX: ffff8880224a8000 RSI: ffffffff815d85b5 RDI: fffff520002c1de8
> RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000
> R10: ffffffff815d23ee R11: 0000000000000000 R12: ffffffff898d3320
> R13: ffffffff89e3c3a0 R14: 0000000000000000 R15: ffffffff898d3320
> FS: 00007f00d3339700(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00007f00d3318718 CR3: 0000000018f1d000 CR4: 00000000001506f0
> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> Call Trace:
> debug_object_activate+0x2da/0x3e0 lib/debugobjects.c:672
> debug_rcu_head_queue kernel/rcu/rcu.h:176 [inline]
> __call_rcu kernel/rcu/tree.c:3013 [inline]
> call_rcu+0x2c/0x750 kernel/rcu/tree.c:3109
> queue_rcu_work+0x82/0xa0 kernel/workqueue.c:1754
> route4_queue_work net/sched/cls_route.c:272 [inline]
> route4_destroy+0x4b9/0x9a0 net/sched/cls_route.c:299
> tcf_proto_destroy+0x6a/0x2d0 net/sched/cls_api.c:297
> tcf_proto_put+0x8c/0xc0 net/sched/cls_api.c:309
> tcf_chain_flush+0x21a/0x360 net/sched/cls_api.c:615
> tcf_block_flush_all_chains net/sched/cls_api.c:1016 [inline]
> __tcf_block_put+0x15a/0x510 net/sched/cls_api.c:1178
> tcf_block_put_ext net/sched/cls_api.c:1383 [inline]
> tcf_block_put_ext net/sched/cls_api.c:1375 [inline]
> tcf_block_put+0xde/0x130 net/sched/cls_api.c:1393
> drr_destroy_qdisc+0x44/0x1d0 net/sched/sch_drr.c:458
> qdisc_destroy+0xc4/0x4d0 net/sched/sch_generic.c:1025
> qdisc_put+0xcd/0xe0 net/sched/sch_generic.c:1044
> notify_and_destroy net/sched/sch_api.c:1006 [inline]
> qdisc_graft+0xc7c/0x1260 net/sched/sch_api.c:1078
> tc_modify_qdisc+0xba4/0x1a60 net/sched/sch_api.c:1674
> rtnetlink_rcv_msg+0x413/0xb80 net/core/rtnetlink.c:5575
> netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2504
> netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline]
> netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1340
> netlink_sendmsg+0x86d/0xdb0 net/netlink/af_netlink.c:1929
> sock_sendmsg_nosec net/socket.c:703 [inline]
> sock_sendmsg+0xcf/0x120 net/socket.c:723
> ____sys_sendmsg+0x6e8/0x810 net/socket.c:2394
> ___sys_sendmsg+0xf3/0x170 net/socket.c:2448
> __sys_sendmsg+0xe5/0x1b0 net/socket.c:2477
> do_syscall_x64 arch/x86/entry/common.c:50 [inline]
> do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
> entry_SYSCALL_64_after_hwframe+0x44/0xae
> RIP: 0033:0x445ef9
> Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 11 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
> RSP: 002b:00007f00d3339308 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
> RAX: ffffffffffffffda RBX: 00000000004cb468 RCX: 0000000000445ef9
> RDX: 0000000000000000 RSI: 0000000020000040 RDI: 0000000000000004
> RBP: 00000000004cb460 R08: 0000000000000001 R09: 0000000000000000
> R10: 0000000000000008 R11: 0000000000000246 R12: 00000000004cb46c
> R13: 000000000049b074 R14: 6d32cc5e8ead0600 R15: 0000000000022000
>
This looks like route4_destroy is deleting the 'fold' which has been freed by tcf_queue_work in route4_change. It means 'fold' is still in the table.
I have tested this patch on syzbot and it works well, but I am not sure whether it will introduce other issues...
diff --git a/net/sched/cls_route.c b/net/sched/cls_route.c
index a35ab8c27866..758c21f9d628 100644
--- a/net/sched/cls_route.c
+++ b/net/sched/cls_route.c
@@ -526,7 +526,7 @@ static int route4_change(struct net *net, struct sk_buff *in_skb,
rcu_assign_pointer(f->next, f1);
rcu_assign_pointer(*fp, f);
- if (fold && fold->handle && f->handle != fold->handle) {
+ if (fold && f->handle != fold->handle) {
th = to_hash(fold->handle);
h = from_hash(fold->handle >> 16);
b = rtnl_dereference(head->table[th]);
^ permalink raw reply related [flat|nested] 12+ messages in thread
* Re: [syzbot] WARNING: ODEBUG bug in route4_destroy
2022-06-14 14:35 ` Zhen Chen
@ 2022-06-14 14:46 ` Dan Carpenter
2022-06-15 11:57 ` Zhen Chen
0 siblings, 1 reply; 12+ messages in thread
From: Dan Carpenter @ 2022-06-14 14:46 UTC (permalink / raw)
To: Zhen Chen
Cc: syzbot, davem, jhs, jiri, kuba, linux-kernel, netdev,
syzkaller-bugs, xiyou.wangcong
On Tue, Jun 14, 2022 at 10:35:44PM +0800, 'Zhen Chen' via syzkaller-bugs wrote:
>
> This looks like route4_destroy is deleting the 'fold' which has been
> freed by tcf_queue_work in route4_change. It means 'fold' is still in
> the table.
> I have tested this patch on syzbot and it works well, but I am not
> sure whether it will introduce other issues...
>
> diff --git a/net/sched/cls_route.c b/net/sched/cls_route.c
> index a35ab8c27866..758c21f9d628 100644
> --- a/net/sched/cls_route.c
> +++ b/net/sched/cls_route.c
> @@ -526,7 +526,7 @@ static int route4_change(struct net *net, struct sk_buff *in_skb,
> rcu_assign_pointer(f->next, f1);
> rcu_assign_pointer(*fp, f);
>
> - if (fold && fold->handle && f->handle != fold->handle) {
> + if (fold && f->handle != fold->handle) {
^^^^^^^^^^^^
There is still a dereference here so your patch doesn't make sense. :/
regards,
dan carpenter
> th = to_hash(fold->handle);
> h = from_hash(fold->handle >> 16);
> b = rtnl_dereference(head->table[th]);
>
> --
> You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bugs+unsubscribe@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/0c0468ae-5fe3-a71f-c987-18475756caca%40huawei.com.
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [syzbot] WARNING: ODEBUG bug in route4_destroy
2022-06-14 14:46 ` Dan Carpenter
@ 2022-06-15 11:57 ` Zhen Chen
0 siblings, 0 replies; 12+ messages in thread
From: Zhen Chen @ 2022-06-15 11:57 UTC (permalink / raw)
To: Dan Carpenter
Cc: syzbot, davem, jhs, jiri, kuba, linux-kernel, netdev,
syzkaller-bugs, xiyou.wangcong, rose.chen
On 22/6/14 22:46, Dan Carpenter wrote:
> On Tue, Jun 14, 2022 at 10:35:44PM +0800, 'Zhen Chen' via syzkaller-bugs wrote:
>>
>> This looks like route4_destroy is deleting the 'fold' which has been
>> freed by tcf_queue_work in route4_change. It means 'fold' is still in
>> the table.
>> I have tested this patch on syzbot and it works well, but I am not
>> sure whether it will introduce other issues...
>>
>> diff --git a/net/sched/cls_route.c b/net/sched/cls_route.c
>> index a35ab8c27866..758c21f9d628 100644
>> --- a/net/sched/cls_route.c
>> +++ b/net/sched/cls_route.c
>> @@ -526,7 +526,7 @@ static int route4_change(struct net *net, struct sk_buff *in_skb,
>> rcu_assign_pointer(f->next, f1);
>> rcu_assign_pointer(*fp, f);
>>
>> - if (fold && fold->handle && f->handle != fold->handle) {
>> + if (fold && f->handle != fold->handle) {
> ^^^^^^^^^^^^
> There is still a dereference here so your patch doesn't make sense. :/
>
> regards,
> dan carpenter
Thanks for your reply but I think the dereference may not be the point.
If fold->handle equals 0, it will not be removed from the hash table, but afterwards the old filter will be freed because it only checks the pointer 'fold' is null or not.
if (fold) {
tcf_unbind_filter(tp, &fold->res);
tcf_exts_get_net(&fold->exts);
tcf_queue_work(&fold->rwork, route4_delete_filter_work);
}
So my patch simply eliminates the handle judgement and it seems to work fine on syzbot.
If I misunderstood anything, pleaese let me know :) Thanks!
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [syzbot] WARNING: ODEBUG bug in route4_destroy
[not found] <20220616132136.2669-1-hdanton@sina.com>
@ 2022-06-16 16:16 ` syzbot
0 siblings, 0 replies; 12+ messages in thread
From: syzbot @ 2022-06-16 16:16 UTC (permalink / raw)
To: hdanton, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-and-tested-by: syzbot+2e3efb5eb71cb5075ba7@syzkaller.appspotmail.com
Tested on:
commit: 018ab4fa netfs: fix up netfs_inode_init() docbook comm..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=10c31fbff00000
kernel config: https://syzkaller.appspot.com/x/.config?x=f21890d74080ef72
dashboard link: https://syzkaller.appspot.com/bug?extid=2e3efb5eb71cb5075ba7
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
patch: https://syzkaller.appspot.com/x/patch.diff?x=1627e7a0080000
Note: testing is done by a robot and is best-effort only.
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [syzbot] WARNING: ODEBUG bug in route4_destroy
[not found] <20220616123726.2597-1-hdanton@sina.com>
@ 2022-06-16 12:56 ` syzbot
0 siblings, 0 replies; 12+ messages in thread
From: syzbot @ 2022-06-16 12:56 UTC (permalink / raw)
To: hdanton, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-and-tested-by: syzbot+2e3efb5eb71cb5075ba7@syzkaller.appspotmail.com
Tested on:
commit: 018ab4fa netfs: fix up netfs_inode_init() docbook comm..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=167212c3f00000
kernel config: https://syzkaller.appspot.com/x/.config?x=f21890d74080ef72
dashboard link: https://syzkaller.appspot.com/bug?extid=2e3efb5eb71cb5075ba7
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
patch: https://syzkaller.appspot.com/x/patch.diff?x=15b2f608080000
Note: testing is done by a robot and is best-effort only.
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [syzbot] WARNING: ODEBUG bug in route4_destroy
[not found] <20220616121345.2536-1-hdanton@sina.com>
@ 2022-06-16 12:26 ` syzbot
0 siblings, 0 replies; 12+ messages in thread
From: syzbot @ 2022-06-16 12:26 UTC (permalink / raw)
To: hdanton, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: use-after-free Read in route4_destroy
==================================================================
BUG: KASAN: use-after-free in route4_destroy+0x852/0xa10 net/sched/cls_route.c:305
Read of size 8 at addr ffff88801fcbe000 by task syz-executor.0/4164
CPU: 1 PID: 4164 Comm: syz-executor.0 Not tainted 5.19.0-rc2-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
print_address_description.constprop.0.cold+0xeb/0x495 mm/kasan/report.c:313
print_report mm/kasan/report.c:429 [inline]
kasan_report.cold+0xf4/0x1c6 mm/kasan/report.c:491
route4_destroy+0x852/0xa10 net/sched/cls_route.c:305
tcf_proto_destroy+0x6a/0x2d0 net/sched/cls_api.c:314
tcf_proto_put+0x8c/0xc0 net/sched/cls_api.c:326
tcf_chain_flush+0x21a/0x360 net/sched/cls_api.c:632
tcf_block_flush_all_chains net/sched/cls_api.c:1034 [inline]
__tcf_block_put+0x15a/0x510 net/sched/cls_api.c:1196
tcf_block_put_ext net/sched/cls_api.c:1396 [inline]
tcf_block_put+0xb3/0x100 net/sched/cls_api.c:1411
drr_destroy_qdisc+0x44/0x1d0 net/sched/sch_drr.c:455
qdisc_destroy+0xc4/0x4e0 net/sched/sch_generic.c:1067
qdisc_put+0xcd/0xe0 net/sched/sch_generic.c:1086
notify_and_destroy net/sched/sch_api.c:1012 [inline]
qdisc_graft+0xeb1/0x1270 net/sched/sch_api.c:1084
tc_modify_qdisc+0xbb7/0x1a00 net/sched/sch_api.c:1671
rtnetlink_rcv_msg+0x43a/0xc90 net/core/rtnetlink.c:6089
netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2501
netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
netlink_unicast+0x543/0x7f0 net/netlink/af_netlink.c:1345
netlink_sendmsg+0x917/0xe10 net/netlink/af_netlink.c:1921
sock_sendmsg_nosec net/socket.c:714 [inline]
sock_sendmsg+0xcf/0x120 net/socket.c:734
____sys_sendmsg+0x6eb/0x810 net/socket.c:2492
___sys_sendmsg+0xf3/0x170 net/socket.c:2546
__sys_sendmsg net/socket.c:2575 [inline]
__do_sys_sendmsg net/socket.c:2584 [inline]
__se_sys_sendmsg net/socket.c:2582 [inline]
__x64_sys_sendmsg+0x132/0x220 net/socket.c:2582
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0x80 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x46/0xb0
RIP: 0033:0x4665f9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fd7310da188 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 000000000056bf80 RCX: 00000000004665f9
RDX: 0000000000000000 RSI: 0000000020000040 RDI: 0000000000000004
RBP: 00000000004bfcc4 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf80
R13: 00007ffc67b9e05f R14: 00007fd7310da300 R15: 0000000000022000
</TASK>
Allocated by task 4160:
kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
kasan_set_track mm/kasan/common.c:45 [inline]
set_alloc_info mm/kasan/common.c:436 [inline]
____kasan_kmalloc mm/kasan/common.c:515 [inline]
____kasan_kmalloc mm/kasan/common.c:474 [inline]
__kasan_kmalloc+0xa9/0xd0 mm/kasan/common.c:524
kmalloc include/linux/slab.h:600 [inline]
kzalloc include/linux/slab.h:733 [inline]
route4_change+0x28c/0x2450 net/sched/cls_route.c:505
tc_new_tfilter+0x98d/0x2200 net/sched/cls_api.c:2148
rtnetlink_rcv_msg+0x946/0xc90 net/core/rtnetlink.c:6080
netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2501
netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
netlink_unicast+0x543/0x7f0 net/netlink/af_netlink.c:1345
netlink_sendmsg+0x917/0xe10 net/netlink/af_netlink.c:1921
sock_sendmsg_nosec net/socket.c:714 [inline]
sock_sendmsg+0xcf/0x120 net/socket.c:734
____sys_sendmsg+0x6eb/0x810 net/socket.c:2492
___sys_sendmsg+0xf3/0x170 net/socket.c:2546
__sys_sendmsg net/socket.c:2575 [inline]
__do_sys_sendmsg net/socket.c:2584 [inline]
__se_sys_sendmsg net/socket.c:2582 [inline]
__x64_sys_sendmsg+0x132/0x220 net/socket.c:2582
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0x80 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x46/0xb0
Freed by task 1095:
kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
kasan_set_track+0x21/0x30 mm/kasan/common.c:45
kasan_set_free_info+0x20/0x30 mm/kasan/generic.c:370
____kasan_slab_free mm/kasan/common.c:366 [inline]
____kasan_slab_free+0x166/0x1a0 mm/kasan/common.c:328
kasan_slab_free include/linux/kasan.h:200 [inline]
slab_free_hook mm/slub.c:1727 [inline]
slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1753
slab_free mm/slub.c:3507 [inline]
kfree+0xd6/0x4d0 mm/slub.c:4555
__route4_delete_filter net/sched/cls_route.c:262 [inline]
route4_delete_filter_work+0xb0/0xf0 net/sched/cls_route.c:271
process_one_work+0x996/0x1610 kernel/workqueue.c:2289
worker_thread+0x665/0x1080 kernel/workqueue.c:2436
kthread+0x2e9/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302
Last potentially related work creation:
kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
__kasan_record_aux_stack+0xbe/0xd0 mm/kasan/generic.c:348
insert_work+0x48/0x350 kernel/workqueue.c:1358
__queue_work+0x62f/0x1150 kernel/workqueue.c:1517
rcu_work_rcufn+0x58/0x80 kernel/workqueue.c:1754
rcu_do_batch kernel/rcu/tree.c:2578 [inline]
rcu_core+0x7b1/0x1880 kernel/rcu/tree.c:2838
__do_softirq+0x29b/0x9c2 kernel/softirq.c:571
Second to last potentially related work creation:
kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
__kasan_record_aux_stack+0xbe/0xd0 mm/kasan/generic.c:348
call_rcu+0x99/0x790 kernel/rcu/tree.c:3126
queue_rcu_work+0x82/0xa0 kernel/workqueue.c:1774
route4_queue_work+0x46/0x50 net/sched/cls_route.c:279
route4_change+0x1a73/0x2450 net/sched/cls_route.c:564
tc_new_tfilter+0x98d/0x2200 net/sched/cls_api.c:2148
rtnetlink_rcv_msg+0x946/0xc90 net/core/rtnetlink.c:6080
netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2501
netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
netlink_unicast+0x543/0x7f0 net/netlink/af_netlink.c:1345
netlink_sendmsg+0x917/0xe10 net/netlink/af_netlink.c:1921
sock_sendmsg_nosec net/socket.c:714 [inline]
sock_sendmsg+0xcf/0x120 net/socket.c:734
____sys_sendmsg+0x6eb/0x810 net/socket.c:2492
___sys_sendmsg+0xf3/0x170 net/socket.c:2546
__sys_sendmsg net/socket.c:2575 [inline]
__do_sys_sendmsg net/socket.c:2584 [inline]
__se_sys_sendmsg net/socket.c:2582 [inline]
__x64_sys_sendmsg+0x132/0x220 net/socket.c:2582
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0x80 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x46/0xb0
The buggy address belongs to the object at ffff88801fcbe000
which belongs to the cache kmalloc-192 of size 192
The buggy address is located 0 bytes inside of
192-byte region [ffff88801fcbe000, ffff88801fcbe0c0)
The buggy address belongs to the physical page:
page:ffffea00007f2f80 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1fcbe
flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000200 ffffea00007d50c0 dead000000000002 ffff888010c41a00
raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12c00(GFP_NOIO|__GFP_NOWARN|__GFP_NORETRY), pid 146, tgid 146 (kworker/0:2), ts 9150330232, free_ts 9143712005
prep_new_page mm/page_alloc.c:2456 [inline]
get_page_from_freelist+0x1290/0x3b70 mm/page_alloc.c:4198
__alloc_pages+0x1c7/0x510 mm/page_alloc.c:5426
alloc_pages+0x1aa/0x310 mm/mempolicy.c:2272
alloc_slab_page mm/slub.c:1797 [inline]
allocate_slab+0x26c/0x3c0 mm/slub.c:1942
new_slab mm/slub.c:2002 [inline]
___slab_alloc+0x985/0xd90 mm/slub.c:3002
__slab_alloc.constprop.0+0x4d/0xa0 mm/slub.c:3089
slab_alloc_node mm/slub.c:3180 [inline]
slab_alloc mm/slub.c:3222 [inline]
__kmalloc+0x318/0x350 mm/slub.c:4413
kmalloc include/linux/slab.h:605 [inline]
usb_alloc_urb+0xa5/0xb0 drivers/usb/core/urb.c:74
usb_internal_control_msg drivers/usb/core/message.c:95 [inline]
usb_control_msg+0x1c9/0x4a0 drivers/usb/core/message.c:153
get_port_status drivers/usb/core/hub.c:580 [inline]
hub_ext_port_status+0x112/0x450 drivers/usb/core/hub.c:597
hub_port_status drivers/usb/core/hub.c:619 [inline]
hub_activate+0xa5c/0x1c90 drivers/usb/core/hub.c:1129
process_one_work+0x996/0x1610 kernel/workqueue.c:2289
worker_thread+0x665/0x1080 kernel/workqueue.c:2436
kthread+0x2e9/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1371 [inline]
free_pcp_prepare+0x549/0xd20 mm/page_alloc.c:1421
free_unref_page_prepare mm/page_alloc.c:3343 [inline]
free_unref_page+0x19/0x6a0 mm/page_alloc.c:3438
mm_free_pgd kernel/fork.c:737 [inline]
__mmdrop+0xcb/0x3f0 kernel/fork.c:788
mmdrop include/linux/sched/mm.h:50 [inline]
__mmput+0x3f1/0x4b0 kernel/fork.c:1197
mmput+0x56/0x60 kernel/fork.c:1208
free_bprm+0x65/0x2e0 fs/exec.c:1486
kernel_execve+0x3fa/0x500 fs/exec.c:2005
call_usermodehelper_exec_async+0x2e3/0x580 kernel/umh.c:112
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302
Memory state around the buggy address:
ffff88801fcbdf00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88801fcbdf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88801fcbe000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88801fcbe080: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
ffff88801fcbe100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
Tested on:
commit: 018ab4fa netfs: fix up netfs_inode_init() docbook comm..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=13ff8ac3f00000
kernel config: https://syzkaller.appspot.com/x/.config?x=f21890d74080ef72
dashboard link: https://syzkaller.appspot.com/bug?extid=2e3efb5eb71cb5075ba7
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
patch: https://syzkaller.appspot.com/x/patch.diff?x=14a571a7f00000
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [syzbot] WARNING: ODEBUG bug in route4_destroy
[not found] <20220616112635.2462-1-hdanton@sina.com>
@ 2022-06-16 11:42 ` syzbot
0 siblings, 0 replies; 12+ messages in thread
From: syzbot @ 2022-06-16 11:42 UTC (permalink / raw)
To: hdanton, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: use-after-free Read in route4_destroy
==================================================================
BUG: KASAN: use-after-free in route4_destroy+0x82b/0x9a0 net/sched/cls_route.c:302
BUG: KASAN: use-after-free in route4_destroy+0x82b/0x9a0 net/sched/cls_route.c:302
Read of size 8 at addr ffff88802160ec00 by task syz-executor.0/4173
CPU: 0 PID: 4173 Comm: syz-executor.0 Not tainted 5.19.0-rc2-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
print_address_description.constprop.0.cold+0xeb/0x495 mm/kasan/report.c:313
print_report mm/kasan/report.c:429 [inline]
kasan_report.cold+0xf4/0x1c6 mm/kasan/report.c:491
route4_destroy+0x82b/0x9a0 net/sched/cls_route.c:302
tcf_proto_destroy+0x6a/0x2d0 net/sched/cls_api.c:314
tcf_proto_put+0x8c/0xc0 net/sched/cls_api.c:326
tcf_chain_flush+0x21a/0x360 net/sched/cls_api.c:632
tcf_block_flush_all_chains net/sched/cls_api.c:1034 [inline]
__tcf_block_put+0x15a/0x510 net/sched/cls_api.c:1196
tcf_block_put_ext net/sched/cls_api.c:1396 [inline]
tcf_block_put+0xb3/0x100 net/sched/cls_api.c:1411
drr_destroy_qdisc+0x44/0x1d0 net/sched/sch_drr.c:455
qdisc_destroy+0xc4/0x4e0 net/sched/sch_generic.c:1067
qdisc_put+0xcd/0xe0 net/sched/sch_generic.c:1086
notify_and_destroy net/sched/sch_api.c:1012 [inline]
qdisc_graft+0xeb1/0x1270 net/sched/sch_api.c:1084
tc_modify_qdisc+0xbb7/0x1a00 net/sched/sch_api.c:1671
rtnetlink_rcv_msg+0x43a/0xc90 net/core/rtnetlink.c:6089
netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2501
netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
netlink_unicast+0x543/0x7f0 net/netlink/af_netlink.c:1345
netlink_sendmsg+0x917/0xe10 net/netlink/af_netlink.c:1921
sock_sendmsg_nosec net/socket.c:714 [inline]
sock_sendmsg+0xcf/0x120 net/socket.c:734
____sys_sendmsg+0x6eb/0x810 net/socket.c:2492
___sys_sendmsg+0xf3/0x170 net/socket.c:2546
__sys_sendmsg net/socket.c:2575 [inline]
__do_sys_sendmsg net/socket.c:2584 [inline]
__se_sys_sendmsg net/socket.c:2582 [inline]
__x64_sys_sendmsg+0x132/0x220 net/socket.c:2582
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0x80 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x46/0xb0
RIP: 0033:0x4665f9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fe70b8b5188 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 000000000056bf80 RCX: 00000000004665f9
RDX: 0000000000000000 RSI: 0000000020000040 RDI: 0000000000000004
RBP: 00000000004bfcc4 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf80
R13: 00007ffdfeb02b6f R14: 00007fe70b8b5300 R15: 0000000000022000
</TASK>
Allocated by task 4169:
kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
kasan_set_track mm/kasan/common.c:45 [inline]
set_alloc_info mm/kasan/common.c:436 [inline]
____kasan_kmalloc mm/kasan/common.c:515 [inline]
____kasan_kmalloc mm/kasan/common.c:474 [inline]
__kasan_kmalloc+0xa9/0xd0 mm/kasan/common.c:524
kmalloc include/linux/slab.h:600 [inline]
kzalloc include/linux/slab.h:733 [inline]
route4_change+0x28c/0x2450 net/sched/cls_route.c:500
tc_new_tfilter+0x98d/0x2200 net/sched/cls_api.c:2148
rtnetlink_rcv_msg+0x946/0xc90 net/core/rtnetlink.c:6080
netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2501
netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
netlink_unicast+0x543/0x7f0 net/netlink/af_netlink.c:1345
netlink_sendmsg+0x917/0xe10 net/netlink/af_netlink.c:1921
sock_sendmsg_nosec net/socket.c:714 [inline]
sock_sendmsg+0xcf/0x120 net/socket.c:734
____sys_sendmsg+0x6eb/0x810 net/socket.c:2492
___sys_sendmsg+0xf3/0x170 net/socket.c:2546
__sys_sendmsg net/socket.c:2575 [inline]
__do_sys_sendmsg net/socket.c:2584 [inline]
__se_sys_sendmsg net/socket.c:2582 [inline]
__x64_sys_sendmsg+0x132/0x220 net/socket.c:2582
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0x80 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x46/0xb0
Freed by task 1312:
kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
kasan_set_track+0x21/0x30 mm/kasan/common.c:45
kasan_set_free_info+0x20/0x30 mm/kasan/generic.c:370
____kasan_slab_free mm/kasan/common.c:366 [inline]
____kasan_slab_free+0x166/0x1a0 mm/kasan/common.c:328
kasan_slab_free include/linux/kasan.h:200 [inline]
slab_free_hook mm/slub.c:1727 [inline]
slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1753
slab_free mm/slub.c:3507 [inline]
kfree+0xd6/0x4d0 mm/slub.c:4555
__route4_delete_filter net/sched/cls_route.c:262 [inline]
route4_delete_filter_work+0xb0/0xf0 net/sched/cls_route.c:271
process_one_work+0x996/0x1610 kernel/workqueue.c:2289
worker_thread+0x665/0x1080 kernel/workqueue.c:2436
kthread+0x2e9/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302
Last potentially related work creation:
kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
__kasan_record_aux_stack+0xbe/0xd0 mm/kasan/generic.c:348
insert_work+0x48/0x350 kernel/workqueue.c:1358
__queue_work+0x62f/0x1150 kernel/workqueue.c:1517
rcu_work_rcufn+0x58/0x80 kernel/workqueue.c:1754
rcu_do_batch kernel/rcu/tree.c:2578 [inline]
rcu_core+0x7b1/0x1880 kernel/rcu/tree.c:2838
__do_softirq+0x29b/0x9c2 kernel/softirq.c:571
Second to last potentially related work creation:
kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
__kasan_record_aux_stack+0xbe/0xd0 mm/kasan/generic.c:348
call_rcu+0x99/0x790 kernel/rcu/tree.c:3126
queue_rcu_work+0x82/0xa0 kernel/workqueue.c:1774
route4_queue_work+0x46/0x50 net/sched/cls_route.c:279
route4_change+0x1a73/0x2450 net/sched/cls_route.c:559
tc_new_tfilter+0x98d/0x2200 net/sched/cls_api.c:2148
rtnetlink_rcv_msg+0x946/0xc90 net/core/rtnetlink.c:6080
netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2501
netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
netlink_unicast+0x543/0x7f0 net/netlink/af_netlink.c:1345
netlink_sendmsg+0x917/0xe10 net/netlink/af_netlink.c:1921
sock_sendmsg_nosec net/socket.c:714 [inline]
sock_sendmsg+0xcf/0x120 net/socket.c:734
____sys_sendmsg+0x6eb/0x810 net/socket.c:2492
___sys_sendmsg+0xf3/0x170 net/socket.c:2546
__sys_sendmsg net/socket.c:2575 [inline]
__do_sys_sendmsg net/socket.c:2584 [inline]
__se_sys_sendmsg net/socket.c:2582 [inline]
__x64_sys_sendmsg+0x132/0x220 net/socket.c:2582
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0x80 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x46/0xb0
The buggy address belongs to the object at ffff88802160ec00
which belongs to the cache kmalloc-192 of size 192
The buggy address is located 0 bytes inside of
192-byte region [ffff88802160ec00, ffff88802160ecc0)
The buggy address belongs to the physical page:
page:ffffea0000858380 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2160e
flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000200 ffffea0000848740 dead000000000002 ffff888010c41a00
raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 1, tgid 1 (swapper/0), ts 9272225302, free_ts 9271655317
prep_new_page mm/page_alloc.c:2456 [inline]
get_page_from_freelist+0x1290/0x3b70 mm/page_alloc.c:4198
__alloc_pages+0x1c7/0x510 mm/page_alloc.c:5426
alloc_page_interleave+0x1e/0x200 mm/mempolicy.c:2105
alloc_pages+0x2b1/0x310 mm/mempolicy.c:2267
alloc_slab_page mm/slub.c:1797 [inline]
allocate_slab+0x26c/0x3c0 mm/slub.c:1942
new_slab mm/slub.c:2002 [inline]
___slab_alloc+0x985/0xd90 mm/slub.c:3002
__slab_alloc.constprop.0+0x4d/0xa0 mm/slub.c:3089
slab_alloc_node mm/slub.c:3180 [inline]
slab_alloc mm/slub.c:3222 [inline]
kmem_cache_alloc_trace+0x310/0x3f0 mm/slub.c:3253
kmalloc include/linux/slab.h:600 [inline]
kzalloc include/linux/slab.h:733 [inline]
call_usermodehelper_setup+0x97/0x340 kernel/umh.c:365
kobject_uevent_env+0xefa/0x1660 lib/kobject_uevent.c:614
driver_register+0x2db/0x3a0 drivers/base/driver.c:248
usb_register_driver+0x249/0x460 drivers/usb/core/driver.c:1062
do_one_initcall+0x103/0x650 init/main.c:1295
do_initcall_level init/main.c:1368 [inline]
do_initcalls init/main.c:1384 [inline]
do_basic_setup init/main.c:1403 [inline]
kernel_init_freeable+0x6b1/0x73a init/main.c:1610
kernel_init+0x1a/0x1d0 init/main.c:1499
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1371 [inline]
free_pcp_prepare+0x549/0xd20 mm/page_alloc.c:1421
free_unref_page_prepare mm/page_alloc.c:3343 [inline]
free_unref_page_list+0x16f/0xf80 mm/page_alloc.c:3475
release_pages+0xff1/0x2290 mm/swap.c:980
tlb_batch_pages_flush+0xa8/0x1a0 mm/mmu_gather.c:58
tlb_flush_mmu_free mm/mmu_gather.c:255 [inline]
tlb_flush_mmu mm/mmu_gather.c:262 [inline]
tlb_finish_mmu+0x147/0x7e0 mm/mmu_gather.c:353
exit_mmap+0x1de/0x4a0 mm/mmap.c:3164
__mmput+0x122/0x4b0 kernel/fork.c:1187
mmput+0x56/0x60 kernel/fork.c:1208
free_bprm+0x65/0x2e0 fs/exec.c:1486
kernel_execve+0x3fa/0x500 fs/exec.c:2005
call_usermodehelper_exec_async+0x2e3/0x580 kernel/umh.c:112
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302
Memory state around the buggy address:
ffff88802160eb00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff88802160eb80: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc
>ffff88802160ec00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88802160ec80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
ffff88802160ed00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
Tested on:
commit: 018ab4fa netfs: fix up netfs_inode_init() docbook comm..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=144269e8080000
kernel config: https://syzkaller.appspot.com/x/.config?x=f21890d74080ef72
dashboard link: https://syzkaller.appspot.com/bug?extid=2e3efb5eb71cb5075ba7
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
patch: https://syzkaller.appspot.com/x/patch.diff?x=1461c9a7f00000
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [syzbot] WARNING: ODEBUG bug in route4_destroy
[not found] <20220616104752.2392-1-hdanton@sina.com>
@ 2022-06-16 10:59 ` syzbot
0 siblings, 0 replies; 12+ messages in thread
From: syzbot @ 2022-06-16 10:59 UTC (permalink / raw)
To: hdanton, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: use-after-free Read in route4_destroy
==================================================================
BUG: KASAN: use-after-free in route4_destroy+0x82b/0x9a0 net/sched/cls_route.c:302
Read of size 8 at addr ffff88801f531d00 by task syz-executor.0/4165
CPU: 1 PID: 4165 Comm: syz-executor.0 Not tainted 5.19.0-rc2-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
print_address_description.constprop.0.cold+0xeb/0x495 mm/kasan/report.c:313
print_report mm/kasan/report.c:429 [inline]
kasan_report.cold+0xf4/0x1c6 mm/kasan/report.c:491
route4_destroy+0x82b/0x9a0 net/sched/cls_route.c:302
tcf_proto_destroy+0x6a/0x2d0 net/sched/cls_api.c:314
tcf_proto_put+0x8c/0xc0 net/sched/cls_api.c:326
tcf_chain_flush+0x21a/0x360 net/sched/cls_api.c:632
tcf_block_flush_all_chains net/sched/cls_api.c:1034 [inline]
__tcf_block_put+0x15a/0x510 net/sched/cls_api.c:1196
tcf_block_put_ext net/sched/cls_api.c:1396 [inline]
tcf_block_put+0xb3/0x100 net/sched/cls_api.c:1411
drr_destroy_qdisc+0x44/0x1d0 net/sched/sch_drr.c:455
qdisc_destroy+0xc4/0x4e0 net/sched/sch_generic.c:1067
qdisc_put+0xcd/0xe0 net/sched/sch_generic.c:1086
notify_and_destroy net/sched/sch_api.c:1012 [inline]
qdisc_graft+0xeb1/0x1270 net/sched/sch_api.c:1084
tc_modify_qdisc+0xbb7/0x1a00 net/sched/sch_api.c:1671
rtnetlink_rcv_msg+0x43a/0xc90 net/core/rtnetlink.c:6089
netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2501
netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
netlink_unicast+0x543/0x7f0 net/netlink/af_netlink.c:1345
netlink_sendmsg+0x917/0xe10 net/netlink/af_netlink.c:1921
sock_sendmsg_nosec net/socket.c:714 [inline]
sock_sendmsg+0xcf/0x120 net/socket.c:734
____sys_sendmsg+0x6eb/0x810 net/socket.c:2492
___sys_sendmsg+0xf3/0x170 net/socket.c:2546
__sys_sendmsg net/socket.c:2575 [inline]
__do_sys_sendmsg net/socket.c:2584 [inline]
__se_sys_sendmsg net/socket.c:2582 [inline]
__x64_sys_sendmsg+0x132/0x220 net/socket.c:2582
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0x80 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x46/0xb0
RIP: 0033:0x4665f9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f6148fc7188 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 000000000056bf80 RCX: 00000000004665f9
RDX: 0000000000000000 RSI: 0000000020000040 RDI: 0000000000000004
RBP: 00000000004bfcc4 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf80
R13: 00007ffdd1fe3e1f R14: 00007f6148fc7300 R15: 0000000000022000
</TASK>
Allocated by task 4161:
kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
kasan_set_track mm/kasan/common.c:45 [inline]
set_alloc_info mm/kasan/common.c:436 [inline]
____kasan_kmalloc mm/kasan/common.c:515 [inline]
____kasan_kmalloc mm/kasan/common.c:474 [inline]
__kasan_kmalloc+0xa9/0xd0 mm/kasan/common.c:524
kmalloc include/linux/slab.h:600 [inline]
kzalloc include/linux/slab.h:733 [inline]
route4_change+0x28c/0x2490 net/sched/cls_route.c:500
tc_new_tfilter+0x98d/0x2200 net/sched/cls_api.c:2148
rtnetlink_rcv_msg+0x946/0xc90 net/core/rtnetlink.c:6080
netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2501
netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
netlink_unicast+0x543/0x7f0 net/netlink/af_netlink.c:1345
netlink_sendmsg+0x917/0xe10 net/netlink/af_netlink.c:1921
sock_sendmsg_nosec net/socket.c:714 [inline]
sock_sendmsg+0xcf/0x120 net/socket.c:734
____sys_sendmsg+0x6eb/0x810 net/socket.c:2492
___sys_sendmsg+0xf3/0x170 net/socket.c:2546
__sys_sendmsg net/socket.c:2575 [inline]
__do_sys_sendmsg net/socket.c:2584 [inline]
__se_sys_sendmsg net/socket.c:2582 [inline]
__x64_sys_sendmsg+0x132/0x220 net/socket.c:2582
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0x80 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x46/0xb0
Freed by task 8:
kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
kasan_set_track+0x21/0x30 mm/kasan/common.c:45
kasan_set_free_info+0x20/0x30 mm/kasan/generic.c:370
____kasan_slab_free mm/kasan/common.c:366 [inline]
____kasan_slab_free+0x166/0x1a0 mm/kasan/common.c:328
kasan_slab_free include/linux/kasan.h:200 [inline]
slab_free_hook mm/slub.c:1727 [inline]
slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1753
slab_free mm/slub.c:3507 [inline]
kfree+0xd6/0x4d0 mm/slub.c:4555
__route4_delete_filter net/sched/cls_route.c:262 [inline]
route4_delete_filter_work+0xb0/0xf0 net/sched/cls_route.c:271
process_one_work+0x996/0x1610 kernel/workqueue.c:2289
worker_thread+0x665/0x1080 kernel/workqueue.c:2436
kthread+0x2e9/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302
Last potentially related work creation:
kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
__kasan_record_aux_stack+0xbe/0xd0 mm/kasan/generic.c:348
insert_work+0x48/0x350 kernel/workqueue.c:1358
__queue_work+0x62f/0x1150 kernel/workqueue.c:1517
rcu_work_rcufn+0x58/0x80 kernel/workqueue.c:1754
rcu_do_batch kernel/rcu/tree.c:2578 [inline]
rcu_core+0x7b1/0x1880 kernel/rcu/tree.c:2838
__do_softirq+0x29b/0x9c2 kernel/softirq.c:571
Second to last potentially related work creation:
kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
__kasan_record_aux_stack+0xbe/0xd0 mm/kasan/generic.c:348
call_rcu+0x99/0x790 kernel/rcu/tree.c:3126
queue_rcu_work+0x82/0xa0 kernel/workqueue.c:1774
route4_queue_work+0x46/0x50 net/sched/cls_route.c:279
route4_change+0x19e5/0x2490 net/sched/cls_route.c:557
tc_new_tfilter+0x98d/0x2200 net/sched/cls_api.c:2148
rtnetlink_rcv_msg+0x946/0xc90 net/core/rtnetlink.c:6080
netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2501
netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
netlink_unicast+0x543/0x7f0 net/netlink/af_netlink.c:1345
netlink_sendmsg+0x917/0xe10 net/netlink/af_netlink.c:1921
sock_sendmsg_nosec net/socket.c:714 [inline]
sock_sendmsg+0xcf/0x120 net/socket.c:734
____sys_sendmsg+0x6eb/0x810 net/socket.c:2492
___sys_sendmsg+0xf3/0x170 net/socket.c:2546
__sys_sendmsg net/socket.c:2575 [inline]
__do_sys_sendmsg net/socket.c:2584 [inline]
__se_sys_sendmsg net/socket.c:2582 [inline]
__x64_sys_sendmsg+0x132/0x220 net/socket.c:2582
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0x80 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x46/0xb0
The buggy address belongs to the object at ffff88801f531d00
which belongs to the cache kmalloc-192 of size 192
The buggy address is located 0 bytes inside of
192-byte region [ffff88801f531d00, ffff88801f531dc0)
The buggy address belongs to the physical page:
page:ffffea00007d4c40 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1f531
flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000200 ffffea00007d2200 dead000000000002 ffff888010c41a00
raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 1, tgid 1 (swapper/0), ts 7564804891, free_ts 7198223118
prep_new_page mm/page_alloc.c:2456 [inline]
get_page_from_freelist+0x1290/0x3b70 mm/page_alloc.c:4198
__alloc_pages+0x1c7/0x510 mm/page_alloc.c:5426
alloc_page_interleave+0x1e/0x200 mm/mempolicy.c:2105
alloc_pages+0x2b1/0x310 mm/mempolicy.c:2267
alloc_slab_page mm/slub.c:1797 [inline]
allocate_slab+0x26c/0x3c0 mm/slub.c:1942
new_slab mm/slub.c:2002 [inline]
___slab_alloc+0x985/0xd90 mm/slub.c:3002
__slab_alloc.constprop.0+0x4d/0xa0 mm/slub.c:3089
slab_alloc_node mm/slub.c:3180 [inline]
slab_alloc mm/slub.c:3222 [inline]
kmem_cache_alloc_trace+0x310/0x3f0 mm/slub.c:3253
kmalloc include/linux/slab.h:600 [inline]
__usb_create_hcd+0x7af/0xa70 drivers/usb/core/hcd.c:2588
vhci_hcd_probe+0xfb/0x3a0 drivers/usb/usbip/vhci_hcd.c:1351
platform_probe+0xfc/0x1f0 drivers/base/platform.c:1400
call_driver_probe drivers/base/dd.c:555 [inline]
really_probe+0x23e/0xb90 drivers/base/dd.c:634
__driver_probe_device+0x338/0x4d0 drivers/base/dd.c:764
driver_probe_device+0x4c/0x1a0 drivers/base/dd.c:794
__device_attach_driver+0x20b/0x2f0 drivers/base/dd.c:917
bus_for_each_drv+0x15f/0x1e0 drivers/base/bus.c:427
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1371 [inline]
free_pcp_prepare+0x549/0xd20 mm/page_alloc.c:1421
free_unref_page_prepare mm/page_alloc.c:3343 [inline]
free_unref_page+0x19/0x6a0 mm/page_alloc.c:3438
__vunmap+0x85d/0xd30 mm/vmalloc.c:2665
free_work+0x58/0x70 mm/vmalloc.c:97
process_one_work+0x996/0x1610 kernel/workqueue.c:2289
worker_thread+0x665/0x1080 kernel/workqueue.c:2436
kthread+0x2e9/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302
Memory state around the buggy address:
ffff88801f531c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff88801f531c80: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc
>ffff88801f531d00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88801f531d80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
ffff88801f531e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
Tested on:
commit: 018ab4fa netfs: fix up netfs_inode_init() docbook comm..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=12b25a7ff00000
kernel config: https://syzkaller.appspot.com/x/.config?x=f21890d74080ef72
dashboard link: https://syzkaller.appspot.com/bug?extid=2e3efb5eb71cb5075ba7
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
patch: https://syzkaller.appspot.com/x/patch.diff?x=17eb91a7f00000
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [syzbot] WARNING: ODEBUG bug in route4_destroy
[not found] <20220615140453.2269-1-hdanton@sina.com>
@ 2022-06-15 14:27 ` syzbot
0 siblings, 0 replies; 12+ messages in thread
From: syzbot @ 2022-06-15 14:27 UTC (permalink / raw)
To: hdanton, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
WARNING: ODEBUG bug in route4_destroy
------------[ cut here ]------------
ODEBUG: activate active (active state 1) object type: rcu_head hint: 0x0
WARNING: CPU: 1 PID: 4134 at lib/debugobjects.c:502 debug_print_object+0x16e/0x250 lib/debugobjects.c:502
Modules linked in:
CPU: 0 PID: 4134 Comm: syz-executor.0 Not tainted 5.19.0-rc2-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:debug_print_object+0x16e/0x250 lib/debugobjects.c:502
Code: ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 af 00 00 00 48 8b 14 dd e0 c5 27 8a 4c 89 ee 48 c7 c7 c0 b9 27 8a e8 f6 1b 30 05 <0f> 0b 83 05 35 22 c5 09 01 48 83 c4 18 5b 5d 41 5c 41 5d 41 5e c3
RSP: 0018:ffffc900031befb0 EFLAGS: 00010286
RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000000
RDX: ffff888025440000 RSI: ffffffff815fcd08 RDI: fffff52000637de8
RBP: 0000000000000001 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000080000000 R11: 0000000000000001 R12: ffffffff89cde060
R13: ffffffff8a27c080 R14: 0000000000000000 R15: ffffffff89cde060
FS: 00007f1daf655700(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f1daf634718 CR3: 0000000024a07000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
debug_object_activate+0x2da/0x3e0 lib/debugobjects.c:674
debug_rcu_head_queue kernel/rcu/rcu.h:178 [inline]
call_rcu+0x2c/0x790 kernel/rcu/tree.c:3111
queue_rcu_work+0x82/0xa0 kernel/workqueue.c:1774
route4_queue_work net/sched/cls_route.c:279 [inline]
route4_destroy+0x4e7/0x9d0 net/sched/cls_route.c:306
tcf_proto_destroy+0x6a/0x2d0 net/sched/cls_api.c:314
tcf_proto_put+0x8c/0xc0 net/sched/cls_api.c:326
tcf_chain_flush+0x21a/0x360 net/sched/cls_api.c:632
tcf_block_flush_all_chains net/sched/cls_api.c:1034 [inline]
__tcf_block_put+0x15a/0x510 net/sched/cls_api.c:1196
tcf_block_put_ext net/sched/cls_api.c:1396 [inline]
tcf_block_put+0xb3/0x100 net/sched/cls_api.c:1411
drr_destroy_qdisc+0x44/0x1d0 net/sched/sch_drr.c:455
qdisc_destroy+0xc4/0x4e0 net/sched/sch_generic.c:1067
qdisc_put+0xcd/0xe0 net/sched/sch_generic.c:1086
notify_and_destroy net/sched/sch_api.c:1012 [inline]
qdisc_graft+0xeb1/0x1270 net/sched/sch_api.c:1084
tc_modify_qdisc+0xbb7/0x1a00 net/sched/sch_api.c:1671
rtnetlink_rcv_msg+0x43a/0xc90 net/core/rtnetlink.c:6089
netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2501
netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
netlink_unicast+0x543/0x7f0 net/netlink/af_netlink.c:1345
netlink_sendmsg+0x917/0xe10 net/netlink/af_netlink.c:1921
sock_sendmsg_nosec net/socket.c:714 [inline]
sock_sendmsg+0xcf/0x120 net/socket.c:734
____sys_sendmsg+0x6eb/0x810 net/socket.c:2492
___sys_sendmsg+0xf3/0x170 net/socket.c:2546
__sys_sendmsg net/socket.c:2575 [inline]
__do_sys_sendmsg net/socket.c:2584 [inline]
__se_sys_sendmsg net/socket.c:2582 [inline]
__x64_sys_sendmsg+0x132/0x220 net/socket.c:2582
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0x80 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x46/0xb0
RIP: 0033:0x4665f9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f1daf655188 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 000000000056bf80 RCX: 00000000004665f9
RDX: 0000000000000000 RSI: 0000000020000040 RDI: 0000000000000004
RBP: 00000000004bfcc4 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf80
R13: 00007ffc31782fcf R14: 00007f1daf655300 R15: 0000000000022000
</TASK>
Tested on:
commit: 018ab4fa netfs: fix up netfs_inode_init() docbook comm..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=107ff687f00000
kernel config: https://syzkaller.appspot.com/x/.config?x=f21890d74080ef72
dashboard link: https://syzkaller.appspot.com/bug?extid=2e3efb5eb71cb5075ba7
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
patch: https://syzkaller.appspot.com/x/patch.diff?x=1703e12ff00000
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [syzbot] WARNING: ODEBUG bug in route4_destroy
[not found] <20220615121701.2143-1-hdanton@sina.com>
@ 2022-06-15 12:32 ` syzbot
0 siblings, 0 replies; 12+ messages in thread
From: syzbot @ 2022-06-15 12:32 UTC (permalink / raw)
To: hdanton, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: use-after-free Read in route4_destroy
==================================================================
BUG: KASAN: use-after-free in route4_destroy+0x861/0x9d0 net/sched/cls_route.c:302
Read of size 8 at addr ffff888021de7700 by task syz-executor.0/4141
CPU: 1 PID: 4141 Comm: syz-executor.0 Not tainted 5.19.0-rc2-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
print_address_description.constprop.0.cold+0xeb/0x495 mm/kasan/report.c:313
print_report mm/kasan/report.c:429 [inline]
kasan_report.cold+0xf4/0x1c6 mm/kasan/report.c:491
route4_destroy+0x861/0x9d0 net/sched/cls_route.c:302
tcf_proto_destroy+0x6a/0x2d0 net/sched/cls_api.c:314
tcf_proto_put+0x8c/0xc0 net/sched/cls_api.c:326
tcf_chain_flush+0x21a/0x360 net/sched/cls_api.c:632
tcf_block_flush_all_chains net/sched/cls_api.c:1034 [inline]
__tcf_block_put+0x15a/0x510 net/sched/cls_api.c:1196
tcf_block_put_ext net/sched/cls_api.c:1396 [inline]
tcf_block_put+0xb3/0x100 net/sched/cls_api.c:1411
drr_destroy_qdisc+0x44/0x1d0 net/sched/sch_drr.c:455
qdisc_destroy+0xc4/0x4e0 net/sched/sch_generic.c:1067
qdisc_put+0xcd/0xe0 net/sched/sch_generic.c:1086
notify_and_destroy net/sched/sch_api.c:1012 [inline]
qdisc_graft+0xeb1/0x1270 net/sched/sch_api.c:1084
tc_modify_qdisc+0xbb7/0x1a00 net/sched/sch_api.c:1671
rtnetlink_rcv_msg+0x43a/0xc90 net/core/rtnetlink.c:6089
netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2501
netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
netlink_unicast+0x543/0x7f0 net/netlink/af_netlink.c:1345
netlink_sendmsg+0x917/0xe10 net/netlink/af_netlink.c:1921
sock_sendmsg_nosec net/socket.c:714 [inline]
sock_sendmsg+0xcf/0x120 net/socket.c:734
____sys_sendmsg+0x6eb/0x810 net/socket.c:2492
___sys_sendmsg+0xf3/0x170 net/socket.c:2546
__sys_sendmsg net/socket.c:2575 [inline]
__do_sys_sendmsg net/socket.c:2584 [inline]
__se_sys_sendmsg net/socket.c:2582 [inline]
__x64_sys_sendmsg+0x132/0x220 net/socket.c:2582
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0x80 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x46/0xb0
RIP: 0033:0x4665f9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f157e77d188 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 000000000056bf80 RCX: 00000000004665f9
RDX: 0000000000000000 RSI: 0000000020000040 RDI: 0000000000000004
RBP: 00000000004bfcc4 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf80
R13: 00007ffd57f086af R14: 00007f157e77d300 R15: 0000000000022000
</TASK>
Allocated by task 4137:
kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
kasan_set_track mm/kasan/common.c:45 [inline]
set_alloc_info mm/kasan/common.c:436 [inline]
____kasan_kmalloc mm/kasan/common.c:515 [inline]
____kasan_kmalloc mm/kasan/common.c:474 [inline]
__kasan_kmalloc+0xa9/0xd0 mm/kasan/common.c:524
kmalloc include/linux/slab.h:600 [inline]
kzalloc include/linux/slab.h:733 [inline]
route4_change+0x28c/0x24a0 net/sched/cls_route.c:500
tc_new_tfilter+0x98d/0x2200 net/sched/cls_api.c:2148
rtnetlink_rcv_msg+0x946/0xc90 net/core/rtnetlink.c:6080
netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2501
netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
netlink_unicast+0x543/0x7f0 net/netlink/af_netlink.c:1345
netlink_sendmsg+0x917/0xe10 net/netlink/af_netlink.c:1921
sock_sendmsg_nosec net/socket.c:714 [inline]
sock_sendmsg+0xcf/0x120 net/socket.c:734
____sys_sendmsg+0x6eb/0x810 net/socket.c:2492
___sys_sendmsg+0xf3/0x170 net/socket.c:2546
__sys_sendmsg net/socket.c:2575 [inline]
__do_sys_sendmsg net/socket.c:2584 [inline]
__se_sys_sendmsg net/socket.c:2582 [inline]
__x64_sys_sendmsg+0x132/0x220 net/socket.c:2582
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0x80 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x46/0xb0
Freed by task 42:
kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
kasan_set_track+0x21/0x30 mm/kasan/common.c:45
kasan_set_free_info+0x20/0x30 mm/kasan/generic.c:370
____kasan_slab_free mm/kasan/common.c:366 [inline]
____kasan_slab_free+0x166/0x1a0 mm/kasan/common.c:328
kasan_slab_free include/linux/kasan.h:200 [inline]
slab_free_hook mm/slub.c:1727 [inline]
slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1753
slab_free mm/slub.c:3507 [inline]
kfree+0xd6/0x4d0 mm/slub.c:4555
__route4_delete_filter net/sched/cls_route.c:262 [inline]
route4_delete_filter_work+0xb0/0xf0 net/sched/cls_route.c:271
process_one_work+0x996/0x1610 kernel/workqueue.c:2289
worker_thread+0x665/0x1080 kernel/workqueue.c:2436
kthread+0x2e9/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302
Last potentially related work creation:
kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
__kasan_record_aux_stack+0xbe/0xd0 mm/kasan/generic.c:348
insert_work+0x48/0x350 kernel/workqueue.c:1358
__queue_work+0x62f/0x1150 kernel/workqueue.c:1517
rcu_work_rcufn+0x58/0x80 kernel/workqueue.c:1754
rcu_do_batch kernel/rcu/tree.c:2578 [inline]
rcu_core+0x7b1/0x1880 kernel/rcu/tree.c:2838
__do_softirq+0x29b/0x9c2 kernel/softirq.c:571
Second to last potentially related work creation:
kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
__kasan_record_aux_stack+0xbe/0xd0 mm/kasan/generic.c:348
call_rcu+0x99/0x790 kernel/rcu/tree.c:3126
queue_rcu_work+0x82/0xa0 kernel/workqueue.c:1774
route4_change+0x19ed/0x24a0 net/sched/cls_route.c:557
tc_new_tfilter+0x98d/0x2200 net/sched/cls_api.c:2148
rtnetlink_rcv_msg+0x946/0xc90 net/core/rtnetlink.c:6080
netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2501
netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
netlink_unicast+0x543/0x7f0 net/netlink/af_netlink.c:1345
netlink_sendmsg+0x917/0xe10 net/netlink/af_netlink.c:1921
sock_sendmsg_nosec net/socket.c:714 [inline]
sock_sendmsg+0xcf/0x120 net/socket.c:734
____sys_sendmsg+0x6eb/0x810 net/socket.c:2492
___sys_sendmsg+0xf3/0x170 net/socket.c:2546
__sys_sendmsg net/socket.c:2575 [inline]
__do_sys_sendmsg net/socket.c:2584 [inline]
__se_sys_sendmsg net/socket.c:2582 [inline]
__x64_sys_sendmsg+0x132/0x220 net/socket.c:2582
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0x80 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x46/0xb0
The buggy address belongs to the object at ffff888021de7700
which belongs to the cache kmalloc-192 of size 192
The buggy address is located 0 bytes inside of
192-byte region [ffff888021de7700, ffff888021de77c0)
The buggy address belongs to the physical page:
page:ffffea00008779c0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x21de7
flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000200 ffffea0000841500 dead000000000003 ffff888010c41a00
raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 1, tgid 1 (swapper/0), ts 10074698598, free_ts 0
prep_new_page mm/page_alloc.c:2456 [inline]
get_page_from_freelist+0x1290/0x3b70 mm/page_alloc.c:4198
__alloc_pages+0x1c7/0x510 mm/page_alloc.c:5426
alloc_page_interleave+0x1e/0x200 mm/mempolicy.c:2105
alloc_pages+0x2b1/0x310 mm/mempolicy.c:2267
alloc_slab_page mm/slub.c:1797 [inline]
allocate_slab+0x26c/0x3c0 mm/slub.c:1942
new_slab mm/slub.c:2002 [inline]
___slab_alloc+0x985/0xd90 mm/slub.c:3002
__slab_alloc.constprop.0+0x4d/0xa0 mm/slub.c:3089
slab_alloc_node mm/slub.c:3180 [inline]
slab_alloc mm/slub.c:3222 [inline]
kmem_cache_alloc_trace+0x310/0x3f0 mm/slub.c:3253
kmalloc include/linux/slab.h:600 [inline]
kzalloc include/linux/slab.h:733 [inline]
call_usermodehelper_setup+0x97/0x340 kernel/umh.c:365
kobject_uevent_env+0xefa/0x1660 lib/kobject_uevent.c:614
driver_register+0x2db/0x3a0 drivers/base/driver.c:248
usb_register_driver+0x249/0x460 drivers/usb/core/driver.c:1062
do_one_initcall+0x103/0x650 init/main.c:1295
do_initcall_level init/main.c:1368 [inline]
do_initcalls init/main.c:1384 [inline]
do_basic_setup init/main.c:1403 [inline]
kernel_init_freeable+0x6b1/0x73a init/main.c:1610
kernel_init+0x1a/0x1d0 init/main.c:1499
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302
page_owner free stack trace missing
Memory state around the buggy address:
ffff888021de7600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff888021de7680: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
>ffff888021de7700: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888021de7780: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
ffff888021de7800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
Tested on:
commit: 018ab4fa netfs: fix up netfs_inode_init() docbook comm..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=12a20787f00000
kernel config: https://syzkaller.appspot.com/x/.config?x=f21890d74080ef72
dashboard link: https://syzkaller.appspot.com/bug?extid=2e3efb5eb71cb5075ba7
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
patch: https://syzkaller.appspot.com/x/patch.diff?x=14dcf608080000
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [syzbot] WARNING: ODEBUG bug in route4_destroy
[not found] <20220615104440.1997-1-hdanton@sina.com>
@ 2022-06-15 10:55 ` syzbot
0 siblings, 0 replies; 12+ messages in thread
From: syzbot @ 2022-06-15 10:55 UTC (permalink / raw)
To: hdanton, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
WARNING: ODEBUG bug in route4_destroy
------------[ cut here ]------------
ODEBUG: activate active (active state 1) object type: rcu_head hint: 0x0
WARNING: CPU: 0 PID: 4132 at lib/debugobjects.c:502 debug_print_object+0x16e/0x250 lib/debugobjects.c:502
Modules linked in:
CPU: 0 PID: 4132 Comm: syz-executor.0 Not tainted 5.19.0-rc2-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:debug_print_object+0x16e/0x250 lib/debugobjects.c:502
Code: ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 af 00 00 00 48 8b 14 dd e0 c5 27 8a 4c 89 ee 48 c7 c7 c0 b9 27 8a e8 f6 1b 30 05 <0f> 0b 83 05 35 22 c5 09 01 48 83 c4 18 5b 5d 41 5c 41 5d 41 5e c3
RSP: 0018:ffffc9000339efb0 EFLAGS: 00010286
RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000000
RDX: ffff8880221057c0 RSI: ffffffff815fcd08 RDI: fffff52000673de8
RBP: 0000000000000001 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000080000000 R11: 0000000000000001 R12: ffffffff89cde060
R13: ffffffff8a27c080 R14: 0000000000000000 R15: ffffffff89cde060
FS: 00007fd48e521700(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fd48e500718 CR3: 000000001b202000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
debug_object_activate+0x2da/0x3e0 lib/debugobjects.c:674
debug_rcu_head_queue kernel/rcu/rcu.h:178 [inline]
call_rcu+0x2c/0x790 kernel/rcu/tree.c:3111
queue_rcu_work+0x82/0xa0 kernel/workqueue.c:1774
route4_queue_work net/sched/cls_route.c:272 [inline]
route4_destroy+0x4b9/0x9a0 net/sched/cls_route.c:299
tcf_proto_destroy+0x6a/0x2d0 net/sched/cls_api.c:314
tcf_proto_put+0x8c/0xc0 net/sched/cls_api.c:326
tcf_chain_flush+0x21a/0x360 net/sched/cls_api.c:632
tcf_block_flush_all_chains net/sched/cls_api.c:1034 [inline]
__tcf_block_put+0x15a/0x510 net/sched/cls_api.c:1196
tcf_block_put_ext net/sched/cls_api.c:1396 [inline]
tcf_block_put+0xb3/0x100 net/sched/cls_api.c:1411
drr_destroy_qdisc+0x44/0x1d0 net/sched/sch_drr.c:455
qdisc_destroy+0xc4/0x4e0 net/sched/sch_generic.c:1067
qdisc_put+0xcd/0xe0 net/sched/sch_generic.c:1086
notify_and_destroy net/sched/sch_api.c:1012 [inline]
qdisc_graft+0xeb1/0x1270 net/sched/sch_api.c:1084
tc_modify_qdisc+0xbb7/0x1a00 net/sched/sch_api.c:1671
rtnetlink_rcv_msg+0x43a/0xc90 net/core/rtnetlink.c:6089
netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2501
netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
netlink_unicast+0x543/0x7f0 net/netlink/af_netlink.c:1345
netlink_sendmsg+0x917/0xe10 net/netlink/af_netlink.c:1921
sock_sendmsg_nosec net/socket.c:714 [inline]
sock_sendmsg+0xcf/0x120 net/socket.c:734
____sys_sendmsg+0x6eb/0x810 net/socket.c:2492
___sys_sendmsg+0xf3/0x170 net/socket.c:2546
__sys_sendmsg net/socket.c:2575 [inline]
__do_sys_sendmsg net/socket.c:2584 [inline]
__se_sys_sendmsg net/socket.c:2582 [inline]
__x64_sys_sendmsg+0x132/0x220 net/socket.c:2582
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0x80 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x46/0xb0
RIP: 0033:0x4665f9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fd48e521188 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 000000000056bf80 RCX: 00000000004665f9
RDX: 0000000000000000 RSI: 0000000020000040 RDI: 0000000000000004
RBP: 00000000004bfcc4 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf80
R13: 00007ffefe84a09f R14: 00007fd48e521300 R15: 0000000000022000
</TASK>
Tested on:
commit: 018ab4fa netfs: fix up netfs_inode_init() docbook comm..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=169cf608080000
kernel config: https://syzkaller.appspot.com/x/.config?x=f21890d74080ef72
dashboard link: https://syzkaller.appspot.com/bug?extid=2e3efb5eb71cb5075ba7
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
Note: no patches were applied.
^ permalink raw reply [flat|nested] 12+ messages in thread
end of thread, other threads:[~2022-06-16 16:16 UTC | newest]
Thread overview: 12+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-09-04 16:46 [syzbot] WARNING: ODEBUG bug in route4_destroy syzbot
2022-06-14 14:35 ` Zhen Chen
2022-06-14 14:46 ` Dan Carpenter
2022-06-15 11:57 ` Zhen Chen
[not found] <20220615104440.1997-1-hdanton@sina.com>
2022-06-15 10:55 ` syzbot
[not found] <20220615121701.2143-1-hdanton@sina.com>
2022-06-15 12:32 ` syzbot
[not found] <20220615140453.2269-1-hdanton@sina.com>
2022-06-15 14:27 ` syzbot
[not found] <20220616104752.2392-1-hdanton@sina.com>
2022-06-16 10:59 ` syzbot
[not found] <20220616112635.2462-1-hdanton@sina.com>
2022-06-16 11:42 ` syzbot
[not found] <20220616121345.2536-1-hdanton@sina.com>
2022-06-16 12:26 ` syzbot
[not found] <20220616123726.2597-1-hdanton@sina.com>
2022-06-16 12:56 ` syzbot
[not found] <20220616132136.2669-1-hdanton@sina.com>
2022-06-16 16:16 ` syzbot
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.