From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <SRS0=wNtT=Y5=kvack.org=owner-linux-mm@kernel.org>
X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on
	aws-us-west-2-korg-lkml-1.web.codeaurora.org
X-Spam-Level: 
X-Spam-Status: No, score=-2.2 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS,
	MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,USER_AGENT_SANE_1 autolearn=no
	autolearn_force=no version=3.4.0
Received: from mail.kernel.org (mail.kernel.org [198.145.29.99])
	by smtp.lore.kernel.org (Postfix) with ESMTP id 84DBBCA9ED9
	for <linux-mm@archiver.kernel.org>; Tue,  5 Nov 2019 08:06:03 +0000 (UTC)
Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17])
	by mail.kernel.org (Postfix) with ESMTP id 355FF214D8
	for <linux-mm@archiver.kernel.org>; Tue,  5 Nov 2019 08:06:03 +0000 (UTC)
DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 355FF214D8
Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=clip-os.org
Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org
Received: by kanga.kvack.org (Postfix)
	id C2ED16B0003; Tue,  5 Nov 2019 03:06:02 -0500 (EST)
Received: by kanga.kvack.org (Postfix, from userid 40)
	id BDF276B0006; Tue,  5 Nov 2019 03:06:02 -0500 (EST)
X-Delivered-To: int-list-linux-mm@kvack.org
Received: by kanga.kvack.org (Postfix, from userid 63042)
	id B1B126B0007; Tue,  5 Nov 2019 03:06:02 -0500 (EST)
X-Delivered-To: linux-mm@kvack.org
Received: from forelay.hostedemail.com (smtprelay0249.hostedemail.com [216.40.44.249])
	by kanga.kvack.org (Postfix) with ESMTP id 9C56A6B0003
	for <linux-mm@kvack.org>; Tue,  5 Nov 2019 03:06:02 -0500 (EST)
Received: from smtpin01.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251])
	by forelay03.hostedemail.com (Postfix) with SMTP id 0BECD824999B
	for <linux-mm@kvack.org>; Tue,  5 Nov 2019 08:06:02 +0000 (UTC)
X-FDA: 76121490564.01.corn58_177e942df2745
X-HE-Tag: corn58_177e942df2745
X-Filterd-Recvd-Size: 2046
Received: from relay10.mail.gandi.net (relay10.mail.gandi.net [217.70.178.230])
	by imf24.hostedemail.com (Postfix) with ESMTP
	for <linux-mm@kvack.org>; Tue,  5 Nov 2019 08:06:01 +0000 (UTC)
Received: from gandi.net (laubervilliers-658-1-215-187.w90-63.abo.wanadoo.fr [90.63.246.187])
	(Authenticated sender: thibaut.sautereau@clip-os.org)
	by relay10.mail.gandi.net (Postfix) with ESMTPSA id 3CD66240008;
	Tue,  5 Nov 2019 08:05:54 +0000 (UTC)
Date: Tue, 5 Nov 2019 09:05:54 +0100
From: Thibaut Sautereau <thibaut.sautereau@clip-os.org>
To: Eric Dumazet <eric.dumazet@gmail.com>
Cc: netdev@vger.kernel.org, linux-mm@kvack.org,
	linux-kernel@vger.kernel.org,
	"David S. Miller" <davem@davemloft.net>,
	Laura Abbott <labbott@redhat.com>,
	Kees Cook <keescook@chromium.org>,
	Alexander Potapenko <glider@google.com>,
	Andrew Morton <akpm@linux-foundation.org>, clipos@ssi.gouv.fr
Subject: Re: Double free of struct sk_buff reported by
 SLAB_CONSISTENCY_CHECKS with init_on_free
Message-ID: <20191105080554.GA1006@gandi.net>
References: <20191104170303.GA50361@gandi.net>
 <719eebd3-259d-8beb-025a-f2d17c632711@gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
In-Reply-To: <719eebd3-259d-8beb-025a-f2d17c632711@gmail.com>
User-Agent: Mutt/1.12.2 (2019-09-21)
X-Bogosity: Ham, tests=bogofilter, spamicity=0.026610, version=1.2.4
Sender: owner-linux-mm@kvack.org
Precedence: bulk
X-Loop: owner-majordomo@kvack.org
List-ID: <linux-mm.kvack.org>

On Mon, Nov 04, 2019 at 09:33:18AM -0800, Eric Dumazet wrote:
> 
> 
> On 11/4/19 9:03 AM, Thibaut Sautereau wrote:
> > 
> > We first encountered this issue under huge network traffic (system image
> > download), and I was able to reproduce by simply sending a big packet
> > with `ping -s 65507 <ip>`, which crashes the kernel every single time.
> > 
> 
> Since you have a repro, could you start a bisection ?

>From my previous email:

	"Bisection points to the following commit: 1b7e816fc80e ("mm: slub:
	Fix slab walking for init_on_free"), and indeed the BUG is not
	triggered when init_on_free is disabled."

Or are you meaning something else?

-- 
Thibaut Sautereau
CLIP OS developer