From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-1.0 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_PASS autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 07A42C282C2 for ; Sun, 10 Feb 2019 15:51:28 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id D2DEB20844 for ; Sun, 10 Feb 2019 15:51:27 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726869AbfBJPv1 (ORCPT ); Sun, 10 Feb 2019 10:51:27 -0500 Received: from shadbolt.e.decadent.org.uk ([88.96.1.126]:57682 "EHLO shadbolt.e.decadent.org.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726154AbfBJPv0 (ORCPT ); Sun, 10 Feb 2019 10:51:26 -0500 Received: from [192.168.4.242] (helo=deadeye) by shadbolt.decadent.org.uk with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.89) (envelope-from ) id 1gsrO8-0005Nt-U4; Sun, 10 Feb 2019 15:51:25 +0000 Received: from ben by deadeye with local (Exim 4.92-RC5) (envelope-from ) id 1gsrO8-0003vw-O5; Sun, 10 Feb 2019 15:51:24 +0000 Message-ID: Subject: Re: tc qdisc kernel crash From: Ben Hutchings To: netdev Cc: 921542@bugs.debian.org, Adrian Date: Sun, 10 Feb 2019 15:51:20 +0000 In-Reply-To: <154947154317.4485.11268926035712969198.reportbug@Telenet-PC> References: <154947154317.4485.11268926035712969198.reportbug@Telenet-PC> Content-Type: multipart/signed; micalg="pgp-sha512"; protocol="application/pgp-signature"; boundary="=-6eBq+MBmjz4IKMVAZGyh" User-Agent: Evolution 3.30.4-1 Mime-Version: 1.0 X-SA-Exim-Connect-IP: 192.168.4.242 X-SA-Exim-Mail-From: ben@decadent.org.uk X-SA-Exim-Scanned: No (on shadbolt.decadent.org.uk); SAEximRunCond expanded to false Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org --=-6eBq+MBmjz4IKMVAZGyh Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Control: tag -1 confirmed upstream Control: found -1 4.20-1~exp1 Adrian (cc'd) reported (https://bugs.debian.org/921542) that a script using tc could trigger a kernel crash. I've simplified the script he provided down to: --- BEGIN --- #!/bin/sh -ex modprobe ifb while true; do tc qdisc add dev ifb0 root handle 2:0 prio bands 5 tc qdisc add dev ifb0 parent 2:5 sfq tc filter add dev ifb0 parent 2:0 protocol ip prio 5 handle 0 tcindex m= ask 0 classid 2:5 pass_on tc qdisc del dev ifb0 root || true done --- END --- The crash is still reproducible in 4.20 and 5.0-rc5. KASan shows a use-after-free: + modprobe ifb + true + tc qdisc add dev ifb0 root handle 2:0 prio bands 5 + tc qdisc add dev ifb0 parent 2:5 sfq + tc filter add dev ifb0 parent 2:0 protocol ip prio 5 handle 0 tcindex mas= k 0 classid 2:5 pass_on + tc qdisc del dev ifb0 root + true + tc qdisc add dev ifb0 root handle 2:0 prio bands 5 [ 63.926983] =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D [ 63.929429] BUG: KASAN: use-after-free in worker_thread+0x327/0x5b0 [ 63.931489] Read of size 8 at addr ffff88804fd22130 by task kworker/u8:1= /32 [ 63.933766] [ 63.934397] CPU: 0 PID: 32 Comm: kworker/u8:1 Not tainted 5.0.0-rc5 #3 [ 63.936629] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS = 1.12.0-1 04/01/2014 [ 63.939537] Workqueue: (null) (events_unbound) [ 63.942039] Call Trace: [ 63.943187] dump_stack+0x71/0xa0 [ 63.944386] ? worker_thread+0x327/0x5b0 [ 63.945881] print_address_description+0x65/0x22e [ 63.947980] ? worker_thread+0x327/0x5b0 [ 63.949588] ? worker_thread+0x327/0x5b0 [ 63.951254] kasan_report.cold.3+0x1a/0x40 [ 63.953036] ? worker_thread+0x327/0x5b0 [ 63.954692] worker_thread+0x327/0x5b0 [ 63.956236] ? flush_rcu_work+0x40/0x40 [ 63.957722] kthread+0x1ae/0x1d0 [ 63.959067] ? __kthread_parkme+0x90/0x90 [ 63.960451] ret_from_fork+0x35/0x40 [ 63.962020] [ 63.962817] Allocated by task 757: [ 63.964465] __kasan_kmalloc.constprop.13+0xc1/0xd0 [ 63.966670] tcindex_alloc_perfect_hash+0x37/0x150 [cls_tcindex] [ 63.969287] tcindex_set_parms+0xb38/0xd30 [cls_tcindex] [ 63.972539] tcindex_change+0x13d/0x1c2 [cls_tcindex] [ 63.974796] tc_new_tfilter+0x7ec/0xaf0 [ 63.976546] rtnetlink_rcv_msg+0x35c/0x490 [ 63.978302] netlink_rcv_skb+0xc6/0x1f0 [ 63.980050] netlink_unicast+0x309/0x3d0 [ 63.981990] netlink_sendmsg+0x37d/0x5e0 [ 63.983849] sock_sendmsg+0x6d/0x80 [ 63.985538] ___sys_sendmsg+0x46a/0x4e0 [ 63.987328] __sys_sendmsg+0xd3/0x160 [ 63.988974] do_syscall_64+0x73/0x140 [ 63.990616] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 63.992538] [ 63.993430] Freed by task 9: [ 63.994660] __kasan_slab_free+0x125/0x170 [ 63.996239] kfree+0x90/0x1d0 [ 63.997496] __tcindex_destroy+0x1f/0x40 [cls_tcindex] [ 63.999316] rcu_process_callbacks+0x3cb/0x650 [ 64.000889] __do_softirq+0x115/0x3b4 [ 64.003254] [ 64.004138] The buggy address belongs to the object at ffff88804fd22100 [ 64.004138] which belongs to the cache kmalloc-8k of size 8192 [ 64.009001] The buggy address is located 48 bytes inside of [ 64.009001] 8192-byte region [ffff88804fd22100, ffff88804fd24100) [ 64.013752] The buggy address belongs to the page: [ 64.015906] page:ffffea00013f4800 count:1 mapcount:0 mapping:ffff8880510= 02700 index:0x0 compound_mapcount: 0 [ 64.020237] flags: 0xffffc000010200(slab|head) [ 64.022176] raw: 00ffffc000010200 dead000000000100 dead000000000200 ffff= 888051002700 [ 64.025247] raw: 0000000000000000 0000000080030003 00000001ffffffff 0000= 000000000000 [ 64.028847] page dumped because: kasan: bad access detected [ 64.031367] [ 64.033285] Memory state around the buggy address: [ 64.035276] ffff88804fd22000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc= fc fc [ 64.037741] ffff88804fd22080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc= fc fc [ 64.040138] >ffff88804fd22100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb= fb fb [ 64.042717] ^ [ 64.044794] ffff88804fd22180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb= fb fb [ 64.047431] ffff88804fd22200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb= fb fb [ 64.049993] =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D Ben. --=20 Ben Hutchings The world is coming to an end. Please log off. --=-6eBq+MBmjz4IKMVAZGyh Content-Type: application/pgp-signature; name="signature.asc" Content-Description: This is a digitally signed message part -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEErCspvTSmr92z9o8157/I7JWGEQkFAlxgSHgACgkQ57/I7JWG EQmhWw/9GxyrJhueQSgv6W9bhy++m0TYRhhj5G77sokaIVOlu5dNSt21CblEWoqS 78rBmXgTVirE3A54vRvBF+HS5kSESBoWlE4ESOI8lIX6+26+pDMeXeE+tUaw4TVK rlTIfose8fKQWt0HnRfCH9fdx9kufXEVaFW4jXxz2b2Kbgfjb72YGQxb1K1Pd1o+ sOEOFFH7QMjnmck8RUx+rO4IwsJY/jLSJELPuRiSXmVugyLcXWcIUQlosMBUexYP tEqwpc6s0cPG2C2j5wWEdMGwJKH46YL4Zjvvi5QEzMcm2sMGUEtIRsjLrtS08321 pPKIXN/gaa96a2U7Ng8/O8jnp+Q8rTJpombjTLbKE82yU+uYjXQKuBoSzuDnAz49 pHF4r2JcwLv4rkMWVqQ6tslARW0TUkHUl8iOsbHEXy5PmAPFKlFi547/3eLKfq3a e78Zvj7InZmD9JV9OHMrJx9Ct+w0RiAw3J6qPhrNLB2vgysyvWaoADQWGxHSdQVc Qoxa1sbWex1BFvWx35JpH53NmmU/3QdmMHHU8wkTVEOiefIJAsMRkXUVmz0hf0XA JyxzOKI9jO5xbpVG2/JD2Cna2R/vC+QeI31oGSs6yPy2iKNp4l/wrr2BrayO3YgZ F8HYJyNZML7p0+9krCmkAit8YiM/ZuVxAbfJZzwAU6vMiiIKvWc= =iccx -----END PGP SIGNATURE----- --=-6eBq+MBmjz4IKMVAZGyh--