linux-kernel - vhost: reproducible vvhost_net_release -> vhost_dev_cleanup -> host_dev_free

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <c86063c7a1dc47ea679f45a5cabfc0378e4fdaea.camel@gmx.de>
Date: Mon, 04 Aug 2025 09:14:03 +0200
From: Mike Galbraith <efault@....de>
To: lkml <linux-kernel@...r.kernel.org>
Cc: "Michael S. Tsirkin" <mst@...hat.com>, Jason Wang <jasowang@...hat.com>
Subject: vhost: reproducible vvhost_net_release -> vhost_dev_cleanup ->
 host_dev_free_iovecs -> kfree  -> KaBoOM

Greetings,

While trying to reproduce a possible sched issue Linus met, met the
below reproducible LTP inspired crash instead.

[ 3577.421177] Oops: general protection fault, probably for non-canonical address 0x3fbf76982fc0008: 0000 [#1] SMP
[ 3577.421195] CPU: 2 UID: 65534 PID: 8325 Comm: read_all Kdump: loaded Not tainted 6.16.0.g186f3edf-master #182 PREEMPT(voluntary)  85e6fa82a94c1c68749cb9dc59977997ab1f7c98
[ 3577.421207] Hardware name: MEDION MS-7848/MS-7848, BIOS M7848W08.20C 09/23/2013
[ 3577.421212] RIP: 0010:kfree+0x6f/0x360
[ 3577.421220] Code: 80 48 01 d8 0f 82 fe 02 00 00 48 c7 c2 00 00 00 80 48 2b 15 9b c2 ff 00 48 01 d0 48 c1 e8 0c 48 c1 e0 06 48 03 05 79 c2 ff 00 <48> 8b 50 08 49 89 c4 f6 c2 01 0f 85 1b 02 00 00 0f 1f 44 00 00 41
[ 3577.421227] RSP: 0018:ffffd348c1cefc60 EFLAGS: 00010207
[ 3577.421233] RAX: 03fbf76982fc0000 RBX: ff000000ff000000 RCX: 0000000000000000
[ 3577.421238] RDX: 0000751f40000000 RSI: ffffffffc1c7cda3 RDI: ff000000ff000000
[ 3577.421242] RBP: ffffd348c1cefca8 R08: ffff8ae1944c6ee8 R09: ffff8ae154fc9250
[ 3577.421246] R10: ffffd348c1cefc60 R11: ffffffffffffffff R12: ffff8ae14b9c0000
[ 3577.421250] R13: ffff8ae146f7fb20 R14: ffff8ae1407c0cc0 R15: 0000000000000000
[ 3577.421254] FS:  00007facec89e740(0000) GS:ffff8ae49b0e4000(0000) knlGS:0000000000000000
[ 3577.421259] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 3577.421263] CR2: 00007efc8c7a5000 CR3: 000000010ec1b005 CR4: 00000000001726f0
[ 3577.421268] Call Trace:
[ 3577.421272]  <TASK>
[ 3577.421278]  vhost_dev_free_iovecs+0x73/0x90 [vhost 3c674dad08c506310edaf87107e3d1cb15256ce4]
[ 3577.421290]  vhost_dev_cleanup+0xa0/0x220 [vhost 3c674dad08c506310edaf87107e3d1cb15256ce4]
[ 3577.421299]  vhost_net_release+0x47/0xe0 [vhost_net 4ef709b820ec57b61084d8295f282af45a90d07e]
[ 3577.421306]  __fput+0xf4/0x2b0
[ 3577.421313]  __x64_sys_close+0x3d/0x80
[ 3577.421317]  do_syscall_64+0x7f/0xa10

To reproduce, from LTP home directory:
   testcases/bin/read_all -d /dev -p -q -r 3testcases/bin/read_all -d /dev -p -q -r 3

Config attached.  The original was enterprise derived tune for maximum
lard, this one is bisect ready (but execution unlikely today at least).

	-Mike


View attachment "config" of type "text/plain" (184598 bytes)