linux-kernel - Re: vhost: reproducible vvhost_net_release -> vhost_dev_cleanup -> host_dev_free

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CACGkMEtog0jx0tR35L=6XXsyctDvGiN7YPC+OQVJBkaQ9886PA@mail.gmail.com>
Date: Mon, 4 Aug 2025 17:05:32 +0800
From: Jason Wang <jasowang@...hat.com>
To: Mike Galbraith <efault@....de>
Cc: lkml <linux-kernel@...r.kernel.org>, "Michael S. Tsirkin" <mst@...hat.com>
Subject: Re: vhost: reproducible vvhost_net_release -> vhost_dev_cleanup ->
 host_dev_free_iovecs -> kfree -> KaBoOM

Hi Mike:

On Mon, Aug 4, 2025 at 3:14 PM Mike Galbraith <efault@....de> wrote:
>
> Greetings,
>
> While trying to reproduce a possible sched issue Linus met, met the
> below reproducible LTP inspired crash instead.
>
> [ 3577.421177] Oops: general protection fault, probably for non-canonical address 0x3fbf76982fc0008: 0000 [#1] SMP
> [ 3577.421195] CPU: 2 UID: 65534 PID: 8325 Comm: read_all Kdump: loaded Not tainted 6.16.0.g186f3edf-master #182 PREEMPT(voluntary)  85e6fa82a94c1c68749cb9dc59977997ab1f7c98
> [ 3577.421207] Hardware name: MEDION MS-7848/MS-7848, BIOS M7848W08.20C 09/23/2013
> [ 3577.421212] RIP: 0010:kfree+0x6f/0x360
> [ 3577.421220] Code: 80 48 01 d8 0f 82 fe 02 00 00 48 c7 c2 00 00 00 80 48 2b 15 9b c2 ff 00 48 01 d0 48 c1 e8 0c 48 c1 e0 06 48 03 05 79 c2 ff 00 <48> 8b 50 08 49 89 c4 f6 c2 01 0f 85 1b 02 00 00 0f 1f 44 00 00 41
> [ 3577.421227] RSP: 0018:ffffd348c1cefc60 EFLAGS: 00010207
> [ 3577.421233] RAX: 03fbf76982fc0000 RBX: ff000000ff000000 RCX: 0000000000000000
> [ 3577.421238] RDX: 0000751f40000000 RSI: ffffffffc1c7cda3 RDI: ff000000ff000000
> [ 3577.421242] RBP: ffffd348c1cefca8 R08: ffff8ae1944c6ee8 R09: ffff8ae154fc9250
> [ 3577.421246] R10: ffffd348c1cefc60 R11: ffffffffffffffff R12: ffff8ae14b9c0000
> [ 3577.421250] R13: ffff8ae146f7fb20 R14: ffff8ae1407c0cc0 R15: 0000000000000000
> [ 3577.421254] FS:  00007facec89e740(0000) GS:ffff8ae49b0e4000(0000) knlGS:0000000000000000
> [ 3577.421259] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 3577.421263] CR2: 00007efc8c7a5000 CR3: 000000010ec1b005 CR4: 00000000001726f0
> [ 3577.421268] Call Trace:
> [ 3577.421272]  <TASK>
> [ 3577.421278]  vhost_dev_free_iovecs+0x73/0x90 [vhost 3c674dad08c506310edaf87107e3d1cb15256ce4]
> [ 3577.421290]  vhost_dev_cleanup+0xa0/0x220 [vhost 3c674dad08c506310edaf87107e3d1cb15256ce4]
> [ 3577.421299]  vhost_net_release+0x47/0xe0 [vhost_net 4ef709b820ec57b61084d8295f282af45a90d07e]
> [ 3577.421306]  __fput+0xf4/0x2b0
> [ 3577.421313]  __x64_sys_close+0x3d/0x80
> [ 3577.421317]  do_syscall_64+0x7f/0xa10
>
> To reproduce, from LTP home directory:
>    testcases/bin/read_all -d /dev -p -q -r 3testcases/bin/read_all -d /dev -p -q -r 3
>
> Config attached.  The original was enterprise derived tune for maximum
> lard, this one is bisect ready (but execution unlikely today at least).
>
>         -Mike
>

I've posted a fix here:

https://lore.kernel.org/virtualization/f2d3027f-44d1-44d2-b89c-e01085c6d036@linux.ibm.com/T/#t

Thanks