Message-ID: <CANaxB-zSpXdFc44itLp2g4HC0JGVRO_1mKz2Qk2pdygChu1jAQ@mail.gmail.com>
Date:   Sat, 8 Dec 2018 10:02:16 -0800
From:   Andrei Vagin <avagin@...il.com>
To:     David Ahern <dsahern@...il.com>,
        Linux Kernel Network Developers <netdev@...r.kernel.org>
Subject: linux-next: BUG: KASAN: use-after-free in neigh_mark_dead+0x192/0x1c0

Hi David,

Our tests detected a new problem on net-next (v4.20-rc4-1241-g83af01ba1c2d).

[   92.949574] ==================================================================
[   92.949794] BUG: KASAN: use-after-free in neigh_mark_dead+0x192/0x1c0
[   92.949950] Write of size 8 at addr ffff8881d9bc9438 by task kworker/u4:1/37
[   92.950108]
[   92.950254] CPU: 1 PID: 37 Comm: kworker/u4:1 Not tainted 4.20.0-rc4+ #1
[   92.950257] Hardware name: Google Google Compute Engine/Google
Compute Engine, BIOS Google 01/01/2011
[   92.950263] Workqueue: netns cleanup_net
[   92.950267] Call Trace:
[   92.950276]  dump_stack+0x5b/0x8b
[   92.950284]  print_address_description+0x6a/0x270
[   92.950290]  kasan_report+0x260/0x380
[   92.950295]  ? neigh_mark_dead+0x192/0x1c0
[   92.950301]  neigh_mark_dead+0x192/0x1c0
[   92.950307]  neigh_flush_dev+0x1ad/0x510
[   92.950318]  __neigh_ifdown+0x49/0x2a0
[   92.950327]  neigh_ifdown+0xc/0x10
[   92.950333]  fib_netdev_event+0x1f5/0x300
[   92.950342]  notifier_call_chain+0xbf/0x130
[   92.950352]  dev_close_many+0x249/0x4d0
[   92.950360]  ? __dev_close_many+0x280/0x280
[   92.950364]  ? default_device_exit_batch+0xf3/0x3b0
[   92.950374]  rollback_registered_many+0x34c/0xd00
[   92.950378]  ? default_device_exit_batch+0xf3/0x3b0
[   92.950383]  ? wait_for_completion+0x2d0/0x2d0
[   92.950386]  ? __mutex_lock+0x31f/0x1000
[   92.950391]  ? generic_xdp_install+0x3c0/0x3c0
[   92.950397]  ? default_device_exit_batch+0x1b6/0x3b0
[   92.950403]  ? find_held_lock+0x32/0x1c0
[   92.950408]  ? default_device_exit_batch+0x1b6/0x3b0
[   92.950416]  ? rtnl_is_locked+0x16/0x30
[   92.950420]  ? unregister_netdevice_queue+0x69/0x3f0
[   92.950424]  ? rollback_registered_many+0xd00/0xd00
[   92.950432]  unregister_netdevice_many.part.124+0x17/0x210
[   92.950439]  default_device_exit_batch+0x2d6/0x3b0
[   92.950444]  ? unregister_netdevice_many+0x40/0x40
[   92.950450]  ? dev_change_net_namespace+0xb90/0xb90
[   92.950459]  ? do_wait_intr_irq+0x210/0x210
[   92.950466]  ? ops_exit_list.isra.6+0x94/0x140
[   92.950473]  cleanup_net+0x309/0x650
[   92.950478]  ? process_one_work+0x8ae/0x16c0
[   92.950482]  ? net_drop_ns+0x60/0x60
[   92.950490]  ? lock_acquire+0xfe/0x290
[   92.950497]  ? strscpy+0x96/0x300
[   92.950505]  process_one_work+0x96c/0x16c0
[   92.950516]  ? pwq_dec_nr_in_flight+0x2c0/0x2c0
[   92.950520]  ? do_raw_spin_lock+0x120/0x290
[   92.950532]  worker_thread+0x87/0xe80
[   92.950541]  ? __kthread_parkme+0x82/0xf0
[   92.950546]  ? process_one_work+0x16c0/0x16c0
[   92.950550]  kthread+0x2e9/0x3a0
[   92.950554]  ? kthread_park+0x120/0x120
[   92.950560]  ret_from_fork+0x35/0x40
[   92.950572]
[   92.950713] Allocated by task 8903:
[   92.950863]  kasan_kmalloc+0xa0/0xd0
[   92.950868]  __kmalloc+0x132/0x250
[   92.950872]  ___neigh_create+0x4d6/0x18e0
[   92.950877]  ip_finish_output2+0x4e7/0xff0
[   92.950880]  ip_output+0x1c5/0x3f0
[   92.950884]  __ip_queue_xmit+0x7c9/0x1990
[   92.950888]  __tcp_transmit_skb+0x1872/0x33e0
[   92.950891]  do_tcp_setsockopt.isra.41+0x1712/0x1c70
[   92.950895]  __sys_setsockopt+0x114/0x1e0
[   92.950899]  __x64_sys_setsockopt+0xba/0x150
[   92.950904]  do_syscall_64+0x94/0x280
[   92.950908]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
[   92.950909]
[   92.951049] Freed by task 8936:
[   92.951200]  __kasan_slab_free+0x130/0x180
[   92.951204]  kfree+0xc2/0x1e0
[   92.951209]  rcu_process_callbacks+0x647/0xbe0
[   92.951213]  __do_softirq+0x199/0x658
[   92.951215]
[   92.951356] The buggy address belongs to the object at ffff8881d9bc9200
[   92.951356]  which belongs to the cache kmalloc-1k of size 1024
[   92.951530] The buggy address is located 568 bytes inside of
[   92.951530]  1024-byte region [ffff8881d9bc9200, ffff8881d9bc9600)
[   92.951702] The buggy address belongs to the page:
[   92.951856] page:ffffea000766f200 count:1 mapcount:0
mapping:ffff8881dac02a00 index:0x0 compound_mapcount: 0
[   92.952026] flags: 0x17fff8000010200(slab|head)
[   92.952185] raw: 017fff8000010200 dead000000000100 dead000000000200
ffff8881dac02a00
[   92.952351] raw: 0000000000000000 00000000000e000e 00000001ffffffff
0000000000000000
[   92.952515] page dumped because: kasan: bad access detected
[   92.952662]
[   92.952815] Memory state around the buggy address:
[   92.952981]  ffff8881d9bc9300: fb fb fb fb fb fb fb fb fb fb fb fb
fb fb fb fb
[   92.953168]  ffff8881d9bc9380: fb fb fb fb fb fb fb fb fb fb fb fb
fb fb fb fb
[   92.953348] >ffff8881d9bc9400: fb fb fb fb fb fb fb fb fb fb fb fb
fb fb fb fb
[   92.953527]                                         ^
[   92.953688]  ffff8881d9bc9480: fb fb fb fb fb fb fb fb fb fb fb fb
fb fb fb fb
[   92.953871]  ffff8881d9bc9500: fb fb fb fb fb fb fb fb fb fb fb fb
fb fb fb fb
[   92.954048] ==================================================================
[   92.954233] Disabling lock debugging due to kernel taint

Here is more more details (config, dmest, etc):
https://travis-ci.org/avagin/linux/jobs/465254438

I can give more details on the next week. Let me know if you need anything.

Thanks,
Andrei

Powered by blists - more mailing lists