netdev - Re: [syzbot] BUG: corrupted list in netif_napi

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 18 Oct 2021 23:31:41 +0000
From:   Saeed Mahameed <saeedm@...dia.com>
To:     Vlad Buslov <vladbu@...dia.com>,
        "kuba@...nel.org" <kuba@...nel.org>
CC:     "songliubraving@...com" <songliubraving@...com>,
        "hawk@...nel.org" <hawk@...nel.org>,
        "syzkaller-bugs@...glegroups.com" <syzkaller-bugs@...glegroups.com>,
        "kafai@...com" <kafai@...com>,
        "davem@...emloft.net" <davem@...emloft.net>,
        "john.fastabend@...il.com" <john.fastabend@...il.com>,
        "andrii@...nel.org" <andrii@...nel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "pabeni@...hat.com" <pabeni@...hat.com>,
        "kpsingh@...nel.org" <kpsingh@...nel.org>,
        "ast@...nel.org" <ast@...nel.org>,
        "joamaki@...il.com" <joamaki@...il.com>, "yhs@...com" <yhs@...com>,
        "toke@...e.dk" <toke@...e.dk>,
        "daniel@...earbox.net" <daniel@...earbox.net>,
        "bpf@...r.kernel.org" <bpf@...r.kernel.org>,
        Maxim Mikityanskiy <maximmi@...dia.com>,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>,
        "syzbot+62e474dd92a35e3060d8@...kaller.appspotmail.com" 
        <syzbot+62e474dd92a35e3060d8@...kaller.appspotmail.com>
Subject: Re: [syzbot] BUG: corrupted list in netif_napi_add

On Mon, 2021-10-18 at 19:12 +0300, Vlad Buslov wrote:
> On Mon 18 Oct 2021 at 18:42, Jakub Kicinski <kuba@...nel.org> wrote:
> > On Mon, 18 Oct 2021 17:04:19 +0300 Vlad Buslov wrote:
> > > We got a use-after-free with very similar trace [0] during
> > > nightly
> > > regression. The issue happens when ip link up/down state is
> > > flipped
> > > several times in loop and doesn't reproduce for me manually. The
> > > fact
> > > that it didn't reproduce for me after running test ten times
> > > suggests
> > > that it is either very hard to reproduce or that it is a result
> > > of some
> > > interaction between several tests in our suite.
> > > 
> > > [0]:
> > > 
> > > [ 3187.779569] mlx5_core 0000:08:00.0 enp8s0f0: Link up
> > >  [ 3187.890694]
> > > =================================================================
> > > =
> > >  [ 3187.892518] BUG: KASAN: use-after-free in
> > > __list_add_valid+0xc3/0xf0
> > >  [ 3187.894132] Read of size 8 at addr ffff8881150b3fb8 by task
> > > ip/119618
> > 
> > Hm, not sure how similar it is. This one looks like channel was
> > freed
> > without deleting NAPI. Do you have list debug enabled?
> 
> Yes, CONFIG_DEBUG_LIST is enabled.
> 
do you have core dumps ?
let's enable kernel.panic_on_oops with core dumps and look at it next
time we see this, I really don't think mlx5 is leaking..