netdev - Re: Question on comment in dev_queue_xmit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Tue, 8 Feb 2022 16:13:07 -0800
From:   Ben Greear <greearb@...delatech.com>
To:     Salam Noureddine <noureddine@...sta.com>
Cc:     netdev <netdev@...r.kernel.org>
Subject: Re: Question on comment in dev_queue_xmit_nit

On 2/8/22 3:51 PM, Ben Greear wrote:
> Hello Salam,
> 
> After an 8 day torture test on a hacked 5.15.7+ kernel doing wifi testing, our system crashed
> in the dev_queue_xmit_nit method, evidently 'skb' is NULL.
> 
> gdb claims it is the 'skb2 = skb_clone ...' line below.  Now, this crash could
> be fault of my local patches or other random things, but the comment caught
> my attention.  It is cloning once per loop as far as I can see, so why the comment
> about 'done only once' ?
> 
>          /* need to clone skb, done only once */
>          skb2 = skb_clone(skb, GFP_ATOMIC);
>          if (!skb2)
>              goto out_unlock;
> 
> Thanks,
> Ben
> 

My question above stands, but I was looking at wrong stack frame for the actual
crash location.  It is actually dying down in slub.c, so I guess it is some nasty
memory corruption and this crash site is probably not actually related to the cause...

(gdb) l *(dev_queue_xmit_nit+0xf4)
0xffffffff819bf4d4 is in dev_queue_xmit_nit (/home2/greearb/git/linux-5.15.dev.y/net/core/dev.c:2305).
2300				pt_prev = ptype;
2301				continue;
2302			}
2303	
2304			/* need to clone skb, done only once */
2305			skb2 = skb_clone(skb, GFP_ATOMIC);
2306			if (!skb2)
2307				goto out_unlock;
2308	
2309			net_timestamp_set(skb2);
(gdb) l *(skb_clone+0x47)
0xffffffff819a9ff7 is in skb_clone (/home2/greearb/git/linux-5.15.dev.y/net/core/skbuff.c:1521).
1516			refcount_set(&fclones->fclone_ref, 2);
1517		} else {
1518			if (skb_pfmemalloc(skb))
1519				gfp_mask |= __GFP_MEMALLOC;
1520	
1521			n = kmem_cache_alloc(skbuff_head_cache, gfp_mask);
1522			if (!n)
1523				return NULL;
1524	
1525			n->fclone = SKB_FCLONE_UNAVAILABLE;
(gdb) l *(kmem_cache_alloc+0x71)
0xffffffff8133b821 is in kmem_cache_alloc (/home2/greearb/git/linux-5.15.dev.y/mm/slub.c:352).
347	}
348	
349	static inline void *get_freepointer(struct kmem_cache *s, void *object)
350	{
351		object = kasan_reset_tag(object);
352		return freelist_dereference(s, object + s->offset);
353	}
354	

Thanks,
Ben