netdev - RFH, where did I go wrong?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <42776059-242c-cf49-c3ed-31e311b91f1c@tarent.de>
Date:   Thu, 8 Sep 2022 23:01:31 +0200 (CEST)
From:   Thorsten Glaser <t.glaser@...ent.de>
To:     netdev@...r.kernel.org
Subject: RFH, where did I go wrong?

Hi,

under high load, my homegrown qdisc causes a system crash,
but I’m a bit baffled at the message and location. Perhaps
anyone has directly an idea where I could have messed up?

Transcription of the most relevant info from the screen photo:

virt_to_cache: Object is not a Slab page!
… at mm/slab.h:435 kmem_cache_free+…

Call Trace:
__rtnl_unlock+0x34/0x40
netdev_run_todo+…
rtnetlink_rcv_msg
? _copy_to_iter
? __free_one_page
? rtnl_calcit.isra.0
netlink_rcv_skb
netlink_unicast
netlink_sendmsg
sock_sendmsg
____sys_sendmsg
[…]

The trace is followed by two…

BUG: Bad rss-counter state mm:0000000001b817b09
first one is type:MM_FILEPAGES val:81
second one is type:MM_ANONPAGES val:30

I guess I either messed up with pointers or locking, but I don’t
have the Linux kernel coding experience to know where to even start
looking for causes.

Source in question is…
https://github.com/tarent/sch_jens/blob/iproute2_5.10.0-4jens14/janz/sch_janz.c
… though I don’t exactly ask for someone to solve this for me (though
that would, obviously, also be welcome ☺) but to get to know enough
for me to figure out the bug.

I probably would start by adding lots of debugging printks, but the
problem occurs when throwing iperf with 40 Mbit/s on this set to limit
to 20 Mbit/s, which’d cause a lot of information — plus I don’t even
know what kind of error “Object is not a Slab page” is (i.e. what wrong
thing is passed where or written to where).

Thanks in advance,
//mirabilos
-- 
Infrastrukturexperte • tarent solutions GmbH
Am Dickobskreuz 10, D-53121 Bonn • http://www.tarent.de/
Telephon +49 228 54881-393 • Fax: +49 228 54881-235
HRB AG Bonn 5168 • USt-ID (VAT): DE122264941
Geschäftsführer: Dr. Stefan Barth, Kai Ebenrett, Boris Esser, Alexander Steeg

                        ****************************************************
/⁀\ The UTF-8 Ribbon
╲ ╱ Campaign against      Mit dem tarent-Newsletter nichts mehr verpassen:
 ╳  HTML eMail! Also,     https://www.tarent.de/newsletter
╱ ╲ header encryption!
                        ****************************************************