netdev - Re: Urgent Bug Report Kernel crash 6.5.2

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Wed, 20 Sep 2023 10:03:51 +0300
From: Martin Zaharinov <micron10@...il.com>
To: Bagas Sanjaya <bagasdotme@...il.com>
Cc: Eric Dumazet <edumazet@...gle.com>,
 Paolo Abeni <pabeni@...hat.com>,
 netdev <netdev@...r.kernel.org>,
 patchwork-bot+netdevbpf@...nel.org,
 Jakub Kicinski <kuba@...nel.org>,
 Stephen Hemminger <stephen@...workplumber.org>,
 kuba+netdrv@...nel.org,
 dsahern@...il.com,
 Florian Westphal <fw@...len.de>,
 Pablo Neira Ayuso <pablo@...filter.org>
Subject: Re: Urgent Bug Report Kernel crash 6.5.2

Hi

Ok on first see all is look come after in kernel 6.4 add : atomics: Provide rcuref - scalable reference counting  ( https://www.spinics.net/lists/linux-tip-commits/msg62042.html )

I check all running machine with kernel 6.4.2 is minimal and have same bug report.

i have fell machine with kernel 6.3.9 and not see problems there .

and the problem may be is allocate in this part : 

[39651.444202] ? rcuref_put_slowpath (lib/rcuref.c:267 (discriminator 1))
[39651.444297] ? rcuref_put_slowpath (lib/rcuref.c:267 (discriminator 1))
[39651.444391] dst_release (./arch/x86/include/asm/preempt.h:95 ./include/linux/rcuref.h:151 net/core/dst.c:166)
[39651.444487] __dev_queue_xmit (./include/net/dst.h:283 net/core/dev.c:4158)
[39651.444582] ? nf_hook_slow (./include/linux/netfilter.h:143 net/netfilter/core.c:626)

may be changes in dst.c make problem , I'm guessing at the moment. 

but in real with kernel 6.3 all is fine for now.

dst.c changes 6.3.9 > 6.5.4 :

--- linux-6.3.9/net/core/dst.c	2023-06-21 14:02:19.000000000 +0000
+++ linux-6.5.4/net/core/dst.c	2023-09-19 10:30:30.000000000 +0000
@@ -66,7 +66,8 @@ void dst_init(struct dst_entry *dst, str
 	dst->tclassid = 0;
 #endif
 	dst->lwtstate = NULL;
-	atomic_set(&dst->__refcnt, initial_ref);
+	rcuref_init(&dst->__rcuref, initial_ref);
+	INIT_LIST_HEAD(&dst->rt_uncached);
 	dst->__use = 0;
 	dst->lastuse = jiffies;
 	dst->flags = flags;
@@ -162,31 +163,15 @@ EXPORT_SYMBOL(dst_dev_put);

 void dst_release(struct dst_entry *dst)
 {
-	if (dst) {
-		int newrefcnt;
-
-		newrefcnt = atomic_dec_return(&dst->__refcnt);
-		if (WARN_ONCE(newrefcnt < 0, "dst_release underflow"))
-			net_warn_ratelimited("%s: dst:%p refcnt:%d\n",
-					     __func__, dst, newrefcnt);
-		if (!newrefcnt)
-			call_rcu_hurry(&dst->rcu_head, dst_destroy_rcu);
-	}
+	if (dst && rcuref_put(&dst->__rcuref))
+		call_rcu_hurry(&dst->rcu_head, dst_destroy_rcu);
 }
 EXPORT_SYMBOL(dst_release);

 void dst_release_immediate(struct dst_entry *dst)
 {
-	if (dst) {
-		int newrefcnt;
-
-		newrefcnt = atomic_dec_return(&dst->__refcnt);
-		if (WARN_ONCE(newrefcnt < 0, "dst_release_immediate underflow"))
-			net_warn_ratelimited("%s: dst:%p refcnt:%d\n",
-					     __func__, dst, newrefcnt);
-		if (!newrefcnt)
-			dst_destroy(dst);
-	}
+	if (dst && rcuref_put(&dst->__rcuref))
+		dst_destroy(dst);
 }
 EXPORT_SYMBOL(dst_release_immediate);



> On 20 Sep 2023, at 9:16, Bagas Sanjaya <bagasdotme@...il.com> wrote:
> 
> On Wed, Sep 20, 2023 at 09:05:10AM +0300, Martin Zaharinov wrote:
>>> On 20 Sep 2023, at 6:59, Eric Dumazet <edumazet@...gle.com> wrote:
>>> Again, your best route is a bisection.
>> 
>> For now its not possible to make bisection , its hard to change kernel on running machine …
>> 
> 
> You have to do bisection, unfortunately. There is many guides there on
> Internet. Or you can read Documentation/admin-guide/bug-bisect.rst.
> 
> Bye!
> 
> -- 
> An old man doll... just what I always wanted! - Clara