| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <ce8d3e55-b8bc-409c-ace9-5cf1c4f7c88e@gmail.com>
Date: Wed, 3 Jan 2024 17:41:54 -0800
From: Kui-Feng Lee <sinquersw@...il.com>
To: netdev@...r.kernel.org, victor@...atatu.com
Cc: jhs@...atatu.com, xiyou.wangcong@...il.com, jiri@...nulli.us,
pctammela@...atatu.com, "David S. Miller" <davem@...emloft.net>,
Andrii Nakryiko <andrii@...nel.org>, Alexei Starovoitov <ast@...nel.org>,
Martin KaFai Lau <martin.lau@...ux.dev>, Kernel Team <kernel-team@...a.com>
Subject: net/sched - kernel crashes when replacing a qdisc node.
The kernel crashes when running selftests/bpf/prog_tests/lwt_reroute.c.
We got the error message at end of this post.
It happens when lwt_reroute.c running the shell command
tc qdisc replace dev tun0 root fq limit 5 flow_limit 5
The kernel crashes at the line
block = cl_ops->tcf_block(sch, TC_H_MIN_INGRESS, NULL);
in the function qdisc_block_add_dev(), which is added by
913b47d3424e7 ("net/sched: Introduce tc block netdev tracking infra")
recently. According to what I saw, cl_ops (sch->ops->cl_ops) is null,
and it causes cl_ops->tcf_block an invalid memory access. The id of
qdisc here is "fq", and it has no Qdisc_class_ops.
IMHO, qdisc_block_add_dev() wrongly believes that every qdisc received
by it is classful. This issue causes BPF CI fails, and we have to
disable some test cases for now.
Error message:
[ 5.230927] BUG: kernel NULL pointer dereference, address:
0000000000000048
[ 5.231767] #PF: supervisor read access in kernel mode
[ 5.231872] #PF: error_code(0x0000) - not-present page
[ 5.231872] PGD 0 P4D 0
[ 5.233365] Oops: 0000 [#1] PREEMPT SMP NOPTI
[ 5.233365] CPU: 2 PID: 2179 Comm: tc Tainted: G OE
6.7.0-rc6-01883-gb4560055c8f1-dirty #1582
[ 5.233944] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),
BIOS 1.15.0-1 04/01/2014
[ 5.233944] RIP: 0010:qdisc_create+0x2d0/0x800
[ 5.236068] Code: 00 48 c7 c7 31 af 83 82 e8 3d 60 60 ff 49 8b 44 24
18 be a6 04 00 00 48 c7 c7 b8 ad 83 82 4c 8b 78 08 4c 89 fa e8 20 60 60
ff <49> 8b 57 481
[ 5.236068] RSP: 0018:ffffc900003e3998 EFLAGS: 00010282
[ 5.239068] RAX: 0000000000000032 RBX: ffff88810a9cc000 RCX:
0000000000000000
[ 5.239068] RDX: 0000000000000001 RSI: ffffffff82762bcb RDI:
00000000ffffffff
[ 5.240161] RBP: ffffffff83915340 R08: ffffffff83765168 R09:
0000000000000003
[ 5.240161] R10: ffffffff83065180 R11: ffffffff835e5180 R12:
ffff888106ef8000
[ 5.240161] R13: 0000000000000000 R14: 0000000080010000 R15:
0000000000000000
[ 5.243192] FS: 00007f16eed0c740(0000) GS:ffff888237d00000(0000)
knlGS:0000000000000000
[ 5.243192] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 5.243192] CR2: 0000000000000048 CR3: 000000010a92c000 CR4:
00000000000006f0
[ 5.243192] Call Trace:
[ 5.245838] <TASK>
[ 5.245838] ? __die+0x20/0x60
[ 5.245838] ? page_fault_oops+0x14b/0x420
[ 5.246765] ? fixup_exception+0x22/0x280
[ 5.246765] ? exc_page_fault+0x60/0x120
[ 5.246765] ? asm_exc_page_fault+0x22/0x30
[ 5.246765] ? qdisc_create+0x2d0/0x800
[ 5.246765] ? qdisc_create+0x2d0/0x800
[ 5.246765] tc_modify_qdisc+0x224/0x890
[ 5.246765] rtnetlink_rcv_msg+0x146/0x3c0
[ 5.246765] ? rtnl_calcit.isra.0+0x110/0x110
[ 5.246765] netlink_rcv_skb+0x41/0xd0
[ 5.251263] netlink_unicast+0x213/0x340
[ 5.251389] netlink_sendmsg+0x1e4/0x400
[ 5.251389] __sock_sendmsg+0x38/0x70
[ 5.251389] ____sys_sendmsg+0x1e4/0x220
[ 5.251389] ? copy_msghdr_from_user+0x5d/0x80
[ 5.251389] ___sys_sendmsg+0x6f/0xa0
[ 5.251389] ? copy_msghdr_from_user+0x5d/0x80
[ 5.251389] ? ___sys_recvmsg+0x75/0xa0
[ 5.251389] __sys_sendmsg+0x49/0x80
[ 5.255231] do_syscall_64+0x3b/0xe0
[ 5.255231] entry_SYSCALL_64_after_hwframe+0x63/0x6b
[ 5.255231] RIP: 0033:0x7f16eeb27b17
[ 5.255231] Code: 0f 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f
1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f
05 <48> 3d 00 f00
[ 5.255231] RSP: 002b:00007ffdddd33af8 EFLAGS: 00000246 ORIG_RAX:
000000000000002e
[ 5.259735] RAX: ffffffffffffffda RBX: 0000000065960730 RCX:
00007f16eeb27b17
[ 5.259966] RDX: 0000000000000000 RSI: 00007ffdddd33b60 RDI:
0000000000000007
[ 5.259966] RBP: 0000000000000000 R08: 0000000000000001 R09:
0000560365ad78f0
[ 5.259966] R10: 0000560365adf8f0 R11: 0000000000000246 R12:
0000000000000001
[ 5.259966] R13: 0000560365aa7236 R14: 0000560365aa70c8 R15:
0000560365acdf40
[ 5.259966] </TASK>
[ 5.264057] Modules linked in: bpf_testmod(OE)
[ 5.264057] CR2: 0000000000000048
[ 5.265368] ---[ end trace 0000000000000000 ]---
[ 5.265980] RIP: 0010:qdisc_create+0x2d0/0x800
[ 5.266576] Code: 00 48 c7 c7 31 af 83 82 e8 3d 60 60 ff 49 8b 44 24
18 be a6 04 00 00 48 c7 c7 b8 ad 83 82 4c 8b 78 08 4c 89 fa e8 20 60 60
ff <49> 8b 57 481
[ 5.268924] RSP: 0018:ffffc900003e3998 EFLAGS: 00010282
[ 5.269594] RAX: 0000000000000032 RBX: ffff88810a9cc000 RCX:
0000000000000000
[ 5.270522] RDX: 0000000000000001 RSI: ffffffff82762bcb RDI:
00000000ffffffff
[ 5.271363] RBP: ffffffff83915340 R08: ffffffff83765168 R09:
0000000000000003
[ 5.272261] R10: ffffffff83065180 R11: ffffffff835e5180 R12:
ffff888106ef8000
[ 5.273140] R13: 0000000000000000 R14: 0000000080010000 R15:
0000000000000000
[ 5.274030] FS: 00007f16eed0c740(0000) GS:ffff888237d80000(0000)
knlGS:0000000000000000
[ 5.275042] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 5.275816] CR2: 00007ff5f9430088 CR3: 000000010a92c000 CR4:
00000000000006f0
[ 5.276728] Kernel panic - not syncing: Fatal exception
[ 5.277552] Kernel Offset: disabled
[ 5.277718] ---[ end Kernel panic - not syncing: Fatal exception ]---
Powered by blists - more mailing lists