Re: [syzbot] KASAN: use-after-free Read in netdev_core_pick_tx

[syzbot <syzbot+10a7a8ca6e94600110ec@syzkaller.appspotmail.com>]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

ice registered as radio22
[    9.280484][    T1] vivid-011: V4L2 transmitter device registered as radio23
[    9.281637][    T1] vivid-011: V4L2 metadata capture device registered as video53
[    9.282665][    T1] vivid-011: V4L2 metadata output device registered as video54
[    9.283695][    T1] vivid-011: V4L2 touch capture device registered as v4l-touch11
[    9.284749][    T1] vivid-012: using single planar format API
[    9.313834][    T1] vivid-012: CEC adapter cec24 registered for HDMI input 0
[    9.314750][    T1] vivid-012: V4L2 capture device registered as video55
[    9.315693][    T1] vivid-012: CEC adapter cec25 registered for HDMI output 0
[    9.316677][    T1] vivid-012: V4L2 output device registered as video56
[    9.317646][    T1] vivid-012: V4L2 capture device registered as vbi24, supports raw and sliced VBI
[    9.318291][    T1] vivid-012: V4L2 output device registered as vbi25, supports raw and sliced VBI
[    9.320037][    T1] vivid-012: V4L2 capture device registered as swradio12
[    9.321192][    T1] vivid-012: V4L2 receiver device registered as radio24
[    9.322138][    T1] vivid-012: V4L2 transmitter device registered as radio25
[    9.323120][    T1] vivid-012: V4L2 metadata capture device registered as video57
[    9.324128][    T1] vivid-012: V4L2 metadata output device registered as video58
[    9.325064][    T1] vivid-012: V4L2 touch capture device registered as v4l-touch12
[    9.326045][    T1] vivid-013: using multiplanar format API
[    9.353487][    T1] vivid-013: CEC adapter cec26 registered for HDMI input 0
[    9.354582][    T1] vivid-013: V4L2 capture device registered as video59
[    9.355753][    T1] vivid-013: CEC adapter cec27 registered for HDMI output 0
[    9.357436][    T1] vivid-013: V4L2 output device registered as video60
[    9.358424][    T1] vivid-013: V4L2 capture device registered as vbi26, supports raw and sliced VBI
[    9.359083][    T1] vivid-013: V4L2 output device registered as vbi27, supports raw and sliced VBI
[    9.359853][    T1] vivid-013: V4L2 capture device registered as swradio13
[    9.362214][    T1] vivid-013: V4L2 receiver device registered as radio26
[    9.363251][    T1] vivid-013: V4L2 transmitter device registered as radio27
[    9.364242][    T1] vivid-013: V4L2 metadata capture device registered as video61
[    9.365221][    T1] vivid-013: V4L2 metadata output device registered as video62
[    9.366272][    T1] vivid-013: V4L2 touch capture device registered as v4l-touch13
[    9.367776][    T1] vivid-014: using single planar format API
[    9.395970][    T1] vivid-014: CEC adapter cec28 registered for HDMI input 0
[    9.397055][    T1] vivid-014: V4L2 capture device registered as video63
[    9.398170][    T1] vivid-014: CEC adapter cec29 registered for HDMI output 0
[    9.399246][    T1] vivid-014: V4L2 output device registered as video64
[    9.400190][    T1] vivid-014: V4L2 capture device registered as vbi28, supports raw and sliced VBI
[    9.400893][    T1] vivid-014: V4L2 output device registered as vbi29, supports raw and sliced VBI
[    9.402605][    T1] vivid-014: V4L2 capture device registered as swradio14
[    9.403517][    T1] vivid-014: V4L2 receiver device registered as radio28
[    9.404644][    T1] vivid-014: V4L2 transmitter device registered as radio29
[    9.406460][    T1] vivid-014: V4L2 metadata capture device registered as video65
[    9.407559][    T1] vivid-014: V4L2 metadata output device registered as video66
[    9.408605][    T1] vivid-014: V4L2 touch capture device registered as v4l-touch14
[    9.409611][    T1] vivid-015: using multiplanar format API
[    9.438655][    T1] vivid-015: CEC adapter cec30 registered for HDMI input 0
[    9.439767][    T1] vivid-015: V4L2 capture device registered as video67
[    9.440915][    T1] vivid-015: CEC adapter cec31 registered for HDMI output 0
[    9.442045][    T1] vivid-015: V4L2 output device registered as video68
[    9.443006][    T1] vivid-015: V4L2 capture device registered as vbi30, supports raw and sliced VBI
[    9.443770][    T1] vivid-015: V4L2 output device registered as vbi31, supports raw and sliced VBI
[    9.445343][    T1] vivid-015: V4L2 capture device registered as swradio15
[    9.446659][    T1] vivid-015: V4L2 receiver device registered as radio30
[    9.447727][    T1] vivid-015: V4L2 transmitter device registered as radio31
[    9.449013][    T1] vivid-015: V4L2 metadata capture device registered as video69
[    9.450180][    T1] vivid-015: V4L2 metadata output device registered as video70
[    9.451250][    T1] vivid-015: V4L2 touch capture device registered as v4l-touch15
[    9.453925][    T1] usbcore: registered new interface driver radioshark2
[    9.454577][    T1] usbcore: registered new interface driver radioshark
[    9.455355][    T1] usbcore: registered new interface driver radio-si470x
[    9.456610][    T1] usbcore: registered new interface driver radio-usb-si4713
[    9.457292][    T1] usbcore: registered new interface driver dsbr100
[    9.462150][    T8] floppy0: no floppy controllers found
[    9.462792][    T8] work still pending
[    9.463392][  T983] floppy0: floppy_shutdown: timeout handler died.  
[    9.475753][    T1] usbcore: registered new interface driver radio-keene
[    9.476503][    T1] usbcore: registered new interface driver radio-ma901
[    9.477112][    T1] usbcore: registered new interface driver radio-mr800
[    9.477798][    T1] usbcore: registered new interface driver radio-raremono
[    9.481027][    T1] usbcore: registered new interface driver pcwd_usb
[    9.494826][    T1] device-mapper: core: CONFIG_IMA_DISABLE_HTABLE is disabled. Duplicate IMA measurements will not be recorded in the IMA log.
[    9.495376][    T1] device-mapper: uevent: version 1.0.3
[    9.497645][    T1] device-mapper: ioctl: 4.46.0-ioctl (2022-02-22) initialised: dm-devel@redhat.com
[    9.501149][    T1] device-mapper: multipath round-robin: version 1.2.0 loaded
[    9.501167][    T1] device-mapper: multipath queue-length: version 0.2.0 loaded
[    9.501181][    T1] device-mapper: multipath service-time: version 0.3.0 loaded
[    9.502267][    T1] device-mapper: raid: Loading target version 1.15.1
[    9.505124][    T1] Bluetooth: HCI UART driver ver 2.3
[    9.505144][    T1] Bluetooth: HCI UART protocol H4 registered
[    9.505152][    T1] Bluetooth: HCI UART protocol BCSP registered
[    9.505633][    T1] Bluetooth: HCI UART protocol LL registered
[    9.506139][    T1] Bluetooth: HCI UART protocol Three-wire (H5) registered
[    9.506647][    T1] Bluetooth: HCI UART protocol QCA registered
[    9.506658][    T1] Bluetooth: HCI UART protocol AG6XX registered
[    9.507116][    T1] Bluetooth: HCI UART protocol Marvell registered
[    9.507954][    T1] usbcore: registered new interface driver bcm203x
[    9.508662][    T1] usbcore: registered new interface driver bpa10x
[    9.509399][    T1] usbcore: registered new interface driver bfusb
[    9.510131][    T1] usbcore: registered new interface driver btusb
[    9.511709][    T1] usbcore: registered new interface driver ath3k
[    9.513851][    T1] CAPI 2.0 started up with major 68 (middleware)
[    9.513866][    T1] Modular ISDN core version 1.1.29
[    9.515537][    T1] NET: Registered PF_ISDN protocol family
[    9.515549][    T1] DSP module 2.0
[    9.515556][    T1] mISDN_dsp: DSP clocks every 80 samples. This equals 1 jiffies.
[    9.522655][    T1] mISDN: Layer-1-over-IP driver Rev. 2.00
[    9.523481][    T1] 0 virtual devices registered
[    9.524502][    T1] usbcore: registered new interface driver HFC-S_USB
[    9.524519][    T1] intel_pstate: CPU model not supported
[    9.524530][    T1] VUB300 Driver rom wait states = 1C irqpoll timeout = 0400
[    9.537137][    T1] usbcore: registered new interface driver vub300
[    9.537472][    T1] usbcore: registered new interface driver ushc
[    9.552092][    T1] iscsi: registered transport (iser)
[    9.555962][    T1] SoftiWARP attached
[    9.556710][    T1] Driver 'memconsole' was unable to register with bus_type 'coreboot' because the bus was not initialized.
[    9.556724][    T1] Driver 'vpd' was unable to register with bus_type 'coreboot' because the bus was not initialized.
[    9.577857][    T1] hid: raw HID events driver (C) Jiri Kosina
[    9.659663][    T1] usbcore: registered new interface driver usbhid
[    9.659678][    T1] usbhid: USB HID core driver
[    9.670996][    T1] usbcore: registered new interface driver es2_ap_driver
[    9.671013][    T1] comedi: version 0.7.76 - http://www.comedi.org
[    9.672407][    T1] usbcore: registered new interface driver dt9812
[    9.673045][    T1] usbcore: registered new interface driver ni6501
[    9.673705][    T1] usbcore: registered new interface driver usbdux
[    9.674341][    T1] usbcore: registered new interface driver usbduxfast
[    9.675032][    T1] usbcore: registered new interface driver usbduxsigma
[    9.675723][    T1] usbcore: registered new interface driver vmk80xx
[    9.676478][    T1] usbcore: registered new interface driver prism2_usb
[    9.677979][    T1] usbcore: registered new interface driver r8712u
[    9.678861][    T1] greybus: registered new driver hid
[    9.679716][    T1] greybus: registered new driver gbphy
[    9.681416][    T1] gb_gbphy: registered new driver usb
[    9.681426][    T1] asus_wmi: ASUS WMI generic driver loaded
[    9.810733][ T1233] CPU: 0 PID: 1233 Comm: aoe_tx0 Not tainted 5.18.0-rc7-syzkaller-dirty #0
[    9.810733][ T1233] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
[    9.810733][ T1233] Call Trace:
[    9.810733][ T1233]  <TASK>
[    9.810733][ T1233]  dump_stack_lvl+0x1e3/0x2cb
[    9.810733][ T1233]  ? bfq_pos_tree_add_move+0x436/0x436
[    9.810733][ T1233]  ? panic+0x76e/0x76e
[    9.810733][ T1233]  ? vscnprintf+0x59/0x80
[    9.810733][ T1233]  ? refcount_warn_saturate+0x120/0x1a0
[    9.810733][ T1233]  panic+0x312/0x76e
[    9.810733][ T1233]  ? __warn+0x131/0x220
[    9.810733][ T1233]  ? fb_is_primary_device+0xcc/0xcc
[    9.810733][ T1233]  ? ret_from_fork+0x1f/0x30
[    9.810733][ T1233]  ? refcount_warn_saturate+0x17c/0x1a0
[    9.810733][ T1233]  __warn+0x1fa/0x220
[    9.810733][ T1233]  ? refcount_warn_saturate+0x17c/0x1a0
[    9.845860][    T1] usbcore: registered new interface driver snd-usb-audio
[    9.846654][    T1] usbcore: registered new interface driver snd-ua101
[    9.847409][    T1] usbcore: registered new interface driver snd-usb-usx2y
[    9.848855][    T1] usbcore: registered new interface driver snd-usb-us122l
[    9.853684][    T1] usbcore: registered new interface driver snd-usb-caiaq
[    9.856046][    T1] usbcore: registered new interface driver snd-usb-6fire
[    9.860384][    T1] usbcore: registered new interface driver snd-usb-hiface
[    9.863557][    T1] usbcore: registered new interface driver snd-bcd2000
[    9.864161][    T1] usbcore: registered new interface driver snd_usb_pod
[    9.864962][    T1] usbcore: registered new interface driver snd_usb_podhd
[    9.865647][    T1] usbcore: registered new interface driver snd_usb_toneport
[    9.866260][    T1] usbcore: registered new interface driver snd_usb_variax
[    9.867610][    T1] drop_monitor: Initializing network drop monitor service
[    9.868126][    T1] NET: Registered PF_LLC protocol family
[    9.868421][    T1] GACT probability on
[    9.868478][    T1] Mirror/redirect action on
[    9.868814][    T1] Simple TC action Loaded
[    9.860705][ T1233]  report_bug+0x1b1/0x2e0
[    9.860705][ T1233]  handle_bug+0x3d/0x70
[    9.860705][ T1233]  exc_invalid_op+0x16/0x40
[    9.860705][ T1233]  asm_exc_invalid_op+0x12/0x20
[    9.860705][ T1233] RIP: 0010:refcount_warn_saturate+0x17c/0x1a0
[    9.860705][ T1233] Code: e8 8a 31 c0 e8 65 80 26 fd 0f 0b e9 64 ff ff ff e8 b9 14 5d fd c6 05 bc 02 c5 09 01 48 c7 c7 80 4b e8 8a 31 c0 e8 44 80 26 fd <0f> 0b e9 43 ff ff ff 89 d9 80 e1 07 80 c1 03 38 c1 0f 8c a2 fe ff
[    9.860705][ T1233] RSP: 0000:ffffc900050afc28 EFLAGS: 00010246
[    9.860705][ T1233] RAX: f57a10d46fd60000 RBX: 0000000000000004 RCX: ffff88801e663b00
[    9.860705][ T1233] RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000
[    9.860705][ T1233] RBP: 0000000000000004 R08: ffffffff816ad552 R09: fffff52000a15ed5
[    9.860705][ T1233] R10: fffff52000a15ed5 R11: 1ffff92000a15ed4 R12: ffff8881459f05b8
[    9.860705][ T1233] R13: 1ffff92000a15f8c R14: ffff8881459f0600 R15: dffffc0000000000
[    9.860705][ T1233]  ? wake_up_klogd+0xb2/0xf0
[    9.860705][ T1233]  ? refcount_warn_saturate+0x17c/0x1a0
[    9.860705][ T1233]  ref_tracker_free+0x659/0x7a0
[    9.860705][ T1233]  ? refcount_inc+0x80/0x80
[    9.860705][ T1233]  ? do_raw_spin_unlock+0x134/0x8a0
[    9.860705][ T1233]  ? _raw_spin_unlock_irq+0x1f/0x40
[    9.860705][ T1233]  ? lockdep_hardirqs_on+0x95/0x140
[    9.860705][ T1233]  tx+0xc9/0x190
[    9.860705][ T1233]  ? aoenet_xmit+0x1a0/0x1a0
[    9.860705][ T1233]  kthread+0x241/0x450
[    9.860705][ T1233]  ? aoe_ktstart+0x130/0x130
[    9.860705][ T1233]  ? do_task_dead+0xc0/0xc0
[    9.860705][ T1233]  ? _raw_spin_unlock+0x40/0x40
[    9.860705][ T1233]  ? lockdep_hardirqs_on_prepare+0x448/0x7b0
[    9.860705][ T1233]  ? __kthread_parkme+0x166/0x1c0
[    9.860705][ T1233]  kthread+0x266/0x300
[    9.860705][ T1233]  ? aoe_ktstart+0x130/0x130
[    9.860705][ T1233]  ? kthread_blkcg+0xd0/0xd0
[    9.860705][ T1233]  ret_from_fork+0x1f/0x30
[    9.860705][ T1233]  </TASK>
[    9.860705][ T1233] Kernel Offset: disabled
[    9.860705][ T1233] Rebooting in 86400 seconds..


syzkaller build log:
go env (err=<nil>)
GO111MODULE="auto"
GOARCH="amd64"
GOBIN=""
GOCACHE="/syzkaller/.cache/go-build"
GOENV="/syzkaller/.config/go/env"
GOEXE=""
GOEXPERIMENT=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOINSECURE=""
GOMODCACHE="/syzkaller/jobs/linux/gopath/pkg/mod"
GONOPROXY=""
GONOSUMDB=""
GOOS="linux"
GOPATH="/syzkaller/jobs/linux/gopath"
GOPRIVATE=""
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/usr/local/go"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/usr/local/go/pkg/tool/linux_amd64"
GOVCS=""
GOVERSION="go1.17"
GCCGO="gccgo"
AR="ar"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
GOMOD="/syzkaller/jobs/linux/gopath/src/github.com/google/syzkaller/go.mod"
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build3020494642=/tmp/go-build -gno-record-gcc-switches"

git status (err=<nil>)
HEAD detached at 744a39e22
nothing to commit, working tree clean


go list -f '{{.Stale}}' ./sys/syz-sysgen | grep -q false || go install ./sys/syz-sysgen
make .descriptions
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=744a39e220cece33e207035facce6c5ae161b775 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20220514-093120'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-fuzzer github.com/google/syzkaller/syz-fuzzer
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=744a39e220cece33e207035facce6c5ae161b775 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20220514-093120'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=744a39e220cece33e207035facce6c5ae161b775 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20220514-093120'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-stress github.com/google/syzkaller/tools/syz-stress
mkdir -p ./bin/linux_amd64
gcc -o ./bin/linux_amd64/syz-executor executor/executor.cc \
	-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -static-pie -fpermissive -w -DGOOS_linux=1 -DGOARCH_amd64=1 \
	-DHOSTGOOS_linux=1 -DGIT_REVISION=\"744a39e220cece33e207035facce6c5ae161b775\"


Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=125fadbe880000


Tested on:

commit:         42226c98 Linux 5.18-rc7
git tree:       https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel config:  https://syzkaller.appspot.com/x/.config?x=d84df8e1a4c4d5a4
dashboard link: https://syzkaller.appspot.com/bug?extid=10a7a8ca6e94600110ec
compiler:       Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2
patch:          https://syzkaller.appspot.com/x/patch.diff?x=161ac065880000