From: syzbot <syzbot+d4d8c0fd15a0abe39bcf@syzkaller.appspotmail.com>
To: hdanton@sina.com, linux-kernel@vger.kernel.org,
syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [net?] KASAN: slab-use-after-free Read in taprio_dump
Date: Wed, 20 Dec 2023 04:44:04 -0800 [thread overview]
Message-ID: <000000000000999995060cf05663@google.com> (raw)
In-Reply-To: <20231220111554.1127-1-hdanton@sina.com>
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
WARNING in call_rcu
------------[ cut here ]------------
ODEBUG: activate active (active state 1) object: 0000000040a741f2 object type: rcu_head hint: 0x0
WARNING: CPU: 0 PID: 10724 at lib/debugobjects.c:517 debug_print_object lib/debugobjects.c:514 [inline]
WARNING: CPU: 0 PID: 10724 at lib/debugobjects.c:517 debug_object_activate+0x578/0x7e0 lib/debugobjects.c:733
Modules linked in:
CPU: 0 PID: 10724 Comm: syz-executor.4 Not tainted 6.7.0-rc5-syzkaller-00083-gd5b235ec8eab-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023
pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : debug_print_object lib/debugobjects.c:514 [inline]
pc : debug_object_activate+0x578/0x7e0 lib/debugobjects.c:733
lr : debug_print_object lib/debugobjects.c:514 [inline]
lr : debug_object_activate+0x578/0x7e0 lib/debugobjects.c:733
sp : ffff800080007a00
x29: ffff800080007ad0 x28: dfff800000000000 x27: ffff700010000f44
x26: 0000000000000000 x25: ffff0000da75c900 x24: 0000000000000000
x23: ffff80008a9af3a0 x22: ffff80008ae8cdc0 x21: 0000000000000001
x20: ffff80008a9af3a0 x19: ffff0000da75c900 x18: ffff800080006ee0
x17: 6631343761303430 x16: ffff80008a82f460 x15: 0000000000000001
x14: 1fffe0003682623a x13: 0000000000000000 x12: 0000000000000000
x11: 0000000000010004 x10: 0000000000ff0100 x9 : f1155cbcba9a1100
x8 : f1155cbcba9a1100 x7 : 0000000000000001 x6 : 0000000000000001
x5 : ffff8000800072f8 x4 : ffff80008e5d2600 x3 : ffff8000805ad1c0
x2 : 0000000000000001 x1 : 0000000100010002 x0 : 0000000000000000
Call trace:
debug_print_object lib/debugobjects.c:514 [inline]
debug_object_activate+0x578/0x7e0 lib/debugobjects.c:733
debug_rcu_head_queue kernel/rcu/rcu.h:227 [inline]
__call_rcu_common kernel/rcu/tree.c:2666 [inline]
call_rcu+0x48/0xaf4 kernel/rcu/tree.c:2795
switch_schedules net/sched/sch_taprio.c:210 [inline]
advance_sched+0x7e0/0xac0 net/sched/sch_taprio.c:984
__run_hrtimer kernel/time/hrtimer.c:1688 [inline]
__hrtimer_run_queues+0x484/0xca0 kernel/time/hrtimer.c:1752
hrtimer_interrupt+0x2c0/0xb64 kernel/time/hrtimer.c:1814
timer_handler drivers/clocksource/arm_arch_timer.c:674 [inline]
arch_timer_handler_virt+0x74/0x88 drivers/clocksource/arm_arch_timer.c:685
handle_percpu_devid_irq+0x2a4/0x804 kernel/irq/chip.c:942
generic_handle_irq_desc include/linux/irqdesc.h:161 [inline]
handle_irq_desc kernel/irq/irqdesc.c:672 [inline]
generic_handle_domain_irq+0x7c/0xc4 kernel/irq/irqdesc.c:728
__gic_handle_irq drivers/irqchip/irq-gic-v3.c:782 [inline]
__gic_handle_irq_from_irqson drivers/irqchip/irq-gic-v3.c:833 [inline]
gic_handle_irq+0x6c/0x190 drivers/irqchip/irq-gic-v3.c:877
call_on_irq_stack+0x24/0x4c arch/arm64/kernel/entry.S:886
do_interrupt_handler+0xd4/0x138 arch/arm64/kernel/entry-common.c:276
__el1_irq arch/arm64/kernel/entry-common.c:502 [inline]
el1_interrupt+0x34/0x68 arch/arm64/kernel/entry-common.c:517
el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:522
el1h_64_irq+0x64/0x68 arch/arm64/kernel/entry.S:591
__daif_local_irq_restore arch/arm64/include/asm/irqflags.h:176 [inline]
arch_local_irq_restore arch/arm64/include/asm/irqflags.h:196 [inline]
__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline]
_raw_spin_unlock_irqrestore+0x44/0x98 kernel/locking/spinlock.c:194
unlock_hrtimer_base kernel/time/hrtimer.c:1020 [inline]
hrtimer_start_range_ns+0x8a0/0x9ac kernel/time/hrtimer.c:1304
hrtimer_start include/linux/hrtimer.h:418 [inline]
taprio_dump+0xa40/0xc68 net/sched/sch_taprio.c:2444
tc_fill_qdisc+0x570/0xf1c net/sched/sch_api.c:952
qdisc_notify+0x1a0/0x338 net/sched/sch_api.c:1024
tc_modify_qdisc+0x16d4/0x1870 net/sched/sch_api.c:1719
rtnetlink_rcv_msg+0x748/0xdbc net/core/rtnetlink.c:6558
netlink_rcv_skb+0x214/0x3c4 net/netlink/af_netlink.c:2545
rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:6576
netlink_unicast_kernel net/netlink/af_netlink.c:1342 [inline]
netlink_unicast+0x65c/0x898 net/netlink/af_netlink.c:1368
netlink_sendmsg+0x83c/0xb20 net/netlink/af_netlink.c:1910
sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg net/socket.c:745 [inline]
____sys_sendmsg+0x56c/0x840 net/socket.c:2584
___sys_sendmsg net/socket.c:2638 [inline]
__sys_sendmsg+0x26c/0x33c net/socket.c:2667
__do_sys_sendmsg net/socket.c:2676 [inline]
__se_sys_sendmsg net/socket.c:2674 [inline]
__arm64_sys_sendmsg+0x80/0x94 net/socket.c:2674
__invoke_syscall arch/arm64/kernel/syscall.c:37 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:51
el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:136
do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:155
el0_svc+0x54/0x158 arch/arm64/kernel/entry-common.c:678
el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:696
el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:595
irq event stamp: 2628
hardirqs last enabled at (2627): [<ffff80008a91ca44>] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline]
hardirqs last enabled at (2627): [<ffff80008a91ca44>] _raw_spin_unlock_irqrestore+0x38/0x98 kernel/locking/spinlock.c:194
hardirqs last disabled at (2628): [<ffff80008a82b044>] __el1_irq arch/arm64/kernel/entry-common.c:499 [inline]
hardirqs last disabled at (2628): [<ffff80008a82b044>] el1_interrupt+0x24/0x68 arch/arm64/kernel/entry-common.c:517
softirqs last enabled at (2616): [<ffff800088d03038>] spin_unlock_bh include/linux/spinlock.h:396 [inline]
softirqs last enabled at (2616): [<ffff800088d03038>] taprio_change+0x3504/0x3d40 net/sched/sch_taprio.c:2010
softirqs last disabled at (2608): [<ffff800088d029c0>] spin_lock_bh include/linux/spinlock.h:356 [inline]
softirqs last disabled at (2608): [<ffff800088d029c0>] taprio_change+0x2e8c/0x3d40 net/sched/sch_taprio.c:1943
---[ end trace 0000000000000000 ]---
------------[ cut here ]------------
ODEBUG: active_state active (active state 1) object: 0000000040a741f2 object type: rcu_head hint: 0x0
WARNING: CPU: 0 PID: 10724 at lib/debugobjects.c:517 debug_print_object lib/debugobjects.c:514 [inline]
WARNING: CPU: 0 PID: 10724 at lib/debugobjects.c:517 debug_object_active_state+0x2e4/0x414 lib/debugobjects.c:993
Modules linked in:
CPU: 0 PID: 10724 Comm: syz-executor.4 Tainted: G W 6.7.0-rc5-syzkaller-00083-gd5b235ec8eab-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023
pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : debug_print_object lib/debugobjects.c:514 [inline]
pc : debug_object_active_state+0x2e4/0x414 lib/debugobjects.c:993
lr : debug_print_object lib/debugobjects.c:514 [inline]
lr : debug_object_active_state+0x2e4/0x414 lib/debugobjects.c:993
sp : ffff800080007ac0
x29: ffff800080007ad0 x28: ffff80008e4f0000 x27: dfff800000000000
x26: 1fffe0001ac85cf7 x25: ffff800092d4d000 x24: 1fffe0001ac85cf8
x23: 0000000000000000 x22: ffff0000da75c900 x21: ffff80008a9af3a0
x20: ffff80008ae8cdc0 x19: 0000000000000001 x18: ffff800080006ee0
x17: 6130343030303030 x16: ffff80008a82f460 x15: 0000000000000001
x14: 1fffe0003682623a x13: 0000000000000000 x12: 0000000000000000
x11: 0000000000010004 x10: 0000000000ff0100 x9 : f1155cbcba9a1100
x8 : f1155cbcba9a1100 x7 : 0000000000000001 x6 : 0000000000000001
x5 : ffff8000800073b8 x4 : ffff80008e5d2600 x3 : ffff8000805ad1c0
x2 : 0000000000000001 x1 : 0000000100010002 x0 : 0000000000000000
Call trace:
debug_print_object lib/debugobjects.c:514 [inline]
debug_object_active_state+0x2e4/0x414 lib/debugobjects.c:993
debug_rcu_head_queue kernel/rcu/rcu.h:228 [inline]
__call_rcu_common kernel/rcu/tree.c:2666 [inline]
call_rcu+0x60/0xaf4 kernel/rcu/tree.c:2795
switch_schedules net/sched/sch_taprio.c:210 [inline]
advance_sched+0x7e0/0xac0 net/sched/sch_taprio.c:984
__run_hrtimer kernel/time/hrtimer.c:1688 [inline]
__hrtimer_run_queues+0x484/0xca0 kernel/time/hrtimer.c:1752
hrtimer_interrupt+0x2c0/0xb64 kernel/time/hrtimer.c:1814
timer_handler drivers/clocksource/arm_arch_timer.c:674 [inline]
arch_timer_handler_virt+0x74/0x88 drivers/clocksource/arm_arch_timer.c:685
handle_percpu_devid_irq+0x2a4/0x804 kernel/irq/chip.c:942
generic_handle_irq_desc include/linux/irqdesc.h:161 [inline]
handle_irq_desc kernel/irq/irqdesc.c:672 [inline]
generic_handle_domain_irq+0x7c/0xc4 kernel/irq/irqdesc.c:728
__gic_handle_irq drivers/irqchip/irq-gic-v3.c:782 [inline]
__gic_handle_irq_from_irqson drivers/irqchip/irq-gic-v3.c:833 [inline]
gic_handle_irq+0x6c/0x190 drivers/irqchip/irq-gic-v3.c:877
call_on_irq_stack+0x24/0x4c arch/arm64/kernel/entry.S:886
do_interrupt_handler+0xd4/0x138 arch/arm64/kernel/entry-common.c:276
__el1_irq arch/arm64/kernel/entry-common.c:502 [inline]
el1_interrupt+0x34/0x68 arch/arm64/kernel/entry-common.c:517
el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:522
el1h_64_irq+0x64/0x68 arch/arm64/kernel/entry.S:591
__daif_local_irq_restore arch/arm64/include/asm/irqflags.h:176 [inline]
arch_local_irq_restore arch/arm64/include/asm/irqflags.h:196 [inline]
__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline]
_raw_spin_unlock_irqrestore+0x44/0x98 kernel/locking/spinlock.c:194
unlock_hrtimer_base kernel/time/hrtimer.c:1020 [inline]
hrtimer_start_range_ns+0x8a0/0x9ac kernel/time/hrtimer.c:1304
hrtimer_start include/linux/hrtimer.h:418 [inline]
taprio_dump+0xa40/0xc68 net/sched/sch_taprio.c:2444
tc_fill_qdisc+0x570/0xf1c net/sched/sch_api.c:952
qdisc_notify+0x1a0/0x338 net/sched/sch_api.c:1024
tc_modify_qdisc+0x16d4/0x1870 net/sched/sch_api.c:1719
rtnetlink_rcv_msg+0x748/0xdbc net/core/rtnetlink.c:6558
netlink_rcv_skb+0x214/0x3c4 net/netlink/af_netlink.c:2545
rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:6576
netlink_unicast_kernel net/netlink/af_netlink.c:1342 [inline]
netlink_unicast+0x65c/0x898 net/netlink/af_netlink.c:1368
netlink_sendmsg+0x83c/0xb20 net/netlink/af_netlink.c:1910
sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg net/socket.c:745 [inline]
____sys_sendmsg+0x56c/0x840 net/socket.c:2584
___sys_sendmsg net/socket.c:2638 [inline]
__sys_sendmsg+0x26c/0x33c net/socket.c:2667
__do_sys_sendmsg net/socket.c:2676 [inline]
__se_sys_sendmsg net/socket.c:2674 [inline]
__arm64_sys_sendmsg+0x80/0x94 net/socket.c:2674
__invoke_syscall arch/arm64/kernel/syscall.c:37 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:51
el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:136
do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:155
el0_svc+0x54/0x158 arch/arm64/kernel/entry-common.c:678
el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:696
el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:595
irq event stamp: 2628
hardirqs last enabled at (2627): [<ffff80008a91ca44>] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline]
hardirqs last enabled at (2627): [<ffff80008a91ca44>] _raw_spin_unlock_irqrestore+0x38/0x98 kernel/locking/spinlock.c:194
hardirqs last disabled at (2628): [<ffff80008a82b044>] __el1_irq arch/arm64/kernel/entry-common.c:499 [inline]
hardirqs last disabled at (2628): [<ffff80008a82b044>] el1_interrupt+0x24/0x68 arch/arm64/kernel/entry-common.c:517
softirqs last enabled at (2616): [<ffff800088d03038>] spin_unlock_bh include/linux/spinlock.h:396 [inline]
softirqs last enabled at (2616): [<ffff800088d03038>] taprio_change+0x3504/0x3d40 net/sched/sch_taprio.c:2010
softirqs last disabled at (2608): [<ffff800088d029c0>] spin_lock_bh include/linux/spinlock.h:356 [inline]
softirqs last disabled at (2608): [<ffff800088d029c0>] taprio_change+0x2e8c/0x3d40 net/sched/sch_taprio.c:1943
---[ end trace 0000000000000000 ]---
rcu: __call_rcu_common(): Double-freed CB 0000000040a741f2->taprio_free_sched_cb+0x0/0x178()!!! slab kmalloc-512 start ffff0000da75c800 pointer offset 256 size 512
Tested on:
commit: d5b235ec Merge branch 'for-next/core' into for-kernelci
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=11d6e2bee80000
kernel config: https://syzkaller.appspot.com/x/.config?x=f36ea342ce412b14
dashboard link: https://syzkaller.appspot.com/bug?extid=d4d8c0fd15a0abe39bcf
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64
patch: https://syzkaller.appspot.com/x/patch.diff?x=11e0f416e80000
next prev parent reply other threads:[~2023-12-20 12:44 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-12-18 14:33 [syzbot] [net?] KASAN: slab-use-after-free Read in taprio_dump syzbot
2023-12-19 10:59 ` Hillf Danton
2023-12-19 11:20 ` syzbot
2023-12-20 11:15 ` Hillf Danton
2023-12-20 12:44 ` syzbot [this message]
2023-12-21 4:36 ` Hillf Danton
2023-12-21 5:02 ` syzbot
2024-11-05 11:14 ` Jeongjun Park
2024-11-05 20:41 ` syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=000000000000999995060cf05663@google.com \
--to=syzbot+d4d8c0fd15a0abe39bcf@syzkaller.appspotmail.com \
--cc=hdanton@sina.com \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.