From: Denys Fedoryshchenko <nuclearcat@nuclearcat.com>
To: Guillaume Nault <g.nault@alphalink.fr>
Cc: Linux Kernel Network Developers <netdev@vger.kernel.org>
Subject: Re: ppp/pppoe, still panic 4.15.3 in ppp_push
Date: Wed, 21 Feb 2018 12:26:51 +0200 [thread overview]
Message-ID: <ba6cd172193fb55c55b9bfb99a364c8f@nuclearcat.com> (raw)
In-Reply-To: <20180216184812.GM1422@alphalink.fr>
It seems even rebuilding seemingly stable version triggering crashes too
(but different ones)
Maybe it is coincidence, and bug reproducer appeared in network same
time i decided to upgrade kernel,
as it happened with xt_MSS(and that bug existed for years).
Deleted quoting, i added more debug options (as much as performance
degradation allows me).
This is vanilla again:
[14834.090421]
==================================================================
[14834.091157] BUG: KASAN: use-after-free in __list_add_valid+0x69/0xad
[14834.091521] Read of size 8 at addr ffff8803dbeb8660 by task
accel-pppd/12636
[14834.091905]
[14834.092282] CPU: 0 PID: 12636 Comm: accel-pppd Not tainted
4.15.4-build-0134 #1
[14834.092930] Hardware name: HP ProLiant DL320e Gen8 v2, BIOS P80
04/02/2015
[14834.093320] Call Trace:
[14834.093680] dump_stack+0xb3/0x13e
[14834.094050] ? _atomic_dec_and_lock+0x10f/0x10f
[14834.094434] print_address_description+0x69/0x236
[14834.094814] ? __list_add_valid+0x69/0xad
[14834.095197] kasan_report+0x219/0x23f
[14834.095570] __list_add_valid+0x69/0xad
[14834.095957] ppp_ioctl+0x1216/0x2201 [ppp_generic]
[14834.096348] ? ppp_write+0x1cc/0x1cc [ppp_generic]
[14834.096723] ? get_usage_char.isra.2+0x36/0x36
[14834.097094] ? packet_poll+0x362/0x362
[14834.097455] ? lock_downgrade+0x4d0/0x4d0
[14834.097811] ? rcu_irq_enter_disabled+0x8/0x8
[14834.098187] ? get_usage_char.isra.2+0x36/0x36
[14834.098561] ? __fget+0x3b8/0x3eb
[14834.098936] ? get_usage_char.isra.2+0x36/0x36
[14834.099309] ? __fget+0x3a0/0x3eb
[14834.099682] ? get_usage_char.isra.2+0x36/0x36
[14834.100069] ? __fget+0x3a0/0x3eb
[14834.100443] ? lock_downgrade+0x4d0/0x4d0
[14834.100814] ? rcu_irq_enter_disabled+0x8/0x8
[14834.101203] ? __fget+0x3b8/0x3eb
[14834.101581] ? expand_files+0x62f/0x62f
[14834.101945] ? kernel_read+0xed/0xed
[14834.102322] ? SyS_getpeername+0x28b/0x28b
[14834.102690] vfs_ioctl+0x6e/0x81
[14834.103049] do_vfs_ioctl+0xe2f/0xe62
[14834.103413] ? ioctl_preallocate+0x211/0x211
[14834.103778] ? __fget_light+0x28c/0x2ca
[14834.104150] ? iterate_fd+0x2a8/0x2a8
[14834.104526] ? SyS_rt_sigprocmask+0x12e/0x181
[14834.104876] ? sigprocmask+0x23f/0x23f
[14834.105231] ? SyS_write+0x148/0x173
[14834.105580] ? SyS_read+0x173/0x173
[14834.105943] SyS_ioctl+0x39/0x55
[14834.106316] ? do_vfs_ioctl+0xe62/0xe62
[14834.106694] do_syscall_64+0x262/0x594
[14834.107076] ? syscall_return_slowpath+0x351/0x351
[14834.107447] ? up_read+0x17/0x2c
[14834.107806] ? __do_page_fault+0x68a/0x763
[14834.108171] ? entry_SYSCALL_64_after_hwframe+0x36/0x9b
[14834.108550] ? trace_hardirqs_off_thunk+0x1a/0x1c
[14834.108937] entry_SYSCALL_64_after_hwframe+0x26/0x9b
[14834.109293] RIP: 0033:0x7fc9be3758a7
[14834.109652] RSP: 002b:00007fc9bf92aaf8 EFLAGS: 00000206 ORIG_RAX:
0000000000000010
[14834.110313] RAX: ffffffffffffffda RBX: 00007fc9bdc5e1e3 RCX:
00007fc9be3758a7
[14834.110707] RDX: 00007fc9b7ad13e8 RSI: 000000004004743a RDI:
0000000000004b9f
[14834.111082] RBP: 00007fc9bf92ab20 R08: 0000000000000000 R09:
000055f07a27fe40
[14834.111471] R10: 0000000000000008 R11: 0000000000000206 R12:
00007fc9b7ad12d8
[14834.111845] R13: 00007ffd06346a6f R14: 0000000000000000 R15:
00007fc9bf92b700
[14834.112231]
[14834.112589] Allocated by task 12636:
[14834.112962] ppp_register_net_channel+0xc4/0x610 [ppp_generic]
[14834.113331] pppoe_connect+0xe6d/0x1097 [pppoe]
[14834.113691] SyS_connect+0x19c/0x274
[14834.114054] do_syscall_64+0x262/0x594
[14834.114421] entry_SYSCALL_64_after_hwframe+0x26/0x9b
[14834.114792]
[14834.115139] Freed by task 12636:
[14834.115504] kfree+0xe2/0x154
[14834.115866] ppp_release+0x11b/0x12a [ppp_generic]
[14834.116240] __fput+0x342/0x5ba
[14834.116611] task_work_run+0x15d/0x198
[14834.116973] exit_to_usermode_loop+0xc7/0x153
[14834.117320] do_syscall_64+0x53d/0x594
[14834.117694] entry_SYSCALL_64_after_hwframe+0x26/0x9b
[14834.118067]
[14834.118426] The buggy address belongs to the object at
ffff8803dbeb8480
[14834.119087] The buggy address is located 480 bytes inside of
[14834.119755] The buggy address belongs to the page:
[14834.120138] page:ffffea000f6fae00 count:1 mapcount:0 mapping:
(null) index:0xffff8803dbebd580 compound_mapcount: 0
[14834.120817] flags: 0x17ffe00000008100(slab|head)
[14834.121171] raw: 17ffe00000008100 0000000000000000 ffff8803dbebd580
00000001001c001b
[14834.121800] raw: ffffea000d718020 ffffea000d32d620 ffff8803f080ee80
0000000000000000
[14834.122415] page dumped because: kasan: bad access detected
[14834.122787]
[14834.123140] Memory state around the buggy address:
[14834.123503] ffff8803dbeb8500: fb fb fb fb fb fb fb fb fb fb fb fb fb
fb fb fb
[14834.124150] ffff8803dbeb8580: fb fb fb fb fb fb fb fb fb fb fb fb fb
fb fb fb
[14834.124806] >ffff8803dbeb8600: fb fb fb fb fb fb fb fb fb fb fb fb fb
fb fb fb
[14834.125467] ^
[14834.125848] ffff8803dbeb8680: fb fb fb fb fb fb fb fb fb fb fb fb fb
fb fb fb
[14834.126493] ffff8803dbeb8700: fb fb fb fb fb fb fb fb fb fb fb fb fb
fb fb fb
[14834.127143]
==================================================================
[14834.127768] Disabling lock debugging due to kernel taint
ferrari-dns 10.0.252.9 # cat udp-2018_02_21.log |grep "Feb 21 06:02:14
10.0.252.9"
[14834.090421]
==================================================================
[14834.091157] BUG: KASAN: use-after-free in __list_add_valid+0x69/0xad
[14834.091521] Read of size 8 at addr ffff8803dbeb8660 by task
accel-pppd/12636
[14834.091905]
[14834.092282] CPU: 0 PID: 12636 Comm: accel-pppd Not tainted
4.15.4-build-0134 #1
[14834.092930] Hardware name: HP ProLiant DL320e Gen8 v2, BIOS P80
04/02/2015
[14834.093320] Call Trace:
[14834.093680] dump_stack+0xb3/0x13e
[14834.094050] ? _atomic_dec_and_lock+0x10f/0x10f
[14834.094434] print_address_description+0x69/0x236
[14834.094814] ? __list_add_valid+0x69/0xad
[14834.095197] kasan_report+0x219/0x23f
[14834.095570] __list_add_valid+0x69/0xad
[14834.095957] ppp_ioctl+0x1216/0x2201 [ppp_generic]
[14834.096348] ? ppp_write+0x1cc/0x1cc [ppp_generic]
[14834.096723] ? get_usage_char.isra.2+0x36/0x36
[14834.097094] ? packet_poll+0x362/0x362
[14834.097455] ? lock_downgrade+0x4d0/0x4d0
[14834.097811] ? rcu_irq_enter_disabled+0x8/0x8
[14834.098187] ? get_usage_char.isra.2+0x36/0x36
[14834.098561] ? __fget+0x3b8/0x3eb
[14834.098936] ? get_usage_char.isra.2+0x36/0x36
[14834.099309] ? __fget+0x3a0/0x3eb
[14834.099682] ? get_usage_char.isra.2+0x36/0x36
[14834.100069] ? __fget+0x3a0/0x3eb
[14834.100443] ? lock_downgrade+0x4d0/0x4d0
[14834.100814] ? rcu_irq_enter_disabled+0x8/0x8
[14834.101203] ? __fget+0x3b8/0x3eb
[14834.101581] ? expand_files+0x62f/0x62f
[14834.101945] ? kernel_read+0xed/0xed
[14834.102322] ? SyS_getpeername+0x28b/0x28b
[14834.102690] vfs_ioctl+0x6e/0x81
[14834.103049] do_vfs_ioctl+0xe2f/0xe62
[14834.103413] ? ioctl_preallocate+0x211/0x211
[14834.103778] ? __fget_light+0x28c/0x2ca
[14834.104150] ? iterate_fd+0x2a8/0x2a8
[14834.104526] ? SyS_rt_sigprocmask+0x12e/0x181
[14834.104876] ? sigprocmask+0x23f/0x23f
[14834.105231] ? SyS_write+0x148/0x173
[14834.105580] ? SyS_read+0x173/0x173
[14834.105943] SyS_ioctl+0x39/0x55
[14834.106316] ? do_vfs_ioctl+0xe62/0xe62
[14834.106694] do_syscall_64+0x262/0x594
[14834.107076] ? syscall_return_slowpath+0x351/0x351
[14834.107447] ? up_read+0x17/0x2c
[14834.107806] ? __do_page_fault+0x68a/0x763
[14834.108171] ? entry_SYSCALL_64_after_hwframe+0x36/0x9b
[14834.108550] ? trace_hardirqs_off_thunk+0x1a/0x1c
[14834.108937] entry_SYSCALL_64_after_hwframe+0x26/0x9b
[14834.109293] RIP: 0033:0x7fc9be3758a7
[14834.109652] RSP: 002b:00007fc9bf92aaf8 EFLAGS: 00000206 ORIG_RAX:
0000000000000010
[14834.110313] RAX: ffffffffffffffda RBX: 00007fc9bdc5e1e3 RCX:
00007fc9be3758a7
[14834.110707] RDX: 00007fc9b7ad13e8 RSI: 000000004004743a RDI:
0000000000004b9f
[14834.111082] RBP: 00007fc9bf92ab20 R08: 0000000000000000 R09:
000055f07a27fe40
[14834.111471] R10: 0000000000000008 R11: 0000000000000206 R12:
00007fc9b7ad12d8
[14834.111845] R13: 00007ffd06346a6f R14: 0000000000000000 R15:
00007fc9bf92b700
[14834.112231]
[14834.112589] Allocated by task 12636:
[14834.112962] ppp_register_net_channel+0xc4/0x610 [ppp_generic]
[14834.113331] pppoe_connect+0xe6d/0x1097 [pppoe]
[14834.113691] SyS_connect+0x19c/0x274
[14834.114054] do_syscall_64+0x262/0x594
[14834.114421] entry_SYSCALL_64_after_hwframe+0x26/0x9b
[14834.114792]
[14834.115139] Freed by task 12636:
[14834.115504] kfree+0xe2/0x154
[14834.115866] ppp_release+0x11b/0x12a [ppp_generic]
[14834.116240] __fput+0x342/0x5ba
[14834.116611] task_work_run+0x15d/0x198
[14834.116973] exit_to_usermode_loop+0xc7/0x153
[14834.117320] do_syscall_64+0x53d/0x594
[14834.117694] entry_SYSCALL_64_after_hwframe+0x26/0x9b
[14834.118067]
[14834.118426] The buggy address belongs to the object at
ffff8803dbeb8480
[14834.119087] The buggy address is located 480 bytes inside of
[14834.119755] The buggy address belongs to the page:
[14834.120138] page:ffffea000f6fae00 count:1 mapcount:0 mapping:
(null) index:0xffff8803dbebd580 compound_mapcount: 0
[14834.120817] flags: 0x17ffe00000008100(slab|head)
[14834.121171] raw: 17ffe00000008100 0000000000000000 ffff8803dbebd580
00000001001c001b
[14834.121800] raw: ffffea000d718020 ffffea000d32d620 ffff8803f080ee80
0000000000000000
[14834.122415] page dumped because: kasan: bad access detected
[14834.122787]
[14834.123140] Memory state around the buggy address:
[14834.123503] ffff8803dbeb8500: fb fb fb fb fb fb fb fb fb fb fb fb fb
fb fb fb
[14834.124150] ffff8803dbeb8580: fb fb fb fb fb fb fb fb fb fb fb fb fb
fb fb fb
[14834.124806] >ffff8803dbeb8600: fb fb fb fb fb fb fb fb fb fb fb fb fb
fb fb fb
[14834.125467] ^
[14834.125848] ffff8803dbeb8680: fb fb fb fb fb fb fb fb fb fb fb fb fb
fb fb fb
[14834.126493] ffff8803dbeb8700: fb fb fb fb fb fb fb fb fb fb fb fb fb
fb fb fb
[14834.127143]
==================================================================
[14834.127768] Disabling lock debugging due to kernel taint
next prev parent reply other threads:[~2018-02-21 10:26 UTC|newest]
Thread overview: 37+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-02-14 13:17 ppp/pppoe, still panic 4.15.3 in ppp_push Denys Fedoryshchenko
2018-02-14 16:07 ` Guillaume Nault
2018-02-14 16:29 ` Denys Fedoryshchenko
2018-02-14 16:47 ` Guillaume Nault
2018-02-14 16:49 ` Denys Fedoryshchenko
2018-02-14 17:25 ` Guillaume Nault
2018-02-15 10:19 ` Denys Fedoryshchenko
2018-02-15 15:55 ` Guillaume Nault
2018-02-15 16:01 ` Denys Fedoryshchenko
2018-02-15 19:31 ` Guillaume Nault
2018-02-15 19:34 ` Denys Fedoryshchenko
2018-02-15 19:42 ` Guillaume Nault
2018-02-16 11:13 ` Denys Fedoryshchenko
2018-02-16 18:48 ` Guillaume Nault
2018-02-18 10:01 ` Denys Fedoryshchenko
2018-02-21 18:38 ` Guillaume Nault
2018-02-20 9:05 ` Denys Fedoryshchenko
2018-02-21 10:26 ` Denys Fedoryshchenko [this message]
2018-02-21 18:55 ` Guillaume Nault
2018-02-21 19:30 ` Denys Fedoryshchenko
2018-02-21 20:04 ` Cong Wang
2018-02-22 18:30 ` Guillaume Nault
2018-02-22 18:51 ` Denys Fedoryshchenko
2018-02-23 9:38 ` Guillaume Nault
2018-02-23 9:41 ` Denys Fedoryshchenko
2018-02-23 10:07 ` Guillaume Nault
2018-02-23 10:54 ` Denys Fedoryshchenko
2018-02-24 21:22 ` Denys Fedoryshchenko
2018-02-27 10:58 ` Denys Fedoryshchenko
2018-02-27 18:56 ` Guillaume Nault
2018-03-01 20:01 ` Guillaume Nault
2018-03-01 20:07 ` Denys Fedoryshchenko
2018-03-02 17:43 ` Guillaume Nault
2018-03-03 9:33 ` Denys Fedoryshchenko
2018-03-05 17:22 ` Guillaume Nault
2018-02-27 18:54 ` Guillaume Nault
2018-02-15 19:20 ` Guillaume Nault
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ba6cd172193fb55c55b9bfb99a364c8f@nuclearcat.com \
--to=nuclearcat@nuclearcat.com \
--cc=g.nault@alphalink.fr \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.