From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from nuclearcat.com ([144.76.183.226]:50202 "EHLO nuclearcat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932751AbeBUK0y (ORCPT ); Wed, 21 Feb 2018 05:26:54 -0500 MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII; format=flowed Content-Transfer-Encoding: 7bit Date: Wed, 21 Feb 2018 12:26:51 +0200 From: Denys Fedoryshchenko To: Guillaume Nault Cc: Linux Kernel Network Developers Subject: Re: ppp/pppoe, still panic 4.15.3 in ppp_push In-Reply-To: <20180216184812.GM1422@alphalink.fr> References: <20180214164728.GG1422@alphalink.fr> <802ba894fee75e34576d39aed5022dc8@nuclearcat.com> <20180214172549.GH1422@alphalink.fr> <20180215155517.GI1422@alphalink.fr> <79ba31ea47137ca539beea112bec8e57@nuclearcat.com> <20180215193114.GK1422@alphalink.fr> <61f3b6b7b437cd7b37e3aae0d2ee1df8@nuclearcat.com> <20180215194253.GL1422@alphalink.fr> <159534b0fadb78c727bce6d55d358689@nuclearcat.com> <20180216184812.GM1422@alphalink.fr> Message-ID: Sender: netdev-owner@vger.kernel.org List-ID: It seems even rebuilding seemingly stable version triggering crashes too (but different ones) Maybe it is coincidence, and bug reproducer appeared in network same time i decided to upgrade kernel, as it happened with xt_MSS(and that bug existed for years). Deleted quoting, i added more debug options (as much as performance degradation allows me). This is vanilla again: [14834.090421] ================================================================== [14834.091157] BUG: KASAN: use-after-free in __list_add_valid+0x69/0xad [14834.091521] Read of size 8 at addr ffff8803dbeb8660 by task accel-pppd/12636 [14834.091905] [14834.092282] CPU: 0 PID: 12636 Comm: accel-pppd Not tainted 4.15.4-build-0134 #1 [14834.092930] Hardware name: HP ProLiant DL320e Gen8 v2, BIOS P80 04/02/2015 [14834.093320] Call Trace: [14834.093680] dump_stack+0xb3/0x13e [14834.094050] ? _atomic_dec_and_lock+0x10f/0x10f [14834.094434] print_address_description+0x69/0x236 [14834.094814] ? __list_add_valid+0x69/0xad [14834.095197] kasan_report+0x219/0x23f [14834.095570] __list_add_valid+0x69/0xad [14834.095957] ppp_ioctl+0x1216/0x2201 [ppp_generic] [14834.096348] ? ppp_write+0x1cc/0x1cc [ppp_generic] [14834.096723] ? get_usage_char.isra.2+0x36/0x36 [14834.097094] ? packet_poll+0x362/0x362 [14834.097455] ? lock_downgrade+0x4d0/0x4d0 [14834.097811] ? rcu_irq_enter_disabled+0x8/0x8 [14834.098187] ? get_usage_char.isra.2+0x36/0x36 [14834.098561] ? __fget+0x3b8/0x3eb [14834.098936] ? get_usage_char.isra.2+0x36/0x36 [14834.099309] ? __fget+0x3a0/0x3eb [14834.099682] ? get_usage_char.isra.2+0x36/0x36 [14834.100069] ? __fget+0x3a0/0x3eb [14834.100443] ? lock_downgrade+0x4d0/0x4d0 [14834.100814] ? rcu_irq_enter_disabled+0x8/0x8 [14834.101203] ? __fget+0x3b8/0x3eb [14834.101581] ? expand_files+0x62f/0x62f [14834.101945] ? kernel_read+0xed/0xed [14834.102322] ? SyS_getpeername+0x28b/0x28b [14834.102690] vfs_ioctl+0x6e/0x81 [14834.103049] do_vfs_ioctl+0xe2f/0xe62 [14834.103413] ? ioctl_preallocate+0x211/0x211 [14834.103778] ? __fget_light+0x28c/0x2ca [14834.104150] ? iterate_fd+0x2a8/0x2a8 [14834.104526] ? SyS_rt_sigprocmask+0x12e/0x181 [14834.104876] ? sigprocmask+0x23f/0x23f [14834.105231] ? SyS_write+0x148/0x173 [14834.105580] ? SyS_read+0x173/0x173 [14834.105943] SyS_ioctl+0x39/0x55 [14834.106316] ? do_vfs_ioctl+0xe62/0xe62 [14834.106694] do_syscall_64+0x262/0x594 [14834.107076] ? syscall_return_slowpath+0x351/0x351 [14834.107447] ? up_read+0x17/0x2c [14834.107806] ? __do_page_fault+0x68a/0x763 [14834.108171] ? entry_SYSCALL_64_after_hwframe+0x36/0x9b [14834.108550] ? trace_hardirqs_off_thunk+0x1a/0x1c [14834.108937] entry_SYSCALL_64_after_hwframe+0x26/0x9b [14834.109293] RIP: 0033:0x7fc9be3758a7 [14834.109652] RSP: 002b:00007fc9bf92aaf8 EFLAGS: 00000206 ORIG_RAX: 0000000000000010 [14834.110313] RAX: ffffffffffffffda RBX: 00007fc9bdc5e1e3 RCX: 00007fc9be3758a7 [14834.110707] RDX: 00007fc9b7ad13e8 RSI: 000000004004743a RDI: 0000000000004b9f [14834.111082] RBP: 00007fc9bf92ab20 R08: 0000000000000000 R09: 000055f07a27fe40 [14834.111471] R10: 0000000000000008 R11: 0000000000000206 R12: 00007fc9b7ad12d8 [14834.111845] R13: 00007ffd06346a6f R14: 0000000000000000 R15: 00007fc9bf92b700 [14834.112231] [14834.112589] Allocated by task 12636: [14834.112962] ppp_register_net_channel+0xc4/0x610 [ppp_generic] [14834.113331] pppoe_connect+0xe6d/0x1097 [pppoe] [14834.113691] SyS_connect+0x19c/0x274 [14834.114054] do_syscall_64+0x262/0x594 [14834.114421] entry_SYSCALL_64_after_hwframe+0x26/0x9b [14834.114792] [14834.115139] Freed by task 12636: [14834.115504] kfree+0xe2/0x154 [14834.115866] ppp_release+0x11b/0x12a [ppp_generic] [14834.116240] __fput+0x342/0x5ba [14834.116611] task_work_run+0x15d/0x198 [14834.116973] exit_to_usermode_loop+0xc7/0x153 [14834.117320] do_syscall_64+0x53d/0x594 [14834.117694] entry_SYSCALL_64_after_hwframe+0x26/0x9b [14834.118067] [14834.118426] The buggy address belongs to the object at ffff8803dbeb8480 [14834.119087] The buggy address is located 480 bytes inside of [14834.119755] The buggy address belongs to the page: [14834.120138] page:ffffea000f6fae00 count:1 mapcount:0 mapping: (null) index:0xffff8803dbebd580 compound_mapcount: 0 [14834.120817] flags: 0x17ffe00000008100(slab|head) [14834.121171] raw: 17ffe00000008100 0000000000000000 ffff8803dbebd580 00000001001c001b [14834.121800] raw: ffffea000d718020 ffffea000d32d620 ffff8803f080ee80 0000000000000000 [14834.122415] page dumped because: kasan: bad access detected [14834.122787] [14834.123140] Memory state around the buggy address: [14834.123503] ffff8803dbeb8500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [14834.124150] ffff8803dbeb8580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [14834.124806] >ffff8803dbeb8600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [14834.125467] ^ [14834.125848] ffff8803dbeb8680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [14834.126493] ffff8803dbeb8700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [14834.127143] ================================================================== [14834.127768] Disabling lock debugging due to kernel taint ferrari-dns 10.0.252.9 # cat udp-2018_02_21.log |grep "Feb 21 06:02:14 10.0.252.9" [14834.090421] ================================================================== [14834.091157] BUG: KASAN: use-after-free in __list_add_valid+0x69/0xad [14834.091521] Read of size 8 at addr ffff8803dbeb8660 by task accel-pppd/12636 [14834.091905] [14834.092282] CPU: 0 PID: 12636 Comm: accel-pppd Not tainted 4.15.4-build-0134 #1 [14834.092930] Hardware name: HP ProLiant DL320e Gen8 v2, BIOS P80 04/02/2015 [14834.093320] Call Trace: [14834.093680] dump_stack+0xb3/0x13e [14834.094050] ? _atomic_dec_and_lock+0x10f/0x10f [14834.094434] print_address_description+0x69/0x236 [14834.094814] ? __list_add_valid+0x69/0xad [14834.095197] kasan_report+0x219/0x23f [14834.095570] __list_add_valid+0x69/0xad [14834.095957] ppp_ioctl+0x1216/0x2201 [ppp_generic] [14834.096348] ? ppp_write+0x1cc/0x1cc [ppp_generic] [14834.096723] ? get_usage_char.isra.2+0x36/0x36 [14834.097094] ? packet_poll+0x362/0x362 [14834.097455] ? lock_downgrade+0x4d0/0x4d0 [14834.097811] ? rcu_irq_enter_disabled+0x8/0x8 [14834.098187] ? get_usage_char.isra.2+0x36/0x36 [14834.098561] ? __fget+0x3b8/0x3eb [14834.098936] ? get_usage_char.isra.2+0x36/0x36 [14834.099309] ? __fget+0x3a0/0x3eb [14834.099682] ? get_usage_char.isra.2+0x36/0x36 [14834.100069] ? __fget+0x3a0/0x3eb [14834.100443] ? lock_downgrade+0x4d0/0x4d0 [14834.100814] ? rcu_irq_enter_disabled+0x8/0x8 [14834.101203] ? __fget+0x3b8/0x3eb [14834.101581] ? expand_files+0x62f/0x62f [14834.101945] ? kernel_read+0xed/0xed [14834.102322] ? SyS_getpeername+0x28b/0x28b [14834.102690] vfs_ioctl+0x6e/0x81 [14834.103049] do_vfs_ioctl+0xe2f/0xe62 [14834.103413] ? ioctl_preallocate+0x211/0x211 [14834.103778] ? __fget_light+0x28c/0x2ca [14834.104150] ? iterate_fd+0x2a8/0x2a8 [14834.104526] ? SyS_rt_sigprocmask+0x12e/0x181 [14834.104876] ? sigprocmask+0x23f/0x23f [14834.105231] ? SyS_write+0x148/0x173 [14834.105580] ? SyS_read+0x173/0x173 [14834.105943] SyS_ioctl+0x39/0x55 [14834.106316] ? do_vfs_ioctl+0xe62/0xe62 [14834.106694] do_syscall_64+0x262/0x594 [14834.107076] ? syscall_return_slowpath+0x351/0x351 [14834.107447] ? up_read+0x17/0x2c [14834.107806] ? __do_page_fault+0x68a/0x763 [14834.108171] ? entry_SYSCALL_64_after_hwframe+0x36/0x9b [14834.108550] ? trace_hardirqs_off_thunk+0x1a/0x1c [14834.108937] entry_SYSCALL_64_after_hwframe+0x26/0x9b [14834.109293] RIP: 0033:0x7fc9be3758a7 [14834.109652] RSP: 002b:00007fc9bf92aaf8 EFLAGS: 00000206 ORIG_RAX: 0000000000000010 [14834.110313] RAX: ffffffffffffffda RBX: 00007fc9bdc5e1e3 RCX: 00007fc9be3758a7 [14834.110707] RDX: 00007fc9b7ad13e8 RSI: 000000004004743a RDI: 0000000000004b9f [14834.111082] RBP: 00007fc9bf92ab20 R08: 0000000000000000 R09: 000055f07a27fe40 [14834.111471] R10: 0000000000000008 R11: 0000000000000206 R12: 00007fc9b7ad12d8 [14834.111845] R13: 00007ffd06346a6f R14: 0000000000000000 R15: 00007fc9bf92b700 [14834.112231] [14834.112589] Allocated by task 12636: [14834.112962] ppp_register_net_channel+0xc4/0x610 [ppp_generic] [14834.113331] pppoe_connect+0xe6d/0x1097 [pppoe] [14834.113691] SyS_connect+0x19c/0x274 [14834.114054] do_syscall_64+0x262/0x594 [14834.114421] entry_SYSCALL_64_after_hwframe+0x26/0x9b [14834.114792] [14834.115139] Freed by task 12636: [14834.115504] kfree+0xe2/0x154 [14834.115866] ppp_release+0x11b/0x12a [ppp_generic] [14834.116240] __fput+0x342/0x5ba [14834.116611] task_work_run+0x15d/0x198 [14834.116973] exit_to_usermode_loop+0xc7/0x153 [14834.117320] do_syscall_64+0x53d/0x594 [14834.117694] entry_SYSCALL_64_after_hwframe+0x26/0x9b [14834.118067] [14834.118426] The buggy address belongs to the object at ffff8803dbeb8480 [14834.119087] The buggy address is located 480 bytes inside of [14834.119755] The buggy address belongs to the page: [14834.120138] page:ffffea000f6fae00 count:1 mapcount:0 mapping: (null) index:0xffff8803dbebd580 compound_mapcount: 0 [14834.120817] flags: 0x17ffe00000008100(slab|head) [14834.121171] raw: 17ffe00000008100 0000000000000000 ffff8803dbebd580 00000001001c001b [14834.121800] raw: ffffea000d718020 ffffea000d32d620 ffff8803f080ee80 0000000000000000 [14834.122415] page dumped because: kasan: bad access detected [14834.122787] [14834.123140] Memory state around the buggy address: [14834.123503] ffff8803dbeb8500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [14834.124150] ffff8803dbeb8580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [14834.124806] >ffff8803dbeb8600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [14834.125467] ^ [14834.125848] ffff8803dbeb8680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [14834.126493] ffff8803dbeb8700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [14834.127143] ================================================================== [14834.127768] Disabling lock debugging due to kernel taint