* [syzbot] [net?] KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings
@ 2024-03-22 20:10 syzbot
2024-03-25 12:09 ` Denis Kirjanov
` (2 more replies)
0 siblings, 3 replies; 9+ messages in thread
From: syzbot @ 2024-03-22 20:10 UTC (permalink / raw)
To: davem, edumazet, kuba, linux-kernel, netdev, pabeni,
syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 61387b8dcf1d Merge tag 'for-6.9/dm-vdo' of git://git.kerne..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=11effbd1180000
kernel config: https://syzkaller.appspot.com/x/.config?x=c6aea81bc9ff5e99
dashboard link: https://syzkaller.appspot.com/bug?extid=5fe14f2ff4ccbace9a26
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/b972a52930fa/disk-61387b8d.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/caa2592898b6/vmlinux-61387b8d.xz
kernel image: https://storage.googleapis.com/syzbot-assets/4187257afcc5/bzImage-61387b8d.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+5fe14f2ff4ccbace9a26@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: slab-use-after-free in __ethtool_get_link_ksettings+0x186/0x190 net/ethtool/ioctl.c:441
Read of size 8 at addr ffff888021f46308 by task kworker/0:4/5169
CPU: 0 PID: 5169 Comm: kworker/0:4 Not tainted 6.8.0-syzkaller-05562-g61387b8dcf1d #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024
Workqueue: infiniband ib_cache_event_task
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:114
print_address_description mm/kasan/report.c:377 [inline]
print_report+0xc3/0x620 mm/kasan/report.c:488
kasan_report+0xd9/0x110 mm/kasan/report.c:601
__ethtool_get_link_ksettings+0x186/0x190 net/ethtool/ioctl.c:441
__ethtool_get_link_ksettings+0xf5/0x190 net/ethtool/ioctl.c:445
ib_get_eth_speed+0x123/0xb50 drivers/infiniband/core/verbs.c:1984
siw_query_port+0x3c/0x3e0 drivers/infiniband/sw/siw/siw_verbs.c:179
iw_query_port drivers/infiniband/core/device.c:2049 [inline]
ib_query_port drivers/infiniband/core/device.c:2090 [inline]
ib_query_port+0x3d5/0x8a0 drivers/infiniband/core/device.c:2082
ib_cache_update.part.0+0xdc/0xa30 drivers/infiniband/core/cache.c:1498
ib_cache_update drivers/infiniband/core/cache.c:1572 [inline]
ib_cache_event_task+0x1c2/0x290 drivers/infiniband/core/cache.c:1572
process_one_work+0x9ac/0x1a60 kernel/workqueue.c:3254
process_scheduled_works kernel/workqueue.c:3335 [inline]
worker_thread+0x6c8/0xf70 kernel/workqueue.c:3416
kthread+0x2c4/0x3a0 kernel/kthread.c:388
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243
</TASK>
Allocated by task 10125:
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:370 [inline]
__kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:387
kasan_kmalloc include/linux/kasan.h:211 [inline]
__do_kmalloc_node mm/slub.c:3966 [inline]
__kmalloc_node+0x226/0x480 mm/slub.c:3973
kmalloc_node include/linux/slab.h:648 [inline]
kvmalloc_node+0x9d/0x1a0 mm/util.c:634
kvmalloc include/linux/slab.h:766 [inline]
kvzalloc include/linux/slab.h:774 [inline]
alloc_netdev_mqs+0xb3/0x12b0 net/core/dev.c:10840
rtnl_create_link+0xc88/0xfa0 net/core/rtnetlink.c:3358
rtnl_newlink_create net/core/rtnetlink.c:3484 [inline]
__rtnl_newlink+0x10ae/0x1960 net/core/rtnetlink.c:3714
rtnl_newlink+0x67/0xa0 net/core/rtnetlink.c:3727
rtnetlink_rcv_msg+0x3ca/0xe60 net/core/rtnetlink.c:6595
netlink_rcv_skb+0x16e/0x440 net/netlink/af_netlink.c:2559
netlink_unicast_kernel net/netlink/af_netlink.c:1335 [inline]
netlink_unicast+0x545/0x820 net/netlink/af_netlink.c:1361
netlink_sendmsg+0x8b8/0xd70 net/netlink/af_netlink.c:1905
sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg net/socket.c:745 [inline]
__sys_sendto+0x482/0x4e0 net/socket.c:2191
__do_sys_sendto net/socket.c:2203 [inline]
__se_sys_sendto net/socket.c:2199 [inline]
__x64_sys_sendto+0xe0/0x1c0 net/socket.c:2199
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xd5/0x260 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x6d/0x75
Freed by task 61:
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:579
poison_slab_object mm/kasan/common.c:240 [inline]
__kasan_slab_free+0x11d/0x1a0 mm/kasan/common.c:256
kasan_slab_free include/linux/kasan.h:184 [inline]
slab_free_hook mm/slub.c:2106 [inline]
slab_free mm/slub.c:4280 [inline]
kfree+0x129/0x370 mm/slub.c:4390
kvfree+0x47/0x50 mm/util.c:680
device_release+0xa4/0x240 drivers/base/core.c:2499
kobject_cleanup lib/kobject.c:689 [inline]
kobject_release lib/kobject.c:720 [inline]
kref_put include/linux/kref.h:65 [inline]
kobject_put+0x1fd/0x5b0 lib/kobject.c:737
netdev_run_todo+0x7d1/0x1260 net/core/dev.c:10591
default_device_exit_batch+0x860/0xae0 net/core/dev.c:11632
ops_exit_list+0x12b/0x180 net/core/net_namespace.c:175
cleanup_net+0x5b7/0xbf0 net/core/net_namespace.c:637
process_one_work+0x9ac/0x1a60 kernel/workqueue.c:3254
process_scheduled_works kernel/workqueue.c:3335 [inline]
worker_thread+0x6c8/0xf70 kernel/workqueue.c:3416
kthread+0x2c4/0x3a0 kernel/kthread.c:388
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243
The buggy address belongs to the object at ffff888021f46000
which belongs to the cache kmalloc-cg-4k of size 4096
The buggy address is located 776 bytes inside of
freed 4096-byte region [ffff888021f46000, ffff888021f47000)
The buggy address belongs to the physical page:
page:ffffea000087d000 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x21f40
head:ffffea000087d000 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0
memcg:ffff8880636ce481
flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xffffffff()
raw: 00fff00000000840 ffff88801504f500 dead000000000122 0000000000000000
raw: 0000000000000000 0000000000040004 00000001ffffffff ffff8880636ce481
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 10125, tgid 10125 (syz-executor.2), ts 404185927295, free_ts 404019420685
set_page_owner include/linux/page_owner.h:31 [inline]
post_alloc_hook+0x2d4/0x350 mm/page_alloc.c:1533
prep_new_page mm/page_alloc.c:1540 [inline]
get_page_from_freelist+0xa28/0x3780 mm/page_alloc.c:3311
__alloc_pages+0x22b/0x2410 mm/page_alloc.c:4569
__alloc_pages_node include/linux/gfp.h:238 [inline]
alloc_pages_node include/linux/gfp.h:261 [inline]
alloc_slab_page mm/slub.c:2175 [inline]
allocate_slab mm/slub.c:2338 [inline]
new_slab+0xcc/0x3a0 mm/slub.c:2391
___slab_alloc+0x66d/0x1790 mm/slub.c:3525
__slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3610
__slab_alloc_node mm/slub.c:3663 [inline]
slab_alloc_node mm/slub.c:3835 [inline]
__do_kmalloc_node mm/slub.c:3965 [inline]
__kmalloc_node_track_caller+0x367/0x470 mm/slub.c:3986
kmemdup+0x29/0x60 mm/util.c:131
kmemdup include/linux/fortify-string.h:738 [inline]
__devinet_sysctl_register+0xbc/0x360 net/ipv4/devinet.c:2577
devinet_sysctl_register net/ipv4/devinet.c:2629 [inline]
devinet_sysctl_register+0x17b/0x200 net/ipv4/devinet.c:2619
inetdev_init+0x28b/0x580 net/ipv4/devinet.c:286
inetdev_event+0xd23/0x19b0 net/ipv4/devinet.c:1560
notifier_call_chain+0xbc/0x3e0 kernel/notifier.c:93
call_netdevice_notifiers_info+0xbe/0x140 net/core/dev.c:1950
call_netdevice_notifiers_extack net/core/dev.c:1988 [inline]
call_netdevice_notifiers net/core/dev.c:2002 [inline]
register_netdevice+0x15f5/0x1ca0 net/core/dev.c:10307
virt_wifi_newlink+0x3ed/0x970 drivers/net/wireless/virtual/virt_wifi.c:553
page last free pid 10234 tgid 10232 stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1140 [inline]
free_unref_page_prepare+0x527/0xb10 mm/page_alloc.c:2346
free_unref_page+0x33/0x3c0 mm/page_alloc.c:2486
__put_partials+0x14c/0x170 mm/slub.c:2906
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x140 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:322
kasan_slab_alloc include/linux/kasan.h:201 [inline]
slab_post_alloc_hook mm/slub.c:3798 [inline]
slab_alloc_node mm/slub.c:3845 [inline]
kmem_cache_alloc_node+0x177/0x340 mm/slub.c:3888
__alloc_skb+0x2b1/0x380 net/core/skbuff.c:658
alloc_skb_fclone include/linux/skbuff.h:1368 [inline]
tipc_buf_acquire+0x26/0xe0 net/tipc/msg.c:72
tipc_msg_build+0x10c/0x1120 net/tipc/msg.c:386
tipc_sendmcast+0x79e/0xb70 net/tipc/socket.c:881
__tipc_sendmsg+0x1317/0x1940 net/tipc/socket.c:1469
tipc_sendmsg+0x4f/0x70 net/tipc/socket.c:1403
sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg net/socket.c:745 [inline]
____sys_sendmsg+0xab8/0xc90 net/socket.c:2584
___sys_sendmsg+0x135/0x1e0 net/socket.c:2638
__sys_sendmmsg+0x1a1/0x450 net/socket.c:2724
Memory state around the buggy address:
ffff888021f46200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888021f46280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888021f46300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888021f46380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888021f46400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
==================================================================
BUG: KASAN: slab-use-after-free in __ethtool_get_link_ksettings+0x165/0x190 net/ethtool/ioctl.c:445
Read of size 8 at addr ffff888021f46308 by task kworker/0:4/5169
CPU: 0 PID: 5169 Comm: kworker/0:4 Tainted: G B 6.8.0-syzkaller-05562-g61387b8dcf1d #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024
Workqueue: infiniband ib_cache_event_task
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:114
print_address_description mm/kasan/report.c:377 [inline]
print_report+0xc3/0x620 mm/kasan/report.c:488
kasan_report+0xd9/0x110 mm/kasan/report.c:601
__ethtool_get_link_ksettings+0x165/0x190 net/ethtool/ioctl.c:445
__ethtool_get_link_ksettings+0xf5/0x190 net/ethtool/ioctl.c:445
ib_get_eth_speed+0x123/0xb50 drivers/infiniband/core/verbs.c:1984
siw_query_port+0x3c/0x3e0 drivers/infiniband/sw/siw/siw_verbs.c:179
iw_query_port drivers/infiniband/core/device.c:2049 [inline]
ib_query_port drivers/infiniband/core/device.c:2090 [inline]
ib_query_port+0x3d5/0x8a0 drivers/infiniband/core/device.c:2082
ib_cache_update.part.0+0xdc/0xa30 drivers/infiniband/core/cache.c:1498
ib_cache_update drivers/infiniband/core/cache.c:1572 [inline]
ib_cache_event_task+0x1c2/0x290 drivers/infiniband/core/cache.c:1572
process_one_work+0x9ac/0x1a60 kernel/workqueue.c:3254
process_scheduled_works kernel/workqueue.c:3335 [inline]
worker_thread+0x6c8/0xf70 kernel/workqueue.c:3416
kthread+0x2c4/0x3a0 kernel/kthread.c:388
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243
</TASK>
Allocated by task 10125:
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:370 [inline]
__kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:387
kasan_kmalloc include/linux/kasan.h:211 [inline]
__do_kmalloc_node mm/slub.c:3966 [inline]
__kmalloc_node+0x226/0x480 mm/slub.c:3973
kmalloc_node include/linux/slab.h:648 [inline]
kvmalloc_node+0x9d/0x1a0 mm/util.c:634
kvmalloc include/linux/slab.h:766 [inline]
kvzalloc include/linux/slab.h:774 [inline]
alloc_netdev_mqs+0xb3/0x12b0 net/core/dev.c:10840
rtnl_create_link+0xc88/0xfa0 net/core/rtnetlink.c:3358
rtnl_newlink_create net/core/rtnetlink.c:3484 [inline]
__rtnl_newlink+0x10ae/0x1960 net/core/rtnetlink.c:3714
rtnl_newlink+0x67/0xa0 net/core/rtnetlink.c:3727
rtnetlink_rcv_msg+0x3ca/0xe60 net/core/rtnetlink.c:6595
netlink_rcv_skb+0x16e/0x440 net/netlink/af_netlink.c:2559
netlink_unicast_kernel net/netlink/af_netlink.c:1335 [inline]
netlink_unicast+0x545/0x820 net/netlink/af_netlink.c:1361
netlink_sendmsg+0x8b8/0xd70 net/netlink/af_netlink.c:1905
sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg net/socket.c:745 [inline]
__sys_sendto+0x482/0x4e0 net/socket.c:2191
__do_sys_sendto net/socket.c:2203 [inline]
__se_sys_sendto net/socket.c:2199 [inline]
__x64_sys_sendto+0xe0/0x1c0 net/socket.c:2199
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xd5/0x260 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x6d/0x75
Freed by task 61:
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:579
poison_slab_object mm/kasan/common.c:240 [inline]
__kasan_slab_free+0x11d/0x1a0 mm/kasan/common.c:256
kasan_slab_free include/linux/kasan.h:184 [inline]
slab_free_hook mm/slub.c:2106 [inline]
slab_free mm/slub.c:4280 [inline]
kfree+0x129/0x370 mm/slub.c:4390
kvfree+0x47/0x50 mm/util.c:680
device_release+0xa4/0x240 drivers/base/core.c:2499
kobject_cleanup lib/kobject.c:689 [inline]
kobject_release lib/kobject.c:720 [inline]
kref_put include/linux/kref.h:65 [inline]
kobject_put+0x1fd/0x5b0 lib/kobject.c:737
netdev_run_todo+0x7d1/0x1260 net/core/dev.c:10591
default_device_exit_batch+0x860/0xae0 net/core/dev.c:11632
ops_exit_list+0x12b/0x180 net/core/net_namespace.c:175
cleanup_net+0x5b7/0xbf0 net/core/net_namespace.c:637
process_one_work+0x9ac/0x1a60 kernel/workqueue.c:3254
process_scheduled_works kernel/workqueue.c:3335 [inline]
worker_thread+0x6c8/0xf70 kernel/workqueue.c:3416
kthread+0x2c4/0x3a0 kernel/kthread.c:388
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243
The buggy address belongs to the object at ffff888021f46000
which belongs to the cache kmalloc-cg-4k of size 4096
The buggy address is located 776 bytes inside of
freed 4096-byte region [ffff888021f46000, ffff888021f47000)
The buggy address belongs to the physical page:
page:ffffea000087d000 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x21f40
head:ffffea000087d000 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0
memcg:ffff8880636ce481
flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xffffffff()
raw: 00fff00000000840 ffff88801504f500 dead000000000122 0000000000000000
raw: 0000000000000000 0000000000040004 00000001ffffffff ffff8880636ce481
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 10125, tgid 10125 (syz-executor.2), ts 404185927295, free_ts 404019420685
set_page_owner include/linux/page_owner.h:31 [inline]
post_alloc_hook+0x2d4/0x350 mm/page_alloc.c:1533
prep_new_page mm/page_alloc.c:1540 [inline]
get_page_from_freelist+0xa28/0x3780 mm/page_alloc.c:3311
__alloc_pages+0x22b/0x2410 mm/page_alloc.c:4569
__alloc_pages_node include/linux/gfp.h:238 [inline]
alloc_pages_node include/linux/gfp.h:261 [inline]
alloc_slab_page mm/slub.c:2175 [inline]
allocate_slab mm/slub.c:2338 [inline]
new_slab+0xcc/0x3a0 mm/slub.c:2391
___slab_alloc+0x66d/0x1790 mm/slub.c:3525
__slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3610
__slab_alloc_node mm/slub.c:3663 [inline]
slab_alloc_node mm/slub.c:3835 [inline]
__do_kmalloc_node mm/slub.c:3965 [inline]
__kmalloc_node_track_caller+0x367/0x470 mm/slub.c:3986
kmemdup+0x29/0x60 mm/util.c:131
kmemdup include/linux/fortify-string.h:738 [inline]
__devinet_sysctl_register+0xbc/0x360 net/ipv4/devinet.c:2577
devinet_sysctl_register net/ipv4/devinet.c:2629 [inline]
devinet_sysctl_register+0x17b/0x200 net/ipv4/devinet.c:2619
inetdev_init+0x28b/0x580 net/ipv4/devinet.c:286
inetdev_event+0xd23/0x19b0 net/ipv4/devinet.c:1560
notifier_call_chain+0xbc/0x3e0 kernel/notifier.c:93
call_netdevice_notifiers_info+0xbe/0x140 net/core/dev.c:1950
call_netdevice_notifiers_extack net/core/dev.c:1988 [inline]
call_netdevice_notifiers net/core/dev.c:2002 [inline]
register_netdevice+0x15f5/0x1ca0 net/core/dev.c:10307
virt_wifi_newlink+0x3ed/0x970 drivers/net/wireless/virtual/virt_wifi.c:553
page last free pid 10234 tgid 10232 stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1140 [inline]
free_unref_page_prepare+0x527/0xb10 mm/page_alloc.c:2346
free_unref_page+0x33/0x3c0 mm/page_alloc.c:2486
__put_partials+0x14c/0x170 mm/slub.c:2906
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x140 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:322
kasan_slab_alloc include/linux/kasan.h:201 [inline]
slab_post_alloc_hook mm/slub.c:3798 [inline]
slab_alloc_node mm/slub.c:3845 [inline]
kmem_cache_alloc_node+0x177/0x340 mm/slub.c:3888
__alloc_skb+0x2b1/0x380 net/core/skbuff.c:658
alloc_skb_fclone include/linux/skbuff.h:1368 [inline]
tipc_buf_acquire+0x26/0xe0 net/tipc/msg.c:72
tipc_msg_build+0x10c/0x1120 net/tipc/msg.c:386
tipc_sendmcast+0x79e/0xb70 net/tipc/socket.c:881
__tipc_sendmsg+0x1317/0x1940 net/tipc/socket.c:1469
tipc_sendmsg+0x4f/0x70 net/tipc/socket.c:1403
sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg net/socket.c:745 [inline]
____sys_sendmsg+0xab8/0xc90 net/socket.c:2584
___sys_sendmsg+0x135/0x1e0 net/socket.c:2638
__sys_sendmmsg+0x1a1/0x450 net/socket.c:2724
Memory state around the buggy address:
ffff888021f46200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888021f46280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888021f46300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888021f46380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888021f46400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 9+ messages in thread* Re: [syzbot] [net?] KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings
2024-03-22 20:10 [syzbot] [net?] KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings syzbot
@ 2024-03-25 12:09 ` Denis Kirjanov
2024-03-25 13:08 ` Eric Dumazet
2024-09-27 18:26 ` syzbot
2024-10-08 1:44 ` syzbot
2 siblings, 1 reply; 9+ messages in thread
From: Denis Kirjanov @ 2024-03-25 12:09 UTC (permalink / raw)
To: syzbot, davem, edumazet, kuba, linux-kernel, netdev, pabeni,
syzkaller-bugs
On 3/22/24 23:10, syzbot wrote:
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: 61387b8dcf1d Merge tag 'for-6.9/dm-vdo' of git://git.kerne..
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=11effbd1180000
> kernel config: https://syzkaller.appspot.com/x/.config?x=c6aea81bc9ff5e99
> dashboard link: https://syzkaller.appspot.com/bug?extid=5fe14f2ff4ccbace9a26
> compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
>
> Unfortunately, I don't have any reproducer for this issue yet.
>
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/b972a52930fa/disk-61387b8d.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/caa2592898b6/vmlinux-61387b8d.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/4187257afcc5/bzImage-61387b8d.xz
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+5fe14f2ff4ccbace9a26@syzkaller.appspotmail.com
>
> ==================================================================
> BUG: KASAN: slab-use-after-free in __ethtool_get_link_ksettings+0x186/0x190 net/ethtool/ioctl.c:441
> Read of size 8 at addr ffff888021f46308 by task kworker/0:4/5169
>
> CPU: 0 PID: 5169 Comm: kworker/0:4 Not tainted 6.8.0-syzkaller-05562-g61387b8dcf1d #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024
> Workqueue: infiniband ib_cache_event_task
> Call Trace:
> <TASK>
> __dump_stack lib/dump_stack.c:88 [inline]
> dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:114
> print_address_description mm/kasan/report.c:377 [inline]
> print_report+0xc3/0x620 mm/kasan/report.c:488
> kasan_report+0xd9/0x110 mm/kasan/report.c:601
> __ethtool_get_link_ksettings+0x186/0x190 net/ethtool/ioctl.c:441
> __ethtool_get_link_ksettings+0xf5/0x190 net/ethtool/ioctl.c:445
Hmm, report says that we have a net_device freed even that we have a dev_hold()
before __ethtool_get_link_ksettings()
> ib_get_eth_speed+0x123/0xb50 drivers/infiniband/core/verbs.c:1984
> siw_query_port+0x3c/0x3e0 drivers/infiniband/sw/siw/siw_verbs.c:179
> iw_query_port drivers/infiniband/core/device.c:2049 [inline]
> ib_query_port drivers/infiniband/core/device.c:2090 [inline]
> ib_query_port+0x3d5/0x8a0 drivers/infiniband/core/device.c:2082
> ib_cache_update.part.0+0xdc/0xa30 drivers/infiniband/core/cache.c:1498
> ib_cache_update drivers/infiniband/core/cache.c:1572 [inline]
> ib_cache_event_task+0x1c2/0x290 drivers/infiniband/core/cache.c:1572
> process_one_work+0x9ac/0x1a60 kernel/workqueue.c:3254
> process_scheduled_works kernel/workqueue.c:3335 [inline]
> worker_thread+0x6c8/0xf70 kernel/workqueue.c:3416
> kthread+0x2c4/0x3a0 kernel/kthread.c:388
> ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147
> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243
> </TASK>
>
> Allocated by task 10125:
> kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
> kasan_save_track+0x14/0x30 mm/kasan/common.c:68
> poison_kmalloc_redzone mm/kasan/common.c:370 [inline]
> __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:387
> kasan_kmalloc include/linux/kasan.h:211 [inline]
> __do_kmalloc_node mm/slub.c:3966 [inline]
> __kmalloc_node+0x226/0x480 mm/slub.c:3973
> kmalloc_node include/linux/slab.h:648 [inline]
> kvmalloc_node+0x9d/0x1a0 mm/util.c:634
> kvmalloc include/linux/slab.h:766 [inline]
> kvzalloc include/linux/slab.h:774 [inline]
> alloc_netdev_mqs+0xb3/0x12b0 net/core/dev.c:10840
> rtnl_create_link+0xc88/0xfa0 net/core/rtnetlink.c:3358
> rtnl_newlink_create net/core/rtnetlink.c:3484 [inline]
> __rtnl_newlink+0x10ae/0x1960 net/core/rtnetlink.c:3714
> rtnl_newlink+0x67/0xa0 net/core/rtnetlink.c:3727
> rtnetlink_rcv_msg+0x3ca/0xe60 net/core/rtnetlink.c:6595
> netlink_rcv_skb+0x16e/0x440 net/netlink/af_netlink.c:2559
> netlink_unicast_kernel net/netlink/af_netlink.c:1335 [inline]
> netlink_unicast+0x545/0x820 net/netlink/af_netlink.c:1361
> netlink_sendmsg+0x8b8/0xd70 net/netlink/af_netlink.c:1905
> sock_sendmsg_nosec net/socket.c:730 [inline]
> __sock_sendmsg net/socket.c:745 [inline]
> __sys_sendto+0x482/0x4e0 net/socket.c:2191
> __do_sys_sendto net/socket.c:2203 [inline]
> __se_sys_sendto net/socket.c:2199 [inline]
> __x64_sys_sendto+0xe0/0x1c0 net/socket.c:2199
> do_syscall_x64 arch/x86/entry/common.c:52 [inline]
> do_syscall_64+0xd5/0x260 arch/x86/entry/common.c:83
> entry_SYSCALL_64_after_hwframe+0x6d/0x75
>
> Freed by task 61:
> kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
> kasan_save_track+0x14/0x30 mm/kasan/common.c:68
> kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:579
> poison_slab_object mm/kasan/common.c:240 [inline]
> __kasan_slab_free+0x11d/0x1a0 mm/kasan/common.c:256
> kasan_slab_free include/linux/kasan.h:184 [inline]
> slab_free_hook mm/slub.c:2106 [inline]
> slab_free mm/slub.c:4280 [inline]
> kfree+0x129/0x370 mm/slub.c:4390
> kvfree+0x47/0x50 mm/util.c:680
> device_release+0xa4/0x240 drivers/base/core.c:2499
> kobject_cleanup lib/kobject.c:689 [inline]
> kobject_release lib/kobject.c:720 [inline]
> kref_put include/linux/kref.h:65 [inline]
> kobject_put+0x1fd/0x5b0 lib/kobject.c:737
> netdev_run_todo+0x7d1/0x1260 net/core/dev.c:10591
> default_device_exit_batch+0x860/0xae0 net/core/dev.c:11632
> ops_exit_list+0x12b/0x180 net/core/net_namespace.c:175
> cleanup_net+0x5b7/0xbf0 net/core/net_namespace.c:637
> process_one_work+0x9ac/0x1a60 kernel/workqueue.c:3254
> process_scheduled_works kernel/workqueue.c:3335 [inline]
> worker_thread+0x6c8/0xf70 kernel/workqueue.c:3416
> kthread+0x2c4/0x3a0 kernel/kthread.c:388
> ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147
> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243
>
> The buggy address belongs to the object at ffff888021f46000
> which belongs to the cache kmalloc-cg-4k of size 4096
> The buggy address is located 776 bytes inside of
> freed 4096-byte region [ffff888021f46000, ffff888021f47000)
>
> The buggy address belongs to the physical page:
> page:ffffea000087d000 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x21f40
> head:ffffea000087d000 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0
> memcg:ffff8880636ce481
> flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff)
> page_type: 0xffffffff()
> raw: 00fff00000000840 ffff88801504f500 dead000000000122 0000000000000000
> raw: 0000000000000000 0000000000040004 00000001ffffffff ffff8880636ce481
> page dumped because: kasan: bad access detected
> page_owner tracks the page as allocated
> page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 10125, tgid 10125 (syz-executor.2), ts 404185927295, free_ts 404019420685
> set_page_owner include/linux/page_owner.h:31 [inline]
> post_alloc_hook+0x2d4/0x350 mm/page_alloc.c:1533
> prep_new_page mm/page_alloc.c:1540 [inline]
> get_page_from_freelist+0xa28/0x3780 mm/page_alloc.c:3311
> __alloc_pages+0x22b/0x2410 mm/page_alloc.c:4569
> __alloc_pages_node include/linux/gfp.h:238 [inline]
> alloc_pages_node include/linux/gfp.h:261 [inline]
> alloc_slab_page mm/slub.c:2175 [inline]
> allocate_slab mm/slub.c:2338 [inline]
> new_slab+0xcc/0x3a0 mm/slub.c:2391
> ___slab_alloc+0x66d/0x1790 mm/slub.c:3525
> __slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3610
> __slab_alloc_node mm/slub.c:3663 [inline]
> slab_alloc_node mm/slub.c:3835 [inline]
> __do_kmalloc_node mm/slub.c:3965 [inline]
> __kmalloc_node_track_caller+0x367/0x470 mm/slub.c:3986
> kmemdup+0x29/0x60 mm/util.c:131
> kmemdup include/linux/fortify-string.h:738 [inline]
> __devinet_sysctl_register+0xbc/0x360 net/ipv4/devinet.c:2577
> devinet_sysctl_register net/ipv4/devinet.c:2629 [inline]
> devinet_sysctl_register+0x17b/0x200 net/ipv4/devinet.c:2619
> inetdev_init+0x28b/0x580 net/ipv4/devinet.c:286
> inetdev_event+0xd23/0x19b0 net/ipv4/devinet.c:1560
> notifier_call_chain+0xbc/0x3e0 kernel/notifier.c:93
> call_netdevice_notifiers_info+0xbe/0x140 net/core/dev.c:1950
> call_netdevice_notifiers_extack net/core/dev.c:1988 [inline]
> call_netdevice_notifiers net/core/dev.c:2002 [inline]
> register_netdevice+0x15f5/0x1ca0 net/core/dev.c:10307
> virt_wifi_newlink+0x3ed/0x970 drivers/net/wireless/virtual/virt_wifi.c:553
> page last free pid 10234 tgid 10232 stack trace:
> reset_page_owner include/linux/page_owner.h:24 [inline]
> free_pages_prepare mm/page_alloc.c:1140 [inline]
> free_unref_page_prepare+0x527/0xb10 mm/page_alloc.c:2346
> free_unref_page+0x33/0x3c0 mm/page_alloc.c:2486
> __put_partials+0x14c/0x170 mm/slub.c:2906
> qlink_free mm/kasan/quarantine.c:163 [inline]
> qlist_free_all+0x4e/0x140 mm/kasan/quarantine.c:179
> kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
> __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:322
> kasan_slab_alloc include/linux/kasan.h:201 [inline]
> slab_post_alloc_hook mm/slub.c:3798 [inline]
> slab_alloc_node mm/slub.c:3845 [inline]
> kmem_cache_alloc_node+0x177/0x340 mm/slub.c:3888
> __alloc_skb+0x2b1/0x380 net/core/skbuff.c:658
> alloc_skb_fclone include/linux/skbuff.h:1368 [inline]
> tipc_buf_acquire+0x26/0xe0 net/tipc/msg.c:72
> tipc_msg_build+0x10c/0x1120 net/tipc/msg.c:386
> tipc_sendmcast+0x79e/0xb70 net/tipc/socket.c:881
> __tipc_sendmsg+0x1317/0x1940 net/tipc/socket.c:1469
> tipc_sendmsg+0x4f/0x70 net/tipc/socket.c:1403
> sock_sendmsg_nosec net/socket.c:730 [inline]
> __sock_sendmsg net/socket.c:745 [inline]
> ____sys_sendmsg+0xab8/0xc90 net/socket.c:2584
> ___sys_sendmsg+0x135/0x1e0 net/socket.c:2638
> __sys_sendmmsg+0x1a1/0x450 net/socket.c:2724
>
> Memory state around the buggy address:
> ffff888021f46200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> ffff888021f46280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>> ffff888021f46300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> ^
> ffff888021f46380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> ffff888021f46400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> ==================================================================
> ==================================================================
> BUG: KASAN: slab-use-after-free in __ethtool_get_link_ksettings+0x165/0x190 net/ethtool/ioctl.c:445
> Read of size 8 at addr ffff888021f46308 by task kworker/0:4/5169
>
> CPU: 0 PID: 5169 Comm: kworker/0:4 Tainted: G B 6.8.0-syzkaller-05562-g61387b8dcf1d #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024
> Workqueue: infiniband ib_cache_event_task
> Call Trace:
> <TASK>
> __dump_stack lib/dump_stack.c:88 [inline]
> dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:114
> print_address_description mm/kasan/report.c:377 [inline]
> print_report+0xc3/0x620 mm/kasan/report.c:488
> kasan_report+0xd9/0x110 mm/kasan/report.c:601
> __ethtool_get_link_ksettings+0x165/0x190 net/ethtool/ioctl.c:445
> __ethtool_get_link_ksettings+0xf5/0x190 net/ethtool/ioctl.c:445
> ib_get_eth_speed+0x123/0xb50 drivers/infiniband/core/verbs.c:1984
> siw_query_port+0x3c/0x3e0 drivers/infiniband/sw/siw/siw_verbs.c:179
> iw_query_port drivers/infiniband/core/device.c:2049 [inline]
> ib_query_port drivers/infiniband/core/device.c:2090 [inline]
> ib_query_port+0x3d5/0x8a0 drivers/infiniband/core/device.c:2082
> ib_cache_update.part.0+0xdc/0xa30 drivers/infiniband/core/cache.c:1498
> ib_cache_update drivers/infiniband/core/cache.c:1572 [inline]
> ib_cache_event_task+0x1c2/0x290 drivers/infiniband/core/cache.c:1572
> process_one_work+0x9ac/0x1a60 kernel/workqueue.c:3254
> process_scheduled_works kernel/workqueue.c:3335 [inline]
> worker_thread+0x6c8/0xf70 kernel/workqueue.c:3416
> kthread+0x2c4/0x3a0 kernel/kthread.c:388
> ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147
> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243
> </TASK>
>
> Allocated by task 10125:
> kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
> kasan_save_track+0x14/0x30 mm/kasan/common.c:68
> poison_kmalloc_redzone mm/kasan/common.c:370 [inline]
> __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:387
> kasan_kmalloc include/linux/kasan.h:211 [inline]
> __do_kmalloc_node mm/slub.c:3966 [inline]
> __kmalloc_node+0x226/0x480 mm/slub.c:3973
> kmalloc_node include/linux/slab.h:648 [inline]
> kvmalloc_node+0x9d/0x1a0 mm/util.c:634
> kvmalloc include/linux/slab.h:766 [inline]
> kvzalloc include/linux/slab.h:774 [inline]
> alloc_netdev_mqs+0xb3/0x12b0 net/core/dev.c:10840
> rtnl_create_link+0xc88/0xfa0 net/core/rtnetlink.c:3358
> rtnl_newlink_create net/core/rtnetlink.c:3484 [inline]
> __rtnl_newlink+0x10ae/0x1960 net/core/rtnetlink.c:3714
> rtnl_newlink+0x67/0xa0 net/core/rtnetlink.c:3727
> rtnetlink_rcv_msg+0x3ca/0xe60 net/core/rtnetlink.c:6595
> netlink_rcv_skb+0x16e/0x440 net/netlink/af_netlink.c:2559
> netlink_unicast_kernel net/netlink/af_netlink.c:1335 [inline]
> netlink_unicast+0x545/0x820 net/netlink/af_netlink.c:1361
> netlink_sendmsg+0x8b8/0xd70 net/netlink/af_netlink.c:1905
> sock_sendmsg_nosec net/socket.c:730 [inline]
> __sock_sendmsg net/socket.c:745 [inline]
> __sys_sendto+0x482/0x4e0 net/socket.c:2191
> __do_sys_sendto net/socket.c:2203 [inline]
> __se_sys_sendto net/socket.c:2199 [inline]
> __x64_sys_sendto+0xe0/0x1c0 net/socket.c:2199
> do_syscall_x64 arch/x86/entry/common.c:52 [inline]
> do_syscall_64+0xd5/0x260 arch/x86/entry/common.c:83
> entry_SYSCALL_64_after_hwframe+0x6d/0x75
>
> Freed by task 61:
> kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
> kasan_save_track+0x14/0x30 mm/kasan/common.c:68
> kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:579
> poison_slab_object mm/kasan/common.c:240 [inline]
> __kasan_slab_free+0x11d/0x1a0 mm/kasan/common.c:256
> kasan_slab_free include/linux/kasan.h:184 [inline]
> slab_free_hook mm/slub.c:2106 [inline]
> slab_free mm/slub.c:4280 [inline]
> kfree+0x129/0x370 mm/slub.c:4390
> kvfree+0x47/0x50 mm/util.c:680
> device_release+0xa4/0x240 drivers/base/core.c:2499
> kobject_cleanup lib/kobject.c:689 [inline]
> kobject_release lib/kobject.c:720 [inline]
> kref_put include/linux/kref.h:65 [inline]
> kobject_put+0x1fd/0x5b0 lib/kobject.c:737
> netdev_run_todo+0x7d1/0x1260 net/core/dev.c:10591
> default_device_exit_batch+0x860/0xae0 net/core/dev.c:11632
> ops_exit_list+0x12b/0x180 net/core/net_namespace.c:175
> cleanup_net+0x5b7/0xbf0 net/core/net_namespace.c:637
> process_one_work+0x9ac/0x1a60 kernel/workqueue.c:3254
> process_scheduled_works kernel/workqueue.c:3335 [inline]
> worker_thread+0x6c8/0xf70 kernel/workqueue.c:3416
> kthread+0x2c4/0x3a0 kernel/kthread.c:388
> ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147
> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243
>
> The buggy address belongs to the object at ffff888021f46000
> which belongs to the cache kmalloc-cg-4k of size 4096
> The buggy address is located 776 bytes inside of
> freed 4096-byte region [ffff888021f46000, ffff888021f47000)
>
> The buggy address belongs to the physical page:
> page:ffffea000087d000 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x21f40
> head:ffffea000087d000 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0
> memcg:ffff8880636ce481
> flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff)
> page_type: 0xffffffff()
> raw: 00fff00000000840 ffff88801504f500 dead000000000122 0000000000000000
> raw: 0000000000000000 0000000000040004 00000001ffffffff ffff8880636ce481
> page dumped because: kasan: bad access detected
> page_owner tracks the page as allocated
> page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 10125, tgid 10125 (syz-executor.2), ts 404185927295, free_ts 404019420685
> set_page_owner include/linux/page_owner.h:31 [inline]
> post_alloc_hook+0x2d4/0x350 mm/page_alloc.c:1533
> prep_new_page mm/page_alloc.c:1540 [inline]
> get_page_from_freelist+0xa28/0x3780 mm/page_alloc.c:3311
> __alloc_pages+0x22b/0x2410 mm/page_alloc.c:4569
> __alloc_pages_node include/linux/gfp.h:238 [inline]
> alloc_pages_node include/linux/gfp.h:261 [inline]
> alloc_slab_page mm/slub.c:2175 [inline]
> allocate_slab mm/slub.c:2338 [inline]
> new_slab+0xcc/0x3a0 mm/slub.c:2391
> ___slab_alloc+0x66d/0x1790 mm/slub.c:3525
> __slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3610
> __slab_alloc_node mm/slub.c:3663 [inline]
> slab_alloc_node mm/slub.c:3835 [inline]
> __do_kmalloc_node mm/slub.c:3965 [inline]
> __kmalloc_node_track_caller+0x367/0x470 mm/slub.c:3986
> kmemdup+0x29/0x60 mm/util.c:131
> kmemdup include/linux/fortify-string.h:738 [inline]
> __devinet_sysctl_register+0xbc/0x360 net/ipv4/devinet.c:2577
> devinet_sysctl_register net/ipv4/devinet.c:2629 [inline]
> devinet_sysctl_register+0x17b/0x200 net/ipv4/devinet.c:2619
> inetdev_init+0x28b/0x580 net/ipv4/devinet.c:286
> inetdev_event+0xd23/0x19b0 net/ipv4/devinet.c:1560
> notifier_call_chain+0xbc/0x3e0 kernel/notifier.c:93
> call_netdevice_notifiers_info+0xbe/0x140 net/core/dev.c:1950
> call_netdevice_notifiers_extack net/core/dev.c:1988 [inline]
> call_netdevice_notifiers net/core/dev.c:2002 [inline]
> register_netdevice+0x15f5/0x1ca0 net/core/dev.c:10307
> virt_wifi_newlink+0x3ed/0x970 drivers/net/wireless/virtual/virt_wifi.c:553
> page last free pid 10234 tgid 10232 stack trace:
> reset_page_owner include/linux/page_owner.h:24 [inline]
> free_pages_prepare mm/page_alloc.c:1140 [inline]
> free_unref_page_prepare+0x527/0xb10 mm/page_alloc.c:2346
> free_unref_page+0x33/0x3c0 mm/page_alloc.c:2486
> __put_partials+0x14c/0x170 mm/slub.c:2906
> qlink_free mm/kasan/quarantine.c:163 [inline]
> qlist_free_all+0x4e/0x140 mm/kasan/quarantine.c:179
> kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
> __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:322
> kasan_slab_alloc include/linux/kasan.h:201 [inline]
> slab_post_alloc_hook mm/slub.c:3798 [inline]
> slab_alloc_node mm/slub.c:3845 [inline]
> kmem_cache_alloc_node+0x177/0x340 mm/slub.c:3888
> __alloc_skb+0x2b1/0x380 net/core/skbuff.c:658
> alloc_skb_fclone include/linux/skbuff.h:1368 [inline]
> tipc_buf_acquire+0x26/0xe0 net/tipc/msg.c:72
> tipc_msg_build+0x10c/0x1120 net/tipc/msg.c:386
> tipc_sendmcast+0x79e/0xb70 net/tipc/socket.c:881
> __tipc_sendmsg+0x1317/0x1940 net/tipc/socket.c:1469
> tipc_sendmsg+0x4f/0x70 net/tipc/socket.c:1403
> sock_sendmsg_nosec net/socket.c:730 [inline]
> __sock_sendmsg net/socket.c:745 [inline]
> ____sys_sendmsg+0xab8/0xc90 net/socket.c:2584
> ___sys_sendmsg+0x135/0x1e0 net/socket.c:2638
> __sys_sendmmsg+0x1a1/0x450 net/socket.c:2724
>
> Memory state around the buggy address:
> ffff888021f46200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> ffff888021f46280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>> ffff888021f46300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> ^
> ffff888021f46380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> ffff888021f46400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> ==================================================================
>
>
> ---
> This report is generated by a bot. It may contain errors.
> See https://goo.gl/tpsmEJ for more information about syzbot.
> syzbot engineers can be reached at syzkaller@googlegroups.com.
>
> syzbot will keep track of this issue. See:
> https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
>
> If the report is already addressed, let syzbot know by replying with:
> #syz fix: exact-commit-title
>
> If you want to overwrite report's subsystems, reply with:
> #syz set subsystems: new-subsystem
> (See the list of subsystem names on the web dashboard)
>
> If the report is a duplicate of another one, reply with:
> #syz dup: exact-subject-of-another-report
>
> If you want to undo deduplication, reply with:
> #syz undup
>
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [syzbot] [net?] KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings
2024-03-25 12:09 ` Denis Kirjanov
@ 2024-03-25 13:08 ` Eric Dumazet
2024-09-28 12:21 ` Hillf Danton
0 siblings, 1 reply; 9+ messages in thread
From: Eric Dumazet @ 2024-03-25 13:08 UTC (permalink / raw)
To: Denis Kirjanov
Cc: syzbot, davem, kuba, linux-kernel, netdev, pabeni, syzkaller-bugs
On Mon, Mar 25, 2024 at 1:10 PM Denis Kirjanov <dkirjanov@suse.de> wrote:
>
>
>
> On 3/22/24 23:10, syzbot wrote:
> > Hello,
> >
> > syzbot found the following issue on:
> >
> > HEAD commit: 61387b8dcf1d Merge tag 'for-6.9/dm-vdo' of git://git.kerne..
> > git tree: upstream
> > console output: https://syzkaller.appspot.com/x/log.txt?x=11effbd1180000
> > kernel config: https://syzkaller.appspot.com/x/.config?x=c6aea81bc9ff5e99
> > dashboard link: https://syzkaller.appspot.com/bug?extid=5fe14f2ff4ccbace9a26
> > compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
> >
> > Unfortunately, I don't have any reproducer for this issue yet.
> >
> > Downloadable assets:
> > disk image: https://storage.googleapis.com/syzbot-assets/b972a52930fa/disk-61387b8d.raw.xz
> > vmlinux: https://storage.googleapis.com/syzbot-assets/caa2592898b6/vmlinux-61387b8d.xz
> > kernel image: https://storage.googleapis.com/syzbot-assets/4187257afcc5/bzImage-61387b8d.xz
> >
> > IMPORTANT: if you fix the issue, please add the following tag to the commit:
> > Reported-by: syzbot+5fe14f2ff4ccbace9a26@syzkaller.appspotmail.com
> >
> > ==================================================================
> > BUG: KASAN: slab-use-after-free in __ethtool_get_link_ksettings+0x186/0x190 net/ethtool/ioctl.c:441
> > Read of size 8 at addr ffff888021f46308 by task kworker/0:4/5169
> >
> > CPU: 0 PID: 5169 Comm: kworker/0:4 Not tainted 6.8.0-syzkaller-05562-g61387b8dcf1d #0
> > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024
> > Workqueue: infiniband ib_cache_event_task
> > Call Trace:
> > <TASK>
> > __dump_stack lib/dump_stack.c:88 [inline]
> > dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:114
> > print_address_description mm/kasan/report.c:377 [inline]
> > print_report+0xc3/0x620 mm/kasan/report.c:488
> > kasan_report+0xd9/0x110 mm/kasan/report.c:601
> > __ethtool_get_link_ksettings+0x186/0x190 net/ethtool/ioctl.c:441
> > __ethtool_get_link_ksettings+0xf5/0x190 net/ethtool/ioctl.c:445
>
> Hmm, report says that we have a net_device freed even that we have a dev_hold()
> before __ethtool_get_link_ksettings()
dev_hold(dev) might be done too late, the device is already being dismantled.
ib_device_get_netdev() should probably be done under RTNL locking,
otherwise the final part is racy :
if (res && res->reg_state != NETREG_REGISTERED) {
dev_put(res);
return NULL;
}
>
> > ib_get_eth_speed+0x123/0xb50 drivers/infiniband/core/verbs.c:1984
> > siw_query_port+0x3c/0x3e0 drivers/infiniband/sw/siw/siw_verbs.c:179
> > iw_query_port drivers/infiniband/core/device.c:2049 [inline]
> > ib_query_port drivers/infiniband/core/device.c:2090 [inline]
> > ib_query_port+0x3d5/0x8a0 drivers/infiniband/core/device.c:2082
> > ib_cache_update.part.0+0xdc/0xa30 drivers/infiniband/core/cache.c:1498
> > ib_cache_update drivers/infiniband/core/cache.c:1572 [inline]
> > ib_cache_event_task+0x1c2/0x290 drivers/infiniband/core/cache.c:1572
> > process_one_work+0x9ac/0x1a60 kernel/workqueue.c:3254
> > process_scheduled_works kernel/workqueue.c:3335 [inline]
> > worker_thread+0x6c8/0xf70 kernel/workqueue.c:3416
> > kthread+0x2c4/0x3a0 kernel/kthread.c:388
> > ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147
> > ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243
> > </TASK>
> >
> > Allocated by task 10125:
> > kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
> > kasan_save_track+0x14/0x30 mm/kasan/common.c:68
> > poison_kmalloc_redzone mm/kasan/common.c:370 [inline]
> > __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:387
> > kasan_kmalloc include/linux/kasan.h:211 [inline]
> > __do_kmalloc_node mm/slub.c:3966 [inline]
> > __kmalloc_node+0x226/0x480 mm/slub.c:3973
> > kmalloc_node include/linux/slab.h:648 [inline]
> > kvmalloc_node+0x9d/0x1a0 mm/util.c:634
> > kvmalloc include/linux/slab.h:766 [inline]
> > kvzalloc include/linux/slab.h:774 [inline]
> > alloc_netdev_mqs+0xb3/0x12b0 net/core/dev.c:10840
> > rtnl_create_link+0xc88/0xfa0 net/core/rtnetlink.c:3358
> > rtnl_newlink_create net/core/rtnetlink.c:3484 [inline]
> > __rtnl_newlink+0x10ae/0x1960 net/core/rtnetlink.c:3714
> > rtnl_newlink+0x67/0xa0 net/core/rtnetlink.c:3727
> > rtnetlink_rcv_msg+0x3ca/0xe60 net/core/rtnetlink.c:6595
> > netlink_rcv_skb+0x16e/0x440 net/netlink/af_netlink.c:2559
> > netlink_unicast_kernel net/netlink/af_netlink.c:1335 [inline]
> > netlink_unicast+0x545/0x820 net/netlink/af_netlink.c:1361
> > netlink_sendmsg+0x8b8/0xd70 net/netlink/af_netlink.c:1905
> > sock_sendmsg_nosec net/socket.c:730 [inline]
> > __sock_sendmsg net/socket.c:745 [inline]
> > __sys_sendto+0x482/0x4e0 net/socket.c:2191
> > __do_sys_sendto net/socket.c:2203 [inline]
> > __se_sys_sendto net/socket.c:2199 [inline]
> > __x64_sys_sendto+0xe0/0x1c0 net/socket.c:2199
> > do_syscall_x64 arch/x86/entry/common.c:52 [inline]
> > do_syscall_64+0xd5/0x260 arch/x86/entry/common.c:83
> > entry_SYSCALL_64_after_hwframe+0x6d/0x75
> >
> > Freed by task 61:
> > kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
> > kasan_save_track+0x14/0x30 mm/kasan/common.c:68
> > kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:579
> > poison_slab_object mm/kasan/common.c:240 [inline]
> > __kasan_slab_free+0x11d/0x1a0 mm/kasan/common.c:256
> > kasan_slab_free include/linux/kasan.h:184 [inline]
> > slab_free_hook mm/slub.c:2106 [inline]
> > slab_free mm/slub.c:4280 [inline]
> > kfree+0x129/0x370 mm/slub.c:4390
> > kvfree+0x47/0x50 mm/util.c:680
> > device_release+0xa4/0x240 drivers/base/core.c:2499
> > kobject_cleanup lib/kobject.c:689 [inline]
> > kobject_release lib/kobject.c:720 [inline]
> > kref_put include/linux/kref.h:65 [inline]
> > kobject_put+0x1fd/0x5b0 lib/kobject.c:737
> > netdev_run_todo+0x7d1/0x1260 net/core/dev.c:10591
> > default_device_exit_batch+0x860/0xae0 net/core/dev.c:11632
> > ops_exit_list+0x12b/0x180 net/core/net_namespace.c:175
> > cleanup_net+0x5b7/0xbf0 net/core/net_namespace.c:637
> > process_one_work+0x9ac/0x1a60 kernel/workqueue.c:3254
> > process_scheduled_works kernel/workqueue.c:3335 [inline]
> > worker_thread+0x6c8/0xf70 kernel/workqueue.c:3416
> > kthread+0x2c4/0x3a0 kernel/kthread.c:388
> > ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147
> > ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243
> >
> > The buggy address belongs to the object at ffff888021f46000
> > which belongs to the cache kmalloc-cg-4k of size 4096
> > The buggy address is located 776 bytes inside of
> > freed 4096-byte region [ffff888021f46000, ffff888021f47000)
> >
> > The buggy address belongs to the physical page:
> > page:ffffea000087d000 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x21f40
> > head:ffffea000087d000 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0
> > memcg:ffff8880636ce481
> > flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff)
> > page_type: 0xffffffff()
> > raw: 00fff00000000840 ffff88801504f500 dead000000000122 0000000000000000
> > raw: 0000000000000000 0000000000040004 00000001ffffffff ffff8880636ce481
> > page dumped because: kasan: bad access detected
> > page_owner tracks the page as allocated
> > page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 10125, tgid 10125 (syz-executor.2), ts 404185927295, free_ts 404019420685
> > set_page_owner include/linux/page_owner.h:31 [inline]
> > post_alloc_hook+0x2d4/0x350 mm/page_alloc.c:1533
> > prep_new_page mm/page_alloc.c:1540 [inline]
> > get_page_from_freelist+0xa28/0x3780 mm/page_alloc.c:3311
> > __alloc_pages+0x22b/0x2410 mm/page_alloc.c:4569
> > __alloc_pages_node include/linux/gfp.h:238 [inline]
> > alloc_pages_node include/linux/gfp.h:261 [inline]
> > alloc_slab_page mm/slub.c:2175 [inline]
> > allocate_slab mm/slub.c:2338 [inline]
> > new_slab+0xcc/0x3a0 mm/slub.c:2391
> > ___slab_alloc+0x66d/0x1790 mm/slub.c:3525
> > __slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3610
> > __slab_alloc_node mm/slub.c:3663 [inline]
> > slab_alloc_node mm/slub.c:3835 [inline]
> > __do_kmalloc_node mm/slub.c:3965 [inline]
> > __kmalloc_node_track_caller+0x367/0x470 mm/slub.c:3986
> > kmemdup+0x29/0x60 mm/util.c:131
> > kmemdup include/linux/fortify-string.h:738 [inline]
> > __devinet_sysctl_register+0xbc/0x360 net/ipv4/devinet.c:2577
> > devinet_sysctl_register net/ipv4/devinet.c:2629 [inline]
> > devinet_sysctl_register+0x17b/0x200 net/ipv4/devinet.c:2619
> > inetdev_init+0x28b/0x580 net/ipv4/devinet.c:286
> > inetdev_event+0xd23/0x19b0 net/ipv4/devinet.c:1560
> > notifier_call_chain+0xbc/0x3e0 kernel/notifier.c:93
> > call_netdevice_notifiers_info+0xbe/0x140 net/core/dev.c:1950
> > call_netdevice_notifiers_extack net/core/dev.c:1988 [inline]
> > call_netdevice_notifiers net/core/dev.c:2002 [inline]
> > register_netdevice+0x15f5/0x1ca0 net/core/dev.c:10307
> > virt_wifi_newlink+0x3ed/0x970 drivers/net/wireless/virtual/virt_wifi.c:553
> > page last free pid 10234 tgid 10232 stack trace:
> > reset_page_owner include/linux/page_owner.h:24 [inline]
> > free_pages_prepare mm/page_alloc.c:1140 [inline]
> > free_unref_page_prepare+0x527/0xb10 mm/page_alloc.c:2346
> > free_unref_page+0x33/0x3c0 mm/page_alloc.c:2486
> > __put_partials+0x14c/0x170 mm/slub.c:2906
> > qlink_free mm/kasan/quarantine.c:163 [inline]
> > qlist_free_all+0x4e/0x140 mm/kasan/quarantine.c:179
> > kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
> > __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:322
> > kasan_slab_alloc include/linux/kasan.h:201 [inline]
> > slab_post_alloc_hook mm/slub.c:3798 [inline]
> > slab_alloc_node mm/slub.c:3845 [inline]
> > kmem_cache_alloc_node+0x177/0x340 mm/slub.c:3888
> > __alloc_skb+0x2b1/0x380 net/core/skbuff.c:658
> > alloc_skb_fclone include/linux/skbuff.h:1368 [inline]
> > tipc_buf_acquire+0x26/0xe0 net/tipc/msg.c:72
> > tipc_msg_build+0x10c/0x1120 net/tipc/msg.c:386
> > tipc_sendmcast+0x79e/0xb70 net/tipc/socket.c:881
> > __tipc_sendmsg+0x1317/0x1940 net/tipc/socket.c:1469
> > tipc_sendmsg+0x4f/0x70 net/tipc/socket.c:1403
> > sock_sendmsg_nosec net/socket.c:730 [inline]
> > __sock_sendmsg net/socket.c:745 [inline]
> > ____sys_sendmsg+0xab8/0xc90 net/socket.c:2584
> > ___sys_sendmsg+0x135/0x1e0 net/socket.c:2638
> > __sys_sendmmsg+0x1a1/0x450 net/socket.c:2724
> >
> > Memory state around the buggy address:
> > ffff888021f46200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> > ffff888021f46280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> >> ffff888021f46300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> > ^
> > ffff888021f46380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> > ffff888021f46400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> > ==================================================================
> > ==================================================================
> > BUG: KASAN: slab-use-after-free in __ethtool_get_link_ksettings+0x165/0x190 net/ethtool/ioctl.c:445
> > Read of size 8 at addr ffff888021f46308 by task kworker/0:4/5169
> >
> > CPU: 0 PID: 5169 Comm: kworker/0:4 Tainted: G B 6.8.0-syzkaller-05562-g61387b8dcf1d #0
> > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024
> > Workqueue: infiniband ib_cache_event_task
> > Call Trace:
> > <TASK>
> > __dump_stack lib/dump_stack.c:88 [inline]
> > dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:114
> > print_address_description mm/kasan/report.c:377 [inline]
> > print_report+0xc3/0x620 mm/kasan/report.c:488
> > kasan_report+0xd9/0x110 mm/kasan/report.c:601
> > __ethtool_get_link_ksettings+0x165/0x190 net/ethtool/ioctl.c:445
> > __ethtool_get_link_ksettings+0xf5/0x190 net/ethtool/ioctl.c:445
> > ib_get_eth_speed+0x123/0xb50 drivers/infiniband/core/verbs.c:1984
> > siw_query_port+0x3c/0x3e0 drivers/infiniband/sw/siw/siw_verbs.c:179
> > iw_query_port drivers/infiniband/core/device.c:2049 [inline]
> > ib_query_port drivers/infiniband/core/device.c:2090 [inline]
> > ib_query_port+0x3d5/0x8a0 drivers/infiniband/core/device.c:2082
> > ib_cache_update.part.0+0xdc/0xa30 drivers/infiniband/core/cache.c:1498
> > ib_cache_update drivers/infiniband/core/cache.c:1572 [inline]
> > ib_cache_event_task+0x1c2/0x290 drivers/infiniband/core/cache.c:1572
> > process_one_work+0x9ac/0x1a60 kernel/workqueue.c:3254
> > process_scheduled_works kernel/workqueue.c:3335 [inline]
> > worker_thread+0x6c8/0xf70 kernel/workqueue.c:3416
> > kthread+0x2c4/0x3a0 kernel/kthread.c:388
> > ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147
> > ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243
> > </TASK>
> >
> > Allocated by task 10125:
> > kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
> > kasan_save_track+0x14/0x30 mm/kasan/common.c:68
> > poison_kmalloc_redzone mm/kasan/common.c:370 [inline]
> > __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:387
> > kasan_kmalloc include/linux/kasan.h:211 [inline]
> > __do_kmalloc_node mm/slub.c:3966 [inline]
> > __kmalloc_node+0x226/0x480 mm/slub.c:3973
> > kmalloc_node include/linux/slab.h:648 [inline]
> > kvmalloc_node+0x9d/0x1a0 mm/util.c:634
> > kvmalloc include/linux/slab.h:766 [inline]
> > kvzalloc include/linux/slab.h:774 [inline]
> > alloc_netdev_mqs+0xb3/0x12b0 net/core/dev.c:10840
> > rtnl_create_link+0xc88/0xfa0 net/core/rtnetlink.c:3358
> > rtnl_newlink_create net/core/rtnetlink.c:3484 [inline]
> > __rtnl_newlink+0x10ae/0x1960 net/core/rtnetlink.c:3714
> > rtnl_newlink+0x67/0xa0 net/core/rtnetlink.c:3727
> > rtnetlink_rcv_msg+0x3ca/0xe60 net/core/rtnetlink.c:6595
> > netlink_rcv_skb+0x16e/0x440 net/netlink/af_netlink.c:2559
> > netlink_unicast_kernel net/netlink/af_netlink.c:1335 [inline]
> > netlink_unicast+0x545/0x820 net/netlink/af_netlink.c:1361
> > netlink_sendmsg+0x8b8/0xd70 net/netlink/af_netlink.c:1905
> > sock_sendmsg_nosec net/socket.c:730 [inline]
> > __sock_sendmsg net/socket.c:745 [inline]
> > __sys_sendto+0x482/0x4e0 net/socket.c:2191
> > __do_sys_sendto net/socket.c:2203 [inline]
> > __se_sys_sendto net/socket.c:2199 [inline]
> > __x64_sys_sendto+0xe0/0x1c0 net/socket.c:2199
> > do_syscall_x64 arch/x86/entry/common.c:52 [inline]
> > do_syscall_64+0xd5/0x260 arch/x86/entry/common.c:83
> > entry_SYSCALL_64_after_hwframe+0x6d/0x75
> >
> > Freed by task 61:
> > kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
> > kasan_save_track+0x14/0x30 mm/kasan/common.c:68
> > kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:579
> > poison_slab_object mm/kasan/common.c:240 [inline]
> > __kasan_slab_free+0x11d/0x1a0 mm/kasan/common.c:256
> > kasan_slab_free include/linux/kasan.h:184 [inline]
> > slab_free_hook mm/slub.c:2106 [inline]
> > slab_free mm/slub.c:4280 [inline]
> > kfree+0x129/0x370 mm/slub.c:4390
> > kvfree+0x47/0x50 mm/util.c:680
> > device_release+0xa4/0x240 drivers/base/core.c:2499
> > kobject_cleanup lib/kobject.c:689 [inline]
> > kobject_release lib/kobject.c:720 [inline]
> > kref_put include/linux/kref.h:65 [inline]
> > kobject_put+0x1fd/0x5b0 lib/kobject.c:737
> > netdev_run_todo+0x7d1/0x1260 net/core/dev.c:10591
> > default_device_exit_batch+0x860/0xae0 net/core/dev.c:11632
> > ops_exit_list+0x12b/0x180 net/core/net_namespace.c:175
> > cleanup_net+0x5b7/0xbf0 net/core/net_namespace.c:637
> > process_one_work+0x9ac/0x1a60 kernel/workqueue.c:3254
> > process_scheduled_works kernel/workqueue.c:3335 [inline]
> > worker_thread+0x6c8/0xf70 kernel/workqueue.c:3416
> > kthread+0x2c4/0x3a0 kernel/kthread.c:388
> > ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147
> > ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243
> >
> > The buggy address belongs to the object at ffff888021f46000
> > which belongs to the cache kmalloc-cg-4k of size 4096
> > The buggy address is located 776 bytes inside of
> > freed 4096-byte region [ffff888021f46000, ffff888021f47000)
> >
> > The buggy address belongs to the physical page:
> > page:ffffea000087d000 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x21f40
> > head:ffffea000087d000 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0
> > memcg:ffff8880636ce481
> > flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff)
> > page_type: 0xffffffff()
> > raw: 00fff00000000840 ffff88801504f500 dead000000000122 0000000000000000
> > raw: 0000000000000000 0000000000040004 00000001ffffffff ffff8880636ce481
> > page dumped because: kasan: bad access detected
> > page_owner tracks the page as allocated
> > page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 10125, tgid 10125 (syz-executor.2), ts 404185927295, free_ts 404019420685
> > set_page_owner include/linux/page_owner.h:31 [inline]
> > post_alloc_hook+0x2d4/0x350 mm/page_alloc.c:1533
> > prep_new_page mm/page_alloc.c:1540 [inline]
> > get_page_from_freelist+0xa28/0x3780 mm/page_alloc.c:3311
> > __alloc_pages+0x22b/0x2410 mm/page_alloc.c:4569
> > __alloc_pages_node include/linux/gfp.h:238 [inline]
> > alloc_pages_node include/linux/gfp.h:261 [inline]
> > alloc_slab_page mm/slub.c:2175 [inline]
> > allocate_slab mm/slub.c:2338 [inline]
> > new_slab+0xcc/0x3a0 mm/slub.c:2391
> > ___slab_alloc+0x66d/0x1790 mm/slub.c:3525
> > __slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3610
> > __slab_alloc_node mm/slub.c:3663 [inline]
> > slab_alloc_node mm/slub.c:3835 [inline]
> > __do_kmalloc_node mm/slub.c:3965 [inline]
> > __kmalloc_node_track_caller+0x367/0x470 mm/slub.c:3986
> > kmemdup+0x29/0x60 mm/util.c:131
> > kmemdup include/linux/fortify-string.h:738 [inline]
> > __devinet_sysctl_register+0xbc/0x360 net/ipv4/devinet.c:2577
> > devinet_sysctl_register net/ipv4/devinet.c:2629 [inline]
> > devinet_sysctl_register+0x17b/0x200 net/ipv4/devinet.c:2619
> > inetdev_init+0x28b/0x580 net/ipv4/devinet.c:286
> > inetdev_event+0xd23/0x19b0 net/ipv4/devinet.c:1560
> > notifier_call_chain+0xbc/0x3e0 kernel/notifier.c:93
> > call_netdevice_notifiers_info+0xbe/0x140 net/core/dev.c:1950
> > call_netdevice_notifiers_extack net/core/dev.c:1988 [inline]
> > call_netdevice_notifiers net/core/dev.c:2002 [inline]
> > register_netdevice+0x15f5/0x1ca0 net/core/dev.c:10307
> > virt_wifi_newlink+0x3ed/0x970 drivers/net/wireless/virtual/virt_wifi.c:553
> > page last free pid 10234 tgid 10232 stack trace:
> > reset_page_owner include/linux/page_owner.h:24 [inline]
> > free_pages_prepare mm/page_alloc.c:1140 [inline]
> > free_unref_page_prepare+0x527/0xb10 mm/page_alloc.c:2346
> > free_unref_page+0x33/0x3c0 mm/page_alloc.c:2486
> > __put_partials+0x14c/0x170 mm/slub.c:2906
> > qlink_free mm/kasan/quarantine.c:163 [inline]
> > qlist_free_all+0x4e/0x140 mm/kasan/quarantine.c:179
> > kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
> > __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:322
> > kasan_slab_alloc include/linux/kasan.h:201 [inline]
> > slab_post_alloc_hook mm/slub.c:3798 [inline]
> > slab_alloc_node mm/slub.c:3845 [inline]
> > kmem_cache_alloc_node+0x177/0x340 mm/slub.c:3888
> > __alloc_skb+0x2b1/0x380 net/core/skbuff.c:658
> > alloc_skb_fclone include/linux/skbuff.h:1368 [inline]
> > tipc_buf_acquire+0x26/0xe0 net/tipc/msg.c:72
> > tipc_msg_build+0x10c/0x1120 net/tipc/msg.c:386
> > tipc_sendmcast+0x79e/0xb70 net/tipc/socket.c:881
> > __tipc_sendmsg+0x1317/0x1940 net/tipc/socket.c:1469
> > tipc_sendmsg+0x4f/0x70 net/tipc/socket.c:1403
> > sock_sendmsg_nosec net/socket.c:730 [inline]
> > __sock_sendmsg net/socket.c:745 [inline]
> > ____sys_sendmsg+0xab8/0xc90 net/socket.c:2584
> > ___sys_sendmsg+0x135/0x1e0 net/socket.c:2638
> > __sys_sendmmsg+0x1a1/0x450 net/socket.c:2724
> >
> > Memory state around the buggy address:
> > ffff888021f46200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> > ffff888021f46280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> >> ffff888021f46300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> > ^
> > ffff888021f46380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> > ffff888021f46400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> > ==================================================================
> >
> >
> > ---
> > This report is generated by a bot. It may contain errors.
> > See https://goo.gl/tpsmEJ for more information about syzbot.
> > syzbot engineers can be reached at syzkaller@googlegroups.com.
> >
> > syzbot will keep track of this issue. See:
> > https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
> >
> > If the report is already addressed, let syzbot know by replying with:
> > #syz fix: exact-commit-title
> >
> > If you want to overwrite report's subsystems, reply with:
> > #syz set subsystems: new-subsystem
> > (See the list of subsystem names on the web dashboard)
> >
> > If the report is a duplicate of another one, reply with:
> > #syz dup: exact-subject-of-another-report
> >
> > If you want to undo deduplication, reply with:
> > #syz undup
> >
^ permalink raw reply [flat|nested] 9+ messages in thread* Re: [syzbot] [net?] KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings
2024-03-25 13:08 ` Eric Dumazet
@ 2024-09-28 12:21 ` Hillf Danton
2024-09-29 11:46 ` Hillf Danton
0 siblings, 1 reply; 9+ messages in thread
From: Hillf Danton @ 2024-09-28 12:21 UTC (permalink / raw)
To: Eric Dumazet
Cc: Denis Kirjanov, syzbot, linux-kernel, Tetsuo Handa, Boqun Feng,
Linus Torvalds, netdev, syzkaller-bugs
On Mon, 25 Mar 2024 14:08:36 +0100 Eric Dumazet <edumazet@google.com>
> On Mon, Mar 25, 2024 at 1:10 PM Denis Kirjanov <dkirjanov@suse.de> wrote:
> > On 3/22/24 23:10, syzbot wrote:
> > > Hello,
> > >
> > > syzbot found the following issue on:
> > >
> > > HEAD commit: 61387b8dcf1d Merge tag 'for-6.9/dm-vdo' of git://git.kerne..
> > > git tree: upstream
> > > console output: https://syzkaller.appspot.com/x/log.txt?x=11effbd1180000
> > > kernel config: https://syzkaller.appspot.com/x/.config?x=c6aea81bc9ff5e99
> > > dashboard link: https://syzkaller.appspot.com/bug?extid=5fe14f2ff4ccbace9a26
> > > compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
> > >
> > > Unfortunately, I don't have any reproducer for this issue yet.
> > >
> > > Downloadable assets:
> > > disk image: https://storage.googleapis.com/syzbot-assets/b972a52930fa/disk-61387b8d.raw.xz
> > > vmlinux: https://storage.googleapis.com/syzbot-assets/caa2592898b6/vmlinux-61387b8d.xz
> > > kernel image: https://storage.googleapis.com/syzbot-assets/4187257afcc5/bzImage-61387b8d.xz
> > >
> > > IMPORTANT: if you fix the issue, please add the following tag to the commit:
> > > Reported-by: syzbot+5fe14f2ff4ccbace9a26@syzkaller.appspotmail.com
> > >
> > > ==================================================================
> > > BUG: KASAN: slab-use-after-free in __ethtool_get_link_ksettings+0x186/0x190 net/ethtool/ioctl.c:441
> > > Read of size 8 at addr ffff888021f46308 by task kworker/0:4/5169
> > >
> > > CPU: 0 PID: 5169 Comm: kworker/0:4 Not tainted 6.8.0-syzkaller-05562-g61387b8dcf1d #0
> > > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024
> > > Workqueue: infiniband ib_cache_event_task
> > > Call Trace:
> > > <TASK>
> > > __dump_stack lib/dump_stack.c:88 [inline]
> > > dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:114
> > > print_address_description mm/kasan/report.c:377 [inline]
> > > print_report+0xc3/0x620 mm/kasan/report.c:488
> > > kasan_report+0xd9/0x110 mm/kasan/report.c:601
> > > __ethtool_get_link_ksettings+0x186/0x190 net/ethtool/ioctl.c:441
> > > __ethtool_get_link_ksettings+0xf5/0x190 net/ethtool/ioctl.c:445
> >
> > Hmm, report says that we have a net_device freed even that we have a dev_hold()
> > before __ethtool_get_link_ksettings()
>
> dev_hold(dev) might be done too late, the device is already being dismantled.
>
> ib_device_get_netdev() should probably be done under RTNL locking,
> otherwise the final part is racy :
>
> if (res && res->reg_state != NETREG_REGISTERED) {
> dev_put(res);
> return NULL;
> }
Given paranoia in netdev_run_todo(),
/* paranoia */
BUG_ON(netdev_refcnt_read(dev) != 1);
the claim that dev_hold(dev) might be done too late could not explain
the success of checking NETREG_REGISTERED, because of checking
NETREG_UNREGISTERING after rcu barrier.
/* Wait for rcu callbacks to finish before next phase */
if (!list_empty(&list))
rcu_barrier();
list_for_each_entry_safe(dev, tmp, &list, todo_list) {
if (unlikely(dev->reg_state != NETREG_UNREGISTERING)) {
netdev_WARN(dev, "run_todo but not unregistering\n");
list_del(&dev->todo_list);
continue;
}
^ permalink raw reply [flat|nested] 9+ messages in thread* Re: [syzbot] [net?] KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings
2024-09-28 12:21 ` Hillf Danton
@ 2024-09-29 11:46 ` Hillf Danton
2024-09-30 8:32 ` Eric Dumazet
0 siblings, 1 reply; 9+ messages in thread
From: Hillf Danton @ 2024-09-29 11:46 UTC (permalink / raw)
To: Eric Dumazet
Cc: Denis Kirjanov, syzbot, linux-kernel, Tetsuo Handa, Boqun Feng,
Linus Torvalds, netdev, syzkaller-bugs
On Sat, 28 Sep 2024 20:21:12 +0800 Hillf Danton <hdanton@sina.com>
> On Mon, 25 Mar 2024 14:08:36 +0100 Eric Dumazet <edumazet@google.com>
> > On Mon, Mar 25, 2024 at 1:10 PM Denis Kirjanov <dkirjanov@suse.de> wrote:
> > >
> > > Hmm, report says that we have a net_device freed even that we have a dev_hold()
> > > before __ethtool_get_link_ksettings()
> >
> > dev_hold(dev) might be done too late, the device is already being dismantled.
> >
> > ib_device_get_netdev() should probably be done under RTNL locking,
> > otherwise the final part is racy :
> >
> > if (res && res->reg_state != NETREG_REGISTERED) {
> > dev_put(res);
> > return NULL;
> > }
>
> Given paranoia in netdev_run_todo(),
>
> /* paranoia */
> BUG_ON(netdev_refcnt_read(dev) != 1);
>
> the claim that dev_hold(dev) might be done too late could not explain
> the success of checking NETREG_REGISTERED, because of checking
> NETREG_UNREGISTERING after rcu barrier.
>
> /* Wait for rcu callbacks to finish before next phase */
> if (!list_empty(&list))
> rcu_barrier();
>
> list_for_each_entry_safe(dev, tmp, &list, todo_list) {
> if (unlikely(dev->reg_state != NETREG_UNREGISTERING)) {
> netdev_WARN(dev, "run_todo but not unregistering\n");
> list_del(&dev->todo_list);
> continue;
> }
>
As simply bumping kref up could survive the syzbot reproducer [1], Eric's reclaim
is incorrect.
--- l/drivers/infiniband/core/verbs.c
+++ v/drivers/infiniband/core/verbs.c
@@ -1979,6 +1979,7 @@ int ib_get_eth_speed(struct ib_device *d
netdev = ib_device_get_netdev(dev, port_num);
if (!netdev)
return -ENODEV;
+ dev_hold(netdev);
rtnl_lock();
rc = __ethtool_get_link_ksettings(netdev, &lksettings);
@@ -1995,6 +1996,7 @@ int ib_get_eth_speed(struct ib_device *d
netdev->name, netdev_speed);
}
+ dev_put(netdev);
ib_get_width_and_speed(netdev_speed, lksettings.lanes,
speed, width);
--
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-by: syzbot+5fe14f2ff4ccbace9a26@syzkaller.appspotmail.com
Tested-by: syzbot+5fe14f2ff4ccbace9a26@syzkaller.appspotmail.com
[1] https://lore.kernel.org/lkml/66f9372f.050a0220.aab67.001a.GAE@google.com/
^ permalink raw reply [flat|nested] 9+ messages in thread* Re: [syzbot] [net?] KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings
2024-09-29 11:46 ` Hillf Danton
@ 2024-09-30 8:32 ` Eric Dumazet
2024-09-30 12:27 ` Hillf Danton
0 siblings, 1 reply; 9+ messages in thread
From: Eric Dumazet @ 2024-09-30 8:32 UTC (permalink / raw)
To: Hillf Danton
Cc: Denis Kirjanov, syzbot, linux-kernel, Tetsuo Handa, Boqun Feng,
Linus Torvalds, netdev, syzkaller-bugs
On Sun, Sep 29, 2024 at 1:46 PM Hillf Danton <hdanton@sina.com> wrote:
>
> On Sat, 28 Sep 2024 20:21:12 +0800 Hillf Danton <hdanton@sina.com>
> > On Mon, 25 Mar 2024 14:08:36 +0100 Eric Dumazet <edumazet@google.com>
> > > On Mon, Mar 25, 2024 at 1:10 PM Denis Kirjanov <dkirjanov@suse.de> wrote:
> > > >
> > > > Hmm, report says that we have a net_device freed even that we have a dev_hold()
> > > > before __ethtool_get_link_ksettings()
> > >
> > > dev_hold(dev) might be done too late, the device is already being dismantled.
> > >
> > > ib_device_get_netdev() should probably be done under RTNL locking,
> > > otherwise the final part is racy :
> > >
> > > if (res && res->reg_state != NETREG_REGISTERED) {
> > > dev_put(res);
> > > return NULL;
> > > }
> >
> > Given paranoia in netdev_run_todo(),
> >
> > /* paranoia */
> > BUG_ON(netdev_refcnt_read(dev) != 1);
> >
> > the claim that dev_hold(dev) might be done too late could not explain
> > the success of checking NETREG_REGISTERED, because of checking
> > NETREG_UNREGISTERING after rcu barrier.
> >
> > /* Wait for rcu callbacks to finish before next phase */
> > if (!list_empty(&list))
> > rcu_barrier();
> >
> > list_for_each_entry_safe(dev, tmp, &list, todo_list) {
> > if (unlikely(dev->reg_state != NETREG_UNREGISTERING)) {
> > netdev_WARN(dev, "run_todo but not unregistering\n");
> > list_del(&dev->todo_list);
> > continue;
> > }
> >
> As simply bumping kref up could survive the syzbot reproducer [1], Eric's reclaim
> is incorrect.
I have about 50 different syzbot reports all pointing to netdevsim and
sysfs buggy interaction.
We will see if you can fix all of them :)
>
> --- l/drivers/infiniband/core/verbs.c
> +++ v/drivers/infiniband/core/verbs.c
> @@ -1979,6 +1979,7 @@ int ib_get_eth_speed(struct ib_device *d
> netdev = ib_device_get_netdev(dev, port_num);
> if (!netdev)
> return -ENODEV;
> + dev_hold(netdev);
>
> rtnl_lock();
> rc = __ethtool_get_link_ksettings(netdev, &lksettings);
> @@ -1995,6 +1996,7 @@ int ib_get_eth_speed(struct ib_device *d
> netdev->name, netdev_speed);
> }
>
> + dev_put(netdev);
> ib_get_width_and_speed(netdev_speed, lksettings.lanes,
> speed, width);
>
> --
> syzbot has tested the proposed patch and the reproducer did not trigger any issue:
>
> Reported-by: syzbot+5fe14f2ff4ccbace9a26@syzkaller.appspotmail.com
> Tested-by: syzbot+5fe14f2ff4ccbace9a26@syzkaller.appspotmail.com
>
> [1] https://lore.kernel.org/lkml/66f9372f.050a0220.aab67.001a.GAE@google.com/
^ permalink raw reply [flat|nested] 9+ messages in thread* Re: [syzbot] [net?] KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings
2024-09-30 8:32 ` Eric Dumazet
@ 2024-09-30 12:27 ` Hillf Danton
0 siblings, 0 replies; 9+ messages in thread
From: Hillf Danton @ 2024-09-30 12:27 UTC (permalink / raw)
To: Eric Dumazet
Cc: Denis Kirjanov, syzbot, linux-kernel, Tetsuo Handa, Boqun Feng,
Linus Torvalds, netdev, syzkaller-bugs
On Mon, 30 Sep 2024 10:32:32 +0200 Eric Dumazet <edumazet@google.com>
> On Sun, Sep 29, 2024 at 1:46 PM Hillf Danton <hdanton@sina.com> wrote:
> > On Sat, 28 Sep 2024 20:21:12 +0800 Hillf Danton <hdanton@sina.com>
> > > On Mon, 25 Mar 2024 14:08:36 +0100 Eric Dumazet <edumazet@google.com>
> > > > On Mon, Mar 25, 2024 at 1:10 PM Denis Kirjanov <dkirjanov@suse.de> wrote:
> > > > >
> > > > > Hmm, report says that we have a net_device freed even that we have a dev_hold()
> > > > > before __ethtool_get_link_ksettings()
> > > >
> > > > dev_hold(dev) might be done too late, the device is already being dismantled.
> > > >
> > > > ib_device_get_netdev() should probably be done under RTNL locking,
> > > > otherwise the final part is racy :
> > > >
> > > > if (res && res->reg_state != NETREG_REGISTERED) {
> > > > dev_put(res);
> > > > return NULL;
> > > > }
> > >
> > > Given paranoia in netdev_run_todo(),
> > >
> > > /* paranoia */
> > > BUG_ON(netdev_refcnt_read(dev) != 1);
> > >
> > > the claim that dev_hold(dev) might be done too late could not explain
> > > the success of checking NETREG_REGISTERED, because of checking
> > > NETREG_UNREGISTERING after rcu barrier.
> > >
> > > /* Wait for rcu callbacks to finish before next phase */
> > > if (!list_empty(&list))
> > > rcu_barrier();
> > >
> > > list_for_each_entry_safe(dev, tmp, &list, todo_list) {
> > > if (unlikely(dev->reg_state != NETREG_UNREGISTERING)) {
> > > netdev_WARN(dev, "run_todo but not unregistering\n");
> > > list_del(&dev->todo_list);
> > > continue;
> > > }
> > >
> > As simply bumping kref up could survive the syzbot reproducer [1], Eric's reclaim
> > is incorrect.
>
> I have about 50 different syzbot reports all pointing to netdevsim and
> sysfs buggy interaction.
>
> We will see if you can fix all of them :)
>
Looks like something I know
[1] https://lore.kernel.org/all/20220819220827.1639-1-hdanton@sina.com/
[2] https://lore.kernel.org/all/20231011211846.1345-1-hdanton@sina.com/
[3] https://lore.kernel.org/all/20240719112012.1562-1-hdanton@sina.com/
BTW I won the 2020 google OSPB Award (How many cents did you donate that year?).
And my current target is the Independent Observer at the 2025 Linux Plumbers
Conference if the LT king thinks observers are welcome.
Now turn to uaf. As the netdev_hold() in ib_device_set_netdev() matches the
netdev_put() in free_netdevs(), in combination with the dev_hold() in
ib_device_get_netdev(), the syz report discovers a valid case where kref fails
to prevent netdev from being freed under feet, even given the paranoia
in netdev_run_todo().
Hillf
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [syzbot] [net?] KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings
2024-03-22 20:10 [syzbot] [net?] KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings syzbot
2024-03-25 12:09 ` Denis Kirjanov
@ 2024-09-27 18:26 ` syzbot
2024-10-08 1:44 ` syzbot
2 siblings, 0 replies; 9+ messages in thread
From: syzbot @ 2024-09-27 18:26 UTC (permalink / raw)
To: davem, dkirjanov, edumazet, jgg, kirjanov, kuba, leon,
linux-kernel, linux-rdma, naveenm, netdev, pabeni, rkannoth,
syzkaller-bugs
syzbot has found a reproducer for the following issue on:
HEAD commit: d505d3593b52 net: wwan: qcom_bam_dmux: Fix missing pm_runt..
git tree: net
console output: https://syzkaller.appspot.com/x/log.txt?x=105286a9980000
kernel config: https://syzkaller.appspot.com/x/.config?x=b2d4fdf18a83ec0b
dashboard link: https://syzkaller.appspot.com/bug?extid=5fe14f2ff4ccbace9a26
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=150d959f980000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0286a1cf90df/disk-d505d359.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/b573fa96ab33/vmlinux-d505d359.xz
kernel image: https://storage.googleapis.com/syzbot-assets/cdd9993102ed/bzImage-d505d359.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+5fe14f2ff4ccbace9a26@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: slab-use-after-free in __ethtool_get_link_ksettings+0x6e/0x190 net/ethtool/ioctl.c:442
Read of size 8 at addr ffff88806ea3a308 by task kworker/1:1/60
CPU: 1 UID: 0 PID: 60 Comm: kworker/1:1 Not tainted 6.11.0-syzkaller-11503-gd505d3593b52 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Workqueue: events smc_ib_port_event_work
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:377 [inline]
print_report+0x169/0x550 mm/kasan/report.c:488
kasan_report+0x143/0x180 mm/kasan/report.c:601
__ethtool_get_link_ksettings+0x6e/0x190 net/ethtool/ioctl.c:442
ib_get_eth_speed+0x160/0x800 drivers/infiniband/core/verbs.c:1996
rxe_query_port+0x76/0x260 drivers/infiniband/sw/rxe/rxe_verbs.c:55
__ib_query_port drivers/infiniband/core/device.c:2111 [inline]
ib_query_port+0x166/0x7d0 drivers/infiniband/core/device.c:2143
smc_ib_remember_port_attr net/smc/smc_ib.c:364 [inline]
smc_ib_port_event_work+0x14e/0xa50 net/smc/smc_ib.c:388
process_one_work kernel/workqueue.c:3229 [inline]
process_scheduled_works+0xa63/0x1850 kernel/workqueue.c:3310
worker_thread+0x870/0xd30 kernel/workqueue.c:3391
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
Allocated by task 5335:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
__kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394
kasan_kmalloc include/linux/kasan.h:257 [inline]
__do_kmalloc_node mm/slub.c:4265 [inline]
__kmalloc_node_noprof+0x22a/0x440 mm/slub.c:4271
__kvmalloc_node_noprof+0x72/0x190 mm/util.c:658
alloc_netdev_mqs+0x9b/0x1000 net/core/dev.c:11093
rtnl_create_link+0x2f9/0xc20 net/core/rtnetlink.c:3374
rtnl_newlink_create net/core/rtnetlink.c:3500 [inline]
__rtnl_newlink net/core/rtnetlink.c:3730 [inline]
rtnl_newlink+0x1423/0x20a0 net/core/rtnetlink.c:3743
rtnetlink_rcv_msg+0x73f/0xcf0 net/core/rtnetlink.c:6646
netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2550
netlink_unicast_kernel net/netlink/af_netlink.c:1331 [inline]
netlink_unicast+0x7f6/0x990 net/netlink/af_netlink.c:1357
netlink_sendmsg+0x8e4/0xcb0 net/netlink/af_netlink.c:1901
sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg+0x221/0x270 net/socket.c:745
__sys_sendto+0x39b/0x4f0 net/socket.c:2210
__do_sys_sendto net/socket.c:2222 [inline]
__se_sys_sendto net/socket.c:2218 [inline]
__x64_sys_sendto+0xde/0x100 net/socket.c:2218
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 1583:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579
poison_slab_object mm/kasan/common.c:247 [inline]
__kasan_slab_free+0x59/0x70 mm/kasan/common.c:264
kasan_slab_free include/linux/kasan.h:230 [inline]
slab_free_hook mm/slub.c:2343 [inline]
slab_free mm/slub.c:4580 [inline]
kfree+0x1a0/0x440 mm/slub.c:4728
device_release+0x99/0x1c0
kobject_cleanup lib/kobject.c:689 [inline]
kobject_release lib/kobject.c:720 [inline]
kref_put include/linux/kref.h:65 [inline]
kobject_put+0x22f/0x480 lib/kobject.c:737
netdev_run_todo+0xe79/0x1000 net/core/dev.c:10812
default_device_exit_batch+0xa24/0xaa0 net/core/dev.c:11945
ops_exit_list net/core/net_namespace.c:178 [inline]
cleanup_net+0x89d/0xcc0 net/core/net_namespace.c:626
process_one_work kernel/workqueue.c:3229 [inline]
process_scheduled_works+0xa63/0x1850 kernel/workqueue.c:3310
worker_thread+0x870/0xd30 kernel/workqueue.c:3391
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
The buggy address belongs to the object at ffff88806ea3a000
which belongs to the cache kmalloc-cg-4k of size 4096
The buggy address is located 776 bytes inside of
freed 4096-byte region [ffff88806ea3a000, ffff88806ea3b000)
The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x6ea38
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
memcg:ffff88802c1c9001
flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000040 ffff88801ac4f500 dead000000000122 0000000000000000
raw: 0000000000000000 0000000000040004 00000001f5000000 ffff88802c1c9001
head: 00fff00000000040 ffff88801ac4f500 dead000000000122 0000000000000000
head: 0000000000000000 0000000000040004 00000001f5000000 ffff88802c1c9001
head: 00fff00000000003 ffffea0001ba8e01 ffffffffffffffff 0000000000000000
head: 0000000700000008 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5335, tgid 5335 (syz-executor), ts 184149259579, free_ts 182141357499
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x3045/0x3190 mm/page_alloc.c:3457
__alloc_pages_noprof+0x256/0x6c0 mm/page_alloc.c:4733
alloc_pages_mpol_noprof+0x3e8/0x680 mm/mempolicy.c:2265
alloc_slab_page+0x6a/0x120 mm/slub.c:2413
allocate_slab+0x5a/0x2f0 mm/slub.c:2579
new_slab mm/slub.c:2632 [inline]
___slab_alloc+0xcd1/0x14b0 mm/slub.c:3819
__slab_alloc+0x58/0xa0 mm/slub.c:3909
__slab_alloc_node mm/slub.c:3962 [inline]
slab_alloc_node mm/slub.c:4123 [inline]
__do_kmalloc_node mm/slub.c:4264 [inline]
__kmalloc_noprof+0x25a/0x400 mm/slub.c:4277
kmalloc_noprof include/linux/slab.h:882 [inline]
kzalloc_noprof include/linux/slab.h:1014 [inline]
__register_sysctl_table+0x65/0x1550 fs/proc/proc_sysctl.c:1368
__addrconf_sysctl_register+0x234/0x3a0 net/ipv6/addrconf.c:7224
addrconf_sysctl_register+0x167/0x1c0 net/ipv6/addrconf.c:7272
ipv6_add_dev+0xcf6/0x1220 net/ipv6/addrconf.c:456
addrconf_notify+0x6a7/0x1020 net/ipv6/addrconf.c:3655
notifier_call_chain+0x19f/0x3e0 kernel/notifier.c:93
call_netdevice_notifiers_extack net/core/dev.c:2034 [inline]
call_netdevice_notifiers net/core/dev.c:2048 [inline]
register_netdevice+0x167f/0x1b00 net/core/dev.c:10520
page last free pid 5308 tgid 5308 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0xcfb/0xf20 mm/page_alloc.c:2638
vfree+0x186/0x2e0 mm/vmalloc.c:3361
kcov_put kernel/kcov.c:439 [inline]
kcov_close+0x28/0x50 kernel/kcov.c:535
__fput+0x23f/0x880 fs/file_table.c:431
task_work_run+0x24f/0x310 kernel/task_work.c:228
exit_task_work include/linux/task_work.h:40 [inline]
do_exit+0xa2f/0x28e0 kernel/exit.c:939
do_group_exit+0x207/0x2c0 kernel/exit.c:1088
get_signal+0x176f/0x1810 kernel/signal.c:2936
arch_do_signal_or_restart+0x96/0x860 arch/x86/kernel/signal.c:337
exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
syscall_exit_to_user_mode+0xc9/0x370 kernel/entry/common.c:218
do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff88806ea3a200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88806ea3a280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88806ea3a300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88806ea3a380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88806ea3a400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 9+ messages in thread* Re: [syzbot] [net?] KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings
2024-03-22 20:10 [syzbot] [net?] KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings syzbot
2024-03-25 12:09 ` Denis Kirjanov
2024-09-27 18:26 ` syzbot
@ 2024-10-08 1:44 ` syzbot
2 siblings, 0 replies; 9+ messages in thread
From: syzbot @ 2024-10-08 1:44 UTC (permalink / raw)
To: ahmed.zaki, andrew, boqun.feng, cmeiohas, davem, dkirjanov,
ecree.xilinx, edumazet, hdanton, jgg, kalesh-anakkur.purayil,
kirjanov, kuba, leon, linux-kernel, linux-rdma, michaelgur,
msanalla, naveenm, netdev, pabeni, penguin-kernel,
przemyslaw.kitszel, rkannoth, syzkaller-bugs, torvalds
syzbot has bisected this issue to:
commit 5f8ca04fdd3c66a322ea318b5f1cb684dd56e5b2
Author: Chiara Meiohas <cmeiohas@nvidia.com>
Date: Mon Sep 9 17:30:22 2024 +0000
RDMA/device: Remove optimization in ib_device_get_netdev()
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=16db2327980000
start commit: c4a14f6d9d17 ipv4: ip_gre: Fix drops of small packets in i..
git tree: net
final oops: https://syzkaller.appspot.com/x/report.txt?x=15db2327980000
console output: https://syzkaller.appspot.com/x/log.txt?x=11db2327980000
kernel config: https://syzkaller.appspot.com/x/.config?x=b2d4fdf18a83ec0b
dashboard link: https://syzkaller.appspot.com/bug?extid=5fe14f2ff4ccbace9a26
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11eca3d0580000
Reported-by: syzbot+5fe14f2ff4ccbace9a26@syzkaller.appspotmail.com
Fixes: 5f8ca04fdd3c ("RDMA/device: Remove optimization in ib_device_get_netdev()")
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
^ permalink raw reply [flat|nested] 9+ messages in thread
end of thread, other threads:[~2024-10-08 1:44 UTC | newest]
Thread overview: 9+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-03-22 20:10 [syzbot] [net?] KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings syzbot
2024-03-25 12:09 ` Denis Kirjanov
2024-03-25 13:08 ` Eric Dumazet
2024-09-28 12:21 ` Hillf Danton
2024-09-29 11:46 ` Hillf Danton
2024-09-30 8:32 ` Eric Dumazet
2024-09-30 12:27 ` Hillf Danton
2024-09-27 18:26 ` syzbot
2024-10-08 1:44 ` syzbot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).