* Re: [PATCH net v2] net: ip: order the reuseport socket in __inet_hash
[not found] <20250801090949.129941-1-dongml2@chinatelecom.cn>
@ 2025-08-11 5:27 ` kernel test robot
2025-08-16 2:18 ` [LTP] " Wei Gao
0 siblings, 1 reply; 4+ messages in thread
From: kernel test robot @ 2025-08-11 5:27 UTC (permalink / raw)
To: Menglong Dong
Cc: oe-lkp, lkp, Menglong Dong, rcu, netdev, ltp, edumazet, kuniyu,
kraig, ncardwell, davem, dsahern, kuba, pabeni, horms,
linux-kernel, oliver.sang
Hello,
kernel test robot noticed "BUG:KASAN:slab-use-after-free_in__inet_hash" on:
commit: 859ca60b71ef223e210d3d003a225d9ca70879fd ("[PATCH net v2] net: ip: order the reuseport socket in __inet_hash")
url: https://github.com/intel-lab-lkp/linux/commits/Menglong-Dong/net-ip-order-the-reuseport-socket-in-__inet_hash/20250801-171131
base: https://git.kernel.org/cgit/linux/kernel/git/davem/net.git 01051012887329ea78eaca19b1d2eac4c9f601b5
patch link: https://lore.kernel.org/all/20250801090949.129941-1-dongml2@chinatelecom.cn/
patch subject: [PATCH net v2] net: ip: order the reuseport socket in __inet_hash
in testcase: ltp
version: ltp-x86_64-6505f9e29-1_20250802
with following parameters:
disk: 1HDD
fs: ext4
test: fs_perms_simple
config: x86_64-rhel-9.4-ltp
compiler: gcc-12
test machine: 4 threads 1 sockets Intel(R) Core(TM) i3-3220 CPU @ 3.30GHz (Ivy Bridge) with 8G memory
(please refer to attached dmesg/kmsg for entire log/backtrace)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <oliver.sang@intel.com>
| Closes: https://lore.kernel.org/oe-lkp/202508110750.a66a4225-lkp@intel.com
kern :err : [ 128.186735] BUG: KASAN: slab-use-after-free in __inet_hash (net/ipv4/inet_hashtables.c:749 net/ipv4/inet_hashtables.c:800)
kern :err : [ 128.186868] Read of size 2 at addr ffff8882125c5f10 by task isc-net-0001/3160
kern :err : [ 128.187050] CPU: 2 UID: 108 PID: 3160 Comm: isc-net-0001 Tainted: G S 6.16.0-06590-g859ca60b71ef #1 PREEMPT(voluntary)
kern :err : [ 128.187056] Tainted: [S]=CPU_OUT_OF_SPEC
kern :err : [ 128.187058] Hardware name: Hewlett-Packard p6-1451cx/2ADA, BIOS 8.15 02/05/2013
kern :err : [ 128.187060] Call Trace:
kern :err : [ 128.187063] <TASK>
kern :err : [ 128.187065] dump_stack_lvl (lib/dump_stack.c:123 (discriminator 1))
kern :err : [ 128.187072] print_address_description+0x2c/0x390
kern :err : [ 128.187079] ? __inet_hash (net/ipv4/inet_hashtables.c:749 net/ipv4/inet_hashtables.c:800)
kern :err : [ 128.187084] print_report (mm/kasan/report.c:483)
kern :err : [ 128.187088] ? kasan_addr_to_slab (mm/kasan/common.c:37)
kern :err : [ 128.187092] ? __inet_hash (net/ipv4/inet_hashtables.c:749 net/ipv4/inet_hashtables.c:800)
kern :err : [ 128.187096] kasan_report (mm/kasan/report.c:597)
kern :err : [ 128.187101] ? __inet_hash (net/ipv4/inet_hashtables.c:749 net/ipv4/inet_hashtables.c:800)
kern :err : [ 128.187106] __inet_hash (net/ipv4/inet_hashtables.c:749 net/ipv4/inet_hashtables.c:800)
kern :err : [ 128.187111] inet_csk_listen_start (net/ipv4/inet_connection_sock.c:1356)
kern :err : [ 128.187115] __inet_listen_sk (net/ipv4/af_inet.c:219)
kern :err : [ 128.187120] ? __pfx___inet_listen_sk (net/ipv4/af_inet.c:192)
kern :err : [ 128.187123] ? _raw_spin_lock_bh (arch/x86/include/asm/atomic.h:107 include/linux/atomic/atomic-arch-fallback.h:2170 include/linux/atomic/atomic-instrumented.h:1302 include/asm-generic/qspinlock.h:111 include/linux/spinlock.h:187 include/linux/spinlock_api_smp.h:127 kernel/locking/spinlock.c:178)
kern :err : [ 128.187128] ? __pfx__raw_spin_lock_bh (kernel/locking/spinlock.c:177)
kern :err : [ 128.187134] inet_listen (net/ipv4/af_inet.c:240)
kern :err : [ 128.187138] __sys_listen (include/linux/file.h:62 include/linux/file.h:83 net/socket.c:1918)
kern :err : [ 128.187144] __x64_sys_listen (net/socket.c:1930)
kern :err : [ 128.187148] ? __x64_sys_getsockname (net/socket.c:2145)
kern :err : [ 128.187152] do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)
kern :err : [ 128.187155] ? do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)
kern :err : [ 128.187159] ? do_sock_setsockopt (net/socket.c:2313)
kern :err : [ 128.187163] ? __x64_sys_bind (net/socket.c:1892)
kern :err : [ 128.187167] ? do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)
kern :err : [ 128.187169] ? alloc_fd (fs/file.c:612)
kern :err : [ 128.187174] ? fdget (include/linux/file.h:57 fs/file.c:1176 fs/file.c:1181)
kern :err : [ 128.187178] ? fput (arch/x86/include/asm/atomic64_64.h:79 include/linux/atomic/atomic-arch-fallback.h:2913 include/linux/atomic/atomic-arch-fallback.h:3364 include/linux/atomic/atomic-long.h:698 include/linux/atomic/atomic-instrumented.h:3767 include/linux/file_ref.h:157 fs/file_table.c:544)
kern :err : [ 128.187181] ? __sys_setsockopt (include/linux/file.h:63 include/linux/file.h:83 net/socket.c:2361)
kern :err : [ 128.187185] ? __x64_sys_setsockopt (net/socket.c:2372)
kern :err : [ 128.187188] ? do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)
kern :err : [ 128.187191] ? __x64_sys_openat (fs/open.c:1461)
kern :err : [ 128.187194] ? __pfx___x64_sys_openat (fs/open.c:1461)
kern :err : [ 128.187198] ? __x64_sys_setsockopt (net/socket.c:2372)
kern :err : [ 128.187201] ? count_memcg_events (arch/x86/include/asm/atomic.h:23 include/linux/atomic/atomic-arch-fallback.h:457 include/linux/atomic/atomic-instrumented.h:33 mm/memcontrol.c:560 mm/memcontrol.c:585 mm/memcontrol.c:564 mm/memcontrol.c:848)
kern :err : [ 128.187206] ? do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)
kern :err : [ 128.187209] ? handle_mm_fault (mm/memory.c:6272 mm/memory.c:6425)
kern :err : [ 128.187213] ? do_user_addr_fault (arch/x86/include/asm/atomic.h:93 include/linux/atomic/atomic-arch-fallback.h:949 include/linux/atomic/atomic-instrumented.h:401 include/linux/refcount.h:389 include/linux/refcount.h:432 include/linux/mmap_lock.h:142 include/linux/mmap_lock.h:237 arch/x86/mm/fault.c:1338)
kern :err : [ 128.187218] ? exc_page_fault (arch/x86/include/asm/irqflags.h:37 arch/x86/include/asm/irqflags.h:114 arch/x86/mm/fault.c:1484 arch/x86/mm/fault.c:1532)
kern :err : [ 128.187223] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
kern :err : [ 128.187227] RIP: 0033:0x7fe51b028897
kern :err : [ 128.187231] Code: f0 ff ff 77 06 c3 0f 1f 44 00 00 48 8b 15 61 75 0c 00 f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 b8 32 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 39 75 0c 00 f7 d8 64 89 01 48
All code
========
0: f0 ff lock (bad)
2: ff 77 06 push 0x6(%rdi)
5: c3 ret
6: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
b: 48 8b 15 61 75 0c 00 mov 0xc7561(%rip),%rdx # 0xc7573
12: f7 d8 neg %eax
14: 64 89 02 mov %eax,%fs:(%rdx)
17: b8 ff ff ff ff mov $0xffffffff,%eax
1c: c3 ret
1d: 66 0f 1f 44 00 00 nopw 0x0(%rax,%rax,1)
23: b8 32 00 00 00 mov $0x32,%eax
28: 0f 05 syscall
2a:* 48 3d 01 f0 ff ff cmp $0xfffffffffffff001,%rax <-- trapping instruction
30: 73 01 jae 0x33
32: c3 ret
33: 48 8b 0d 39 75 0c 00 mov 0xc7539(%rip),%rcx # 0xc7573
3a: f7 d8 neg %eax
3c: 64 89 01 mov %eax,%fs:(%rcx)
3f: 48 rex.W
Code starting with the faulting instruction
===========================================
0: 48 3d 01 f0 ff ff cmp $0xfffffffffffff001,%rax
6: 73 01 jae 0x9
8: c3 ret
9: 48 8b 0d 39 75 0c 00 mov 0xc7539(%rip),%rcx # 0xc7549
10: f7 d8 neg %eax
12: 64 89 01 mov %eax,%fs:(%rcx)
15: 48 rex.W
kern :err : [ 128.187235] RSP: 002b:00007fe5169fe0f8 EFLAGS: 00000217 ORIG_RAX: 0000000000000032
kern :err : [ 128.187239] RAX: ffffffffffffffda RBX: 00007fe516a1d760 RCX: 00007fe51b028897
kern :err : [ 128.187241] RDX: 0000000000000002 RSI: 000000000000000a RDI: 000000000000002c
kern :err : [ 128.187243] RBP: 0000000000000000 R08: 0000000000008000 R09: 00000000ffffffff
kern :err : [ 128.187245] R10: 00007fe5169fe024 R11: 0000000000000217 R12: 00007fe51bbd1d70
kern :err : [ 128.187248] R13: 000000000000000a R14: 00007fe5182de000 R15: 00007fe516a1d5d0
kern :err : [ 128.187252] </TASK>
kern :err : [ 128.192052] Allocated by task 2436:
kern :warn : [ 128.192126] kasan_save_stack (mm/kasan/common.c:48)
kern :warn : [ 128.192209] kasan_save_track (arch/x86/include/asm/current.h:25 mm/kasan/common.c:60 mm/kasan/common.c:69)
kern :warn : [ 128.192289] __kasan_slab_alloc (mm/kasan/common.c:319 mm/kasan/common.c:345)
kern :warn : [ 128.192373] kmem_cache_alloc_noprof (mm/slub.c:4148 mm/slub.c:4197 mm/slub.c:4204)
kern :warn : [ 128.192466] sk_prot_alloc (net/core/sock.c:2233 (discriminator 2))
kern :warn : [ 128.192545] sk_alloc (net/core/sock.c:2295)
kern :warn : [ 128.192615] inet_create (net/ipv4/af_inet.c:1733 (discriminator 2))
kern :warn : [ 128.192717] __sock_create (net/socket.c:1590)
kern :warn : [ 128.192796] __sys_socket (net/socket.c:1686 net/socket.c:1669 net/socket.c:1731)
kern :warn : [ 128.192874] __x64_sys_socket (net/socket.c:1743)
kern :warn : [ 128.192956] do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)
kern :warn : [ 128.193034] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
kern :err : [ 128.193176] Freed by task 0:
kern :warn : [ 128.193240] kasan_save_stack (mm/kasan/common.c:48)
kern :warn : [ 128.193321] kasan_save_track (arch/x86/include/asm/current.h:25 mm/kasan/common.c:60 mm/kasan/common.c:69)
kern :warn : [ 128.193401] kasan_save_free_info (mm/kasan/generic.c:579)
kern :warn : [ 128.193487] __kasan_slab_free (mm/kasan/common.c:271)
kern :warn : [ 128.193569] slab_free_after_rcu_debug (mm/slub.c:4693)
kern :warn : [ 128.193663] rcu_do_batch (arch/x86/include/asm/preempt.h:27 kernel/rcu/tree.c:2583)
kern :warn : [ 128.193740] rcu_core (kernel/rcu/tree.c:2834)
kern :warn : [ 128.193812] handle_softirqs (arch/x86/include/asm/jump_label.h:36 include/trace/events/irq.h:142 kernel/softirq.c:580)
kern :warn : [ 128.193894] __irq_exit_rcu (kernel/softirq.c:614 kernel/softirq.c:453 kernel/softirq.c:680)
kern :warn : [ 128.193977] sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1050 arch/x86/kernel/apic/apic.c:1050)
kern :warn : [ 128.194074] asm_sysvec_apic_timer_interrupt (arch/x86/include/asm/idtentry.h:574)
kern :err : [ 128.194217] Last potentially related work creation:
kern :warn : [ 128.194312] kasan_save_stack (mm/kasan/common.c:48)
kern :warn : [ 128.194393] kasan_record_aux_stack (mm/kasan/generic.c:548)
kern :warn : [ 128.194481] kmem_cache_free (mm/slub.c:2344 mm/slub.c:4643 mm/slub.c:4745)
kern :warn : [ 128.194563] __sk_destruct (net/core/sock.c:2279 net/core/sock.c:2373)
kern :warn : [ 128.194642] rcu_do_batch (arch/x86/include/asm/preempt.h:27 kernel/rcu/tree.c:2583)
kern :warn : [ 128.194719] rcu_core (kernel/rcu/tree.c:2834)
kern :warn : [ 128.194791] handle_softirqs (arch/x86/include/asm/jump_label.h:36 include/trace/events/irq.h:142 kernel/softirq.c:580)
kern :warn : [ 128.194873] __irq_exit_rcu (kernel/softirq.c:614 kernel/softirq.c:453 kernel/softirq.c:680)
kern :warn : [ 128.194955] sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1050 arch/x86/kernel/apic/apic.c:1050)
kern :warn : [ 128.195052] asm_sysvec_apic_timer_interrupt (arch/x86/include/asm/idtentry.h:574)
kern :err : [ 128.195194] Second to last potentially related work creation:
kern :warn : [ 128.195303] kasan_save_stack (mm/kasan/common.c:48)
kern :warn : [ 128.195383] kasan_record_aux_stack (mm/kasan/generic.c:548)
kern :warn : [ 128.195472] __call_rcu_common+0xc8/0x980
kern :warn : [ 128.195571] inet_release (net/ipv4/af_inet.c:436)
kern :warn : [ 128.195648] __sock_release (net/socket.c:650)
kern :warn : [ 128.195727] sock_close (net/socket.c:1441)
kern :warn : [ 128.195799] __fput (fs/file_table.c:468)
kern :warn : [ 128.195869] fput_close_sync (fs/file_table.c:571)
kern :warn : [ 128.195951] __x64_sys_close (fs/open.c:1590 fs/open.c:1572 fs/open.c:1572)
kern :warn : [ 128.196032] do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)
kern :warn : [ 128.196109] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
kern :err : [ 128.196250] The buggy address belongs to the object at ffff8882125c5f00
which belongs to the cache TCP of size 2304
kern :err : [ 128.196468] The buggy address is located 16 bytes inside of
freed 2304-byte region [ffff8882125c5f00, ffff8882125c6800)
kern :err : [ 128.196733] The buggy address belongs to the physical page:
kern :warn : [ 128.196839] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8882125c5580 pfn:0x2125c0
kern :warn : [ 128.197008] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
kern :warn : [ 128.197148] memcg:ffff888217e99e01
kern :warn : [ 128.197221] anon flags: 0x17ffffc0000040(head|node=0|zone=2|lastcpupid=0x1fffff)
kern :warn : [ 128.197358] page_type: f5(slab)
kern :warn : [ 128.197429] raw: 0017ffffc0000040 ffff88810221c640 0000000000000000 0000000000000001
The kernel config and materials to reproduce are available at:
https://download.01.org/0day-ci/archive/20250811/202508110750.a66a4225-lkp@intel.com
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [LTP] [PATCH net v2] net: ip: order the reuseport socket in __inet_hash
2025-08-11 5:27 ` [PATCH net v2] net: ip: order the reuseport socket in __inet_hash kernel test robot
@ 2025-08-16 2:18 ` Wei Gao
2025-08-16 2:35 ` Kuniyuki Iwashima
0 siblings, 1 reply; 4+ messages in thread
From: Wei Gao @ 2025-08-16 2:18 UTC (permalink / raw)
To: kernel test robot
Cc: Menglong Dong, kuniyu, kraig, lkp, netdev, dsahern, linux-kernel,
rcu, edumazet, horms, oe-lkp, kuba, pabeni, ncardwell, davem, ltp,
Menglong Dong
On Mon, Aug 11, 2025 at 01:27:12PM +0800, kernel test robot wrote:
>
>
> Hello,
>
> kernel test robot noticed "BUG:KASAN:slab-use-after-free_in__inet_hash" on:
>
> commit: 859ca60b71ef223e210d3d003a225d9ca70879fd ("[PATCH net v2] net: ip: order the reuseport socket in __inet_hash")
> url: https://github.com/intel-lab-lkp/linux/commits/Menglong-Dong/net-ip-order-the-reuseport-socket-in-__inet_hash/20250801-171131
> base: https://git.kernel.org/cgit/linux/kernel/git/davem/net.git 01051012887329ea78eaca19b1d2eac4c9f601b5
> patch link: https://lore.kernel.org/all/20250801090949.129941-1-dongml2@chinatelecom.cn/
> patch subject: [PATCH net v2] net: ip: order the reuseport socket in __inet_hash
>
> in testcase: ltp
> version: ltp-x86_64-6505f9e29-1_20250802
> with following parameters:
>
> disk: 1HDD
> fs: ext4
> test: fs_perms_simple
>
>
>
> config: x86_64-rhel-9.4-ltp
> compiler: gcc-12
> test machine: 4 threads 1 sockets Intel(R) Core(TM) i3-3220 CPU @ 3.30GHz (Ivy Bridge) with 8G memory
>
> (please refer to attached dmesg/kmsg for entire log/backtrace)
>
>
>
> If you fix the issue in a separate patch/commit (i.e. not just a new version of
> the same patch/commit), kindly add following tags
> | Reported-by: kernel test robot <oliver.sang@intel.com>
> | Closes: https://lore.kernel.org/oe-lkp/202508110750.a66a4225-lkp@intel.com
>
>
> kern :err : [ 128.186735] BUG: KASAN: slab-use-after-free in __inet_hash (net/ipv4/inet_hashtables.c:749 net/ipv4/inet_hashtables.c:800)
This kasan error not related with LTP case, i guess it triggered by network
related process such as bind etc. I try to give following patch to fix
kasan error, correct me if any mistake, thanks.
From: Wei Gao <wegao@suse.com>
Date: Sat, 16 Aug 2025 09:32:56 +0800
Subject: [PATCH v1] net: Fix BUG:KASAN:slab-use-after-free_in__inet_hash
Reported-by: kernel test robot <oliver.sang@intel.com>
Closes: https://lore.kernel.org/oe-lkp/202508110750.a66a4225-lkp@intel.com
Signed-off-by: Wei Gao <wegao@suse.com>
---
include/linux/rculist_nulls.h | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/include/linux/rculist_nulls.h b/include/linux/rculist_nulls.h
index da500f4ae142..5def9009c507 100644
--- a/include/linux/rculist_nulls.h
+++ b/include/linux/rculist_nulls.h
@@ -57,7 +57,7 @@ static inline void hlist_nulls_del_init_rcu(struct hlist_nulls_node *n)
* @node: element of the list.
*/
#define hlist_nulls_pprev_rcu(node) \
- (*((struct hlist_nulls_node __rcu __force **)&(node)->pprev))
+ (*((struct hlist_nulls_node __rcu __force **)(node)->pprev))
/**
* hlist_nulls_del_rcu - deletes entry from hash list without re-initialization
@@ -175,7 +175,7 @@ static inline void hlist_nulls_add_before_rcu(struct hlist_nulls_node *n,
{
WRITE_ONCE(n->pprev, next->pprev);
n->next = next;
- rcu_assign_pointer(hlist_nulls_pprev_rcu(n), n);
+ rcu_assign_pointer(hlist_nulls_pprev_rcu(next), n);
WRITE_ONCE(next->pprev, &n->next);
}
--
2.43.0
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [LTP] [PATCH net v2] net: ip: order the reuseport socket in __inet_hash
2025-08-16 2:18 ` [LTP] " Wei Gao
@ 2025-08-16 2:35 ` Kuniyuki Iwashima
2025-08-16 7:27 ` Wei Gao
0 siblings, 1 reply; 4+ messages in thread
From: Kuniyuki Iwashima @ 2025-08-16 2:35 UTC (permalink / raw)
To: Wei Gao
Cc: kernel test robot, Menglong Dong, kraig, lkp, netdev, dsahern,
linux-kernel, rcu, edumazet, horms, oe-lkp, kuba, pabeni,
ncardwell, davem, ltp, Menglong Dong
On Fri, Aug 15, 2025 at 7:18 PM Wei Gao <wegao@suse.com> wrote:
>
> On Mon, Aug 11, 2025 at 01:27:12PM +0800, kernel test robot wrote:
> >
> >
> > Hello,
> >
> > kernel test robot noticed "BUG:KASAN:slab-use-after-free_in__inet_hash" on:
> >
> > commit: 859ca60b71ef223e210d3d003a225d9ca70879fd ("[PATCH net v2] net: ip: order the reuseport socket in __inet_hash")
> > url: https://github.com/intel-lab-lkp/linux/commits/Menglong-Dong/net-ip-order-the-reuseport-socket-in-__inet_hash/20250801-171131
> > base: https://git.kernel.org/cgit/linux/kernel/git/davem/net.git 01051012887329ea78eaca19b1d2eac4c9f601b5
> > patch link: https://lore.kernel.org/all/20250801090949.129941-1-dongml2@chinatelecom.cn/
> > patch subject: [PATCH net v2] net: ip: order the reuseport socket in __inet_hash
> >
> > in testcase: ltp
> > version: ltp-x86_64-6505f9e29-1_20250802
> > with following parameters:
> >
> > disk: 1HDD
> > fs: ext4
> > test: fs_perms_simple
> >
> >
> >
> > config: x86_64-rhel-9.4-ltp
> > compiler: gcc-12
> > test machine: 4 threads 1 sockets Intel(R) Core(TM) i3-3220 CPU @ 3.30GHz (Ivy Bridge) with 8G memory
> >
> > (please refer to attached dmesg/kmsg for entire log/backtrace)
> >
> >
> >
> > If you fix the issue in a separate patch/commit (i.e. not just a new version of
> > the same patch/commit), kindly add following tags
> > | Reported-by: kernel test robot <oliver.sang@intel.com>
> > | Closes: https://lore.kernel.org/oe-lkp/202508110750.a66a4225-lkp@intel.com
> >
> >
> > kern :err : [ 128.186735] BUG: KASAN: slab-use-after-free in __inet_hash (net/ipv4/inet_hashtables.c:749 net/ipv4/inet_hashtables.c:800)
>
> This kasan error not related with LTP case, i guess it triggered by network
> related process such as bind etc. I try to give following patch to fix
> kasan error, correct me if any mistake, thanks.
Note that the report was for the patch in the mailing list
and the patch was not applied to net-next.git nor net.git.
>
> From: Wei Gao <wegao@suse.com>
> Date: Sat, 16 Aug 2025 09:32:56 +0800
> Subject: [PATCH v1] net: Fix BUG:KASAN:slab-use-after-free_in__inet_hash
>
> Reported-by: kernel test robot <oliver.sang@intel.com>
> Closes: https://lore.kernel.org/oe-lkp/202508110750.a66a4225-lkp@intel.com
> Signed-off-by: Wei Gao <wegao@suse.com>
> ---
> include/linux/rculist_nulls.h | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/include/linux/rculist_nulls.h b/include/linux/rculist_nulls.h
> index da500f4ae142..5def9009c507 100644
> --- a/include/linux/rculist_nulls.h
> +++ b/include/linux/rculist_nulls.h
> @@ -57,7 +57,7 @@ static inline void hlist_nulls_del_init_rcu(struct hlist_nulls_node *n)
> * @node: element of the list.
> */
> #define hlist_nulls_pprev_rcu(node) \
> - (*((struct hlist_nulls_node __rcu __force **)&(node)->pprev))
> + (*((struct hlist_nulls_node __rcu __force **)(node)->pprev))
>
> /**
> * hlist_nulls_del_rcu - deletes entry from hash list without re-initialization
> @@ -175,7 +175,7 @@ static inline void hlist_nulls_add_before_rcu(struct hlist_nulls_node *n,
> {
> WRITE_ONCE(n->pprev, next->pprev);
> n->next = next;
> - rcu_assign_pointer(hlist_nulls_pprev_rcu(n), n);
> + rcu_assign_pointer(hlist_nulls_pprev_rcu(next), n);
> WRITE_ONCE(next->pprev, &n->next);
> }
>
> --
> 2.43.0
>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [LTP] [PATCH net v2] net: ip: order the reuseport socket in __inet_hash
2025-08-16 2:35 ` Kuniyuki Iwashima
@ 2025-08-16 7:27 ` Wei Gao
0 siblings, 0 replies; 4+ messages in thread
From: Wei Gao @ 2025-08-16 7:27 UTC (permalink / raw)
To: Kuniyuki Iwashima
Cc: kernel test robot, Menglong Dong, kraig, lkp, netdev, dsahern,
linux-kernel, rcu, edumazet, horms, oe-lkp, kuba, pabeni,
ncardwell, davem, ltp, Menglong Dong
On Fri, Aug 15, 2025 at 07:35:10PM -0700, Kuniyuki Iwashima wrote:
> On Fri, Aug 15, 2025 at 7:18 PM Wei Gao <wegao@suse.com> wrote:
> >
> > On Mon, Aug 11, 2025 at 01:27:12PM +0800, kernel test robot wrote:
> > >
> > >
> > > Hello,
> > >
> > > kernel test robot noticed "BUG:KASAN:slab-use-after-free_in__inet_hash" on:
> > >
> > > commit: 859ca60b71ef223e210d3d003a225d9ca70879fd ("[PATCH net v2] net: ip: order the reuseport socket in __inet_hash")
> > > url: https://github.com/intel-lab-lkp/linux/commits/Menglong-Dong/net-ip-order-the-reuseport-socket-in-__inet_hash/20250801-171131
> > > base: https://git.kernel.org/cgit/linux/kernel/git/davem/net.git 01051012887329ea78eaca19b1d2eac4c9f601b5
> > > patch link: https://lore.kernel.org/all/20250801090949.129941-1-dongml2@chinatelecom.cn/
> > > patch subject: [PATCH net v2] net: ip: order the reuseport socket in __inet_hash
> > >
> > > in testcase: ltp
> > > version: ltp-x86_64-6505f9e29-1_20250802
> > > with following parameters:
> > >
> > > disk: 1HDD
> > > fs: ext4
> > > test: fs_perms_simple
> > >
> > >
> > >
> > > config: x86_64-rhel-9.4-ltp
> > > compiler: gcc-12
> > > test machine: 4 threads 1 sockets Intel(R) Core(TM) i3-3220 CPU @ 3.30GHz (Ivy Bridge) with 8G memory
> > >
> > > (please refer to attached dmesg/kmsg for entire log/backtrace)
> > >
> > >
> > >
> > > If you fix the issue in a separate patch/commit (i.e. not just a new version of
> > > the same patch/commit), kindly add following tags
> > > | Reported-by: kernel test robot <oliver.sang@intel.com>
> > > | Closes: https://lore.kernel.org/oe-lkp/202508110750.a66a4225-lkp@intel.com
> > >
> > >
> > > kern :err : [ 128.186735] BUG: KASAN: slab-use-after-free in __inet_hash (net/ipv4/inet_hashtables.c:749 net/ipv4/inet_hashtables.c:800)
> >
> > This kasan error not related with LTP case, i guess it triggered by network
> > related process such as bind etc. I try to give following patch to fix
> > kasan error, correct me if any mistake, thanks.
>
> Note that the report was for the patch in the mailing list
> and the patch was not applied to net-next.git nor net.git.
Thanks for note.
Since this email sent to LTP group so i got this. Since
i'm interested in this 'kasan' problem, so trying to fix it.
>
>
> >
> > From: Wei Gao <wegao@suse.com>
> > Date: Sat, 16 Aug 2025 09:32:56 +0800
> > Subject: [PATCH v1] net: Fix BUG:KASAN:slab-use-after-free_in__inet_hash
> >
> > Reported-by: kernel test robot <oliver.sang@intel.com>
> > Closes: https://lore.kernel.org/oe-lkp/202508110750.a66a4225-lkp@intel.com
> > Signed-off-by: Wei Gao <wegao@suse.com>
> > ---
> > include/linux/rculist_nulls.h | 4 ++--
> > 1 file changed, 2 insertions(+), 2 deletions(-)
> >
> > diff --git a/include/linux/rculist_nulls.h b/include/linux/rculist_nulls.h
> > index da500f4ae142..5def9009c507 100644
> > --- a/include/linux/rculist_nulls.h
> > +++ b/include/linux/rculist_nulls.h
> > @@ -57,7 +57,7 @@ static inline void hlist_nulls_del_init_rcu(struct hlist_nulls_node *n)
> > * @node: element of the list.
> > */
> > #define hlist_nulls_pprev_rcu(node) \
> > - (*((struct hlist_nulls_node __rcu __force **)&(node)->pprev))
> > + (*((struct hlist_nulls_node __rcu __force **)(node)->pprev))
> >
> > /**
> > * hlist_nulls_del_rcu - deletes entry from hash list without re-initialization
> > @@ -175,7 +175,7 @@ static inline void hlist_nulls_add_before_rcu(struct hlist_nulls_node *n,
> > {
> > WRITE_ONCE(n->pprev, next->pprev);
> > n->next = next;
> > - rcu_assign_pointer(hlist_nulls_pprev_rcu(n), n);
> > + rcu_assign_pointer(hlist_nulls_pprev_rcu(next), n);
> > WRITE_ONCE(next->pprev, &n->next);
> > }
> >
> > --
> > 2.43.0
> >
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2025-08-16 7:27 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <20250801090949.129941-1-dongml2@chinatelecom.cn>
2025-08-11 5:27 ` [PATCH net v2] net: ip: order the reuseport socket in __inet_hash kernel test robot
2025-08-16 2:18 ` [LTP] " Wei Gao
2025-08-16 2:35 ` Kuniyuki Iwashima
2025-08-16 7:27 ` Wei Gao
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).