Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1620639
| From | Dave Jones <davej@codemonkey.org.uk> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | Re: af_packet: use after free in prb_retire_rx_blk_timer_expired |
| Date | 2017-04-10 21:30 +0200 |
| Message-ID | <tuNaF-50X-1@gated-at.bofh.it> (permalink) |
| References | <tuMRk-4S4-27@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
On Mon, Apr 10, 2017 at 07:03:30PM +0000, alexander.levin@verizon.com wrote:
> Hi all,
>
> I seem to be hitting this use-after-free on a -next kernel using trinity:
>
> [ 531.036054] BUG: KASAN: use-after-free in prb_retire_rx_blk_timer_expired (net/packet/af_packet.c:688) [ 531.036961] Read of size 8 at addr ffff88038c1fb0e8 by task swapper/1/0 [ 531.037727] [ 531.037928] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.11.0-rc5-next-20170407-dirty #24
Funny, I was just going over my old pending bugs, and found this one
from January that looks like what happens with the same bug, but without kasan..
context: PID: 0 TASK: ffff881ff2fa5100 CPU: 5 COMMAND: "swapper/5"
panic: general protection fault: 0000 [#1]
netversion: 2.2-1 (Feb 2014)
Backtrace:
#0 [ffff881fffaa3c00] machine_kexec at ffffffff81044af8
#1 [ffff881fffaa3c60] __crash_kexec at ffffffff810ec755
#2 [ffff881fffaa3d28] crash_kexec at ffffffff810ec81f
#3 [ffff881fffaa3d40] oops_end at ffffffff8101e348
#4 [ffff881fffaa3d68] die at ffffffff8101e76b
#5 [ffff881fffaa3d98] do_general_protection at ffffffff8101be76
#6 [ffff881fffaa3dc0] general_protection at ffffffff817fe5a2
[exception RIP: prb_retire_rx_blk_timer_expired+65]
RIP: ffffffff817e6e41 RSP: ffff881fffaa3e78 RFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff881fd7075800 RCX: 0000000000000000
RDX: ffff883ff0a16bb0 RSI: 0074636361757063 RDI: ffff881fd70758bc
RBP: ffff881fffaa3e88 R8: 0000000000000001 R9: 0000000000000005
R10: 0000000000000000 R11: 0000000000000000 R12: ffff881fd7075b78
R13: 0000000000000100 R14: ffffffff817e6e00 R15: ffff881fd7075800
ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018
#7 [ffff881fffaa3e90] call_timer_fn at ffffffff810cec35
#8 [ffff881fffaa3ec8] run_timer_softirq at ffffffff810cf01c
#9 [ffff881fffaa3f28] __softirqentry_text_start at ffffffff817ff05c
#10 [ffff881fffaa3f88] irq_exit at ffffffff8107d5fc
#11 [ffff881fffaa3f98] smp_apic_timer_interrupt at ffffffff817feea2
#12 [ffff881fffaa3fb0] apic_timer_interrupt at ffffffff817fd56f
--- <IRQ stack> ---
#13 [ffff881ff2fbfdd0] apic_timer_interrupt at ffffffff817fd56f
RIP: 0000000000000018 RSP: 0000000000000000 RFLAGS: ffffffff81ebbb60
RAX: ffffe8e0002a0400 RBX: 00000067b502e95f RCX: 0000000000000006
RDX: 000000000000002e RSI: 0000000000000034 RDI: 0000000000000001
RBP: ffffffff81150540 R8: ffff881ff2fbfee0 R9: 0000000000000001
R10: 0000000000000005 R11: ffffffff81ebbb60 R12: ffff881ff2fbfe48
R13: ffff881ff2fa5110 R14: 0000000000000000 R15: ffff881ff2fa5100
ORIG_RAX: ffff881fffab5340 CS: 20c49ba5e353f7cf SS: ffffffffffffff10
WARNING: possibly bogus exception frame
Dmesg:
Code: 00 00 48 8b 93 10 03 00 00 80 bb 21 03 00 00 00 44 0f b6 83 20 03 00 00 0f b7 c8 48 8b 34 ca 75 57 <44> 8b 5e 0c 45 85 db 74 1d 8b 93 68 03 00 00 85 d2 74 13 f3 90
RIP
[<ffffffff817e6e41>] prb_retire_rx_blk_timer_expired+0x41/0x120
RSP <ffff881fffaa3e78>
------------[ cut here ]------------
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
af_packet: use after free in prb_retire_rx_blk_timer_expired alexander.levin@verizon.com - 2017-04-10 21:10 +0200
Re: af_packet: use after free in prb_retire_rx_blk_timer_expired Dave Jones <davej@codemonkey.org.uk> - 2017-04-10 21:30 +0200
Re: af_packet: use after free in prb_retire_rx_blk_timer_expired Willem de Bruijn <willemdebruijn.kernel@gmail.com> - 2017-04-12 01:30 +0200
csiph-web