Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1568749 > unrolled thread
| Started by | Dmitry Vyukov <dvyukov@google.com> |
|---|---|
| First post | 2017-01-27 23:10 +0100 |
| Last post | 2017-01-28 02:40 +0100 |
| Articles | 6 — 3 participants |
Back to article view | Back to linux.kernel
net: suspicious RCU usage in nf_hook Dmitry Vyukov <dvyukov@google.com> - 2017-01-27 23:10 +0100
Re: net: suspicious RCU usage in nf_hook Cong Wang <xiyou.wangcong@gmail.com> - 2017-01-28 00:30 +0100
Re: net: suspicious RCU usage in nf_hook Cong Wang <xiyou.wangcong@gmail.com> - 2017-01-28 00:40 +0100
Re: net: suspicious RCU usage in nf_hook Eric Dumazet <eric.dumazet@gmail.com> - 2017-01-28 00:50 +0100
Re: net: suspicious RCU usage in nf_hook Cong Wang <xiyou.wangcong@gmail.com> - 2017-01-28 02:10 +0100
Re: net: suspicious RCU usage in nf_hook Eric Dumazet <eric.dumazet@gmail.com> - 2017-01-28 02:40 +0100
| From | Dmitry Vyukov <dvyukov@google.com> |
|---|---|
| Date | 2017-01-27 23:10 +0100 |
| Subject | net: suspicious RCU usage in nf_hook |
| Message-ID | <t4mSt-1o8-3@gated-at.bofh.it> |
Hello,
I've got the following report while running syzkaller fuzzer on
fd694aaa46c7ed811b72eb47d5eb11ce7ab3f7f1:
[ INFO: suspicious RCU usage. ]
4.10.0-rc5+ #192 Not tainted
-------------------------------
./include/linux/rcupdate.h:561 Illegal context switch in RCU read-side
critical section!
other info that might help us debug this:
rcu_scheduler_active = 2, debug_locks = 0
2 locks held by syz-executor14/23111:
#0: (sk_lock-AF_INET6){+.+.+.}, at: [<ffffffff83a35c35>] lock_sock
include/net/sock.h:1454 [inline]
#0: (sk_lock-AF_INET6){+.+.+.}, at: [<ffffffff83a35c35>]
rawv6_sendmsg+0x1e65/0x3ec0 net/ipv6/raw.c:919
#1: (rcu_read_lock){......}, at: [<ffffffff83ae2678>] nf_hook
include/linux/netfilter.h:201 [inline]
#1: (rcu_read_lock){......}, at: [<ffffffff83ae2678>]
__ip6_local_out+0x258/0x840 net/ipv6/output_core.c:160
stack backtrace:
CPU: 2 PID: 23111 Comm: syz-executor14 Not tainted 4.10.0-rc5+ #192
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:15 [inline]
dump_stack+0x2ee/0x3ef lib/dump_stack.c:51
lockdep_rcu_suspicious+0x139/0x180 kernel/locking/lockdep.c:4452
rcu_preempt_sleep_check include/linux/rcupdate.h:560 [inline]
___might_sleep+0x560/0x650 kernel/sched/core.c:7748
__might_sleep+0x95/0x1a0 kernel/sched/core.c:7739
mutex_lock_nested+0x24f/0x1730 kernel/locking/mutex.c:752
atomic_dec_and_mutex_lock+0x119/0x160 kernel/locking/mutex.c:1060
__static_key_slow_dec+0x7a/0x1e0 kernel/jump_label.c:149
static_key_slow_dec+0x51/0x90 kernel/jump_label.c:174
net_disable_timestamp+0x3b/0x50 net/core/dev.c:1728
sock_disable_timestamp+0x98/0xc0 net/core/sock.c:403
__sk_destruct+0x27d/0x6b0 net/core/sock.c:1441
sk_destruct+0x47/0x80 net/core/sock.c:1460
__sk_free+0x57/0x230 net/core/sock.c:1468
sock_wfree+0xae/0x120 net/core/sock.c:1645
skb_release_head_state+0xfc/0x200 net/core/skbuff.c:655
skb_release_all+0x15/0x60 net/core/skbuff.c:668
__kfree_skb+0x15/0x20 net/core/skbuff.c:684
kfree_skb+0x16e/0x4c0 net/core/skbuff.c:705
inet_frag_destroy+0x121/0x290 net/ipv4/inet_fragment.c:304
inet_frag_put include/net/inet_frag.h:133 [inline]
nf_ct_frag6_gather+0x1106/0x3840 net/ipv6/netfilter/nf_conntrack_reasm.c:617
ipv6_defrag+0x1be/0x2b0 net/ipv6/netfilter/nf_defrag_ipv6_hooks.c:68
nf_hook_entry_hookfn include/linux/netfilter.h:102 [inline]
nf_hook_slow+0xc3/0x290 net/netfilter/core.c:310
nf_hook include/linux/netfilter.h:212 [inline]
__ip6_local_out+0x489/0x840 net/ipv6/output_core.c:160
ip6_local_out+0x2d/0x170 net/ipv6/output_core.c:170
ip6_send_skb+0xa1/0x340 net/ipv6/ip6_output.c:1722
ip6_push_pending_frames+0xb3/0xe0 net/ipv6/ip6_output.c:1742
rawv6_push_pending_frames net/ipv6/raw.c:613 [inline]
rawv6_sendmsg+0x2d1a/0x3ec0 net/ipv6/raw.c:927
inet_sendmsg+0x164/0x5b0 net/ipv4/af_inet.c:744
sock_sendmsg_nosec net/socket.c:635 [inline]
sock_sendmsg+0xca/0x110 net/socket.c:645
sock_write_iter+0x326/0x600 net/socket.c:848
do_iter_readv_writev+0x2e3/0x5b0 fs/read_write.c:695
do_readv_writev+0x42c/0x9b0 fs/read_write.c:872
vfs_writev+0x87/0xc0 fs/read_write.c:911
do_writev+0x110/0x2c0 fs/read_write.c:944
SYSC_writev fs/read_write.c:1017 [inline]
SyS_writev+0x27/0x30 fs/read_write.c:1014
entry_SYSCALL_64_fastpath+0x1f/0xc2
RIP: 0033:0x445559
RSP: 002b:00007f6f46fceb58 EFLAGS: 00000292 ORIG_RAX: 0000000000000014
RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000000445559
RDX: 0000000000000001 RSI: 0000000020f1eff0 RDI: 0000000000000005
RBP: 00000000006e19c0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000700000
R13: 0000000020f59000 R14: 0000000000000015 R15: 0000000000020400
BUG: sleeping function called from invalid context at kernel/locking/mutex.c:752
in_atomic(): 1, irqs_disabled(): 0, pid: 23111, name: syz-executor14
INFO: lockdep is turned off.
CPU: 2 PID: 23111 Comm: syz-executor14 Not tainted 4.10.0-rc5+ #192
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:15 [inline]
dump_stack+0x2ee/0x3ef lib/dump_stack.c:51
___might_sleep+0x47e/0x650 kernel/sched/core.c:7780
__might_sleep+0x95/0x1a0 kernel/sched/core.c:7739
mutex_lock_nested+0x24f/0x1730 kernel/locking/mutex.c:752
atomic_dec_and_mutex_lock+0x119/0x160 kernel/locking/mutex.c:1060
__static_key_slow_dec+0x7a/0x1e0 kernel/jump_label.c:149
static_key_slow_dec+0x51/0x90 kernel/jump_label.c:174
net_disable_timestamp+0x3b/0x50 net/core/dev.c:1728
sock_disable_timestamp+0x98/0xc0 net/core/sock.c:403
__sk_destruct+0x27d/0x6b0 net/core/sock.c:1441
sk_destruct+0x47/0x80 net/core/sock.c:1460
__sk_free+0x57/0x230 net/core/sock.c:1468
sock_wfree+0xae/0x120 net/core/sock.c:1645
skb_release_head_state+0xfc/0x200 net/core/skbuff.c:655
skb_release_all+0x15/0x60 net/core/skbuff.c:668
__kfree_skb+0x15/0x20 net/core/skbuff.c:684
kfree_skb+0x16e/0x4c0 net/core/skbuff.c:705
inet_frag_destroy+0x121/0x290 net/ipv4/inet_fragment.c:304
inet_frag_put include/net/inet_frag.h:133 [inline]
nf_ct_frag6_gather+0x1106/0x3840 net/ipv6/netfilter/nf_conntrack_reasm.c:617
ipv6_defrag+0x1be/0x2b0 net/ipv6/netfilter/nf_defrag_ipv6_hooks.c:68
nf_hook_entry_hookfn include/linux/netfilter.h:102 [inline]
nf_hook_slow+0xc3/0x290 net/netfilter/core.c:310
nf_hook include/linux/netfilter.h:212 [inline]
__ip6_local_out+0x489/0x840 net/ipv6/output_core.c:160
ip6_local_out+0x2d/0x170 net/ipv6/output_core.c:170
ip6_send_skb+0xa1/0x340 net/ipv6/ip6_output.c:1722
ip6_push_pending_frames+0xb3/0xe0 net/ipv6/ip6_output.c:1742
rawv6_push_pending_frames net/ipv6/raw.c:613 [inline]
rawv6_sendmsg+0x2d1a/0x3ec0 net/ipv6/raw.c:927
inet_sendmsg+0x164/0x5b0 net/ipv4/af_inet.c:744
sock_sendmsg_nosec net/socket.c:635 [inline]
sock_sendmsg+0xca/0x110 net/socket.c:645
sock_write_iter+0x326/0x600 net/socket.c:848
do_iter_readv_writev+0x2e3/0x5b0 fs/read_write.c:695
do_readv_writev+0x42c/0x9b0 fs/read_write.c:872
vfs_writev+0x87/0xc0 fs/read_write.c:911
do_writev+0x110/0x2c0 fs/read_write.c:944
SYSC_writev fs/read_write.c:1017 [inline]
SyS_writev+0x27/0x30 fs/read_write.c:1014
entry_SYSCALL_64_fastpath+0x1f/0xc2
RIP: 0033:0x445559
RSP: 002b:00007f6f46fceb58 EFLAGS: 00000292 ORIG_RAX: 0000000000000014
RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000000445559
RDX: 0000000000000001 RSI: 0000000020f1eff0 RDI: 0000000000000005
RBP: 00000000006e19c0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000700000
R13: 0000000020f59000 R14: 0000000000000015 R15: 0000000000020400
BUG: scheduling while atomic: syz-executor14/23111/0x00000002
INFO: lockdep is turned off.
Modules linked in:
Kernel panic - not syncing: scheduling while atomic
[toc] | [next] | [standalone]
| From | Cong Wang <xiyou.wangcong@gmail.com> |
|---|---|
| Date | 2017-01-28 00:30 +0100 |
| Message-ID | <t4o7U-241-13@gated-at.bofh.it> |
| In reply to | #1568749 |
On Fri, Jan 27, 2017 at 1:15 PM, Dmitry Vyukov <dvyukov@google.com> wrote: > stack backtrace: > CPU: 2 PID: 23111 Comm: syz-executor14 Not tainted 4.10.0-rc5+ #192 > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 > Call Trace: > __dump_stack lib/dump_stack.c:15 [inline] > dump_stack+0x2ee/0x3ef lib/dump_stack.c:51 > lockdep_rcu_suspicious+0x139/0x180 kernel/locking/lockdep.c:4452 > rcu_preempt_sleep_check include/linux/rcupdate.h:560 [inline] > ___might_sleep+0x560/0x650 kernel/sched/core.c:7748 > __might_sleep+0x95/0x1a0 kernel/sched/core.c:7739 > mutex_lock_nested+0x24f/0x1730 kernel/locking/mutex.c:752 > atomic_dec_and_mutex_lock+0x119/0x160 kernel/locking/mutex.c:1060 > __static_key_slow_dec+0x7a/0x1e0 kernel/jump_label.c:149 > static_key_slow_dec+0x51/0x90 kernel/jump_label.c:174 > net_disable_timestamp+0x3b/0x50 net/core/dev.c:1728 > sock_disable_timestamp+0x98/0xc0 net/core/sock.c:403 > __sk_destruct+0x27d/0x6b0 net/core/sock.c:1441 > sk_destruct+0x47/0x80 net/core/sock.c:1460 jump label uses a mutex and we call jump label API in softIRQ context... Maybe we have to move it to a work struct as what we did for netlink.
[toc] | [prev] | [next] | [standalone]
| From | Cong Wang <xiyou.wangcong@gmail.com> |
|---|---|
| Date | 2017-01-28 00:40 +0100 |
| Message-ID | <t4ohA-27i-17@gated-at.bofh.it> |
| In reply to | #1568781 |
On Fri, Jan 27, 2017 at 3:22 PM, Cong Wang <xiyou.wangcong@gmail.com> wrote: > On Fri, Jan 27, 2017 at 1:15 PM, Dmitry Vyukov <dvyukov@google.com> wrote: >> stack backtrace: >> CPU: 2 PID: 23111 Comm: syz-executor14 Not tainted 4.10.0-rc5+ #192 >> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 >> Call Trace: >> __dump_stack lib/dump_stack.c:15 [inline] >> dump_stack+0x2ee/0x3ef lib/dump_stack.c:51 >> lockdep_rcu_suspicious+0x139/0x180 kernel/locking/lockdep.c:4452 >> rcu_preempt_sleep_check include/linux/rcupdate.h:560 [inline] >> ___might_sleep+0x560/0x650 kernel/sched/core.c:7748 >> __might_sleep+0x95/0x1a0 kernel/sched/core.c:7739 >> mutex_lock_nested+0x24f/0x1730 kernel/locking/mutex.c:752 >> atomic_dec_and_mutex_lock+0x119/0x160 kernel/locking/mutex.c:1060 >> __static_key_slow_dec+0x7a/0x1e0 kernel/jump_label.c:149 >> static_key_slow_dec+0x51/0x90 kernel/jump_label.c:174 >> net_disable_timestamp+0x3b/0x50 net/core/dev.c:1728 >> sock_disable_timestamp+0x98/0xc0 net/core/sock.c:403 >> __sk_destruct+0x27d/0x6b0 net/core/sock.c:1441 >> sk_destruct+0x47/0x80 net/core/sock.c:1460 > > jump label uses a mutex and we call jump label API in softIRQ context... > Maybe we have to move it to a work struct as what we did for netlink. Correct myself: process context but with RCU read lock held...
[toc] | [prev] | [next] | [standalone]
| From | Eric Dumazet <eric.dumazet@gmail.com> |
|---|---|
| Date | 2017-01-28 00:50 +0100 |
| Message-ID | <t4orf-2aJ-1@gated-at.bofh.it> |
| In reply to | #1568749 |
On Fri, 2017-01-27 at 22:15 +0100, Dmitry Vyukov wrote:
> Hello,
>
> I've got the following report while running syzkaller fuzzer on
> fd694aaa46c7ed811b72eb47d5eb11ce7ab3f7f1:
>
> [ INFO: suspicious RCU usage. ]
> 4.10.0-rc5+ #192 Not tainted
> -------------------------------
> ./include/linux/rcupdate.h:561 Illegal context switch in RCU read-side
> critical section!
>
> other info that might help us debug this:
>
> rcu_scheduler_active = 2, debug_locks = 0
> 2 locks held by syz-executor14/23111:
> #0: (sk_lock-AF_INET6){+.+.+.}, at: [<ffffffff83a35c35>] lock_sock
> include/net/sock.h:1454 [inline]
> #0: (sk_lock-AF_INET6){+.+.+.}, at: [<ffffffff83a35c35>]
> rawv6_sendmsg+0x1e65/0x3ec0 net/ipv6/raw.c:919
> #1: (rcu_read_lock){......}, at: [<ffffffff83ae2678>] nf_hook
> include/linux/netfilter.h:201 [inline]
> #1: (rcu_read_lock){......}, at: [<ffffffff83ae2678>]
> __ip6_local_out+0x258/0x840 net/ipv6/output_core.c:160
>
> stack backtrace:
> CPU: 2 PID: 23111 Comm: syz-executor14 Not tainted 4.10.0-rc5+ #192
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
> Call Trace:
> __dump_stack lib/dump_stack.c:15 [inline]
> dump_stack+0x2ee/0x3ef lib/dump_stack.c:51
> lockdep_rcu_suspicious+0x139/0x180 kernel/locking/lockdep.c:4452
> rcu_preempt_sleep_check include/linux/rcupdate.h:560 [inline]
> ___might_sleep+0x560/0x650 kernel/sched/core.c:7748
> __might_sleep+0x95/0x1a0 kernel/sched/core.c:7739
> mutex_lock_nested+0x24f/0x1730 kernel/locking/mutex.c:752
> atomic_dec_and_mutex_lock+0x119/0x160 kernel/locking/mutex.c:1060
> __static_key_slow_dec+0x7a/0x1e0 kernel/jump_label.c:149
> static_key_slow_dec+0x51/0x90 kernel/jump_label.c:174
> net_disable_timestamp+0x3b/0x50 net/core/dev.c:1728
> sock_disable_timestamp+0x98/0xc0 net/core/sock.c:403
> __sk_destruct+0x27d/0x6b0 net/core/sock.c:1441
> sk_destruct+0x47/0x80 net/core/sock.c:1460
> __sk_free+0x57/0x230 net/core/sock.c:1468
> sock_wfree+0xae/0x120 net/core/sock.c:1645
> skb_release_head_state+0xfc/0x200 net/core/skbuff.c:655
> skb_release_all+0x15/0x60 net/core/skbuff.c:668
> __kfree_skb+0x15/0x20 net/core/skbuff.c:684
> kfree_skb+0x16e/0x4c0 net/core/skbuff.c:705
> inet_frag_destroy+0x121/0x290 net/ipv4/inet_fragment.c:304
> inet_frag_put include/net/inet_frag.h:133 [inline]
> nf_ct_frag6_gather+0x1106/0x3840 net/ipv6/netfilter/nf_conntrack_reasm.c:617
> ipv6_defrag+0x1be/0x2b0 net/ipv6/netfilter/nf_defrag_ipv6_hooks.c:68
> nf_hook_entry_hookfn include/linux/netfilter.h:102 [inline]
> nf_hook_slow+0xc3/0x290 net/netfilter/core.c:310
> nf_hook include/linux/netfilter.h:212 [inline]
> __ip6_local_out+0x489/0x840 net/ipv6/output_core.c:160
> ip6_local_out+0x2d/0x170 net/ipv6/output_core.c:170
> ip6_send_skb+0xa1/0x340 net/ipv6/ip6_output.c:1722
> ip6_push_pending_frames+0xb3/0xe0 net/ipv6/ip6_output.c:1742
> rawv6_push_pending_frames net/ipv6/raw.c:613 [inline]
> rawv6_sendmsg+0x2d1a/0x3ec0 net/ipv6/raw.c:927
> inet_sendmsg+0x164/0x5b0 net/ipv4/af_inet.c:744
> sock_sendmsg_nosec net/socket.c:635 [inline]
> sock_sendmsg+0xca/0x110 net/socket.c:645
> sock_write_iter+0x326/0x600 net/socket.c:848
> do_iter_readv_writev+0x2e3/0x5b0 fs/read_write.c:695
> do_readv_writev+0x42c/0x9b0 fs/read_write.c:872
> vfs_writev+0x87/0xc0 fs/read_write.c:911
> do_writev+0x110/0x2c0 fs/read_write.c:944
> SYSC_writev fs/read_write.c:1017 [inline]
> SyS_writev+0x27/0x30 fs/read_write.c:1014
> entry_SYSCALL_64_fastpath+0x1f/0xc2
> RIP: 0033:0x445559
> RSP: 002b:00007f6f46fceb58 EFLAGS: 00000292 ORIG_RAX: 0000000000000014
> RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000000445559
> RDX: 0000000000000001 RSI: 0000000020f1eff0 RDI: 0000000000000005
> RBP: 00000000006e19c0 R08: 0000000000000000 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000700000
> R13: 0000000020f59000 R14: 0000000000000015 R15: 0000000000020400
> BUG: sleeping function called from invalid context at kernel/locking/mutex.c:752
> in_atomic(): 1, irqs_disabled(): 0, pid: 23111, name: syz-executor14
> INFO: lockdep is turned off.
> CPU: 2 PID: 23111 Comm: syz-executor14 Not tainted 4.10.0-rc5+ #192
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
> Call Trace:
> __dump_stack lib/dump_stack.c:15 [inline]
> dump_stack+0x2ee/0x3ef lib/dump_stack.c:51
> ___might_sleep+0x47e/0x650 kernel/sched/core.c:7780
> __might_sleep+0x95/0x1a0 kernel/sched/core.c:7739
> mutex_lock_nested+0x24f/0x1730 kernel/locking/mutex.c:752
> atomic_dec_and_mutex_lock+0x119/0x160 kernel/locking/mutex.c:1060
> __static_key_slow_dec+0x7a/0x1e0 kernel/jump_label.c:149
> static_key_slow_dec+0x51/0x90 kernel/jump_label.c:174
> net_disable_timestamp+0x3b/0x50 net/core/dev.c:1728
> sock_disable_timestamp+0x98/0xc0 net/core/sock.c:403
> __sk_destruct+0x27d/0x6b0 net/core/sock.c:1441
> sk_destruct+0x47/0x80 net/core/sock.c:1460
> __sk_free+0x57/0x230 net/core/sock.c:1468
> sock_wfree+0xae/0x120 net/core/sock.c:1645
> skb_release_head_state+0xfc/0x200 net/core/skbuff.c:655
> skb_release_all+0x15/0x60 net/core/skbuff.c:668
> __kfree_skb+0x15/0x20 net/core/skbuff.c:684
> kfree_skb+0x16e/0x4c0 net/core/skbuff.c:705
> inet_frag_destroy+0x121/0x290 net/ipv4/inet_fragment.c:304
> inet_frag_put include/net/inet_frag.h:133 [inline]
> nf_ct_frag6_gather+0x1106/0x3840 net/ipv6/netfilter/nf_conntrack_reasm.c:617
> ipv6_defrag+0x1be/0x2b0 net/ipv6/netfilter/nf_defrag_ipv6_hooks.c:68
> nf_hook_entry_hookfn include/linux/netfilter.h:102 [inline]
> nf_hook_slow+0xc3/0x290 net/netfilter/core.c:310
> nf_hook include/linux/netfilter.h:212 [inline]
> __ip6_local_out+0x489/0x840 net/ipv6/output_core.c:160
> ip6_local_out+0x2d/0x170 net/ipv6/output_core.c:170
> ip6_send_skb+0xa1/0x340 net/ipv6/ip6_output.c:1722
> ip6_push_pending_frames+0xb3/0xe0 net/ipv6/ip6_output.c:1742
> rawv6_push_pending_frames net/ipv6/raw.c:613 [inline]
> rawv6_sendmsg+0x2d1a/0x3ec0 net/ipv6/raw.c:927
> inet_sendmsg+0x164/0x5b0 net/ipv4/af_inet.c:744
> sock_sendmsg_nosec net/socket.c:635 [inline]
> sock_sendmsg+0xca/0x110 net/socket.c:645
> sock_write_iter+0x326/0x600 net/socket.c:848
> do_iter_readv_writev+0x2e3/0x5b0 fs/read_write.c:695
> do_readv_writev+0x42c/0x9b0 fs/read_write.c:872
> vfs_writev+0x87/0xc0 fs/read_write.c:911
> do_writev+0x110/0x2c0 fs/read_write.c:944
> SYSC_writev fs/read_write.c:1017 [inline]
> SyS_writev+0x27/0x30 fs/read_write.c:1014
> entry_SYSCALL_64_fastpath+0x1f/0xc2
Oh well, I forgot to submit the official patch I think, Jan 9th.
https://groups.google.com/forum/#!topic/syzkaller/BhyN5OFd7sQ
[toc] | [prev] | [next] | [standalone]
| From | Cong Wang <xiyou.wangcong@gmail.com> |
|---|---|
| Date | 2017-01-28 02:10 +0100 |
| Message-ID | <t4pGG-35v-11@gated-at.bofh.it> |
| In reply to | #1568784 |
On Fri, Jan 27, 2017 at 3:35 PM, Eric Dumazet <eric.dumazet@gmail.com> wrote: > Oh well, I forgot to submit the official patch I think, Jan 9th. > > https://groups.google.com/forum/#!topic/syzkaller/BhyN5OFd7sQ > Hmm, but why only fragments need skb_orphan()? It seems like any kfree_skb() inside a nf hook needs to have a preceding skb_orphan(). Also, I am not convinced it is similar to commit 8282f27449bf15548 which is on RX path.
[toc] | [prev] | [next] | [standalone]
| From | Eric Dumazet <eric.dumazet@gmail.com> |
|---|---|
| Date | 2017-01-28 02:40 +0100 |
| Message-ID | <t4q9H-3hQ-5@gated-at.bofh.it> |
| In reply to | #1568814 |
On Fri, 2017-01-27 at 17:00 -0800, Cong Wang wrote: > On Fri, Jan 27, 2017 at 3:35 PM, Eric Dumazet <eric.dumazet@gmail.com> wrote: > > Oh well, I forgot to submit the official patch I think, Jan 9th. > > > > https://groups.google.com/forum/#!topic/syzkaller/BhyN5OFd7sQ > > > > Hmm, but why only fragments need skb_orphan()? It seems like > any kfree_skb() inside a nf hook needs to have a preceding > skb_orphan(). > > Also, I am not convinced it is similar to commit 8282f27449bf15548 > which is on RX path. Well, we clearly see IPv6 reassembly being part of the equation in both cases. I was replying to first part of the splat [1], which was already diagnosed and had a non official patch. use after free is also a bug, regardless of jump label being used or not. I still do not really understand this nf_hook issue, I thought we were disabling BH in netfilter. So the in_interrupt() check in net_disable_timestamp() should trigger, this was the intent of netstamp_needed_deferred existence. Not sure if we can test for rcu_read_lock() as well. [1] sk_destruct+0x47/0x80 net/core/sock.c:1460 __sk_free+0x57/0x230 net/core/sock.c:1468 sock_wfree+0xae/0x120 net/core/sock.c:1645 skb_release_head_state+0xfc/0x200 net/core/skbuff.c:655 skb_release_all+0x15/0x60 net/core/skbuff.c:668 __kfree_skb+0x15/0x20 net/core/skbuff.c:684 kfree_skb+0x16e/0x4c0 net/core/skbuff.c:705 inet_frag_destroy+0x121/0x290 net/ipv4/inet_fragment.c:304 inet_frag_put include/net/inet_frag.h:133 [inline] nf_ct_frag6_gather+0x1106/0x3840 net/ipv6/netfilter/nf_conntrack_reasm.c:617 ipv6_defrag+0x1be/0x2b0 net/ipv6/netfilter/nf_defrag_ipv6_hooks.c:68 nf_hook_entry_hookfn include/linux/netfilter.h:102 [inline] nf_hook_slow+0xc3/0x290 net/netfilter/core.c:310 nf_hook include/linux/netfilter.h:212 [inline] __ip6_local_out+0x489/0x840 net/ipv6/output_core.c:160 ip6_local_out+0x2d/0x170 net/ipv6/output_core.c:170
[toc] | [prev] | [standalone]
Back to top | Article view | linux.kernel
csiph-web