On Fri, Aug 15, 2025 at 7:18 PM Wei Gao <[email protected]> wrote: > > On Mon, Aug 11, 2025 at 01:27:12PM +0800, kernel test robot wrote: > > > > > > Hello, > > > > kernel test robot noticed "BUG:KASAN:slab-use-after-free_in__inet_hash" on: > > > > commit: 859ca60b71ef223e210d3d003a225d9ca70879fd ("[PATCH net v2] net: ip: > > order the reuseport socket in __inet_hash") > > url: > > https://github.com/intel-lab-lkp/linux/commits/Menglong-Dong/net-ip-order-the-reuseport-socket-in-__inet_hash/20250801-171131 > > base: https://git.kernel.org/cgit/linux/kernel/git/davem/net.git > > 01051012887329ea78eaca19b1d2eac4c9f601b5 > > patch link: > > https://lore.kernel.org/all/[email protected]/ > > patch subject: [PATCH net v2] net: ip: order the reuseport socket in > > __inet_hash > > > > in testcase: ltp > > version: ltp-x86_64-6505f9e29-1_20250802 > > with following parameters: > > > > disk: 1HDD > > fs: ext4 > > test: fs_perms_simple > > > > > > > > config: x86_64-rhel-9.4-ltp > > compiler: gcc-12 > > test machine: 4 threads 1 sockets Intel(R) Core(TM) i3-3220 CPU @ 3.30GHz > > (Ivy Bridge) with 8G memory > > > > (please refer to attached dmesg/kmsg for entire log/backtrace) > > > > > > > > If you fix the issue in a separate patch/commit (i.e. not just a new > > version of > > the same patch/commit), kindly add following tags > > | Reported-by: kernel test robot <[email protected]> > > | Closes: https://lore.kernel.org/oe-lkp/[email protected] > > > > > > kern :err : [ 128.186735] BUG: KASAN: slab-use-after-free in __inet_hash > > (net/ipv4/inet_hashtables.c:749 net/ipv4/inet_hashtables.c:800) > > This kasan error not related with LTP case, i guess it triggered by network > related process such as bind etc. I try to give following patch to fix > kasan error, correct me if any mistake, thanks.
Note that the report was for the patch in the mailing list and the patch was not applied to net-next.git nor net.git. > > From: Wei Gao <[email protected]> > Date: Sat, 16 Aug 2025 09:32:56 +0800 > Subject: [PATCH v1] net: Fix BUG:KASAN:slab-use-after-free_in__inet_hash > > Reported-by: kernel test robot <[email protected]> > Closes: https://lore.kernel.org/oe-lkp/[email protected] > Signed-off-by: Wei Gao <[email protected]> > --- > include/linux/rculist_nulls.h | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/include/linux/rculist_nulls.h b/include/linux/rculist_nulls.h > index da500f4ae142..5def9009c507 100644 > --- a/include/linux/rculist_nulls.h > +++ b/include/linux/rculist_nulls.h > @@ -57,7 +57,7 @@ static inline void hlist_nulls_del_init_rcu(struct > hlist_nulls_node *n) > * @node: element of the list. > */ > #define hlist_nulls_pprev_rcu(node) \ > - (*((struct hlist_nulls_node __rcu __force **)&(node)->pprev)) > + (*((struct hlist_nulls_node __rcu __force **)(node)->pprev)) > > /** > * hlist_nulls_del_rcu - deletes entry from hash list without > re-initialization > @@ -175,7 +175,7 @@ static inline void hlist_nulls_add_before_rcu(struct > hlist_nulls_node *n, > { > WRITE_ONCE(n->pprev, next->pprev); > n->next = next; > - rcu_assign_pointer(hlist_nulls_pprev_rcu(n), n); > + rcu_assign_pointer(hlist_nulls_pprev_rcu(next), n); > WRITE_ONCE(next->pprev, &n->next); > } > > -- > 2.43.0 >
