From: Denys Fedoryshchenko <nuclearcat@nuclearcat•com>
To: Guillaume Nault <g.nault@alphalink•fr>
Cc: Linux Kernel Network Developers <netdev@vger•kernel.org>
Subject: Re: ppp/pppoe, still panic 4.15.3 in ppp_push
Date: Wed, 21 Feb 2018 12:26:51 +0200 [thread overview]
Message-ID: <ba6cd172193fb55c55b9bfb99a364c8f@nuclearcat.com> (raw)
In-Reply-To: <20180216184812.GM1422@alphalink.fr>
It seems even rebuilding seemingly stable version triggering crashes too
(but different ones)
Maybe it is coincidence, and bug reproducer appeared in network same
time i decided to upgrade kernel,
as it happened with xt_MSS(and that bug existed for years).
Deleted quoting, i added more debug options (as much as performance
degradation allows me).
This is vanilla again:
[14834.090421]
==================================================================
[14834.091157] BUG: KASAN: use-after-free in __list_add_valid+0x69/0xad
[14834.091521] Read of size 8 at addr ffff8803dbeb8660 by task
accel-pppd/12636
[14834.091905]
[14834.092282] CPU: 0 PID: 12636 Comm: accel-pppd Not tainted
4.15.4-build-0134 #1
[14834.092930] Hardware name: HP ProLiant DL320e Gen8 v2, BIOS P80
04/02/2015
[14834.093320] Call Trace:
[14834.093680] dump_stack+0xb3/0x13e
[14834.094050] ? _atomic_dec_and_lock+0x10f/0x10f
[14834.094434] print_address_description+0x69/0x236
[14834.094814] ? __list_add_valid+0x69/0xad
[14834.095197] kasan_report+0x219/0x23f
[14834.095570] __list_add_valid+0x69/0xad
[14834.095957] ppp_ioctl+0x1216/0x2201 [ppp_generic]
[14834.096348] ? ppp_write+0x1cc/0x1cc [ppp_generic]
[14834.096723] ? get_usage_char.isra.2+0x36/0x36
[14834.097094] ? packet_poll+0x362/0x362
[14834.097455] ? lock_downgrade+0x4d0/0x4d0
[14834.097811] ? rcu_irq_enter_disabled+0x8/0x8
[14834.098187] ? get_usage_char.isra.2+0x36/0x36
[14834.098561] ? __fget+0x3b8/0x3eb
[14834.098936] ? get_usage_char.isra.2+0x36/0x36
[14834.099309] ? __fget+0x3a0/0x3eb
[14834.099682] ? get_usage_char.isra.2+0x36/0x36
[14834.100069] ? __fget+0x3a0/0x3eb
[14834.100443] ? lock_downgrade+0x4d0/0x4d0
[14834.100814] ? rcu_irq_enter_disabled+0x8/0x8
[14834.101203] ? __fget+0x3b8/0x3eb
[14834.101581] ? expand_files+0x62f/0x62f
[14834.101945] ? kernel_read+0xed/0xed
[14834.102322] ? SyS_getpeername+0x28b/0x28b
[14834.102690] vfs_ioctl+0x6e/0x81
[14834.103049] do_vfs_ioctl+0xe2f/0xe62
[14834.103413] ? ioctl_preallocate+0x211/0x211
[14834.103778] ? __fget_light+0x28c/0x2ca
[14834.104150] ? iterate_fd+0x2a8/0x2a8
[14834.104526] ? SyS_rt_sigprocmask+0x12e/0x181
[14834.104876] ? sigprocmask+0x23f/0x23f
[14834.105231] ? SyS_write+0x148/0x173
[14834.105580] ? SyS_read+0x173/0x173
[14834.105943] SyS_ioctl+0x39/0x55
[14834.106316] ? do_vfs_ioctl+0xe62/0xe62
[14834.106694] do_syscall_64+0x262/0x594
[14834.107076] ? syscall_return_slowpath+0x351/0x351
[14834.107447] ? up_read+0x17/0x2c
[14834.107806] ? __do_page_fault+0x68a/0x763
[14834.108171] ? entry_SYSCALL_64_after_hwframe+0x36/0x9b
[14834.108550] ? trace_hardirqs_off_thunk+0x1a/0x1c
[14834.108937] entry_SYSCALL_64_after_hwframe+0x26/0x9b
[14834.109293] RIP: 0033:0x7fc9be3758a7
[14834.109652] RSP: 002b:00007fc9bf92aaf8 EFLAGS: 00000206 ORIG_RAX:
0000000000000010
[14834.110313] RAX: ffffffffffffffda RBX: 00007fc9bdc5e1e3 RCX:
00007fc9be3758a7
[14834.110707] RDX: 00007fc9b7ad13e8 RSI: 000000004004743a RDI:
0000000000004b9f
[14834.111082] RBP: 00007fc9bf92ab20 R08: 0000000000000000 R09:
000055f07a27fe40
[14834.111471] R10: 0000000000000008 R11: 0000000000000206 R12:
00007fc9b7ad12d8
[14834.111845] R13: 00007ffd06346a6f R14: 0000000000000000 R15:
00007fc9bf92b700
[14834.112231]
[14834.112589] Allocated by task 12636:
[14834.112962] ppp_register_net_channel+0xc4/0x610 [ppp_generic]
[14834.113331] pppoe_connect+0xe6d/0x1097 [pppoe]
[14834.113691] SyS_connect+0x19c/0x274
[14834.114054] do_syscall_64+0x262/0x594
[14834.114421] entry_SYSCALL_64_after_hwframe+0x26/0x9b
[14834.114792]
[14834.115139] Freed by task 12636:
[14834.115504] kfree+0xe2/0x154
[14834.115866] ppp_release+0x11b/0x12a [ppp_generic]
[14834.116240] __fput+0x342/0x5ba
[14834.116611] task_work_run+0x15d/0x198
[14834.116973] exit_to_usermode_loop+0xc7/0x153
[14834.117320] do_syscall_64+0x53d/0x594
[14834.117694] entry_SYSCALL_64_after_hwframe+0x26/0x9b
[14834.118067]
[14834.118426] The buggy address belongs to the object at
ffff8803dbeb8480
[14834.119087] The buggy address is located 480 bytes inside of
[14834.119755] The buggy address belongs to the page:
[14834.120138] page:ffffea000f6fae00 count:1 mapcount:0 mapping:
(null) index:0xffff8803dbebd580 compound_mapcount: 0
[14834.120817] flags: 0x17ffe00000008100(slab|head)
[14834.121171] raw: 17ffe00000008100 0000000000000000 ffff8803dbebd580
00000001001c001b
[14834.121800] raw: ffffea000d718020 ffffea000d32d620 ffff8803f080ee80
0000000000000000
[14834.122415] page dumped because: kasan: bad access detected
[14834.122787]
[14834.123140] Memory state around the buggy address:
[14834.123503] ffff8803dbeb8500: fb fb fb fb fb fb fb fb fb fb fb fb fb
fb fb fb
[14834.124150] ffff8803dbeb8580: fb fb fb fb fb fb fb fb fb fb fb fb fb
fb fb fb
[14834.124806] >ffff8803dbeb8600: fb fb fb fb fb fb fb fb fb fb fb fb fb
fb fb fb
[14834.125467] ^
[14834.125848] ffff8803dbeb8680: fb fb fb fb fb fb fb fb fb fb fb fb fb
fb fb fb
[14834.126493] ffff8803dbeb8700: fb fb fb fb fb fb fb fb fb fb fb fb fb
fb fb fb
[14834.127143]
==================================================================
[14834.127768] Disabling lock debugging due to kernel taint
ferrari-dns 10.0.252.9 # cat udp-2018_02_21.log |grep "Feb 21 06:02:14
10.0.252.9"
[14834.090421]
==================================================================
[14834.091157] BUG: KASAN: use-after-free in __list_add_valid+0x69/0xad
[14834.091521] Read of size 8 at addr ffff8803dbeb8660 by task
accel-pppd/12636
[14834.091905]
[14834.092282] CPU: 0 PID: 12636 Comm: accel-pppd Not tainted
4.15.4-build-0134 #1
[14834.092930] Hardware name: HP ProLiant DL320e Gen8 v2, BIOS P80
04/02/2015
[14834.093320] Call Trace:
[14834.093680] dump_stack+0xb3/0x13e
[14834.094050] ? _atomic_dec_and_lock+0x10f/0x10f
[14834.094434] print_address_description+0x69/0x236
[14834.094814] ? __list_add_valid+0x69/0xad
[14834.095197] kasan_report+0x219/0x23f
[14834.095570] __list_add_valid+0x69/0xad
[14834.095957] ppp_ioctl+0x1216/0x2201 [ppp_generic]
[14834.096348] ? ppp_write+0x1cc/0x1cc [ppp_generic]
[14834.096723] ? get_usage_char.isra.2+0x36/0x36
[14834.097094] ? packet_poll+0x362/0x362
[14834.097455] ? lock_downgrade+0x4d0/0x4d0
[14834.097811] ? rcu_irq_enter_disabled+0x8/0x8
[14834.098187] ? get_usage_char.isra.2+0x36/0x36
[14834.098561] ? __fget+0x3b8/0x3eb
[14834.098936] ? get_usage_char.isra.2+0x36/0x36
[14834.099309] ? __fget+0x3a0/0x3eb
[14834.099682] ? get_usage_char.isra.2+0x36/0x36
[14834.100069] ? __fget+0x3a0/0x3eb
[14834.100443] ? lock_downgrade+0x4d0/0x4d0
[14834.100814] ? rcu_irq_enter_disabled+0x8/0x8
[14834.101203] ? __fget+0x3b8/0x3eb
[14834.101581] ? expand_files+0x62f/0x62f
[14834.101945] ? kernel_read+0xed/0xed
[14834.102322] ? SyS_getpeername+0x28b/0x28b
[14834.102690] vfs_ioctl+0x6e/0x81
[14834.103049] do_vfs_ioctl+0xe2f/0xe62
[14834.103413] ? ioctl_preallocate+0x211/0x211
[14834.103778] ? __fget_light+0x28c/0x2ca
[14834.104150] ? iterate_fd+0x2a8/0x2a8
[14834.104526] ? SyS_rt_sigprocmask+0x12e/0x181
[14834.104876] ? sigprocmask+0x23f/0x23f
[14834.105231] ? SyS_write+0x148/0x173
[14834.105580] ? SyS_read+0x173/0x173
[14834.105943] SyS_ioctl+0x39/0x55
[14834.106316] ? do_vfs_ioctl+0xe62/0xe62
[14834.106694] do_syscall_64+0x262/0x594
[14834.107076] ? syscall_return_slowpath+0x351/0x351
[14834.107447] ? up_read+0x17/0x2c
[14834.107806] ? __do_page_fault+0x68a/0x763
[14834.108171] ? entry_SYSCALL_64_after_hwframe+0x36/0x9b
[14834.108550] ? trace_hardirqs_off_thunk+0x1a/0x1c
[14834.108937] entry_SYSCALL_64_after_hwframe+0x26/0x9b
[14834.109293] RIP: 0033:0x7fc9be3758a7
[14834.109652] RSP: 002b:00007fc9bf92aaf8 EFLAGS: 00000206 ORIG_RAX:
0000000000000010
[14834.110313] RAX: ffffffffffffffda RBX: 00007fc9bdc5e1e3 RCX:
00007fc9be3758a7
[14834.110707] RDX: 00007fc9b7ad13e8 RSI: 000000004004743a RDI:
0000000000004b9f
[14834.111082] RBP: 00007fc9bf92ab20 R08: 0000000000000000 R09:
000055f07a27fe40
[14834.111471] R10: 0000000000000008 R11: 0000000000000206 R12:
00007fc9b7ad12d8
[14834.111845] R13: 00007ffd06346a6f R14: 0000000000000000 R15:
00007fc9bf92b700
[14834.112231]
[14834.112589] Allocated by task 12636:
[14834.112962] ppp_register_net_channel+0xc4/0x610 [ppp_generic]
[14834.113331] pppoe_connect+0xe6d/0x1097 [pppoe]
[14834.113691] SyS_connect+0x19c/0x274
[14834.114054] do_syscall_64+0x262/0x594
[14834.114421] entry_SYSCALL_64_after_hwframe+0x26/0x9b
[14834.114792]
[14834.115139] Freed by task 12636:
[14834.115504] kfree+0xe2/0x154
[14834.115866] ppp_release+0x11b/0x12a [ppp_generic]
[14834.116240] __fput+0x342/0x5ba
[14834.116611] task_work_run+0x15d/0x198
[14834.116973] exit_to_usermode_loop+0xc7/0x153
[14834.117320] do_syscall_64+0x53d/0x594
[14834.117694] entry_SYSCALL_64_after_hwframe+0x26/0x9b
[14834.118067]
[14834.118426] The buggy address belongs to the object at
ffff8803dbeb8480
[14834.119087] The buggy address is located 480 bytes inside of
[14834.119755] The buggy address belongs to the page:
[14834.120138] page:ffffea000f6fae00 count:1 mapcount:0 mapping:
(null) index:0xffff8803dbebd580 compound_mapcount: 0
[14834.120817] flags: 0x17ffe00000008100(slab|head)
[14834.121171] raw: 17ffe00000008100 0000000000000000 ffff8803dbebd580
00000001001c001b
[14834.121800] raw: ffffea000d718020 ffffea000d32d620 ffff8803f080ee80
0000000000000000
[14834.122415] page dumped because: kasan: bad access detected
[14834.122787]
[14834.123140] Memory state around the buggy address:
[14834.123503] ffff8803dbeb8500: fb fb fb fb fb fb fb fb fb fb fb fb fb
fb fb fb
[14834.124150] ffff8803dbeb8580: fb fb fb fb fb fb fb fb fb fb fb fb fb
fb fb fb
[14834.124806] >ffff8803dbeb8600: fb fb fb fb fb fb fb fb fb fb fb fb fb
fb fb fb
[14834.125467] ^
[14834.125848] ffff8803dbeb8680: fb fb fb fb fb fb fb fb fb fb fb fb fb
fb fb fb
[14834.126493] ffff8803dbeb8700: fb fb fb fb fb fb fb fb fb fb fb fb fb
fb fb fb
[14834.127143]
==================================================================
[14834.127768] Disabling lock debugging due to kernel taint
next prev parent reply other threads:[~2018-02-21 10:26 UTC|newest]
Thread overview: 37+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-02-14 13:17 ppp/pppoe, still panic 4.15.3 in ppp_push Denys Fedoryshchenko
2018-02-14 16:07 ` Guillaume Nault
2018-02-14 16:29 ` Denys Fedoryshchenko
2018-02-14 16:47 ` Guillaume Nault
2018-02-14 16:49 ` Denys Fedoryshchenko
2018-02-14 17:25 ` Guillaume Nault
2018-02-15 10:19 ` Denys Fedoryshchenko
2018-02-15 15:55 ` Guillaume Nault
2018-02-15 16:01 ` Denys Fedoryshchenko
2018-02-15 19:31 ` Guillaume Nault
2018-02-15 19:34 ` Denys Fedoryshchenko
2018-02-15 19:42 ` Guillaume Nault
2018-02-16 11:13 ` Denys Fedoryshchenko
2018-02-16 18:48 ` Guillaume Nault
2018-02-18 10:01 ` Denys Fedoryshchenko
2018-02-21 18:38 ` Guillaume Nault
2018-02-20 9:05 ` Denys Fedoryshchenko
2018-02-21 10:26 ` Denys Fedoryshchenko [this message]
2018-02-21 18:55 ` Guillaume Nault
2018-02-21 19:30 ` Denys Fedoryshchenko
2018-02-21 20:04 ` Cong Wang
2018-02-22 18:30 ` Guillaume Nault
2018-02-22 18:51 ` Denys Fedoryshchenko
2018-02-23 9:38 ` Guillaume Nault
2018-02-23 9:41 ` Denys Fedoryshchenko
2018-02-23 10:07 ` Guillaume Nault
2018-02-23 10:54 ` Denys Fedoryshchenko
2018-02-24 21:22 ` Denys Fedoryshchenko
2018-02-27 10:58 ` Denys Fedoryshchenko
2018-02-27 18:56 ` Guillaume Nault
2018-03-01 20:01 ` Guillaume Nault
2018-03-01 20:07 ` Denys Fedoryshchenko
2018-03-02 17:43 ` Guillaume Nault
2018-03-03 9:33 ` Denys Fedoryshchenko
2018-03-05 17:22 ` Guillaume Nault
2018-02-27 18:54 ` Guillaume Nault
2018-02-15 19:20 ` Guillaume Nault
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ba6cd172193fb55c55b9bfb99a364c8f@nuclearcat.com \
--to=nuclearcat@nuclearcat$(echo .)com \
--cc=g.nault@alphalink$(echo .)fr \
--cc=netdev@vger$(echo .)kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox