B.A.T.M.A.N October 2019

b.a.t.m.a.n@lists.open-mesh.org

20 participants
16 discussions

KMSAN: uninit-value in batadv_hard_if_event
by syzbot 18 Oct '19

18 Oct '19

Hello, syzbot found the following crash on: HEAD commit: c2453450 kmsan: kcov: prettify the code unpoisoning area->.. git tree: https://github.com/google/kmsan.git master console output: https://syzkaller.appspot.com/x/log.txt?x=10b0c06b600000 kernel config: https://syzkaller.appspot.com/x/.config?x=3684f3c73f43899a dashboard link: https://syzkaller.appspot.com/bug?extid=0183453ce4de8bdf9214 compiler: clang version 9.0.0 (/home/glider/llvm/clang 80fee25776c2fb61e74c1ecb1a523375c2500b69) Unfortunately, I don't have any reproducer for this crash yet. IMPORTANT: if you fix the bug, please add the following tag to the commit: Reported-by: syzbot+0183453ce4de8bdf9214(a)syzkaller.appspotmail.com usb 1-1: config 0 has no interface number 0 usb 1-1: New USB device found, idVendor=0411, idProduct=0012, bcdDevice=56.5f usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 usb 1-1: config 0 descriptor?? ===================================================== BUG: KMSAN: uninit-value in batadv_check_known_mac_addr net/batman-adv/hard-interface.c:511 [inline] BUG: KMSAN: uninit-value in batadv_hardif_add_interface net/batman-adv/hard-interface.c:942 [inline] BUG: KMSAN: uninit-value in batadv_hard_if_event+0x23c0/0x3260 net/batman-adv/hard-interface.c:1032 CPU: 0 PID: 13223 Comm: kworker/0:3 Not tainted 5.4.0-rc3+ #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: usb_hub_wq hub_event Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x191/0x1f0 lib/dump_stack.c:113 kmsan_report+0x14a/0x2f0 mm/kmsan/kmsan_report.c:109 __msan_warning+0x73/0xf0 mm/kmsan/kmsan_instr.c:245 batadv_check_known_mac_addr net/batman-adv/hard-interface.c:511 [inline] batadv_hardif_add_interface net/batman-adv/hard-interface.c:942 [inline] batadv_hard_if_event+0x23c0/0x3260 net/batman-adv/hard-interface.c:1032 notifier_call_chain kernel/notifier.c:95 [inline] __raw_notifier_call_chain kernel/notifier.c:396 [inline] raw_notifier_call_chain+0x13d/0x240 kernel/notifier.c:403 call_netdevice_notifiers_info net/core/dev.c:1749 [inline] call_netdevice_notifiers_extack net/core/dev.c:1761 [inline] call_netdevice_notifiers net/core/dev.c:1775 [inline] register_netdevice+0x2126/0x26a0 net/core/dev.c:8810 register_netdev+0x93/0xd0 net/core/dev.c:8901 rtl8150_probe+0x11ef/0x14a0 drivers/net/usb/rtl8150.c:916 usb_probe_interface+0xd19/0x1310 drivers/usb/core/driver.c:361 really_probe+0xd91/0x1f90 drivers/base/dd.c:552 driver_probe_device+0x1ba/0x510 drivers/base/dd.c:721 __device_attach_driver+0x5b8/0x790 drivers/base/dd.c:828 bus_for_each_drv+0x28e/0x3b0 drivers/base/bus.c:430 __device_attach+0x489/0x750 drivers/base/dd.c:894 device_initial_probe+0x4a/0x60 drivers/base/dd.c:941 bus_probe_device+0x131/0x390 drivers/base/bus.c:490 device_add+0x25b5/0x2df0 drivers/base/core.c:2201 usb_set_configuration+0x309f/0x3710 drivers/usb/core/message.c:2027 generic_probe+0xe7/0x280 drivers/usb/core/generic.c:210 usb_probe_device+0x146/0x200 drivers/usb/core/driver.c:266 really_probe+0xd91/0x1f90 drivers/base/dd.c:552 driver_probe_device+0x1ba/0x510 drivers/base/dd.c:721 __device_attach_driver+0x5b8/0x790 drivers/base/dd.c:828 bus_for_each_drv+0x28e/0x3b0 drivers/base/bus.c:430 __device_attach+0x489/0x750 drivers/base/dd.c:894 device_initial_probe+0x4a/0x60 drivers/base/dd.c:941 bus_probe_device+0x131/0x390 drivers/base/bus.c:490 device_add+0x25b5/0x2df0 drivers/base/core.c:2201 usb_new_device+0x23e5/0x2fb0 drivers/usb/core/hub.c:2536 hub_port_connect drivers/usb/core/hub.c:5098 [inline] hub_port_connect_change drivers/usb/core/hub.c:5213 [inline] port_event drivers/usb/core/hub.c:5359 [inline] hub_event+0x581d/0x72f0 drivers/usb/core/hub.c:5441 process_one_work+0x1572/0x1ef0 kernel/workqueue.c:2269 worker_thread+0x111b/0x2460 kernel/workqueue.c:2415 kthread+0x4b5/0x4f0 kernel/kthread.c:256 ret_from_fork+0x35/0x40 arch/x86/entry/entry_64.S:355 Uninit was stored to memory at: kmsan_save_stack_with_flags mm/kmsan/kmsan.c:150 [inline] kmsan_internal_chain_origin+0xbd/0x170 mm/kmsan/kmsan.c:317 kmsan_memcpy_memmove_metadata+0x25c/0x2e0 mm/kmsan/kmsan.c:253 kmsan_memcpy_metadata+0xb/0x10 mm/kmsan/kmsan.c:273 __msan_memcpy+0x56/0x70 mm/kmsan/kmsan_instr.c:129 set_ethernet_addr drivers/net/usb/rtl8150.c:282 [inline] rtl8150_probe+0x1143/0x14a0 drivers/net/usb/rtl8150.c:912 usb_probe_interface+0xd19/0x1310 drivers/usb/core/driver.c:361 really_probe+0xd91/0x1f90 drivers/base/dd.c:552 driver_probe_device+0x1ba/0x510 drivers/base/dd.c:721 __device_attach_driver+0x5b8/0x790 drivers/base/dd.c:828 bus_for_each_drv+0x28e/0x3b0 drivers/base/bus.c:430 __device_attach+0x489/0x750 drivers/base/dd.c:894 device_initial_probe+0x4a/0x60 drivers/base/dd.c:941 bus_probe_device+0x131/0x390 drivers/base/bus.c:490 device_add+0x25b5/0x2df0 drivers/base/core.c:2201 usb_set_configuration+0x309f/0x3710 drivers/usb/core/message.c:2027 generic_probe+0xe7/0x280 drivers/usb/core/generic.c:210 usb_probe_device+0x146/0x200 drivers/usb/core/driver.c:266 really_probe+0xd91/0x1f90 drivers/base/dd.c:552 driver_probe_device+0x1ba/0x510 drivers/base/dd.c:721 __device_attach_driver+0x5b8/0x790 drivers/base/dd.c:828 bus_for_each_drv+0x28e/0x3b0 drivers/base/bus.c:430 __device_attach+0x489/0x750 drivers/base/dd.c:894 device_initial_probe+0x4a/0x60 drivers/base/dd.c:941 bus_probe_device+0x131/0x390 drivers/base/bus.c:490 device_add+0x25b5/0x2df0 drivers/base/core.c:2201 usb_new_device+0x23e5/0x2fb0 drivers/usb/core/hub.c:2536 hub_port_connect drivers/usb/core/hub.c:5098 [inline] hub_port_connect_change drivers/usb/core/hub.c:5213 [inline] port_event drivers/usb/core/hub.c:5359 [inline] hub_event+0x581d/0x72f0 drivers/usb/core/hub.c:5441 process_one_work+0x1572/0x1ef0 kernel/workqueue.c:2269 worker_thread+0x111b/0x2460 kernel/workqueue.c:2415 kthread+0x4b5/0x4f0 kernel/kthread.c:256 ret_from_fork+0x35/0x40 arch/x86/entry/entry_64.S:355 Local variable description: ----node_id.i@rtl8150_probe Variable was created at: get_registers drivers/net/usb/rtl8150.c:911 [inline] set_ethernet_addr drivers/net/usb/rtl8150.c:281 [inline] rtl8150_probe+0xdc8/0x14a0 drivers/net/usb/rtl8150.c:912 get_registers drivers/net/usb/rtl8150.c:911 [inline] set_ethernet_addr drivers/net/usb/rtl8150.c:281 [inline] rtl8150_probe+0xdc8/0x14a0 drivers/net/usb/rtl8150.c:912 ===================================================== --- This bug is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller(a)googlegroups.com. syzbot will keep track of this bug report. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

3 2

WARNING in batadv_iv_send_outstanding_bat_ogm_packet
by syzbot 14 Oct '19

14 Oct '19

Hello, syzbot found the following crash on: HEAD commit: da940012 Merge tag 'char-misc-5.4-rc3' of git://git.kernel.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=13ffd808e00000 kernel config: https://syzkaller.appspot.com/x/.config?x=2d2fd92a28d3e50 dashboard link: https://syzkaller.appspot.com/bug?extid=c0b807de416427ff3dd1 compiler: clang version 9.0.0 (/home/glider/llvm/clang 80fee25776c2fb61e74c1ecb1a523375c2500b69) syz repro: https://syzkaller.appspot.com/x/repro.syz?x=141ffd77600000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11edd580e00000 IMPORTANT: if you fix the bug, please add the following tag to the commit: Reported-by: syzbot+c0b807de416427ff3dd1(a)syzkaller.appspotmail.com ------------[ cut here ]------------ WARNING: CPU: 1 PID: 30 at net/batman-adv/bat_iv_ogm.c:382 batadv_iv_ogm_emit net/batman-adv/bat_iv_ogm.c:382 [inline] WARNING: CPU: 1 PID: 30 at net/batman-adv/bat_iv_ogm.c:382 batadv_iv_send_outstanding_bat_ogm_packet+0x6b4/0x770 net/batman-adv/bat_iv_ogm.c:1663 Kernel panic - not syncing: panic_on_warn set ... CPU: 1 PID: 30 Comm: kworker/u4:2 Not tainted 5.4.0-rc2+ #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: bat_events batadv_iv_send_outstanding_bat_ogm_packet Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1d8/0x2f8 lib/dump_stack.c:113 panic+0x264/0x7a9 kernel/panic.c:221 __warn+0x20e/0x210 kernel/panic.c:582 report_bug+0x1b6/0x2f0 lib/bug.c:195 fixup_bug arch/x86/kernel/traps.c:179 [inline] do_error_trap+0xd7/0x440 arch/x86/kernel/traps.c:272 do_invalid_op+0x36/0x40 arch/x86/kernel/traps.c:291 invalid_op+0x23/0x30 arch/x86/entry/entry_64.S:1028 RIP: 0010:batadv_iv_ogm_emit net/batman-adv/bat_iv_ogm.c:382 [inline] RIP: 0010:batadv_iv_send_outstanding_bat_ogm_packet+0x6b4/0x770 net/batman-adv/bat_iv_ogm.c:1663 Code: 66 05 00 eb 05 e8 9c 48 23 fa 48 83 c4 68 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 88 48 23 fa 0f 0b e9 34 ff ff ff e8 7c 48 23 fa <0f> 0b e9 28 ff ff ff 89 d9 80 e1 07 80 c1 03 38 c1 0f 8c c1 f9 ff RSP: 0018:ffff8880a9abfc48 EFLAGS: 00010293 RAX: ffffffff874fe8a4 RBX: ffff888094160870 RCX: ffff8880a9ab2080 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002 RBP: ffff8880a9abfcd8 R08: ffffffff874fe28e R09: ffffed10123e6969 R10: ffffed10123e6969 R11: 0000000000000000 R12: ffff888091f34000 R13: dffffc0000000000 R14: ffff8880a80c5000 R15: ffff8880a4481400 process_one_work+0x7ef/0x10e0 kernel/workqueue.c:2269 worker_thread+0xc01/0x1630 kernel/workqueue.c:2415 kthread+0x332/0x350 kernel/kthread.c:255 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352 Kernel Offset: disabled Rebooting in 86400 seconds.. --- This bug is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller(a)googlegroups.com. syzbot will keep track of this bug report. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot. syzbot can test patches for this bug, for details see: https://goo.gl/tpsmEJ#testing-patches

1 1

[PATCH 1/2] batman-adv: Introduce own OGM2 buffer mutex
by Sven Eckelmann 13 Oct '19

13 Oct '19

Only a single function is currently automatically locked by the rtnl_lock because (unlike B.A.T.M.A.N. IV) the OGM2 buffer is independent of the hard interfaces on which it will be transmitted. A private mutex can be used instead to avoid unnecessary delays which would have been introduced by the global lock. Signed-off-by: Sven Eckelmann <sven(a)narfation.org> --- net/batman-adv/bat_v_ogm.c | 26 +++++++++++++++++--------- net/batman-adv/types.h | 8 ++++++-- 2 files changed, 23 insertions(+), 11 deletions(-) diff --git a/net/batman-adv/bat_v_ogm.c b/net/batman-adv/bat_v_ogm.c index 034bdc5e..74452e93 100644 --- a/net/batman-adv/bat_v_ogm.c +++ b/net/batman-adv/bat_v_ogm.c @@ -17,11 +17,12 @@ #include <linux/kernel.h> #include <linux/kref.h> #include <linux/list.h> +#include <linux/lockdep.h> +#include <linux/mutex.h> #include <linux/netdevice.h> #include <linux/random.h> #include <linux/rculist.h> #include <linux/rcupdate.h> -#include <linux/rtnetlink.h> #include <linux/skbuff.h> #include <linux/slab.h> #include <linux/stddef.h> @@ -130,7 +131,7 @@ static void batadv_v_ogm_send_softif(struct batadv_priv *bat_priv) u16 tvlv_len = 0; int ret; - ASSERT_RTNL(); + lockdep_assert_held(&bat_priv->bat_v.ogm_buff_mutex); if (atomic_read(&bat_priv->mesh_state) == BATADV_MESH_DEACTIVATING) goto out; @@ -230,11 +231,12 @@ static void batadv_v_ogm_send(struct work_struct *work) struct batadv_priv_bat_v *bat_v; struct batadv_priv *bat_priv; - rtnl_lock(); bat_v = container_of(work, struct batadv_priv_bat_v, ogm_wq.work); bat_priv = container_of(bat_v, struct batadv_priv, bat_v); + + mutex_lock(&bat_priv->bat_v.ogm_buff_mutex); batadv_v_ogm_send_softif(bat_priv); - rtnl_unlock(); + mutex_unlock(&bat_priv->bat_v.ogm_buff_mutex); } /** @@ -263,13 +265,15 @@ void batadv_v_ogm_primary_iface_set(struct batadv_hard_iface *primary_iface) struct batadv_priv *bat_priv = netdev_priv(primary_iface->soft_iface); struct batadv_ogm2_packet *ogm_packet; - ASSERT_RTNL(); - + mutex_lock(&bat_priv->bat_v.ogm_buff_mutex); if (!bat_priv->bat_v.ogm_buff) - return; + goto unlock; ogm_packet = (struct batadv_ogm2_packet *)bat_priv->bat_v.ogm_buff; ether_addr_copy(ogm_packet->orig, primary_iface->net_dev->dev_addr); + +unlock: + mutex_unlock(&bat_priv->bat_v.ogm_buff_mutex); } /** @@ -873,8 +877,6 @@ int batadv_v_ogm_init(struct batadv_priv *bat_priv) unsigned char *ogm_buff; u32 random_seqno; - ASSERT_RTNL(); - bat_priv->bat_v.ogm_buff_len = BATADV_OGM2_HLEN; ogm_buff = kzalloc(bat_priv->bat_v.ogm_buff_len, GFP_ATOMIC); if (!ogm_buff) @@ -893,6 +895,8 @@ int batadv_v_ogm_init(struct batadv_priv *bat_priv) atomic_set(&bat_priv->bat_v.ogm_seqno, random_seqno); INIT_DELAYED_WORK(&bat_priv->bat_v.ogm_wq, batadv_v_ogm_send); + mutex_init(&bat_priv->bat_v.ogm_buff_mutex); + return 0; } @@ -904,7 +908,11 @@ void batadv_v_ogm_free(struct batadv_priv *bat_priv) { cancel_delayed_work_sync(&bat_priv->bat_v.ogm_wq); + mutex_lock(&bat_priv->bat_v.ogm_buff_mutex); + kfree(bat_priv->bat_v.ogm_buff); bat_priv->bat_v.ogm_buff = NULL; bat_priv->bat_v.ogm_buff_len = 0; + + mutex_unlock(&bat_priv->bat_v.ogm_buff_mutex); } diff --git a/net/batman-adv/types.h b/net/batman-adv/types.h index 282a4650..eded9167 100644 --- a/net/batman-adv/types.h +++ b/net/batman-adv/types.h @@ -17,6 +17,7 @@ #include <linux/if.h> #include <linux/if_ether.h> #include <linux/kref.h> +#include <linux/mutex.h> #include <linux/netdevice.h> #include <linux/netlink.h> #include <linux/sched.h> /* for linux/wait.h */ @@ -1518,15 +1519,18 @@ struct batadv_softif_vlan { * struct batadv_priv_bat_v - B.A.T.M.A.N. V per soft-interface private data */ struct batadv_priv_bat_v { - /** @ogm_buff: buffer holding the OGM packet. rtnl protected */ + /** @ogm_buff: buffer holding the OGM packet */ unsigned char *ogm_buff; - /** @ogm_buff_len: length of the OGM packet buffer. rtnl protected */ + /** @ogm_buff_len: length of the OGM packet buffer */ int ogm_buff_len; /** @ogm_seqno: OGM sequence number - used to identify each OGM */ atomic_t ogm_seqno; + /** @ogm_buff_mutex: lock protecting ogm_buff and ogm_buff_len */ + struct mutex ogm_buff_mutex; + /** @ogm_wq: workqueue used to schedule OGM transmissions */ struct delayed_work ogm_wq; }; -- 2.20.1

1 1

KCSAN: data-race in find_next_bit / rcu_report_exp_cpu_mult
by syzbot 08 Oct '19

08 Oct '19

Hello, syzbot found the following crash on: HEAD commit: b4bd9343 x86, kcsan: Enable KCSAN for x86 git tree: https://github.com/google/ktsan.git kcsan console output: https://syzkaller.appspot.com/x/log.txt?x=11edb20d600000 kernel config: https://syzkaller.appspot.com/x/.config?x=c0906aa620713d80 dashboard link: https://syzkaller.appspot.com/bug?extid=134336b86f728d6e55a0 compiler: gcc (GCC) 9.0.0 20181231 (experimental) Unfortunately, I don't have any reproducer for this crash yet. IMPORTANT: if you fix the bug, please add the following tag to the commit: Reported-by: syzbot+134336b86f728d6e55a0(a)syzkaller.appspotmail.com ================================================================== BUG: KCSAN: data-race in find_next_bit / rcu_report_exp_cpu_mult write to 0xffffffff85a7f140 of 8 bytes by task 7 on cpu 0: rcu_report_exp_cpu_mult+0x4f/0xa0 kernel/rcu/tree_exp.h:244 rcu_report_exp_rdp+0x6c/0x90 kernel/rcu/tree_exp.h:254 rcu_preempt_deferred_qs_irqrestore+0x3bb/0x580 kernel/rcu/tree_plugin.h:475 rcu_read_unlock_special+0xec/0x370 kernel/rcu/tree_plugin.h:659 __rcu_read_unlock+0xcf/0xe0 kernel/rcu/tree_plugin.h:394 rcu_read_unlock include/linux/rcupdate.h:645 [inline] batadv_nc_purge_orig_hash net/batman-adv/network-coding.c:411 [inline] batadv_nc_worker+0x13a/0x390 net/batman-adv/network-coding.c:718 process_one_work+0x3d4/0x890 kernel/workqueue.c:2269 worker_thread+0xa0/0x800 kernel/workqueue.c:2415 kthread+0x1d4/0x200 drivers/block/aoe/aoecmd.c:1253 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:352 read to 0xffffffff85a7f140 of 8 bytes by task 7251 on cpu 1: _find_next_bit lib/find_bit.c:39 [inline] find_next_bit+0x57/0xe0 lib/find_bit.c:70 sync_rcu_exp_select_node_cpus+0x28e/0x510 kernel/rcu/tree_exp.h:375 sync_rcu_exp_select_cpus+0x30c/0x590 kernel/rcu/tree_exp.h:439 rcu_exp_sel_wait_wake kernel/rcu/tree_exp.h:575 [inline] wait_rcu_exp_gp+0x25/0x40 kernel/rcu/tree_exp.h:589 process_one_work+0x3d4/0x890 kernel/workqueue.c:2269 worker_thread+0xa0/0x800 kernel/workqueue.c:2415 kthread+0x1d4/0x200 drivers/block/aoe/aoecmd.c:1253 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:352 Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 7251 Comm: kworker/1:4 Not tainted 5.3.0+ #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: rcu_gp wait_rcu_exp_gp ================================================================== --- This bug is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller(a)googlegroups.com. syzbot will keep track of this bug report. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

6 10

[PATCH maint 1/2] batman-adv: Avoid free/alloc race when handling OGM2 buffer
by Sven Eckelmann 03 Oct '19

03 Oct '19

A B.A.T.M.A.N. V virtual interface has an OGM2 packet buffer which is initialized using data from the RTNL protected netdevice notifier and other rtnetlink related hooks. It is sent regularly via various slave interfaces of the batadv virtual interface and in this process also modified (realloced) to integrate additional state information via TVLV containers. It must be avoided that the worker item is executed without a common lock with the netdevice notifier/rtnetlink helpers. Otherwise it can either happen that half modified data is sent out or the functions modifying the OGM2 buffer try to access already freed memory regions. Fixes: 632835348e65 ("batman-adv: OGMv2 - add basic infrastructure") Signed-off-by: Sven Eckelmann <sven(a)narfation.org> --- net/batman-adv/bat_v_ogm.c | 32 +++++++++++++++++++++++++------- net/batman-adv/types.h | 4 ++-- 2 files changed, 27 insertions(+), 9 deletions(-) diff --git a/net/batman-adv/bat_v_ogm.c b/net/batman-adv/bat_v_ogm.c index dc4f7430..24d00a97 100644 --- a/net/batman-adv/bat_v_ogm.c +++ b/net/batman-adv/bat_v_ogm.c @@ -22,6 +22,7 @@ #include <linux/random.h> #include <linux/rculist.h> #include <linux/rcupdate.h> +#include <linux/rtnetlink.h> #include <linux/skbuff.h> #include <linux/slab.h> #include <linux/spinlock.h> @@ -256,14 +257,12 @@ static void batadv_v_ogm_queue_on_if(struct sk_buff *skb, } /** - * batadv_v_ogm_send() - periodic worker broadcasting the own OGM - * @work: work queue item + * batadv_v_ogm_send_softif() - periodic worker broadcasting the own OGM + * @bat_priv: the bat priv with all the soft interface information */ -static void batadv_v_ogm_send(struct work_struct *work) +static void batadv_v_ogm_send_softif(struct batadv_priv *bat_priv) { struct batadv_hard_iface *hard_iface; - struct batadv_priv_bat_v *bat_v; - struct batadv_priv *bat_priv; struct batadv_ogm2_packet *ogm_packet; struct sk_buff *skb, *skb_tmp; unsigned char *ogm_buff; @@ -271,8 +270,7 @@ static void batadv_v_ogm_send(struct work_struct *work) u16 tvlv_len = 0; int ret; - bat_v = container_of(work, struct batadv_priv_bat_v, ogm_wq.work); - bat_priv = container_of(bat_v, struct batadv_priv, bat_v); + ASSERT_RTNL(); if (atomic_read(&bat_priv->mesh_state) == BATADV_MESH_DEACTIVATING) goto out; @@ -363,6 +361,22 @@ static void batadv_v_ogm_send(struct work_struct *work) return; } +/** + * batadv_v_ogm_send() - periodic worker broadcasting the own OGM + * @work: work queue item + */ +static void batadv_v_ogm_send(struct work_struct *work) +{ + struct batadv_priv_bat_v *bat_v; + struct batadv_priv *bat_priv; + + rtnl_lock(); + bat_v = container_of(work, struct batadv_priv_bat_v, ogm_wq.work); + bat_priv = container_of(bat_v, struct batadv_priv, bat_v); + batadv_v_ogm_send_softif(bat_priv); + rtnl_unlock(); +} + /** * batadv_v_ogm_aggr_work() - OGM queue periodic task per interface * @work: work queue item @@ -424,6 +438,8 @@ void batadv_v_ogm_primary_iface_set(struct batadv_hard_iface *primary_iface) struct batadv_priv *bat_priv = netdev_priv(primary_iface->soft_iface); struct batadv_ogm2_packet *ogm_packet; + ASSERT_RTNL(); + if (!bat_priv->bat_v.ogm_buff) return; @@ -1032,6 +1048,8 @@ int batadv_v_ogm_init(struct batadv_priv *bat_priv) unsigned char *ogm_buff; u32 random_seqno; + ASSERT_RTNL(); + bat_priv->bat_v.ogm_buff_len = BATADV_OGM2_HLEN; ogm_buff = kzalloc(bat_priv->bat_v.ogm_buff_len, GFP_ATOMIC); if (!ogm_buff) diff --git a/net/batman-adv/types.h b/net/batman-adv/types.h index be7c02aa..bb7b4ab1 100644 --- a/net/batman-adv/types.h +++ b/net/batman-adv/types.h @@ -1530,10 +1530,10 @@ struct batadv_softif_vlan { * struct batadv_priv_bat_v - B.A.T.M.A.N. V per soft-interface private data */ struct batadv_priv_bat_v { - /** @ogm_buff: buffer holding the OGM packet */ + /** @ogm_buff: buffer holding the OGM packet. rtnl protected */ unsigned char *ogm_buff; - /** @ogm_buff_len: length of the OGM packet buffer */ + /** @ogm_buff_len: length of the OGM packet buffer. rtnl protected */ int ogm_buff_len; /** @ogm_seqno: OGM sequence number - used to identify each OGM */ -- 2.20.1

1 1

KASAN: use-after-free Read in batadv_iv_ogm_queue_add
by syzbot 01 Oct '19

01 Oct '19

Hello, syzbot found the following crash on: HEAD commit: faeacb6d net: tap: clean up an indentation issue git tree: net console output: https://syzkaller.appspot.com/x/log.txt?x=1241cbd3600000 kernel config: https://syzkaller.appspot.com/x/.config?x=6c210ff0b9a35071 dashboard link: https://syzkaller.appspot.com/bug?extid=0cc629f19ccb8534935b compiler: gcc (GCC) 9.0.0 20181231 (experimental) Unfortunately, I don't have any reproducer for this crash yet. IMPORTANT: if you fix the bug, please add the following tag to the commit: Reported-by: syzbot+0cc629f19ccb8534935b(a)syzkaller.appspotmail.com ================================================================== BUG: KASAN: use-after-free in memcpy include/linux/string.h:359 [inline] BUG: KASAN: use-after-free in batadv_iv_ogm_aggregate_new net/batman-adv/bat_iv_ogm.c:544 [inline] BUG: KASAN: use-after-free in batadv_iv_ogm_queue_add+0x31d/0x1120 net/batman-adv/bat_iv_ogm.c:640 Read of size 24 at addr ffff888099112740 by task kworker/u4:2/2025 CPU: 1 PID: 2025 Comm: kworker/u4:2 Not tainted 5.3.0+ #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: bat_events batadv_iv_send_outstanding_bat_ogm_packet Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x172/0x1f0 lib/dump_stack.c:113 print_address_description.cold+0xd4/0x306 mm/kasan/report.c:351 __kasan_report.cold+0x1b/0x36 mm/kasan/report.c:482 kasan_report+0x12/0x17 mm/kasan/common.c:618 check_memory_region_inline mm/kasan/generic.c:185 [inline] check_memory_region+0x134/0x1a0 mm/kasan/generic.c:192 memcpy+0x24/0x50 mm/kasan/common.c:122 memcpy include/linux/string.h:359 [inline] batadv_iv_ogm_aggregate_new net/batman-adv/bat_iv_ogm.c:544 [inline] batadv_iv_ogm_queue_add+0x31d/0x1120 net/batman-adv/bat_iv_ogm.c:640 batadv_iv_ogm_schedule+0x783/0xe50 net/batman-adv/bat_iv_ogm.c:797 batadv_iv_send_outstanding_bat_ogm_packet+0x580/0x730 net/batman-adv/bat_iv_ogm.c:1675 process_one_work+0x9af/0x1740 kernel/workqueue.c:2269 worker_thread+0x98/0xe40 kernel/workqueue.c:2415 kthread+0x361/0x430 kernel/kthread.c:255 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352 Allocated by task 9774: save_stack+0x23/0x90 mm/kasan/common.c:69 set_track mm/kasan/common.c:77 [inline] __kasan_kmalloc mm/kasan/common.c:493 [inline] __kasan_kmalloc.constprop.0+0xcf/0xe0 mm/kasan/common.c:466 kasan_kmalloc+0x9/0x10 mm/kasan/common.c:507 kmem_cache_alloc_trace+0x158/0x790 mm/slab.c:3550 kmalloc include/linux/slab.h:552 [inline] batadv_iv_ogm_iface_enable+0x123/0x320 net/batman-adv/bat_iv_ogm.c:201 batadv_hardif_enable_interface+0x276/0x950 net/batman-adv/hard-interface.c:761 batadv_softif_slave_add+0x8f/0x100 net/batman-adv/soft-interface.c:892 do_set_master net/core/rtnetlink.c:2369 [inline] do_set_master+0x1ca/0x230 net/core/rtnetlink.c:2343 do_setlink+0xa85/0x3520 net/core/rtnetlink.c:2504 rtnl_setlink+0x273/0x3d0 net/core/rtnetlink.c:2763 rtnetlink_rcv_msg+0x463/0xb00 net/core/rtnetlink.c:5223 netlink_rcv_skb+0x177/0x450 net/netlink/af_netlink.c:2477 rtnetlink_rcv+0x1d/0x30 net/core/rtnetlink.c:5241 netlink_unicast_kernel net/netlink/af_netlink.c:1302 [inline] netlink_unicast+0x531/0x710 net/netlink/af_netlink.c:1328 netlink_sendmsg+0x8a5/0xd60 net/netlink/af_netlink.c:1917 sock_sendmsg_nosec net/socket.c:637 [inline] sock_sendmsg+0xd7/0x130 net/socket.c:657 sock_write_iter+0x27c/0x3e0 net/socket.c:989 call_write_iter include/linux/fs.h:1880 [inline] do_iter_readv_writev+0x5f8/0x8f0 fs/read_write.c:693 do_iter_write fs/read_write.c:970 [inline] do_iter_write+0x184/0x610 fs/read_write.c:951 vfs_writev+0x1b3/0x2f0 fs/read_write.c:1015 do_writev+0x15b/0x330 fs/read_write.c:1058 __do_sys_writev fs/read_write.c:1131 [inline] __se_sys_writev fs/read_write.c:1128 [inline] __x64_sys_writev+0x75/0xb0 fs/read_write.c:1128 do_syscall_64+0xfa/0x760 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe Freed by task 7: save_stack+0x23/0x90 mm/kasan/common.c:69 set_track mm/kasan/common.c:77 [inline] __kasan_slab_free+0x102/0x150 mm/kasan/common.c:455 kasan_slab_free+0xe/0x10 mm/kasan/common.c:463 __cache_free mm/slab.c:3425 [inline] kfree+0x10a/0x2c0 mm/slab.c:3756 batadv_iv_ogm_iface_disable+0x39/0x80 net/batman-adv/bat_iv_ogm.c:220 batadv_hardif_disable_interface.cold+0x4b4/0x87b net/batman-adv/hard-interface.c:875 batadv_softif_destroy_netlink+0xa9/0x130 net/batman-adv/soft-interface.c:1146 default_device_exit_batch+0x25c/0x410 net/core/dev.c:9830 ops_exit_list.isra.0+0xfc/0x150 net/core/net_namespace.c:175 cleanup_net+0x4e2/0xa60 net/core/net_namespace.c:594 process_one_work+0x9af/0x1740 kernel/workqueue.c:2269 worker_thread+0x98/0xe40 kernel/workqueue.c:2415 kthread+0x361/0x430 kernel/kthread.c:255 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352 The buggy address belongs to the object at ffff888099112740 which belongs to the cache kmalloc-32 of size 32 The buggy address is located 0 bytes inside of 32-byte region [ffff888099112740, ffff888099112760) The buggy address belongs to the page: page:ffffea0002644480 refcount:1 mapcount:0 mapping:ffff8880aa4001c0 index:0xffff888099112fc1 flags: 0x1fffc0000000200(slab) raw: 01fffc0000000200 ffffea0002995848 ffffea00029e8bc8 ffff8880aa4001c0 raw: ffff888099112fc1 ffff888099112000 000000010000003a 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff888099112600: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc ffff888099112680: 00 fc fc fc fc fc fc fc fb fb fb fb fc fc fc fc > ffff888099112700: 00 00 00 fc fc fc fc fc fb fb fb fb fc fc fc fc ^ ffff888099112780: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc ffff888099112800: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc ================================================================== --- This bug is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller(a)googlegroups.com. syzbot will keep track of this bug report. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

B.A.T.M.A.N October 2019