B.A.T.M.A.N December 2023

b.a.t.m.a.n@lists.open-mesh.org

4 participants
5 discussions

[PATCH] batman-adv: compat: Fix skb_vlan_eth_hdr conflict in stable kernels
by Sven Eckelmann 23 Dec '23

23 Dec '23

The newest Linux stable kernel releases: * v5.10.205 * v5.15.144 * v6.1.69 received a backported version of commit 1f5020acb33f ("net: vlan: introduce skb_vlan_eth_hdr()"). batman-adv must therefore not provide this function any longer for these kernel versions. Signed-off-by: Sven Eckelmann <sven(a)narfation.org> --- compat-include/linux/if_vlan.h | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/compat-include/linux/if_vlan.h b/compat-include/linux/if_vlan.h index eb15e060..f19674b5 100644 --- a/compat-include/linux/if_vlan.h +++ b/compat-include/linux/if_vlan.h @@ -13,7 +13,10 @@ #include <linux/version.h> #include_next <linux/if_vlan.h> -#if LINUX_VERSION_IS_LESS(6, 4, 0) +#if LINUX_VERSION_IS_LESS(6, 4, 0) && \ + !(LINUX_VERSION_IS_GEQ(5, 10, 205) && LINUX_VERSION_IS_LESS(5, 11, 0)) && \ + !(LINUX_VERSION_IS_GEQ(5, 15, 144) && LINUX_VERSION_IS_LESS(5, 16, 0)) && \ + !(LINUX_VERSION_IS_GEQ(6, 1, 69) && LINUX_VERSION_IS_LESS(6, 2, 0)) /* Prefer this version in TX path, instead of * skb_reset_mac_header() + vlan_eth_hdr() --- base-commit: f33d7f724675544a36b24c77f8d4b95d41252ae2 change-id: 20231223-compat-skb_vlan_eth_hdr-deabef2d774c Best regards, -- Sven Eckelmann <sven(a)narfation.org>

1 0

Fwd: Fwd: memory leak in batadv_iv_ogm_aggregate_new
by Jinho Ju 21 Dec '23

21 Dec '23

---------- Forwarded message --------- 보낸사람: Jinho Ju <wnwlsgh98(a)gmail.com> Date: 2023년 12월 21일 (목) 오후 2:52 Subject: Re: Fwd: memory leak in batadv_iv_ogm_aggregate_new To: Sven Eckelmann <sven(a)narfation.org>, <b.a.t.m.a.n(a)lists.open-mesh.org> Cc: <mareklindner(a)neomailbox.ch>, <sw(a)simonwunderlich.de>, <a(a)unstable.cc> Resending to everyone on the mailing list as per previous mail, adding some things that were missing. Regarding the cause of the L2-related crash being detected by syzkaller, I can't say for sure - what I can say for sure at this point is that a memleak occurring in L2 was detected by my personal syzkaller. Moving away from syzkaller for a moment and shifting the focus to memleak, we have to assume that the conditions for this to occur are that they reference the same network stack and are found in modules in L2, but it seems that when batman-adv is freed and returned while accessing and processing a skb in veth (L3), memleak occurs because it is trying to reference the same skb, the veth freed skb. I'm keeping an eye on 'static netdev_tx_t veth_xmit()' as a related function, but for now, the above flow seems to be the most obvious as the root cause. Jinho Ju, Thanks. 2023년 12월 19일 (화) 오후 7:09, Sven Eckelmann <sven(a)narfation.org>님이 작성: > > On Tuesday, 19 December 2023 08:30:47 CET Jinho Ju wrote: > > ---------- Forwarded message --------- > > 보낸사람: Jinho Ju <wnwlsgh98(a)gmail.com> > > Date: 2023년 12월 19일 (화) 오후 1:58 > > Subject: memory leak in batadv_iv_ogm_aggregate_new > > To: <security(a)kernel.org> > > > > > > Hello, I am "Jinho Ju" who is studying about Kernel security in Korea. > > A "*memory leak in batadv_iv_ogm_aggregate_new*" was reported in Syzkaller > > targeting 6.7-rc6 on December 19, 2023 at 02:03. > > The environment in which this bug was detected is as follows. > > Syzkaller version: 3222d10c > > Kernel version: LInux kernel 6.7-rc6 > > The report provided by Syzkaller is as follows. > > > Thanks. But why isn't this coordinated through the "normal" syzkaller > instance? [1] > > Also when looking at these backtraces, I am not sure if we are the correct > recipients - but please correct me. Take as easy example > batadv_iv_ogm_send_to_if. This function does a clone and immediately sends it > via batadv_send_broadcast_skb. At the end, it goes through > batadv_send_skb_packet - a function which either does a kfree_skb or a > dev_queue_xmit. A function (__dev_queue_xmit) which has in its description: > > Regardless of the return value, the skb is consumed > > So I would assume that something which consumes packets from this queue (so > the sb_dev) is not actually doing its job correctly and leaking frames. So in > my opinion, it is necessary to figure out what tried to handle the skb after > it left batman-adv. Which would involve information like the underlying > interfaces. > > If I read the reproducer correctly, veth pairs are used as underlying interfaces. > > But the setup is so convoluted with vlan, macvlan, hwsim, xfrm, macvtap, ... > I don't see a l2 link between these other interfaces (only L3) but I could be > wrong. So it would be necessary to reduce this complexity heavily to figure > out what is not cleaning up the supplied skbuff. > > I should most likely study the reproducer more but my current assumption is > that you would end up with backtraces that look like veth is leaking skbs when > you modify veth.c like this: > > diff --git a/drivers/net/veth.c b/drivers/net/veth.c > index 977861c46b1f..1d86e3869c77 100644 > --- a/drivers/net/veth.c > +++ b/drivers/net/veth.c > @@ -344,12 +344,22 @@ static netdev_tx_t veth_xmit(struct sk_buff *skb, struct net_device *dev) > { > struct veth_priv *rcv_priv, *priv = netdev_priv(dev); > struct veth_rq *rq = NULL; > + struct sk_buff *hack_skb; > int ret = NETDEV_TX_OK; > struct net_device *rcv; > int length = skb->len; > bool use_napi = false; > int rxq; > > + hack_skb = skb_clone(skb, GFP_ATOMIC); > + if (!hack_skb) { > + kfree_skb(skb); > + return NET_XMIT_DROP; > + } > + > + consume_skb(skb); > + skb = hack_skb; > + > rcu_read_lock(); > rcv = rcu_dereference(priv->peer); > if (unlikely(!rcv) || !pskb_may_pull(skb, ETH_HLEN)) { > > But there is also a chance that actually net/dev/core.c is leaking it and it > never reaches the veth driver. > > > I also don't get why we were contacted in private and why the kernel security > list was involved in the first place. > > Kind regards, > Sven >

2 1

Fwd: memory leak in batadv_iv_ogm_aggregate_new
by Jinho Ju 21 Dec '23

21 Dec '23

---------- Forwarded message --------- 보낸사람: Jinho Ju <wnwlsgh98(a)gmail.com> Date: 2023년 12월 19일 (화) 오후 1:58 Subject: memory leak in batadv_iv_ogm_aggregate_new To: <security(a)kernel.org> Hello, I am "Jinho Ju" who is studying about Kernel security in Korea. A "*memory leak in batadv_iv_ogm_aggregate_new*" was reported in Syzkaller targeting 6.7-rc6 on December 19, 2023 at 02:03. The environment in which this bug was detected is as follows. Syzkaller version: 3222d10c Kernel version: LInux kernel 6.7-rc6 The report provided by Syzkaller is as follows. ============================================================================================================ Syzkaller hit 'memory leak in batadv_iv_ogm_aggregate_new' bug. BUG: memory leak unreferenced object 0xffff8881104a6640 (size 240): comm "kworker/u4:3", pid 9303, jiffies 4295071144 (age 12.160s) hex dump (first 32 bytes): 00 64 54 0a 81 88 ff ff 57 24 00 00 ee 04 0c 07 .dT.....W$...... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<ffffffff81daae1e>] kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline] [<ffffffff81daae1e>] slab_post_alloc_hook mm/slab.h:766 [inline] [<ffffffff81daae1e>] slab_alloc_node mm/slab.c:3237 [inline] [<ffffffff81daae1e>] kmem_cache_alloc_node+0x20e/0x510 mm/slab.c:3509 [<ffffffff885623ba>] __alloc_skb+0x28a/0x330 net/core/skbuff.c:641 [<ffffffff8856d704>] __netdev_alloc_skb+0x74/0x400 net/core/skbuff.c:715 [<ffffffff8a2bf706>] __netdev_alloc_skb_ip_align include/linux/skbuff.h:3245 [inline] [<ffffffff8a2bf706>] netdev_alloc_skb_ip_align include/linux/skbuff.h:3255 [inline] [<ffffffff8a2bf706>] batadv_iv_ogm_aggregate_new+0x106/0x4b0 net/batman-adv/bat_iv_ogm.c:558 [<ffffffff8a2c55b3>] batadv_iv_ogm_queue_add net/batman-adv/bat_iv_ogm.c:670 [inline] [<ffffffff8a2c55b3>] batadv_iv_ogm_schedule_buff+0x983/0x14b0 net/batman-adv/bat_iv_ogm.c:833 [<ffffffff8a2c6413>] batadv_iv_ogm_schedule net/batman-adv/bat_iv_ogm.c:868 [inline] [<ffffffff8a2c6413>] batadv_iv_ogm_schedule net/batman-adv/bat_iv_ogm.c:861 [inline] [<ffffffff8a2c6413>] batadv_iv_send_outstanding_bat_ogm_packet+0x333/0x930 net/batman-adv/bat_iv_ogm.c:1712 [<ffffffff8154b0c8>] process_one_work+0x878/0x15c0 kernel/workqueue.c:2627 [<ffffffff8154c665>] process_scheduled_works kernel/workqueue.c:2700 [inline] [<ffffffff8154c665>] worker_thread+0x855/0x1200 kernel/workqueue.c:2781 [<ffffffff8156bf0c>] kthread+0x2cc/0x3b0 kernel/kthread.c:388 [<ffffffff812fb685>] ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 [<ffffffff81004b71>] ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242 BUG: memory leak unreferenced object 0xffff888109b6c800 (size 1024): comm "kworker/u4:3", pid 9303, jiffies 4295071144 (age 12.170s) hex dump (first 32 bytes): 40 66 4a 10 81 88 ff ff 57 24 00 00 ee 04 03 07 @fJ.....W$...... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<ffffffff81dacac3>] kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline] [<ffffffff81dacac3>] slab_post_alloc_hook mm/slab.h:766 [inline] [<ffffffff81dacac3>] slab_alloc_node mm/slab.c:3237 [inline] [<ffffffff81dacac3>] __kmem_cache_alloc_node+0x1e3/0x4c0 mm/slab.c:3521 [<ffffffff81c12d0e>] __do_kmalloc_node mm/slab_common.c:1006 [inline] [<ffffffff81c12d0e>] __kmalloc_node_track_caller+0x4e/0xd0 mm/slab_common.c:1027 [<ffffffff8855979d>] kmalloc_reserve+0xed/0x260 net/core/skbuff.c:582 [<ffffffff88562259>] __alloc_skb+0x129/0x330 net/core/skbuff.c:651 [<ffffffff8856d704>] __netdev_alloc_skb+0x74/0x400 net/core/skbuff.c:715 [<ffffffff8a2bf706>] __netdev_alloc_skb_ip_align include/linux/skbuff.h:3245 [inline] [<ffffffff8a2bf706>] netdev_alloc_skb_ip_align include/linux/skbuff.h:3255 [inline] [<ffffffff8a2bf706>] batadv_iv_ogm_aggregate_new+0x106/0x4b0 net/batman-adv/bat_iv_ogm.c:558 [<ffffffff8a2c55b3>] batadv_iv_ogm_queue_add net/batman-adv/bat_iv_ogm.c:670 [inline] [<ffffffff8a2c55b3>] batadv_iv_ogm_schedule_buff+0x983/0x14b0 net/batman-adv/bat_iv_ogm.c:833 [<ffffffff8a2c6413>] batadv_iv_ogm_schedule net/batman-adv/bat_iv_ogm.c:868 [inline] [<ffffffff8a2c6413>] batadv_iv_ogm_schedule net/batman-adv/bat_iv_ogm.c:861 [inline] [<ffffffff8a2c6413>] batadv_iv_send_outstanding_bat_ogm_packet+0x333/0x930 net/batman-adv/bat_iv_ogm.c:1712 [<ffffffff8154b0c8>] process_one_work+0x878/0x15c0 kernel/workqueue.c:2627 [<ffffffff8154c665>] process_scheduled_works kernel/workqueue.c:2700 [inline] [<ffffffff8154c665>] worker_thread+0x855/0x1200 kernel/workqueue.c:2781 [<ffffffff8156bf0c>] kthread+0x2cc/0x3b0 kernel/kthread.c:388 [<ffffffff812fb685>] ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 [<ffffffff81004b71>] ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242 BUG: memory leak unreferenced object 0xffff88810a546400 (size 512): comm "kworker/u4:3", pid 9303, jiffies 4295071144 (age 12.170s) hex dump (first 32 bytes): 18 41 68 12 81 88 ff ff 57 24 00 00 ee 04 15 07 .Ah.....W$...... 00 00 00 00 00 00 00 00 10 64 54 0a 81 88 ff ff .........dT..... backtrace: [<ffffffff81dacac3>] kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline] [<ffffffff81dacac3>] slab_post_alloc_hook mm/slab.h:766 [inline] [<ffffffff81dacac3>] slab_alloc_node mm/slab.c:3237 [inline] [<ffffffff81dacac3>] __kmem_cache_alloc_node+0x1e3/0x4c0 mm/slab.c:3521 [<ffffffff81c12436>] kmalloc_trace+0x26/0x60 mm/slab_common.c:1098 [<ffffffff8a32b710>] kmalloc include/linux/slab.h:600 [inline] [<ffffffff8a32b710>] batadv_forw_packet_alloc+0x3b0/0x4d0 net/batman-adv/send.c:519 [<ffffffff8a2bf734>] batadv_iv_ogm_aggregate_new+0x134/0x4b0 net/batman-adv/bat_iv_ogm.c:562 [<ffffffff8a2c55b3>] batadv_iv_ogm_queue_add net/batman-adv/bat_iv_ogm.c:670 [inline] [<ffffffff8a2c55b3>] batadv_iv_ogm_schedule_buff+0x983/0x14b0 net/batman-adv/bat_iv_ogm.c:833 [<ffffffff8a2c6413>] batadv_iv_ogm_schedule net/batman-adv/bat_iv_ogm.c:868 [inline] [<ffffffff8a2c6413>] batadv_iv_ogm_schedule net/batman-adv/bat_iv_ogm.c:861 [inline] [<ffffffff8a2c6413>] batadv_iv_send_outstanding_bat_ogm_packet+0x333/0x930 net/batman-adv/bat_iv_ogm.c:1712 [<ffffffff8154b0c8>] process_one_work+0x878/0x15c0 kernel/workqueue.c:2627 [<ffffffff8154c665>] process_scheduled_works kernel/workqueue.c:2700 [inline] [<ffffffff8154c665>] worker_thread+0x855/0x1200 kernel/workqueue.c:2781 [<ffffffff8156bf0c>] kthread+0x2cc/0x3b0 kernel/kthread.c:388 [<ffffffff812fb685>] ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 [<ffffffff81004b71>] ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242 BUG: memory leak unreferenced object 0xffff88801c47d580 (size 240): comm "kworker/u4:3", pid 9303, jiffies 4295071249 (age 11.120s) hex dump (first 32 bytes): 00 c8 b6 09 81 88 ff ff 57 24 00 00 44 05 d7 06 ........W$..D... 00 e0 ee 06 81 88 ff ff 00 00 00 00 00 00 00 00 ................ backtrace: [<ffffffff81daaac5>] kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline] [<ffffffff81daaac5>] slab_post_alloc_hook mm/slab.h:766 [inline] [<ffffffff81daaac5>] slab_alloc_node mm/slab.c:3237 [inline] [<ffffffff81daaac5>] slab_alloc mm/slab.c:3246 [inline] [<ffffffff81daaac5>] __kmem_cache_alloc_lru mm/slab.c:3423 [inline] [<ffffffff81daaac5>] kmem_cache_alloc+0x295/0x3e0 mm/slab.c:3432 [<ffffffff88573455>] skb_clone+0x145/0x3d0 net/core/skbuff.c:1916 [<ffffffff8a2c661d>] batadv_iv_ogm_send_to_if net/batman-adv/bat_iv_ogm.c:387 [inline] [<ffffffff8a2c661d>] batadv_iv_ogm_emit net/batman-adv/bat_iv_ogm.c:420 [inline] [<ffffffff8a2c661d>] batadv_iv_send_outstanding_bat_ogm_packet+0x53d/0x930 net/batman-adv/bat_iv_ogm.c:1700 [<ffffffff8154b0c8>] process_one_work+0x878/0x15c0 kernel/workqueue.c:2627 [<ffffffff8154c665>] process_scheduled_works kernel/workqueue.c:2700 [inline] [<ffffffff8154c665>] worker_thread+0x855/0x1200 kernel/workqueue.c:2781 [<ffffffff8156bf0c>] kthread+0x2cc/0x3b0 kernel/kthread.c:388 [<ffffffff812fb685>] ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 [<ffffffff81004b71>] ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242 BUG: memory leak unreferenced object 0xffff88810f01b480 (size 240): comm "softirq", pid 0, jiffies 4295071837 (age 10.950s) hex dump (first 32 bytes): 80 86 e7 17 81 88 ff ff 00 00 00 00 67 05 9c 06 ............g... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<ffffffff81daae1e>] kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline] [<ffffffff81daae1e>] slab_post_alloc_hook mm/slab.h:766 [inline] [<ffffffff81daae1e>] slab_alloc_node mm/slab.c:3237 [inline] [<ffffffff81daae1e>] kmem_cache_alloc_node+0x20e/0x510 mm/slab.c:3509 [<ffffffff885623ba>] __alloc_skb+0x28a/0x330 net/core/skbuff.c:641 [<ffffffff8856d704>] __netdev_alloc_skb+0x74/0x400 net/core/skbuff.c:715 [<ffffffff89e93c53>] netdev_alloc_skb include/linux/skbuff.h:3225 [inline] [<ffffffff89e93c53>] dev_alloc_skb include/linux/skbuff.h:3238 [inline] [<ffffffff89e93c53>] __ieee80211_beacon_get+0xbf3/0x1680 net/mac80211/tx.c:5445 [<ffffffff89e948f6>] ieee80211_beacon_get_tim+0xa6/0x280 net/mac80211/tx.c:5567 [<ffffffff864c017e>] ieee80211_beacon_get include/net/mac80211.h:5442 [inline] [<ffffffff864c017e>] mac80211_hwsim_beacon_tx+0x40e/0x750 drivers/net/wireless/virtual/mac80211_hwsim.c:2260 [<ffffffff89eb6bd8>] __iterate_interfaces+0x2c8/0x570 net/mac80211/util.c:767 [<ffffffff89ebdc11>] ieee80211_iterate_active_interfaces_atomic+0x71/0x1b0 net/mac80211/util.c:803 [<ffffffff864a2c51>] mac80211_hwsim_beacon+0x101/0x200 drivers/net/wireless/virtual/mac80211_hwsim.c:2290 [<ffffffff8174ea54>] __run_hrtimer kernel/time/hrtimer.c:1688 [inline] [<ffffffff8174ea54>] __hrtimer_run_queues+0x604/0xc10 kernel/time/hrtimer.c:1752 [<ffffffff8174f1df>] hrtimer_run_softirq+0x17f/0x350 kernel/time/hrtimer.c:1769 [<ffffffff8a6b2774>] __do_softirq+0x1d4/0x85e kernel/softirq.c:553 BUG: memory leak unreferenced object 0xffff88811de3bc80 (size 640): comm "softirq", pid 0, jiffies 4295071837 (age 10.950s) hex dump (first 32 bytes): 80 b4 01 0f 81 88 ff ff 00 00 00 00 67 05 92 06 ............g... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<ffffffff81daae1e>] kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline] [<ffffffff81daae1e>] slab_post_alloc_hook mm/slab.h:766 [inline] [<ffffffff81daae1e>] slab_alloc_node mm/slab.c:3237 [inline] [<ffffffff81daae1e>] kmem_cache_alloc_node+0x20e/0x510 mm/slab.c:3509 [<ffffffff88559813>] kmalloc_reserve+0x163/0x260 net/core/skbuff.c:560 [<ffffffff88562259>] __alloc_skb+0x129/0x330 net/core/skbuff.c:651 [<ffffffff8856d704>] __netdev_alloc_skb+0x74/0x400 net/core/skbuff.c:715 [<ffffffff89e93c53>] netdev_alloc_skb include/linux/skbuff.h:3225 [inline] [<ffffffff89e93c53>] dev_alloc_skb include/linux/skbuff.h:3238 [inline] [<ffffffff89e93c53>] __ieee80211_beacon_get+0xbf3/0x1680 net/mac80211/tx.c:5445 [<ffffffff89e948f6>] ieee80211_beacon_get_tim+0xa6/0x280 net/mac80211/tx.c:5567 [<ffffffff864c017e>] ieee80211_beacon_get include/net/mac80211.h:5442 [inline] [<ffffffff864c017e>] mac80211_hwsim_beacon_tx+0x40e/0x750 drivers/net/wireless/virtual/mac80211_hwsim.c:2260 [<ffffffff89eb6bd8>] __iterate_interfaces+0x2c8/0x570 net/mac80211/util.c:767 [<ffffffff89ebdc11>] ieee80211_iterate_active_interfaces_atomic+0x71/0x1b0 net/mac80211/util.c:803 [<ffffffff864a2c51>] mac80211_hwsim_beacon+0x101/0x200 drivers/net/wireless/virtual/mac80211_hwsim.c:2290 [<ffffffff8174ea54>] __run_hrtimer kernel/time/hrtimer.c:1688 [inline] [<ffffffff8174ea54>] __hrtimer_run_queues+0x604/0xc10 kernel/time/hrtimer.c:1752 [<ffffffff8174f1df>] hrtimer_run_softirq+0x17f/0x350 kernel/time/hrtimer.c:1769 [<ffffffff8a6b2774>] __do_softirq+0x1d4/0x85e kernel/softirq.c:553 BUG: memory leak unreferenced object 0xffff88810f01b200 (size 240): comm "softirq", pid 0, jiffies 4295071837 (age 10.950s) hex dump (first 32 bytes): c0 29 86 0e 81 88 ff ff 00 00 00 00 67 05 9c 06 .)..........g... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<ffffffff81daae1e>] kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline] [<ffffffff81daae1e>] slab_post_alloc_hook mm/slab.h:766 [inline] [<ffffffff81daae1e>] slab_alloc_node mm/slab.c:3237 [inline] [<ffffffff81daae1e>] kmem_cache_alloc_node+0x20e/0x510 mm/slab.c:3509 [<ffffffff885623ba>] __alloc_skb+0x28a/0x330 net/core/skbuff.c:641 [<ffffffff8856d704>] __netdev_alloc_skb+0x74/0x400 net/core/skbuff.c:715 [<ffffffff89e93c53>] netdev_alloc_skb include/linux/skbuff.h:3225 [inline] [<ffffffff89e93c53>] dev_alloc_skb include/linux/skbuff.h:3238 [inline] [<ffffffff89e93c53>] __ieee80211_beacon_get+0xbf3/0x1680 net/mac80211/tx.c:5445 [<ffffffff89e948f6>] ieee80211_beacon_get_tim+0xa6/0x280 net/mac80211/tx.c:5567 [<ffffffff864c017e>] ieee80211_beacon_get include/net/mac80211.h:5442 [inline] [<ffffffff864c017e>] mac80211_hwsim_beacon_tx+0x40e/0x750 drivers/net/wireless/virtual/mac80211_hwsim.c:2260 [<ffffffff89eb6bd8>] __iterate_interfaces+0x2c8/0x570 net/mac80211/util.c:767 [<ffffffff89ebdc11>] ieee80211_iterate_active_interfaces_atomic+0x71/0x1b0 net/mac80211/util.c:803 [<ffffffff864a2c51>] mac80211_hwsim_beacon+0x101/0x200 drivers/net/wireless/virtual/mac80211_hwsim.c:2290 [<ffffffff8174ea54>] __run_hrtimer kernel/time/hrtimer.c:1688 [inline] [<ffffffff8174ea54>] __hrtimer_run_queues+0x604/0xc10 kernel/time/hrtimer.c:1752 [<ffffffff8174f1df>] hrtimer_run_softirq+0x17f/0x350 kernel/time/hrtimer.c:1769 [<ffffffff8a6b2774>] __do_softirq+0x1d4/0x85e kernel/softirq.c:553 Syzkaller reproducer: # {Threaded:false Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Repro:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}} bind$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x1a, 0x0, 0x1, 0x3}, 0x14) r0 = openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000080)='cgroup.procs\x00', 0x2, 0x0) r2 = syz_io_uring_setup(0x1aaa, &(0x7f00000000c0)={0x0, 0x70d1, 0x0, 0x0, 0x158}, &(0x7f0000000140), &(0x7f0000000180)) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000600), 0x40, 0x0) io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x6, &(0x7f0000000680)={0x3, 0x0, &(0x7f0000000640)=[0xffffffffffffffff, 0xffffffffffffffff, r0, r1, r2, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r3]}, 0xa) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) io_uring_register$IORING_REGISTER_IOWQ_MAX_WORKERS(r4, 0x13, &(0x7f0000000700)=[0x200, 0x101], 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000740)={0x2, 0x7}, 0x2) pipe2(0x0, 0x80080) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000980)={0x18, 0x0, 0x0, &(0x7f0000000840)='GPL\x00', 0x850d, 0x0, 0x0, 0x41000, 0x24, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000900)=[r4, 0xffffffffffffffff, r4]}, 0x90) sendmsg$ETHTOOL_MSG_LINKINFO_SET(0xffffffffffffffff, &(0x7f0000000b00)={&(0x7f0000000a40)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a80)={0x28, 0x0, 0x100, 0x70bd2a, 0x25dfdbfc, {}, [@ETHTOOL_A_LINKINFO_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @ETHTOOL_A_LINKINFO_TP_MDIX_CTRL={0x5}]}, 0x28}, 0x1, 0x0, 0x0, 0x20000800}, 0x0) ============================================================================================================ I cannot rule out the possibility that this bug detected in Syzkaller targeting 6.7-rc6 is false positive. Also there are no reported records in 6.7-rc6. I've attached C repro and .config. Thank you So much. JinHo Ju.

1 0

[syzbot] [batman?] INFO: rcu detected stall in sys_recvmmsg (3)
by syzbot 19 Dec '23

19 Dec '23

Hello, syzbot found the following issue on: HEAD commit: 2cf4f94d8e86 Merge tag 'scsi-fixes' of git://git.kernel.or.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=12534501e80000 kernel config: https://syzkaller.appspot.com/x/.config?x=671af399e2dac0e3 dashboard link: https://syzkaller.appspot.com/bug?extid=b079dc0aa6e992859e7c compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 Unfortunately, I don't have any reproducer for this issue yet. Downloadable assets: disk image: https://storage.googleapis.com/syzbot-assets/08b534ec982d/disk-2cf4f94d.raw… vmlinux: https://storage.googleapis.com/syzbot-assets/8c44c6da6081/vmlinux-2cf4f94d.… kernel image: https://storage.googleapis.com/syzbot-assets/7e291c0f9693/bzImage-2cf4f94d.… IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+b079dc0aa6e992859e7c(a)syzkaller.appspotmail.com rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: rcu: 0-...!: (1 GPs behind) idle=c844/1/0x4000000000000000 softirq=35391/35392 fqs=3 rcu: (detected by 1, t=10502 jiffies, g=60989, q=82 ncpus=2) Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 PID: 12878 Comm: syz-executor.1 Not tainted 6.7.0-rc6-syzkaller-00010-g2cf4f94d8e86 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 RIP: 0010:rcu_dynticks_curr_cpu_in_eqs include/linux/context_tracking.h:122 [inline] RIP: 0010:rcu_is_watching+0x3d/0xb0 kernel/rcu/tree.c:700 Code: c7 c3 e8 6d 03 00 83 f8 07 89 c5 77 7a 48 8d 3c ed 60 da a6 8c 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 <75> 54 48 03 1c ed 60 da a6 8c 48 b8 00 00 00 00 00 fc ff df 48 89 RSP: 0018:ffffc90000007c78 EFLAGS: 00000046 RAX: dffffc0000000000 RBX: 0000000000036de8 RCX: ffffffff8166f367 RDX: 1ffffffff194db4c RSI: ffffffff8b2ed360 RDI: ffffffff8ca6da60 RBP: 0000000000000000 R08: 0000000000000000 R09: fffffbfff1e30d1a R10: ffffffff8f1868d7 R11: 0000000000000002 R12: 0000000000000001 R13: 0000000000000000 R14: ffff88802be37300 R15: 0000000000000000 FS: 00007feb948206c0(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020230030 CR3: 000000001f8f7000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <NMI> </NMI> <IRQ> trace_lock_acquire include/trace/events/lock.h:24 [inline] lock_acquire+0x464/0x520 kernel/locking/lockdep.c:5725 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154 spin_lock include/linux/spinlock.h:351 [inline] advance_sched+0xd5/0xc60 net/sched/sch_taprio.c:935 __run_hrtimer kernel/time/hrtimer.c:1688 [inline] __hrtimer_run_queues+0x203/0xc20 kernel/time/hrtimer.c:1752 hrtimer_interrupt+0x31b/0x800 kernel/time/hrtimer.c:1814 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1065 [inline] __sysvec_apic_timer_interrupt+0x105/0x400 arch/x86/kernel/apic/apic.c:1082 sysvec_apic_timer_interrupt+0x90/0xb0 arch/x86/kernel/apic/apic.c:1076 </IRQ> <TASK> asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:649 RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline] RIP: 0010:_raw_spin_unlock_irqrestore+0x31/0x70 kernel/locking/spinlock.c:194 Code: f5 53 48 8b 74 24 10 48 89 fb 48 83 c7 18 e8 86 37 e4 f6 48 89 df e8 ee ae e4 f6 f7 c5 00 02 00 00 75 1f 9c 58 f6 c4 02 75 2f <bf> 01 00 00 00 e8 25 68 d6 f6 65 8b 05 a6 10 81 75 85 c0 74 12 5b RSP: 0018:ffffc90003b0f738 EFLAGS: 00000246 RAX: 0000000000000006 RBX: ffff8880290ad9d0 RCX: 1ffffffff23ead8c RDX: 0000000000000000 RSI: ffffffff8acc9f40 RDI: ffffffff8b2ed3e0 RBP: 0000000000000246 R08: 0000000000000001 R09: fffffbfff23e1fe5 R10: ffffffff91f0ff2f R11: 0000000000000001 R12: ffff8880290ad9b8 R13: ffff8880177bda80 R14: 0000000000000246 R15: ffffc90003b0f8d8 spin_unlock_irqrestore include/linux/spinlock.h:406 [inline] __skb_try_recv_datagram+0x16f/0x4f0 net/core/datagram.c:266 __unix_dgram_recvmsg+0x1d1/0xee0 net/unix/af_unix.c:2383 unix_dgram_recvmsg+0xc3/0xf0 net/unix/af_unix.c:2485 sock_recvmsg_nosec net/socket.c:1044 [inline] ____sys_recvmsg+0x4ab/0x5c0 net/socket.c:2801 ___sys_recvmsg+0x115/0x1a0 net/socket.c:2845 do_recvmmsg+0x2af/0x740 net/socket.c:2939 __sys_recvmmsg net/socket.c:3018 [inline] __do_sys_recvmmsg net/socket.c:3041 [inline] __se_sys_recvmmsg net/socket.c:3034 [inline] __x64_sys_recvmmsg+0x235/0x290 net/socket.c:3034 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x40/0x110 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b RIP: 0033:0x7feb93a7cbe9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007feb948200c8 EFLAGS: 00000246 ORIG_RAX: 000000000000012b RAX: ffffffffffffffda RBX: 00007feb93b9c050 RCX: 00007feb93a7cbe9 RDX: 0000000000010106 RSI: 00000000200000c0 RDI: 0000000000000003 RBP: 00007feb93ac847a R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000 R13: 000000000000006e R14: 00007feb93b9c050 R15: 00007ffcb6b30bd8 </TASK> rcu: rcu_preempt kthread starved for 10496 jiffies! g60989 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=1 rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior. rcu: RCU grace-period kthread stack dump: task:rcu_preempt state:R running task stack:28024 pid:16 tgid:16 ppid:2 flags:0x00004000 Call Trace: <TASK> context_switch kernel/sched/core.c:5376 [inline] __schedule+0xedb/0x5af0 kernel/sched/core.c:6688 __schedule_loop kernel/sched/core.c:6763 [inline] schedule+0xe9/0x270 kernel/sched/core.c:6778 schedule_timeout+0x137/0x290 kernel/time/timer.c:2167 rcu_gp_fqs_loop+0x1ec/0xb10 kernel/rcu/tree.c:1631 rcu_gp_kthread+0x24b/0x380 kernel/rcu/tree.c:1830 kthread+0x2c6/0x3a0 kernel/kthread.c:388 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242 </TASK> rcu: Stack dump where RCU GP kthread last ran: CPU: 1 PID: 11 Comm: kworker/u4:1 Not tainted 6.7.0-rc6-syzkaller-00010-g2cf4f94d8e86 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 Workqueue: events_unbound toggle_allocation_gate RIP: 0010:csd_lock_wait kernel/smp.c:311 [inline] RIP: 0010:smp_call_function_many_cond+0x4e4/0x1550 kernel/smp.c:855 Code: 0b 00 85 ed 74 4d 48 b8 00 00 00 00 00 fc ff df 4d 89 f4 4c 89 f5 49 c1 ec 03 83 e5 07 49 01 c4 83 c5 03 e8 fe b6 0b 00 f3 90 <41> 0f b6 04 24 40 38 c5 7c 08 84 c0 0f 85 24 0e 00 00 8b 43 08 31 RSP: 0018:ffffc9000031f930 EFLAGS: 00000293 RAX: 0000000000000000 RBX: ffff8880b98414c0 RCX: ffffffff817aaaa8 RDX: ffff88801a66e080 RSI: ffffffff817aaa82 RDI: 0000000000000005 RBP: 0000000000000003 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000006 R12: ffffed1017308299 R13: 0000000000000001 R14: ffff8880b98414c8 R15: ffff8880b993d900 FS: 0000000000000000(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020015000 CR3: 000000000cd77000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <IRQ> </IRQ> <TASK> on_each_cpu_cond_mask+0x40/0x90 kernel/smp.c:1023 on_each_cpu include/linux/smp.h:71 [inline] text_poke_sync arch/x86/kernel/alternative.c:2006 [inline] text_poke_bp_batch+0x22b/0x750 arch/x86/kernel/alternative.c:2216 text_poke_flush arch/x86/kernel/alternative.c:2407 [inline] text_poke_flush arch/x86/kernel/alternative.c:2404 [inline] text_poke_finish+0x30/0x40 arch/x86/kernel/alternative.c:2414 arch_jump_label_transform_apply+0x1c/0x30 arch/x86/kernel/jump_label.c:146 jump_label_update+0x1d7/0x400 kernel/jump_label.c:829 static_key_enable_cpuslocked+0x1b7/0x270 kernel/jump_label.c:205 static_key_enable+0x1a/0x20 kernel/jump_label.c:218 toggle_allocation_gate mm/kfence/core.c:830 [inline] toggle_allocation_gate+0xf4/0x250 mm/kfence/core.c:822 process_one_work+0x886/0x15d0 kernel/workqueue.c:2627 process_scheduled_works kernel/workqueue.c:2700 [inline] worker_thread+0x8b9/0x1290 kernel/workqueue.c:2781 kthread+0x2c6/0x3a0 kernel/kthread.c:388 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242 </TASK> --- This report is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller(a)googlegroups.com. syzbot will keep track of this issue. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot. If the report is already addressed, let syzbot know by replying with: #syz fix: exact-commit-title If you want to overwrite report's subsystems, reply with: #syz set subsystems: new-subsystem (See the list of subsystem names on the web dashboard) If the report is a duplicate of another one, reply with: #syz dup: exact-subject-of-another-report If you want to undo deduplication, reply with: #syz undup

1 0

Re: bat0 not capable of MTU > 1500
by Rich Chase 14 Dec '23

14 Dec '23

I am trying to create an unimpeded path MTU of 1500 on my OpenWRT router (Belkin RT-3200). I built the firmware from git Master, with kernel version 6.1, and batman-adv version 2023.2. I have a batmesh hard-if device mastering an 802.1S mesh, which are both set to MTU=2304. Using Luci (OpenWRT web gui for uci), I set the MTU of bat0 to 1504 to accommodate .1q vlans on bat0 -- bat0.5, bat0.110, etc. I see in the system log: kern.err kernel: [751585.375855] bat0: mtu greater than device maximum Also, if I do: #> ip link set bat0 mtu 1504 I get: ip: SIOCSIFMTU: Invalid argument and if I test: #> ip link show bat0 ...it says that my mtu is 1500 still. For my life I can't see anything I'm doing wrong. Why can't bat0 have MTU greater than 1500? I don't have any other devices mastered by bat0, other than my .1s wifi mesh link. Throwing myself at your mercy. Help?

3 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

B.A.T.M.A.N December 2023