B.A.T.M.A.N May 2023

b.a.t.m.a.n@lists.open-mesh.org

4 participants
2 discussions

[PATCH] batman-adv: Broken sync while rescheduling delayed work
by Vladislav Efanov 26 May '23

26 May '23

Syzkaller got a lot of crashes like: KASAN: use-after-free Write in *_timers* All of these crashes point to the same memory area: The buggy address belongs to the object at ffff88801f870000 which belongs to the cache kmalloc-8k of size 8192 The buggy address is located 5320 bytes inside of 8192-byte region [ffff88801f870000, ffff88801f872000) This area belongs to : batadv_priv->batadv_priv_dat->delayed_work->timer_list The reason for these issues is the lack of synchronization. Delayed work (batadv_dat_purge) schedules new timer/work while the device is being deleted. As the result new timer/delayed work is set after cancel_delayed_work_sync() was called. So after the device is freed the timer list contains pointer to already freed memory. Found by Linux Verification Center (linuxtesting.org) with syzkaller. Fixes: 2f1dfbe18507 ("batman-adv: Distributed ARP Table - implement local storage") Signed-off-by: Vladislav Efanov <VEfanov(a)ispras.ru> --- net/batman-adv/distributed-arp-table.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/batman-adv/distributed-arp-table.c b/net/batman-adv/distributed-arp-table.c index 6968e55eb971..28a939d56090 100644 --- a/net/batman-adv/distributed-arp-table.c +++ b/net/batman-adv/distributed-arp-table.c @@ -101,7 +101,6 @@ static void batadv_dat_purge(struct work_struct *work); */ static void batadv_dat_start_timer(struct batadv_priv *bat_priv) { - INIT_DELAYED_WORK(&bat_priv->dat.work, batadv_dat_purge); queue_delayed_work(batadv_event_workqueue, &bat_priv->dat.work, msecs_to_jiffies(10000)); } @@ -819,6 +818,7 @@ int batadv_dat_init(struct batadv_priv *bat_priv) if (!bat_priv->dat.hash) return -ENOMEM; + INIT_DELAYED_WORK(&bat_priv->dat.work, batadv_dat_purge); batadv_dat_start_timer(bat_priv); batadv_tvlv_handler_register(bat_priv, batadv_dat_tvlv_ogm_handler_v1, -- 2.34.1

3 3

[syzbot] Monthly batman report (May 2023)
by syzbot 05 May '23

05 May '23

Hello batman maintainers/developers, This is a 31-day syzbot report for the batman subsystem. All related reports/information can be found at: https://syzkaller.appspot.com/upstream/s/batman During the period, 0 new issues were detected and 0 were fixed. In total, 7 issues are still open and 20 have been fixed so far. Some of the still happening issues: Ref Crashes Repro Title <1> 5238 Yes WARNING: ODEBUG bug in netdev_run_todo https://syzkaller.appspot.com/bug?extid=f9484b345f41843fc9a9 <2> 1372 Yes WARNING: ODEBUG bug in netdev_freemem (2) https://syzkaller.appspot.com/bug?extid=c4521ac872a4ccc3afec <3> 121 Yes INFO: rcu detected stall in batadv_nc_worker (3) https://syzkaller.appspot.com/bug?extid=69904c3b4a09e8fa2e1b --- This report is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller(a)googlegroups.com. To disable reminders for individual bugs, reply with the following command: #syz set <Ref> no-reminders To change bug's subsystems, reply with: #syz set <Ref> subsystems: new-subsystem You may send multiple commands in a single email message.

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

B.A.T.M.A.N May 2023