B.A.T.M.A.N

b.a.t.m.a.n@lists.open-mesh.org

14 participants
4305 discussions

[syzbot] [btrfs?] memory leak in corrupted
by syzbot 17 Jan '24

17 Jan '24

Hello, syzbot found the following issue on: HEAD commit: 052d534373b7 Merge tag 'exfat-for-6.8-rc1' of git://git.ke.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=14620debe80000 kernel config: https://syzkaller.appspot.com/x/.config?x=a7031f9e71583b4a dashboard link: https://syzkaller.appspot.com/bug?extid=ebe64cc5950868e77358 compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16a344c1e80000 Downloadable assets: disk image: https://storage.googleapis.com/syzbot-assets/82a7201eef4c/disk-052d5343.raw… vmlinux: https://storage.googleapis.com/syzbot-assets/ca12b4c31826/vmlinux-052d5343.… kernel image: https://storage.googleapis.com/syzbot-assets/3f07360ba5a8/bzImage-052d5343.… IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+ebe64cc5950868e77358(a)syzkaller.appspotmail.com BUG: memory leak unreferenced object 0xffff88811c71a980 (size 64): comm "syz-executor.7", pid 5063, jiffies 4294953937 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 20 8e 7e 1c 81 88 ff ff ........ .~..... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace (crc 9f8721dd): [<ffffffff815f7d53>] kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline] [<ffffffff815f7d53>] slab_post_alloc_hook mm/slub.c:3817 [inline] [<ffffffff815f7d53>] slab_alloc_node mm/slub.c:3860 [inline] [<ffffffff815f7d53>] kmalloc_trace+0x283/0x330 mm/slub.c:4007 [<ffffffff84aae617>] kmalloc include/linux/slab.h:590 [inline] [<ffffffff84aae617>] kzalloc include/linux/slab.h:711 [inline] [<ffffffff84aae617>] batadv_tvlv_handler_register+0xf7/0x2a0 net/batman-adv/tvlv.c:560 [<ffffffff84a8d09f>] batadv_mcast_init+0x4f/0xc0 net/batman-adv/multicast.c:1926 [<ffffffff84a895b9>] batadv_mesh_init+0x209/0x2f0 net/batman-adv/main.c:231 [<ffffffff84a9fa88>] batadv_softif_init_late+0x1f8/0x280 net/batman-adv/soft-interface.c:812 [<ffffffff83f48559>] register_netdevice+0x189/0xca0 net/core/dev.c:10188 [<ffffffff84a9f255>] batadv_softif_newlink+0x55/0x70 net/batman-adv/soft-interface.c:1088 [<ffffffff83f61dc0>] rtnl_newlink_create net/core/rtnetlink.c:3515 [inline] [<ffffffff83f61dc0>] __rtnl_newlink+0xb10/0xec0 net/core/rtnetlink.c:3735 [<ffffffff83f621bc>] rtnl_newlink+0x4c/0x70 net/core/rtnetlink.c:3748 [<ffffffff83f5cd1f>] rtnetlink_rcv_msg+0x22f/0x5b0 net/core/rtnetlink.c:6615 [<ffffffff84093291>] netlink_rcv_skb+0x91/0x1d0 net/netlink/af_netlink.c:2543 [<ffffffff84092242>] netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline] [<ffffffff84092242>] netlink_unicast+0x2c2/0x440 net/netlink/af_netlink.c:1367 [<ffffffff84092701>] netlink_sendmsg+0x341/0x690 net/netlink/af_netlink.c:1908 [<ffffffff83ef2912>] sock_sendmsg_nosec net/socket.c:730 [inline] [<ffffffff83ef2912>] __sock_sendmsg+0x52/0xa0 net/socket.c:745 [<ffffffff83ef5af4>] __sys_sendto+0x164/0x1e0 net/socket.c:2191 [<ffffffff83ef5b98>] __do_sys_sendto net/socket.c:2203 [inline] [<ffffffff83ef5b98>] __se_sys_sendto net/socket.c:2199 [inline] [<ffffffff83ef5b98>] __x64_sys_sendto+0x28/0x30 net/socket.c:2199 BUG: memory leak unreferenced object 0xffff88811c8561c0 (size 64): comm "syz-executor.0", pid 5062, jiffies 4294953941 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 20 ce 7e 1c 81 88 ff ff ........ .~..... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace (crc 7256c890): [<ffffffff815f7d53>] kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline] [<ffffffff815f7d53>] slab_post_alloc_hook mm/slub.c:3817 [inline] [<ffffffff815f7d53>] slab_alloc_node mm/slub.c:3860 [inline] [<ffffffff815f7d53>] kmalloc_trace+0x283/0x330 mm/slub.c:4007 [<ffffffff84aae617>] kmalloc include/linux/slab.h:590 [inline] [<ffffffff84aae617>] kzalloc include/linux/slab.h:711 [inline] [<ffffffff84aae617>] batadv_tvlv_handler_register+0xf7/0x2a0 net/batman-adv/tvlv.c:560 [<ffffffff84a8d09f>] batadv_mcast_init+0x4f/0xc0 net/batman-adv/multicast.c:1926 [<ffffffff84a895b9>] batadv_mesh_init+0x209/0x2f0 net/batman-adv/main.c:231 [<ffffffff84a9fa88>] batadv_softif_init_late+0x1f8/0x280 net/batman-adv/soft-interface.c:812 [<ffffffff83f48559>] register_netdevice+0x189/0xca0 net/core/dev.c:10188 [<ffffffff84a9f255>] batadv_softif_newlink+0x55/0x70 net/batman-adv/soft-interface.c:1088 [<ffffffff83f61dc0>] rtnl_newlink_create net/core/rtnetlink.c:3515 [inline] [<ffffffff83f61dc0>] __rtnl_newlink+0xb10/0xec0 net/core/rtnetlink.c:3735 [<ffffffff83f621bc>] rtnl_newlink+0x4c/0x70 net/core/rtnetlink.c:3748 [<ffffffff83f5cd1f>] rtnetlink_rcv_msg+0x22f/0x5b0 net/core/rtnetlink.c:6615 [<ffffffff84093291>] netlink_rcv_skb+0x91/0x1d0 net/netlink/af_netlink.c:2543 [<ffffffff84092242>] netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline] [<ffffffff84092242>] netlink_unicast+0x2c2/0x440 net/netlink/af_netlink.c:1367 [<ffffffff84092701>] netlink_sendmsg+0x341/0x690 net/netlink/af_netlink.c:1908 [<ffffffff83ef2912>] sock_sendmsg_nosec net/socket.c:730 [inline] [<ffffffff83ef2912>] __sock_sendmsg+0x52/0xa0 net/socket.c:745 [<ffffffff83ef5af4>] __sys_sendto+0x164/0x1e0 net/socket.c:2191 [<ffffffff83ef5b98>] __do_sys_sendto net/socket.c:2203 [inline] [<ffffffff83ef5b98>] __se_sys_sendto net/socket.c:2199 [inline] [<ffffffff83ef5b98>] __x64_sys_sendto+0x28/0x30 net/socket.c:2199 BUG: memory leak unreferenced object 0xffff88811cd88cc0 (size 64): comm "syz-executor.5", pid 5078, jiffies 4294953981 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 20 8e 05 1d 81 88 ff ff ........ ....... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace (crc a919e6d6): [<ffffffff815f7d53>] kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline] [<ffffffff815f7d53>] slab_post_alloc_hook mm/slub.c:3817 [inline] [<ffffffff815f7d53>] slab_alloc_node mm/slub.c:3860 [inline] [<ffffffff815f7d53>] kmalloc_trace+0x283/0x330 mm/slub.c:4007 [<ffffffff84aae617>] kmalloc include/linux/slab.h:590 [inline] [<ffffffff84aae617>] kzalloc include/linux/slab.h:711 [inline] [<ffffffff84aae617>] batadv_tvlv_handler_register+0xf7/0x2a0 net/batman-adv/tvlv.c:560 [<ffffffff84a8d09f>] batadv_mcast_init+0x4f/0xc0 net/batman-adv/multicast.c:1926 [<ffffffff84a895b9>] batadv_mesh_init+0x209/0x2f0 net/batman-adv/main.c:231 [<ffffffff84a9fa88>] batadv_softif_init_late+0x1f8/0x280 net/batman-adv/soft-interface.c:812 [<ffffffff83f48559>] register_netdevice+0x189/0xca0 net/core/dev.c:10188 [<ffffffff84a9f255>] batadv_softif_newlink+0x55/0x70 net/batman-adv/soft-interface.c:1088 [<ffffffff83f61dc0>] rtnl_newlink_create net/core/rtnetlink.c:3515 [inline] [<ffffffff83f61dc0>] __rtnl_newlink+0xb10/0xec0 net/core/rtnetlink.c:3735 [<ffffffff83f621bc>] rtnl_newlink+0x4c/0x70 net/core/rtnetlink.c:3748 [<ffffffff83f5cd1f>] rtnetlink_rcv_msg+0x22f/0x5b0 net/core/rtnetlink.c:6615 [<ffffffff84093291>] netlink_rcv_skb+0x91/0x1d0 net/netlink/af_netlink.c:2543 [<ffffffff84092242>] netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline] [<ffffffff84092242>] netlink_unicast+0x2c2/0x440 net/netlink/af_netlink.c:1367 [<ffffffff84092701>] netlink_sendmsg+0x341/0x690 net/netlink/af_netlink.c:1908 [<ffffffff83ef2912>] sock_sendmsg_nosec net/socket.c:730 [inline] [<ffffffff83ef2912>] __sock_sendmsg+0x52/0xa0 net/socket.c:745 [<ffffffff83ef5af4>] __sys_sendto+0x164/0x1e0 net/socket.c:2191 [<ffffffff83ef5b98>] __do_sys_sendto net/socket.c:2203 [inline] [<ffffffff83ef5b98>] __se_sys_sendto net/socket.c:2199 [inline] [<ffffffff83ef5b98>] __x64_sys_sendto+0x28/0x30 net/socket.c:2199 --- This report is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller(a)googlegroups.com. syzbot will keep track of this issue. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot. If the report is already addressed, let syzbot know by replying with: #syz fix: exact-commit-title If you want syzbot to run the reproducer, reply with: #syz test: git://repo/address.git branch-or-commit-hash If you attach or paste a git patch, syzbot will apply it before testing. If you want to overwrite report's subsystems, reply with: #syz set subsystems: new-subsystem (See the list of subsystem names on the web dashboard) If the report is a duplicate of another one, reply with: #syz dup: exact-subject-of-another-report If you want to undo deduplication, reply with: #syz undup

2 3

[PATCH] batman-adv: mcast: fix memory leak on deleting a batman-adv interface
by Linus Lüssing 17 Jan '24

17 Jan '24

The batman-adv multicast tracker TVLV handler is registered for the new batman-adv multicast packet type upon creating a batman-adv interface, but not unregistered again upon the interface's deletion, leading to a memory leak. Fix this memory leak by calling the according TVLV handler unregister routine for the multicast tracker TVLV upon batman-adv interface deletion. Fixes: 8ed36122d709 ("batman-adv: mcast: implement multicast packet reception and forwarding") Reported-by: syzbot+ebe64cc5950868e77358(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/000000000000beadc4060f0cbc23@google.com/ Signed-off-by: Linus Lüssing <linus.luessing(a)c0d3.blue> --- net/batman-adv/multicast.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/batman-adv/multicast.c b/net/batman-adv/multicast.c index c8620905c2dc..38fab5e46ae2 100644 --- a/net/batman-adv/multicast.c +++ b/net/batman-adv/multicast.c @@ -2183,6 +2183,7 @@ void batadv_mcast_free(struct batadv_priv *bat_priv) cancel_delayed_work_sync(&bat_priv->mcast.work); batadv_tvlv_container_unregister(bat_priv, BATADV_TVLV_MCAST, 2); + batadv_tvlv_handler_unregister(bat_priv, BATADV_TVLV_MCAST_TRACKER, 1); batadv_tvlv_handler_unregister(bat_priv, BATADV_TVLV_MCAST, 2); /* safely calling outside of worker, as worker was canceled above */ -- 2.43.0

1 0

[PATCH v2] batman-adv: Drop support for Linux < 4.19
by Sven Eckelmann 10 Jan '24

10 Jan '24

The Linux Kernel 4.14 reached its end of life [1] after 6 years. Instead it is recommended to use at least kernel 4.19. It is also over 5 years old but still maintained by the stable kernel team. All older kernels (4.14 - v4.18) will be dropped to reduce the support overhead. [1] https://lore.kernel.org/r/2024011046-ecology-tiptoeing-ce50@gregkh/ Signed-off-by: Sven Eckelmann <sven(a)narfation.org> --- Changes in v2: - Add EOL announcement URL to commit message - Fix conflict in README.external.rst - Link to v1: https://lore.kernel.org/r/20231104-drop-compat-4-14-v1-1-d2453b1cfd45@narfa… --- README.external.rst | 2 +- compat-include/linux/netdevice.h | 8 -------- compat-include/linux/stddef.h | 24 ------------------------ compat-include/net/cfg80211.h | 40 ---------------------------------------- compat-include/net/genetlink.h | 18 ------------------ compat.h | 7 ------- 6 files changed, 1 insertion(+), 98 deletions(-) diff --git a/README.external.rst b/README.external.rst index 3b014af8..4e1de973 100644 --- a/README.external.rst +++ b/README.external.rst @@ -12,7 +12,7 @@ and as an external module. The external module allows to get new features without upgrading to a newer kernel version and to get batman-adv specific bug fixes for kernels that are not supported anymore. It compiles against and should work -with Linux 4.14 - 6.7. Supporting older versions is not +with Linux 4.19 - 6.7. Supporting older versions is not planned, but it's probably easy to backport it. If you work on a backport, feel free to contact us. :-) diff --git a/compat-include/linux/netdevice.h b/compat-include/linux/netdevice.h index 3188ad3d..a489ac9b 100644 --- a/compat-include/linux/netdevice.h +++ b/compat-include/linux/netdevice.h @@ -13,14 +13,6 @@ #include <linux/version.h> #include_next <linux/netdevice.h> -#if LINUX_VERSION_IS_LESS(4, 15, 0) - -#define netdev_master_upper_dev_link(dev, upper_dev, upper_priv, upper_info, extack) \ - netdev_master_upper_dev_link(dev, upper_dev, upper_priv, upper_info) - -#endif /* LINUX_VERSION_IS_LESS(4, 15, 0) */ - - #if LINUX_VERSION_IS_LESS(5, 15, 0) static inline void batadv_dev_put(struct net_device *dev) diff --git a/compat-include/linux/stddef.h b/compat-include/linux/stddef.h deleted file mode 100644 index c4558f81..00000000 --- a/compat-include/linux/stddef.h +++ /dev/null @@ -1,24 +0,0 @@ -/* SPDX-License-Identifier: GPL-2.0 */ -/* Copyright (C) B.A.T.M.A.N. contributors: - * - * Marek Lindner, Simon Wunderlich - * - * This file contains macros for maintaining compatibility with older versions - * of the Linux kernel. - */ - -#ifndef _NET_BATMAN_ADV_COMPAT_LINUX_STDDEF_H_ -#define _NET_BATMAN_ADV_COMPAT_LINUX_STDDEF_H_ - -#include <linux/version.h> -#include_next <linux/stddef.h> - -#if LINUX_VERSION_IS_LESS(4, 16, 0) - -#ifndef sizeof_field -#define sizeof_field(TYPE, MEMBER) sizeof((((TYPE *)0)->MEMBER)) -#endif - -#endif /* LINUX_VERSION_IS_LESS(4, 16, 0) */ - -#endif /* _NET_BATMAN_ADV_COMPAT_LINUX_STDDEF_H_ */ diff --git a/compat-include/net/cfg80211.h b/compat-include/net/cfg80211.h deleted file mode 100644 index 4bfcd5a3..00000000 --- a/compat-include/net/cfg80211.h +++ /dev/null @@ -1,40 +0,0 @@ -/* SPDX-License-Identifier: GPL-2.0 */ -/* Copyright (C) B.A.T.M.A.N. contributors: - * - * Marek Lindner, Simon Wunderlich - * - * This file contains macros for maintaining compatibility with older versions - * of the Linux kernel. - */ - -#ifndef _NET_BATMAN_ADV_COMPAT_NET_CFG80211_H_ -#define _NET_BATMAN_ADV_COMPAT_NET_CFG80211_H_ - -#include <linux/version.h> -#include_next <net/cfg80211.h> - - -#if LINUX_VERSION_IS_LESS(4, 18, 0) && IS_ENABLED(CONFIG_CFG80211) - -/* cfg80211 fix: https://patchwork.kernel.org/patch/10449857/ */ -static inline int batadv_cfg80211_get_station(struct net_device *dev, - const u8 *mac_addr, - struct station_info *sinfo) -{ - memset(sinfo, 0, sizeof(*sinfo)); - return cfg80211_get_station(dev, mac_addr, sinfo); -} - -#define cfg80211_get_station(dev, mac_addr, sinfo) \ - batadv_cfg80211_get_station(dev, mac_addr, sinfo) - -#endif /* LINUX_VERSION_IS_LESS(4, 18, 0) && IS_ENABLED(CONFIG_CFG80211) */ - - -#if LINUX_VERSION_IS_LESS(4, 18, 0) - -#define cfg80211_sinfo_release_content(sinfo) - -#endif /* LINUX_VERSION_IS_LESS(4, 18, 0) */ - -#endif /* _NET_BATMAN_ADV_COMPAT_NET_CFG80211_H_ */ diff --git a/compat-include/net/genetlink.h b/compat-include/net/genetlink.h index 05c57ce0..85376044 100644 --- a/compat-include/net/genetlink.h +++ b/compat-include/net/genetlink.h @@ -13,24 +13,6 @@ #include <linux/version.h> #include_next <net/genetlink.h> -#if LINUX_VERSION_IS_LESS(4, 15, 0) - -static inline -void batadv_genl_dump_check_consistent(struct netlink_callback *cb, - void *user_hdr) -{ - struct genl_family genl_family = { - .hdrsize = 0, - }; - - genl_dump_check_consistent(cb, user_hdr, &genl_family); -} - -#define genl_dump_check_consistent batadv_genl_dump_check_consistent - -#endif /* LINUX_VERSION_IS_LESS(4, 15, 0) */ - - #if LINUX_VERSION_IS_LESS(5, 10, 0) #if LINUX_VERSION_IS_LESS(5, 2, 0) diff --git a/compat.h b/compat.h index 8e19f9bb..638bfc54 100644 --- a/compat.h +++ b/compat.h @@ -16,13 +16,6 @@ #include "compat-autoconf.h" -#if LINUX_VERSION_IS_LESS(4, 15, 0) - -#define batadv_softif_slave_add(__dev, __slave_dev, __extack) \ - batadv_softif_slave_add(__dev, __slave_dev) - -#endif /* LINUX_VERSION_IS_LESS(4, 15, 0) */ - #endif /* __KERNEL__ */ #endif /* _NET_BATMAN_ADV_COMPAT_H_ */ --- base-commit: e6fbde1250b73c3c9f49fc5a22ad9a8b10f864d5 change-id: 20231104-drop-compat-4-14-1bba04bac963 Best regards, -- Sven Eckelmann <sven(a)narfation.org>

1 0

[PATCH] batman-adv: mcast: fix mcast packet type counter on timeouted nodes
by Linus Lüssing 09 Jan '24

09 Jan '24

When a node which does not have the new batman-adv multicast packet type capability vanishes then the according, global counter erroneously would not be reduced in response on other nodes. Which in turn leads to the mesh never switching back to sending with the new multicast packet type. Fix this by reducing the according counter when such a node times out. Fixes: be9b0169c840 ("batman-adv: mcast: implement multicast packet generation") Signed-off-by: Linus Lüssing <linus.luessing(a)c0d3.blue> --- net/batman-adv/multicast.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/batman-adv/multicast.c b/net/batman-adv/multicast.c index 2981a2ed40cb..c8620905c2dc 100644 --- a/net/batman-adv/multicast.c +++ b/net/batman-adv/multicast.c @@ -2206,6 +2206,8 @@ void batadv_mcast_purge_orig(struct batadv_orig_node *orig) BATADV_MCAST_WANT_NO_RTR4); batadv_mcast_want_rtr6_update(bat_priv, orig, BATADV_MCAST_WANT_NO_RTR6); + batadv_mcast_have_mc_ptype_update(bat_priv, orig, + BATADV_MCAST_HAVE_MC_PTYPE_CAPA); spin_unlock_bh(&orig->mcast_handler_lock); } -- 2.43.0

1 0

[PATCH 0/2] batman-adv: Adjustments for two function implementations
by Markus Elfring 02 Jan '24

02 Jan '24

From: Markus Elfring <elfring(a)users.sourceforge.net> Date: Tue, 2 Jan 2024 08:02:01 +0100 A few update suggestions were taken into account from static source code analysis. Markus Elfring (2): Return directly after a failed batadv_dat_select_candidates() in batadv_dat_forward_data() Improve exception handling in batadv_throw_uevent() net/batman-adv/distributed-arp-table.c | 3 +-- net/batman-adv/main.c | 14 ++++++++------ 2 files changed, 9 insertions(+), 8 deletions(-) -- 2.43.0

2 4

[PATCH] batman-adv: compat: Fix skb_vlan_eth_hdr conflict in stable kernels
by Sven Eckelmann 23 Dec '23

23 Dec '23

The newest Linux stable kernel releases: * v5.10.205 * v5.15.144 * v6.1.69 received a backported version of commit 1f5020acb33f ("net: vlan: introduce skb_vlan_eth_hdr()"). batman-adv must therefore not provide this function any longer for these kernel versions. Signed-off-by: Sven Eckelmann <sven(a)narfation.org> --- compat-include/linux/if_vlan.h | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/compat-include/linux/if_vlan.h b/compat-include/linux/if_vlan.h index eb15e060..f19674b5 100644 --- a/compat-include/linux/if_vlan.h +++ b/compat-include/linux/if_vlan.h @@ -13,7 +13,10 @@ #include <linux/version.h> #include_next <linux/if_vlan.h> -#if LINUX_VERSION_IS_LESS(6, 4, 0) +#if LINUX_VERSION_IS_LESS(6, 4, 0) && \ + !(LINUX_VERSION_IS_GEQ(5, 10, 205) && LINUX_VERSION_IS_LESS(5, 11, 0)) && \ + !(LINUX_VERSION_IS_GEQ(5, 15, 144) && LINUX_VERSION_IS_LESS(5, 16, 0)) && \ + !(LINUX_VERSION_IS_GEQ(6, 1, 69) && LINUX_VERSION_IS_LESS(6, 2, 0)) /* Prefer this version in TX path, instead of * skb_reset_mac_header() + vlan_eth_hdr() --- base-commit: f33d7f724675544a36b24c77f8d4b95d41252ae2 change-id: 20231223-compat-skb_vlan_eth_hdr-deabef2d774c Best regards, -- Sven Eckelmann <sven(a)narfation.org>

1 0

Fwd: Fwd: memory leak in batadv_iv_ogm_aggregate_new
by Jinho Ju 21 Dec '23

21 Dec '23

---------- Forwarded message --------- 보낸사람: Jinho Ju <wnwlsgh98(a)gmail.com> Date: 2023년 12월 21일 (목) 오후 2:52 Subject: Re: Fwd: memory leak in batadv_iv_ogm_aggregate_new To: Sven Eckelmann <sven(a)narfation.org>, <b.a.t.m.a.n(a)lists.open-mesh.org> Cc: <mareklindner(a)neomailbox.ch>, <sw(a)simonwunderlich.de>, <a(a)unstable.cc> Resending to everyone on the mailing list as per previous mail, adding some things that were missing. Regarding the cause of the L2-related crash being detected by syzkaller, I can't say for sure - what I can say for sure at this point is that a memleak occurring in L2 was detected by my personal syzkaller. Moving away from syzkaller for a moment and shifting the focus to memleak, we have to assume that the conditions for this to occur are that they reference the same network stack and are found in modules in L2, but it seems that when batman-adv is freed and returned while accessing and processing a skb in veth (L3), memleak occurs because it is trying to reference the same skb, the veth freed skb. I'm keeping an eye on 'static netdev_tx_t veth_xmit()' as a related function, but for now, the above flow seems to be the most obvious as the root cause. Jinho Ju, Thanks. 2023년 12월 19일 (화) 오후 7:09, Sven Eckelmann <sven(a)narfation.org>님이 작성: > > On Tuesday, 19 December 2023 08:30:47 CET Jinho Ju wrote: > > ---------- Forwarded message --------- > > 보낸사람: Jinho Ju <wnwlsgh98(a)gmail.com> > > Date: 2023년 12월 19일 (화) 오후 1:58 > > Subject: memory leak in batadv_iv_ogm_aggregate_new > > To: <security(a)kernel.org> > > > > > > Hello, I am "Jinho Ju" who is studying about Kernel security in Korea. > > A "*memory leak in batadv_iv_ogm_aggregate_new*" was reported in Syzkaller > > targeting 6.7-rc6 on December 19, 2023 at 02:03. > > The environment in which this bug was detected is as follows. > > Syzkaller version: 3222d10c > > Kernel version: LInux kernel 6.7-rc6 > > The report provided by Syzkaller is as follows. > > > Thanks. But why isn't this coordinated through the "normal" syzkaller > instance? [1] > > Also when looking at these backtraces, I am not sure if we are the correct > recipients - but please correct me. Take as easy example > batadv_iv_ogm_send_to_if. This function does a clone and immediately sends it > via batadv_send_broadcast_skb. At the end, it goes through > batadv_send_skb_packet - a function which either does a kfree_skb or a > dev_queue_xmit. A function (__dev_queue_xmit) which has in its description: > > Regardless of the return value, the skb is consumed > > So I would assume that something which consumes packets from this queue (so > the sb_dev) is not actually doing its job correctly and leaking frames. So in > my opinion, it is necessary to figure out what tried to handle the skb after > it left batman-adv. Which would involve information like the underlying > interfaces. > > If I read the reproducer correctly, veth pairs are used as underlying interfaces. > > But the setup is so convoluted with vlan, macvlan, hwsim, xfrm, macvtap, ... > I don't see a l2 link between these other interfaces (only L3) but I could be > wrong. So it would be necessary to reduce this complexity heavily to figure > out what is not cleaning up the supplied skbuff. > > I should most likely study the reproducer more but my current assumption is > that you would end up with backtraces that look like veth is leaking skbs when > you modify veth.c like this: > > diff --git a/drivers/net/veth.c b/drivers/net/veth.c > index 977861c46b1f..1d86e3869c77 100644 > --- a/drivers/net/veth.c > +++ b/drivers/net/veth.c > @@ -344,12 +344,22 @@ static netdev_tx_t veth_xmit(struct sk_buff *skb, struct net_device *dev) > { > struct veth_priv *rcv_priv, *priv = netdev_priv(dev); > struct veth_rq *rq = NULL; > + struct sk_buff *hack_skb; > int ret = NETDEV_TX_OK; > struct net_device *rcv; > int length = skb->len; > bool use_napi = false; > int rxq; > > + hack_skb = skb_clone(skb, GFP_ATOMIC); > + if (!hack_skb) { > + kfree_skb(skb); > + return NET_XMIT_DROP; > + } > + > + consume_skb(skb); > + skb = hack_skb; > + > rcu_read_lock(); > rcv = rcu_dereference(priv->peer); > if (unlikely(!rcv) || !pskb_may_pull(skb, ETH_HLEN)) { > > But there is also a chance that actually net/dev/core.c is leaking it and it > never reaches the veth driver. > > > I also don't get why we were contacted in private and why the kernel security > list was involved in the first place. > > Kind regards, > Sven >

2 1

Fwd: memory leak in batadv_iv_ogm_aggregate_new
by Jinho Ju 21 Dec '23

21 Dec '23

---------- Forwarded message --------- 보낸사람: Jinho Ju <wnwlsgh98(a)gmail.com> Date: 2023년 12월 19일 (화) 오후 1:58 Subject: memory leak in batadv_iv_ogm_aggregate_new To: <security(a)kernel.org> Hello, I am "Jinho Ju" who is studying about Kernel security in Korea. A "*memory leak in batadv_iv_ogm_aggregate_new*" was reported in Syzkaller targeting 6.7-rc6 on December 19, 2023 at 02:03. The environment in which this bug was detected is as follows. Syzkaller version: 3222d10c Kernel version: LInux kernel 6.7-rc6 The report provided by Syzkaller is as follows. ============================================================================================================ Syzkaller hit 'memory leak in batadv_iv_ogm_aggregate_new' bug. BUG: memory leak unreferenced object 0xffff8881104a6640 (size 240): comm "kworker/u4:3", pid 9303, jiffies 4295071144 (age 12.160s) hex dump (first 32 bytes): 00 64 54 0a 81 88 ff ff 57 24 00 00 ee 04 0c 07 .dT.....W$...... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<ffffffff81daae1e>] kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline] [<ffffffff81daae1e>] slab_post_alloc_hook mm/slab.h:766 [inline] [<ffffffff81daae1e>] slab_alloc_node mm/slab.c:3237 [inline] [<ffffffff81daae1e>] kmem_cache_alloc_node+0x20e/0x510 mm/slab.c:3509 [<ffffffff885623ba>] __alloc_skb+0x28a/0x330 net/core/skbuff.c:641 [<ffffffff8856d704>] __netdev_alloc_skb+0x74/0x400 net/core/skbuff.c:715 [<ffffffff8a2bf706>] __netdev_alloc_skb_ip_align include/linux/skbuff.h:3245 [inline] [<ffffffff8a2bf706>] netdev_alloc_skb_ip_align include/linux/skbuff.h:3255 [inline] [<ffffffff8a2bf706>] batadv_iv_ogm_aggregate_new+0x106/0x4b0 net/batman-adv/bat_iv_ogm.c:558 [<ffffffff8a2c55b3>] batadv_iv_ogm_queue_add net/batman-adv/bat_iv_ogm.c:670 [inline] [<ffffffff8a2c55b3>] batadv_iv_ogm_schedule_buff+0x983/0x14b0 net/batman-adv/bat_iv_ogm.c:833 [<ffffffff8a2c6413>] batadv_iv_ogm_schedule net/batman-adv/bat_iv_ogm.c:868 [inline] [<ffffffff8a2c6413>] batadv_iv_ogm_schedule net/batman-adv/bat_iv_ogm.c:861 [inline] [<ffffffff8a2c6413>] batadv_iv_send_outstanding_bat_ogm_packet+0x333/0x930 net/batman-adv/bat_iv_ogm.c:1712 [<ffffffff8154b0c8>] process_one_work+0x878/0x15c0 kernel/workqueue.c:2627 [<ffffffff8154c665>] process_scheduled_works kernel/workqueue.c:2700 [inline] [<ffffffff8154c665>] worker_thread+0x855/0x1200 kernel/workqueue.c:2781 [<ffffffff8156bf0c>] kthread+0x2cc/0x3b0 kernel/kthread.c:388 [<ffffffff812fb685>] ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 [<ffffffff81004b71>] ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242 BUG: memory leak unreferenced object 0xffff888109b6c800 (size 1024): comm "kworker/u4:3", pid 9303, jiffies 4295071144 (age 12.170s) hex dump (first 32 bytes): 40 66 4a 10 81 88 ff ff 57 24 00 00 ee 04 03 07 @fJ.....W$...... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<ffffffff81dacac3>] kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline] [<ffffffff81dacac3>] slab_post_alloc_hook mm/slab.h:766 [inline] [<ffffffff81dacac3>] slab_alloc_node mm/slab.c:3237 [inline] [<ffffffff81dacac3>] __kmem_cache_alloc_node+0x1e3/0x4c0 mm/slab.c:3521 [<ffffffff81c12d0e>] __do_kmalloc_node mm/slab_common.c:1006 [inline] [<ffffffff81c12d0e>] __kmalloc_node_track_caller+0x4e/0xd0 mm/slab_common.c:1027 [<ffffffff8855979d>] kmalloc_reserve+0xed/0x260 net/core/skbuff.c:582 [<ffffffff88562259>] __alloc_skb+0x129/0x330 net/core/skbuff.c:651 [<ffffffff8856d704>] __netdev_alloc_skb+0x74/0x400 net/core/skbuff.c:715 [<ffffffff8a2bf706>] __netdev_alloc_skb_ip_align include/linux/skbuff.h:3245 [inline] [<ffffffff8a2bf706>] netdev_alloc_skb_ip_align include/linux/skbuff.h:3255 [inline] [<ffffffff8a2bf706>] batadv_iv_ogm_aggregate_new+0x106/0x4b0 net/batman-adv/bat_iv_ogm.c:558 [<ffffffff8a2c55b3>] batadv_iv_ogm_queue_add net/batman-adv/bat_iv_ogm.c:670 [inline] [<ffffffff8a2c55b3>] batadv_iv_ogm_schedule_buff+0x983/0x14b0 net/batman-adv/bat_iv_ogm.c:833 [<ffffffff8a2c6413>] batadv_iv_ogm_schedule net/batman-adv/bat_iv_ogm.c:868 [inline] [<ffffffff8a2c6413>] batadv_iv_ogm_schedule net/batman-adv/bat_iv_ogm.c:861 [inline] [<ffffffff8a2c6413>] batadv_iv_send_outstanding_bat_ogm_packet+0x333/0x930 net/batman-adv/bat_iv_ogm.c:1712 [<ffffffff8154b0c8>] process_one_work+0x878/0x15c0 kernel/workqueue.c:2627 [<ffffffff8154c665>] process_scheduled_works kernel/workqueue.c:2700 [inline] [<ffffffff8154c665>] worker_thread+0x855/0x1200 kernel/workqueue.c:2781 [<ffffffff8156bf0c>] kthread+0x2cc/0x3b0 kernel/kthread.c:388 [<ffffffff812fb685>] ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 [<ffffffff81004b71>] ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242 BUG: memory leak unreferenced object 0xffff88810a546400 (size 512): comm "kworker/u4:3", pid 9303, jiffies 4295071144 (age 12.170s) hex dump (first 32 bytes): 18 41 68 12 81 88 ff ff 57 24 00 00 ee 04 15 07 .Ah.....W$...... 00 00 00 00 00 00 00 00 10 64 54 0a 81 88 ff ff .........dT..... backtrace: [<ffffffff81dacac3>] kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline] [<ffffffff81dacac3>] slab_post_alloc_hook mm/slab.h:766 [inline] [<ffffffff81dacac3>] slab_alloc_node mm/slab.c:3237 [inline] [<ffffffff81dacac3>] __kmem_cache_alloc_node+0x1e3/0x4c0 mm/slab.c:3521 [<ffffffff81c12436>] kmalloc_trace+0x26/0x60 mm/slab_common.c:1098 [<ffffffff8a32b710>] kmalloc include/linux/slab.h:600 [inline] [<ffffffff8a32b710>] batadv_forw_packet_alloc+0x3b0/0x4d0 net/batman-adv/send.c:519 [<ffffffff8a2bf734>] batadv_iv_ogm_aggregate_new+0x134/0x4b0 net/batman-adv/bat_iv_ogm.c:562 [<ffffffff8a2c55b3>] batadv_iv_ogm_queue_add net/batman-adv/bat_iv_ogm.c:670 [inline] [<ffffffff8a2c55b3>] batadv_iv_ogm_schedule_buff+0x983/0x14b0 net/batman-adv/bat_iv_ogm.c:833 [<ffffffff8a2c6413>] batadv_iv_ogm_schedule net/batman-adv/bat_iv_ogm.c:868 [inline] [<ffffffff8a2c6413>] batadv_iv_ogm_schedule net/batman-adv/bat_iv_ogm.c:861 [inline] [<ffffffff8a2c6413>] batadv_iv_send_outstanding_bat_ogm_packet+0x333/0x930 net/batman-adv/bat_iv_ogm.c:1712 [<ffffffff8154b0c8>] process_one_work+0x878/0x15c0 kernel/workqueue.c:2627 [<ffffffff8154c665>] process_scheduled_works kernel/workqueue.c:2700 [inline] [<ffffffff8154c665>] worker_thread+0x855/0x1200 kernel/workqueue.c:2781 [<ffffffff8156bf0c>] kthread+0x2cc/0x3b0 kernel/kthread.c:388 [<ffffffff812fb685>] ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 [<ffffffff81004b71>] ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242 BUG: memory leak unreferenced object 0xffff88801c47d580 (size 240): comm "kworker/u4:3", pid 9303, jiffies 4295071249 (age 11.120s) hex dump (first 32 bytes): 00 c8 b6 09 81 88 ff ff 57 24 00 00 44 05 d7 06 ........W$..D... 00 e0 ee 06 81 88 ff ff 00 00 00 00 00 00 00 00 ................ backtrace: [<ffffffff81daaac5>] kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline] [<ffffffff81daaac5>] slab_post_alloc_hook mm/slab.h:766 [inline] [<ffffffff81daaac5>] slab_alloc_node mm/slab.c:3237 [inline] [<ffffffff81daaac5>] slab_alloc mm/slab.c:3246 [inline] [<ffffffff81daaac5>] __kmem_cache_alloc_lru mm/slab.c:3423 [inline] [<ffffffff81daaac5>] kmem_cache_alloc+0x295/0x3e0 mm/slab.c:3432 [<ffffffff88573455>] skb_clone+0x145/0x3d0 net/core/skbuff.c:1916 [<ffffffff8a2c661d>] batadv_iv_ogm_send_to_if net/batman-adv/bat_iv_ogm.c:387 [inline] [<ffffffff8a2c661d>] batadv_iv_ogm_emit net/batman-adv/bat_iv_ogm.c:420 [inline] [<ffffffff8a2c661d>] batadv_iv_send_outstanding_bat_ogm_packet+0x53d/0x930 net/batman-adv/bat_iv_ogm.c:1700 [<ffffffff8154b0c8>] process_one_work+0x878/0x15c0 kernel/workqueue.c:2627 [<ffffffff8154c665>] process_scheduled_works kernel/workqueue.c:2700 [inline] [<ffffffff8154c665>] worker_thread+0x855/0x1200 kernel/workqueue.c:2781 [<ffffffff8156bf0c>] kthread+0x2cc/0x3b0 kernel/kthread.c:388 [<ffffffff812fb685>] ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 [<ffffffff81004b71>] ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242 BUG: memory leak unreferenced object 0xffff88810f01b480 (size 240): comm "softirq", pid 0, jiffies 4295071837 (age 10.950s) hex dump (first 32 bytes): 80 86 e7 17 81 88 ff ff 00 00 00 00 67 05 9c 06 ............g... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<ffffffff81daae1e>] kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline] [<ffffffff81daae1e>] slab_post_alloc_hook mm/slab.h:766 [inline] [<ffffffff81daae1e>] slab_alloc_node mm/slab.c:3237 [inline] [<ffffffff81daae1e>] kmem_cache_alloc_node+0x20e/0x510 mm/slab.c:3509 [<ffffffff885623ba>] __alloc_skb+0x28a/0x330 net/core/skbuff.c:641 [<ffffffff8856d704>] __netdev_alloc_skb+0x74/0x400 net/core/skbuff.c:715 [<ffffffff89e93c53>] netdev_alloc_skb include/linux/skbuff.h:3225 [inline] [<ffffffff89e93c53>] dev_alloc_skb include/linux/skbuff.h:3238 [inline] [<ffffffff89e93c53>] __ieee80211_beacon_get+0xbf3/0x1680 net/mac80211/tx.c:5445 [<ffffffff89e948f6>] ieee80211_beacon_get_tim+0xa6/0x280 net/mac80211/tx.c:5567 [<ffffffff864c017e>] ieee80211_beacon_get include/net/mac80211.h:5442 [inline] [<ffffffff864c017e>] mac80211_hwsim_beacon_tx+0x40e/0x750 drivers/net/wireless/virtual/mac80211_hwsim.c:2260 [<ffffffff89eb6bd8>] __iterate_interfaces+0x2c8/0x570 net/mac80211/util.c:767 [<ffffffff89ebdc11>] ieee80211_iterate_active_interfaces_atomic+0x71/0x1b0 net/mac80211/util.c:803 [<ffffffff864a2c51>] mac80211_hwsim_beacon+0x101/0x200 drivers/net/wireless/virtual/mac80211_hwsim.c:2290 [<ffffffff8174ea54>] __run_hrtimer kernel/time/hrtimer.c:1688 [inline] [<ffffffff8174ea54>] __hrtimer_run_queues+0x604/0xc10 kernel/time/hrtimer.c:1752 [<ffffffff8174f1df>] hrtimer_run_softirq+0x17f/0x350 kernel/time/hrtimer.c:1769 [<ffffffff8a6b2774>] __do_softirq+0x1d4/0x85e kernel/softirq.c:553 BUG: memory leak unreferenced object 0xffff88811de3bc80 (size 640): comm "softirq", pid 0, jiffies 4295071837 (age 10.950s) hex dump (first 32 bytes): 80 b4 01 0f 81 88 ff ff 00 00 00 00 67 05 92 06 ............g... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<ffffffff81daae1e>] kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline] [<ffffffff81daae1e>] slab_post_alloc_hook mm/slab.h:766 [inline] [<ffffffff81daae1e>] slab_alloc_node mm/slab.c:3237 [inline] [<ffffffff81daae1e>] kmem_cache_alloc_node+0x20e/0x510 mm/slab.c:3509 [<ffffffff88559813>] kmalloc_reserve+0x163/0x260 net/core/skbuff.c:560 [<ffffffff88562259>] __alloc_skb+0x129/0x330 net/core/skbuff.c:651 [<ffffffff8856d704>] __netdev_alloc_skb+0x74/0x400 net/core/skbuff.c:715 [<ffffffff89e93c53>] netdev_alloc_skb include/linux/skbuff.h:3225 [inline] [<ffffffff89e93c53>] dev_alloc_skb include/linux/skbuff.h:3238 [inline] [<ffffffff89e93c53>] __ieee80211_beacon_get+0xbf3/0x1680 net/mac80211/tx.c:5445 [<ffffffff89e948f6>] ieee80211_beacon_get_tim+0xa6/0x280 net/mac80211/tx.c:5567 [<ffffffff864c017e>] ieee80211_beacon_get include/net/mac80211.h:5442 [inline] [<ffffffff864c017e>] mac80211_hwsim_beacon_tx+0x40e/0x750 drivers/net/wireless/virtual/mac80211_hwsim.c:2260 [<ffffffff89eb6bd8>] __iterate_interfaces+0x2c8/0x570 net/mac80211/util.c:767 [<ffffffff89ebdc11>] ieee80211_iterate_active_interfaces_atomic+0x71/0x1b0 net/mac80211/util.c:803 [<ffffffff864a2c51>] mac80211_hwsim_beacon+0x101/0x200 drivers/net/wireless/virtual/mac80211_hwsim.c:2290 [<ffffffff8174ea54>] __run_hrtimer kernel/time/hrtimer.c:1688 [inline] [<ffffffff8174ea54>] __hrtimer_run_queues+0x604/0xc10 kernel/time/hrtimer.c:1752 [<ffffffff8174f1df>] hrtimer_run_softirq+0x17f/0x350 kernel/time/hrtimer.c:1769 [<ffffffff8a6b2774>] __do_softirq+0x1d4/0x85e kernel/softirq.c:553 BUG: memory leak unreferenced object 0xffff88810f01b200 (size 240): comm "softirq", pid 0, jiffies 4295071837 (age 10.950s) hex dump (first 32 bytes): c0 29 86 0e 81 88 ff ff 00 00 00 00 67 05 9c 06 .)..........g... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<ffffffff81daae1e>] kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline] [<ffffffff81daae1e>] slab_post_alloc_hook mm/slab.h:766 [inline] [<ffffffff81daae1e>] slab_alloc_node mm/slab.c:3237 [inline] [<ffffffff81daae1e>] kmem_cache_alloc_node+0x20e/0x510 mm/slab.c:3509 [<ffffffff885623ba>] __alloc_skb+0x28a/0x330 net/core/skbuff.c:641 [<ffffffff8856d704>] __netdev_alloc_skb+0x74/0x400 net/core/skbuff.c:715 [<ffffffff89e93c53>] netdev_alloc_skb include/linux/skbuff.h:3225 [inline] [<ffffffff89e93c53>] dev_alloc_skb include/linux/skbuff.h:3238 [inline] [<ffffffff89e93c53>] __ieee80211_beacon_get+0xbf3/0x1680 net/mac80211/tx.c:5445 [<ffffffff89e948f6>] ieee80211_beacon_get_tim+0xa6/0x280 net/mac80211/tx.c:5567 [<ffffffff864c017e>] ieee80211_beacon_get include/net/mac80211.h:5442 [inline] [<ffffffff864c017e>] mac80211_hwsim_beacon_tx+0x40e/0x750 drivers/net/wireless/virtual/mac80211_hwsim.c:2260 [<ffffffff89eb6bd8>] __iterate_interfaces+0x2c8/0x570 net/mac80211/util.c:767 [<ffffffff89ebdc11>] ieee80211_iterate_active_interfaces_atomic+0x71/0x1b0 net/mac80211/util.c:803 [<ffffffff864a2c51>] mac80211_hwsim_beacon+0x101/0x200 drivers/net/wireless/virtual/mac80211_hwsim.c:2290 [<ffffffff8174ea54>] __run_hrtimer kernel/time/hrtimer.c:1688 [inline] [<ffffffff8174ea54>] __hrtimer_run_queues+0x604/0xc10 kernel/time/hrtimer.c:1752 [<ffffffff8174f1df>] hrtimer_run_softirq+0x17f/0x350 kernel/time/hrtimer.c:1769 [<ffffffff8a6b2774>] __do_softirq+0x1d4/0x85e kernel/softirq.c:553 Syzkaller reproducer: # {Threaded:false Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Repro:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}} bind$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x1a, 0x0, 0x1, 0x3}, 0x14) r0 = openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000080)='cgroup.procs\x00', 0x2, 0x0) r2 = syz_io_uring_setup(0x1aaa, &(0x7f00000000c0)={0x0, 0x70d1, 0x0, 0x0, 0x158}, &(0x7f0000000140), &(0x7f0000000180)) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000600), 0x40, 0x0) io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x6, &(0x7f0000000680)={0x3, 0x0, &(0x7f0000000640)=[0xffffffffffffffff, 0xffffffffffffffff, r0, r1, r2, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r3]}, 0xa) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) io_uring_register$IORING_REGISTER_IOWQ_MAX_WORKERS(r4, 0x13, &(0x7f0000000700)=[0x200, 0x101], 0x2) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000740)={0x2, 0x7}, 0x2) pipe2(0x0, 0x80080) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000980)={0x18, 0x0, 0x0, &(0x7f0000000840)='GPL\x00', 0x850d, 0x0, 0x0, 0x41000, 0x24, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000900)=[r4, 0xffffffffffffffff, r4]}, 0x90) sendmsg$ETHTOOL_MSG_LINKINFO_SET(0xffffffffffffffff, &(0x7f0000000b00)={&(0x7f0000000a40)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a80)={0x28, 0x0, 0x100, 0x70bd2a, 0x25dfdbfc, {}, [@ETHTOOL_A_LINKINFO_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @ETHTOOL_A_LINKINFO_TP_MDIX_CTRL={0x5}]}, 0x28}, 0x1, 0x0, 0x0, 0x20000800}, 0x0) ============================================================================================================ I cannot rule out the possibility that this bug detected in Syzkaller targeting 6.7-rc6 is false positive. Also there are no reported records in 6.7-rc6. I've attached C repro and .config. Thank you So much. JinHo Ju.

1 0

[syzbot] [batman?] INFO: rcu detected stall in sys_recvmmsg (3)
by syzbot 19 Dec '23

19 Dec '23

Hello, syzbot found the following issue on: HEAD commit: 2cf4f94d8e86 Merge tag 'scsi-fixes' of git://git.kernel.or.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=12534501e80000 kernel config: https://syzkaller.appspot.com/x/.config?x=671af399e2dac0e3 dashboard link: https://syzkaller.appspot.com/bug?extid=b079dc0aa6e992859e7c compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 Unfortunately, I don't have any reproducer for this issue yet. Downloadable assets: disk image: https://storage.googleapis.com/syzbot-assets/08b534ec982d/disk-2cf4f94d.raw… vmlinux: https://storage.googleapis.com/syzbot-assets/8c44c6da6081/vmlinux-2cf4f94d.… kernel image: https://storage.googleapis.com/syzbot-assets/7e291c0f9693/bzImage-2cf4f94d.… IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+b079dc0aa6e992859e7c(a)syzkaller.appspotmail.com rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: rcu: 0-...!: (1 GPs behind) idle=c844/1/0x4000000000000000 softirq=35391/35392 fqs=3 rcu: (detected by 1, t=10502 jiffies, g=60989, q=82 ncpus=2) Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 PID: 12878 Comm: syz-executor.1 Not tainted 6.7.0-rc6-syzkaller-00010-g2cf4f94d8e86 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 RIP: 0010:rcu_dynticks_curr_cpu_in_eqs include/linux/context_tracking.h:122 [inline] RIP: 0010:rcu_is_watching+0x3d/0xb0 kernel/rcu/tree.c:700 Code: c7 c3 e8 6d 03 00 83 f8 07 89 c5 77 7a 48 8d 3c ed 60 da a6 8c 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 <75> 54 48 03 1c ed 60 da a6 8c 48 b8 00 00 00 00 00 fc ff df 48 89 RSP: 0018:ffffc90000007c78 EFLAGS: 00000046 RAX: dffffc0000000000 RBX: 0000000000036de8 RCX: ffffffff8166f367 RDX: 1ffffffff194db4c RSI: ffffffff8b2ed360 RDI: ffffffff8ca6da60 RBP: 0000000000000000 R08: 0000000000000000 R09: fffffbfff1e30d1a R10: ffffffff8f1868d7 R11: 0000000000000002 R12: 0000000000000001 R13: 0000000000000000 R14: ffff88802be37300 R15: 0000000000000000 FS: 00007feb948206c0(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020230030 CR3: 000000001f8f7000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <NMI> </NMI> <IRQ> trace_lock_acquire include/trace/events/lock.h:24 [inline] lock_acquire+0x464/0x520 kernel/locking/lockdep.c:5725 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154 spin_lock include/linux/spinlock.h:351 [inline] advance_sched+0xd5/0xc60 net/sched/sch_taprio.c:935 __run_hrtimer kernel/time/hrtimer.c:1688 [inline] __hrtimer_run_queues+0x203/0xc20 kernel/time/hrtimer.c:1752 hrtimer_interrupt+0x31b/0x800 kernel/time/hrtimer.c:1814 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1065 [inline] __sysvec_apic_timer_interrupt+0x105/0x400 arch/x86/kernel/apic/apic.c:1082 sysvec_apic_timer_interrupt+0x90/0xb0 arch/x86/kernel/apic/apic.c:1076 </IRQ> <TASK> asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:649 RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline] RIP: 0010:_raw_spin_unlock_irqrestore+0x31/0x70 kernel/locking/spinlock.c:194 Code: f5 53 48 8b 74 24 10 48 89 fb 48 83 c7 18 e8 86 37 e4 f6 48 89 df e8 ee ae e4 f6 f7 c5 00 02 00 00 75 1f 9c 58 f6 c4 02 75 2f <bf> 01 00 00 00 e8 25 68 d6 f6 65 8b 05 a6 10 81 75 85 c0 74 12 5b RSP: 0018:ffffc90003b0f738 EFLAGS: 00000246 RAX: 0000000000000006 RBX: ffff8880290ad9d0 RCX: 1ffffffff23ead8c RDX: 0000000000000000 RSI: ffffffff8acc9f40 RDI: ffffffff8b2ed3e0 RBP: 0000000000000246 R08: 0000000000000001 R09: fffffbfff23e1fe5 R10: ffffffff91f0ff2f R11: 0000000000000001 R12: ffff8880290ad9b8 R13: ffff8880177bda80 R14: 0000000000000246 R15: ffffc90003b0f8d8 spin_unlock_irqrestore include/linux/spinlock.h:406 [inline] __skb_try_recv_datagram+0x16f/0x4f0 net/core/datagram.c:266 __unix_dgram_recvmsg+0x1d1/0xee0 net/unix/af_unix.c:2383 unix_dgram_recvmsg+0xc3/0xf0 net/unix/af_unix.c:2485 sock_recvmsg_nosec net/socket.c:1044 [inline] ____sys_recvmsg+0x4ab/0x5c0 net/socket.c:2801 ___sys_recvmsg+0x115/0x1a0 net/socket.c:2845 do_recvmmsg+0x2af/0x740 net/socket.c:2939 __sys_recvmmsg net/socket.c:3018 [inline] __do_sys_recvmmsg net/socket.c:3041 [inline] __se_sys_recvmmsg net/socket.c:3034 [inline] __x64_sys_recvmmsg+0x235/0x290 net/socket.c:3034 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x40/0x110 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b RIP: 0033:0x7feb93a7cbe9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007feb948200c8 EFLAGS: 00000246 ORIG_RAX: 000000000000012b RAX: ffffffffffffffda RBX: 00007feb93b9c050 RCX: 00007feb93a7cbe9 RDX: 0000000000010106 RSI: 00000000200000c0 RDI: 0000000000000003 RBP: 00007feb93ac847a R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000 R13: 000000000000006e R14: 00007feb93b9c050 R15: 00007ffcb6b30bd8 </TASK> rcu: rcu_preempt kthread starved for 10496 jiffies! g60989 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=1 rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior. rcu: RCU grace-period kthread stack dump: task:rcu_preempt state:R running task stack:28024 pid:16 tgid:16 ppid:2 flags:0x00004000 Call Trace: <TASK> context_switch kernel/sched/core.c:5376 [inline] __schedule+0xedb/0x5af0 kernel/sched/core.c:6688 __schedule_loop kernel/sched/core.c:6763 [inline] schedule+0xe9/0x270 kernel/sched/core.c:6778 schedule_timeout+0x137/0x290 kernel/time/timer.c:2167 rcu_gp_fqs_loop+0x1ec/0xb10 kernel/rcu/tree.c:1631 rcu_gp_kthread+0x24b/0x380 kernel/rcu/tree.c:1830 kthread+0x2c6/0x3a0 kernel/kthread.c:388 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242 </TASK> rcu: Stack dump where RCU GP kthread last ran: CPU: 1 PID: 11 Comm: kworker/u4:1 Not tainted 6.7.0-rc6-syzkaller-00010-g2cf4f94d8e86 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 Workqueue: events_unbound toggle_allocation_gate RIP: 0010:csd_lock_wait kernel/smp.c:311 [inline] RIP: 0010:smp_call_function_many_cond+0x4e4/0x1550 kernel/smp.c:855 Code: 0b 00 85 ed 74 4d 48 b8 00 00 00 00 00 fc ff df 4d 89 f4 4c 89 f5 49 c1 ec 03 83 e5 07 49 01 c4 83 c5 03 e8 fe b6 0b 00 f3 90 <41> 0f b6 04 24 40 38 c5 7c 08 84 c0 0f 85 24 0e 00 00 8b 43 08 31 RSP: 0018:ffffc9000031f930 EFLAGS: 00000293 RAX: 0000000000000000 RBX: ffff8880b98414c0 RCX: ffffffff817aaaa8 RDX: ffff88801a66e080 RSI: ffffffff817aaa82 RDI: 0000000000000005 RBP: 0000000000000003 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000006 R12: ffffed1017308299 R13: 0000000000000001 R14: ffff8880b98414c8 R15: ffff8880b993d900 FS: 0000000000000000(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020015000 CR3: 000000000cd77000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <IRQ> </IRQ> <TASK> on_each_cpu_cond_mask+0x40/0x90 kernel/smp.c:1023 on_each_cpu include/linux/smp.h:71 [inline] text_poke_sync arch/x86/kernel/alternative.c:2006 [inline] text_poke_bp_batch+0x22b/0x750 arch/x86/kernel/alternative.c:2216 text_poke_flush arch/x86/kernel/alternative.c:2407 [inline] text_poke_flush arch/x86/kernel/alternative.c:2404 [inline] text_poke_finish+0x30/0x40 arch/x86/kernel/alternative.c:2414 arch_jump_label_transform_apply+0x1c/0x30 arch/x86/kernel/jump_label.c:146 jump_label_update+0x1d7/0x400 kernel/jump_label.c:829 static_key_enable_cpuslocked+0x1b7/0x270 kernel/jump_label.c:205 static_key_enable+0x1a/0x20 kernel/jump_label.c:218 toggle_allocation_gate mm/kfence/core.c:830 [inline] toggle_allocation_gate+0xf4/0x250 mm/kfence/core.c:822 process_one_work+0x886/0x15d0 kernel/workqueue.c:2627 process_scheduled_works kernel/workqueue.c:2700 [inline] worker_thread+0x8b9/0x1290 kernel/workqueue.c:2781 kthread+0x2c6/0x3a0 kernel/kthread.c:388 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242 </TASK> --- This report is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller(a)googlegroups.com. syzbot will keep track of this issue. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot. If the report is already addressed, let syzbot know by replying with: #syz fix: exact-commit-title If you want to overwrite report's subsystems, reply with: #syz set subsystems: new-subsystem (See the list of subsystem names on the web dashboard) If the report is a duplicate of another one, reply with: #syz dup: exact-subject-of-another-report If you want to undo deduplication, reply with: #syz undup

1 0

[PATCH 0/6] pull request for net-next: batman-adv 2023-11-15
by Simon Wunderlich 18 Nov '23

18 Nov '23

Hi Jakub, hi David, here is a feature/cleanup pull request of batman-adv to go into net-next. Please pull or let me know of any problem! Thank you, Simon The following changes since commit 89cdf9d556016a54ff6ddd62324aa5ec790c05cc: Merge tag 'net-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net (2023-11-09 17:09:35 -0800) are available in the Git repository at: git://git.open-mesh.org/linux-merge.git tags/batadv-next-pullrequest-20231115 for you to fetch changes up to c3ed16a64c0b0a5b116c9753bf48496d49daffb5: batman-adv: Switch to linux/array_size.h (2023-11-14 08:16:34 +0100) ---------------------------------------------------------------- This feature/cleanup patchset includes the following patches: - bump version strings, by Simon Wunderlich - Implement new multicast packet type, including its transmission, forwarding and parsing, by Linus Lüssing (3 patches) - Switch to new headers for sprintf and array size, by Sven Eckelmann (2 patches) ---------------------------------------------------------------- Linus Lüssing (3): batman-adv: mcast: implement multicast packet reception and forwarding batman-adv: mcast: implement multicast packet generation batman-adv: mcast: shrink tracker packet after scrubbing Simon Wunderlich (1): batman-adv: Start new development cycle Sven Eckelmann (2): batman-adv: Switch to linux/sprintf.h batman-adv: Switch to linux/array_size.h include/uapi/linux/batadv_packet.h | 45 +- net/batman-adv/Makefile | 1 + net/batman-adv/bridge_loop_avoidance.c | 2 +- net/batman-adv/fragmentation.c | 8 +- net/batman-adv/gateway_client.c | 2 +- net/batman-adv/main.c | 5 +- net/batman-adv/main.h | 2 +- net/batman-adv/multicast.c | 129 +++- net/batman-adv/multicast.h | 30 +- net/batman-adv/multicast_forw.c | 1178 ++++++++++++++++++++++++++++++++ net/batman-adv/netlink.c | 2 +- net/batman-adv/originator.c | 28 + net/batman-adv/originator.h | 3 + net/batman-adv/routing.c | 70 ++ net/batman-adv/routing.h | 11 + net/batman-adv/soft-interface.c | 18 +- net/batman-adv/types.h | 70 ++ 17 files changed, 1572 insertions(+), 32 deletions(-) create mode 100644 net/batman-adv/multicast_forw.c

2 7

← Newer
1
...
6
7
8
9
10
11
12
...
431
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

B.A.T.M.A.N