====================================== | [ 20.589590][ T69] ================================================================== | [ 20.589933][ T69] BUG: KASAN: slab-use-after-free in kobject_put (lib/kobject.c:733) | [ 20.590281][ T69] Read of size 1 at addr ffff88800a1e46c4 by task kworker/u16:1/69 | [ 20.590585][ T69] [ 20.590692][ T69] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 20.590696][ T69] Workqueue: netns cleanup_net [ 20.590707][ T69] Call Trace: [ 20.590709][ T69] [ 20.590713][ T69] dump_stack_lvl (lib/dump_stack.c:123) [ 20.590720][ T69] print_address_description.constprop.0 (mm/kasan/report.c:379) [ 20.590728][ T69] ? kobject_put (lib/kobject.c:733) [ 20.590733][ T69] print_report (mm/kasan/report.c:483) [ 20.590736][ T69] ? kobject_put (lib/kobject.c:733) [ 20.590739][ T69] ? kasan_addr_to_slab (./include/linux/mm.h:1245 mm/kasan/../slab.h:191 mm/kasan/common.c:47) [ 20.590743][ T69] ? kobject_put (lib/kobject.c:733) [ 20.590746][ T69] kasan_report (mm/kasan/report.c:597) [ 20.590750][ T69] ? kobject_put (lib/kobject.c:733) [ 20.590755][ T69] kobject_put (lib/kobject.c:733) [ 20.590759][ T69] netdev_run_todo (./include/linux/list.h:381 net/core/dev.c:11670) [ 20.590766][ T69] ? dev_ingress_queue_create (net/core/dev.c:12299) [ 20.590770][ T69] ? generic_xdp_install (net/core/dev.c:11630) [ 20.590773][ T69] ? net_generic (./include/linux/rcupdate.h:341 ./include/linux/rcupdate.h:897 ./include/net/netns/generic.h:48) [ 20.590783][ T69] ops_undo_list (net/core/net_namespace.c:190 net/core/net_namespace.c:248) [ 20.590789][ T69] ? rtnl_net_dumpid_one (net/core/net_namespace.c:223) [ 20.590792][ T69] ? cleanup_net (./include/linux/list.h:191 net/core/net_namespace.c:693) [ 20.590798][ T69] cleanup_net (net/core/net_namespace.c:698) [ 20.590803][ T69] ? net_passive_dec (net/core/net_namespace.c:660) [ 20.590807][ T69] ? rcu_is_watching (./include/linux/context_tracking.h:128 kernel/rcu/tree.c:751) [ 20.590816][ T69] process_one_work (kernel/workqueue.c:3268) [ 20.590827][ T69] ? pwq_dec_nr_in_flight (kernel/workqueue.c:3165) [ 20.590833][ T69] ? assign_work (kernel/workqueue.c:1206) [ 20.590837][ T69] worker_thread (kernel/workqueue.c:3340 kernel/workqueue.c:3427) [ 20.590843][ T69] ? rescuer_thread (kernel/workqueue.c:3373) [ 20.590846][ T69] kthread (kernel/kthread.c:463) [ 20.590852][ T69] ? kthread_is_per_cpu (kernel/kthread.c:412) [ 20.590855][ T69] ? ret_from_fork (arch/x86/kernel/process.c:157) [ 20.590860][ T69] ? __lock_release (kernel/locking/lockdep.c:5536) [ 20.590866][ T69] ? rcu_is_watching (./include/linux/context_tracking.h:128 kernel/rcu/tree.c:751) [ 20.590869][ T69] ? kthread_is_per_cpu (kernel/kthread.c:412) [ 20.590872][ T69] ret_from_fork (arch/x86/kernel/process.c:164) [ 20.590875][ T69] ? kthread_is_per_cpu (kernel/kthread.c:412) [ 20.590878][ T69] ret_from_fork_asm (arch/x86/entry/entry_64.S:255) | [ 20.609730][ T69] refcount_t: underflow; use-after-free. | [ 20.609913][ T69] WARNING: CPU: 0 PID: 69 at lib/refcount.c:28 refcount_warn_saturate (lib/refcount.c:28 (discriminator 3)) | [ 20.610197][ T69] Modules linked in: | [ 20.610822][ T69] Tainted: [B]=BAD_PAGE [ 20.611031][ T69] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 20.611402][ T69] Workqueue: netns cleanup_net [ 20.611571][ T69] RIP: 0010:refcount_warn_saturate (lib/refcount.c:28 (discriminator 3)) [ 20.611833][ T69] Code: cc 38 03 80 fb 01 0f 87 29 33 d7 fe 83 e3 01 0f 85 51 ff ff ff c6 05 17 cc 38 03 01 90 48 c7 c7 40 ba 25 93 e8 62 d6 16 ff 90 <0f> 0b 90 90 e9 33 ff ff ff 48 89 df e8 c0 9d a0 ff e9 ba fe ff ff All code ======== 0: cc int3 1: 38 03 cmp %al,(%rbx) 3: 80 fb 01 cmp $0x1,%bl 6: 0f 87 29 33 d7 fe ja 0xfffffffffed73335 c: 83 e3 01 and $0x1,%ebx f: 0f 85 51 ff ff ff jne 0xffffffffffffff66 15: c6 05 17 cc 38 03 01 movb $0x1,0x338cc17(%rip) # 0x338cc33 1c: 90 nop 1d: 48 c7 c7 40 ba 25 93 mov $0xffffffff9325ba40,%rdi 24: e8 62 d6 16 ff call 0xffffffffff16d68b 29: 90 nop 2a:* 0f 0b ud2 <-- trapping instruction 2c: 90 nop 2d: 90 nop 2e: e9 33 ff ff ff jmp 0xffffffffffffff66 33: 48 89 df mov %rbx,%rdi 36: e8 c0 9d a0 ff call 0xffffffffffa09dfb 3b: e9 ba fe ff ff jmp 0xfffffffffffffefa Code starting with the faulting instruction =========================================== 0: 0f 0b ud2 2: 90 nop 3: 90 nop 4: e9 33 ff ff ff jmp 0xffffffffffffff3c 9: 48 89 df mov %rbx,%rdi c: e8 c0 9d a0 ff call 0xffffffffffa09dd1 11: e9 ba fe ff ff jmp 0xfffffffffffffed0 [ 20.612383][ T69] RSP: 0000:ffffc900004a7a08 EFLAGS: 00010282 [ 20.612770][ T69] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 20.613100][ T69] RDX: 0000000000000002 RSI: 0000000000000004 RDI: 0000000000000001 [ 20.613327][ T69] RBP: 0000000000000003 R08: 0000000000000000 R09: fffffbfff2840934 [ 20.613594][ T69] R10: 0000000000000003 R11: ffffc900004a7580 R12: 0000000000000001 [ 20.613874][ T69] R13: dffffc0000000000 R14: dead000000000122 R15: dead000000000100 [ 20.614112][ T69] FS: 0000000000000000(0000) GS:ffff8880d7908000(0000) knlGS:0000000000000000 [ 20.614457][ T69] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 20.614675][ T69] CR2: 00007f466b21f000 CR3: 0000000033d49004 CR4: 0000000000772ef0 [ 20.615079][ T69] PKRU: 55555554 [ 20.615250][ T69] Call Trace: [ 20.615400][ T69] [ 20.615482][ T69] netdev_run_todo (./include/linux/list.h:381 net/core/dev.c:11670) [ 20.615650][ T69] ? dev_ingress_queue_create (net/core/dev.c:12299) [ 20.615826][ T69] ? generic_xdp_install (net/core/dev.c:11630) [ 20.615985][ T69] ? net_generic (./include/linux/rcupdate.h:341 ./include/linux/rcupdate.h:897 ./include/net/netns/generic.h:48) [ 20.616167][ T69] ops_undo_list (net/core/net_namespace.c:190 net/core/net_namespace.c:248) [ 20.616395][ T69] ? rtnl_net_dumpid_one (net/core/net_namespace.c:223) [ 20.616771][ T69] ? cleanup_net (./include/linux/list.h:191 net/core/net_namespace.c:693) [ 20.616971][ T69] cleanup_net (net/core/net_namespace.c:698) [ 20.617123][ T69] ? net_passive_dec (net/core/net_namespace.c:660) [ 20.617358][ T69] ? rcu_is_watching (./include/linux/context_tracking.h:128 kernel/rcu/tree.c:751) [ 20.617625][ T69] process_one_work (kernel/workqueue.c:3268) [ 20.617841][ T69] ? pwq_dec_nr_in_flight (kernel/workqueue.c:3165) [ 20.618044][ T69] ? assign_work (kernel/workqueue.c:1206) [ 20.618300][ T69] worker_thread (kernel/workqueue.c:3340 kernel/workqueue.c:3427) [ 20.618466][ T69] ? rescuer_thread (kernel/workqueue.c:3373) [ 20.618687][ T69] kthread (kernel/kthread.c:463) [ 20.618813][ T69] ? kthread_is_per_cpu (kernel/kthread.c:412) [ 20.618973][ T69] ? ret_from_fork (arch/x86/kernel/process.c:157) [ 20.619157][ T69] ? __lock_release (kernel/locking/lockdep.c:5536) [ 20.619373][ T69] ? rcu_is_watching (./include/linux/context_tracking.h:128 kernel/rcu/tree.c:751) [ 20.619531][ T69] ? kthread_is_per_cpu (kernel/kthread.c:412) [ 20.619702][ T69] ret_from_fork (arch/x86/kernel/process.c:164) [ 20.620109][ T69] ? kthread_is_per_cpu (kernel/kthread.c:412) [ 20.620380][ T69] ret_from_fork_asm (arch/x86/entry/entry_64.S:255) | [ 36.015671][ T324] ------------[ cut here ]------------ | [ 36.016090][ T324] kernel BUG at net/core/net-sysfs.c:2246! | [ 36.016502][ T324] Oops: invalid opcode: 0000 [#1] SMP KASAN | [ 36.017471][ T324] Tainted: [B]=BAD_PAGE, [W]=WARN [ 36.017757][ T324] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 36.018114][ T324] RIP: 0010:netdev_release (net/core/net-sysfs.c:2246 net/core/net-sysfs.c:2242) [ 36.018422][ T324] Code: 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 75 20 48 8b bb b0 fa ff ff e8 9c 81 d1 fe 48 89 ef 5b 5d e9 62 8e d1 fe 90 <0f> 0b e8 0a 65 d8 fe eb bc e8 63 65 d8 fe eb d9 90 f3 0f 1e fa 0f All code ======== 0: 00 00 add %al,(%rax) 2: 00 fc add %bh,%ah 4: ff lcall (bad) 5: df 48 89 fisttps -0x77(%rax) 8: fa cli 9: 48 c1 ea 03 shr $0x3,%rdx d: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) 11: 75 20 jne 0x33 13: 48 8b bb b0 fa ff ff mov -0x550(%rbx),%rdi 1a: e8 9c 81 d1 fe call 0xfffffffffed181bb 1f: 48 89 ef mov %rbp,%rdi 22: 5b pop %rbx 23: 5d pop %rbp 24: e9 62 8e d1 fe jmp 0xfffffffffed18e8b 29: 90 nop 2a:* 0f 0b ud2 <-- trapping instruction 2c: e8 0a 65 d8 fe call 0xfffffffffed8653b 31: eb bc jmp 0xffffffffffffffef 33: e8 63 65 d8 fe call 0xfffffffffed8659b 38: eb d9 jmp 0x13 3a: 90 nop 3b: f3 0f 1e fa endbr64 3f: 0f .byte 0xf Code starting with the faulting instruction =========================================== 0: 0f 0b ud2 2: e8 0a 65 d8 fe call 0xfffffffffed86511 7: eb bc jmp 0xffffffffffffffc5 9: e8 63 65 d8 fe call 0xfffffffffed86571 e: eb d9 jmp 0xffffffffffffffe9 10: 90 nop 11: f3 0f 1e fa endbr64 15: 0f .byte 0xf [ 36.019564][ T324] RSP: 0018:ffffc900005878a8 EFLAGS: 00010297 [ 36.019929][ T324] RAX: 0000000000000000 RBX: ffff8880094fa688 RCX: ffffffff92d7ab51 [ 36.020366][ T324] RDX: 1ffff1100129f4cc RSI: ffffffff932602c0 RDI: ffff8880094fa660 [ 36.020822][ T324] RBP: ffff8880094fa000 R08: 0000000000000001 R09: ffffed100129f4d8 [ 36.021300][ T324] R10: ffff8880094fa6c3 R11: ffffffff904000b0 R12: ffff88800b3be200 [ 36.021767][ T324] R13: 0000000000000000 R14: dead000000000122 R15: dead000000000100 [ 36.022225][ T324] FS: 00007f6b57ed5b80(0000) GS:ffff8880d7a08000(0000) knlGS:0000000000000000 [ 36.022758][ T324] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 36.023140][ T324] CR2: 0000561529334dec CR3: 000000000ae61006 CR4: 0000000000772ef0 [ 36.023600][ T324] PKRU: 55555554 [ 36.023826][ T324] Call Trace: [ 36.024061][ T324] [ 36.024251][ T324] device_release (drivers/base/core.c:2570) [ 36.024577][ T324] kobject_cleanup (lib/kobject.c:693) [ 36.024870][ T324] netdev_run_todo (./include/linux/list.h:381 net/core/dev.c:11670) [ 36.025164][ T324] ? generic_xdp_install (net/core/dev.c:11630) [ 36.025456][ T324] ? kfree (mm/slub.c:6630 mm/slub.c:6837) [ 36.025682][ T324] nsim_destroy (drivers/net/netdevsim/netdev.c:1186) netdevsim [ 36.025997][ T324] __nsim_dev_port_del (drivers/net/netdevsim/dev.c:441 drivers/net/netdevsim/dev.c:1474) netdevsim [ 36.026368][ T324] nsim_dev_reload_destroy (drivers/net/netdevsim/dev.c:1483 drivers/net/netdevsim/dev.c:1707) netdevsim [ 36.026745][ T324] nsim_drv_remove (drivers/net/netdevsim/dev.c:1724) netdevsim [ 36.027055][ T324] device_release_driver_internal (drivers/base/dd.c:1276 drivers/base/dd.c:1297) [ 36.027412][ T324] ? klist_put (lib/klist.c:220) [ 36.027636][ T324] bus_remove_device (./include/linux/kobject.h:193 drivers/base/base.h:73 drivers/base/bus.c:586) [ 36.027925][ T324] device_del (drivers/base/core.c:3879) [ 36.028139][ T324] ? __device_link_del (drivers/base/core.c:3833) [ 36.028423][ T324] ? kernfs_fop_write_iter (fs/kernfs/file.c:77 fs/kernfs/file.c:344) [ 36.028717][ T324] device_unregister (drivers/base/core.c:3796 drivers/base/core.c:3920) [ 36.028999][ T324] del_device_store (drivers/net/netdevsim/bus.c:248) netdevsim [ 36.029363][ T324] ? sysfs_file_kobj (./include/linux/rcupdate.h:341 ./include/linux/rcupdate.h:897 ./include/linux/rcupdate.h:1195 fs/sysfs/file.c:24) [ 36.029652][ T324] ? rcu_is_watching (./include/linux/context_tracking.h:128 kernel/rcu/tree.c:751) [ 36.029941][ T324] ? nsim_bus_dev_numvfs_show (drivers/net/netdevsim/bus.c:215) netdevsim [ 36.030308][ T324] ? sysfs_file_kobj (fs/sysfs/file.c:26) [ 36.030610][ T324] ? sysfs_file_ops (fs/sysfs/file.c:135) [ 36.030895][ T324] kernfs_fop_write_iter (fs/kernfs/file.c:88 fs/kernfs/file.c:356) [ 36.031184][ T324] vfs_write (fs/read_write.c:594 fs/read_write.c:686) [ 36.031409][ T324] ? kernel_write (fs/read_write.c:667) [ 36.031701][ T324] ? lock_vma_under_rcu (mm/mmap_lock.c:259) [ 36.031995][ T324] ? __handle_mm_fault (mm/memory.c:6454) [ 36.032288][ T324] ksys_write (fs/read_write.c:738) [ 36.032513][ T324] ? __ia32_sys_read (fs/read_write.c:728) [ 36.032809][ T324] ? do_user_addr_fault (./arch/x86/include/asm/atomic.h:93 ./include/linux/atomic/atomic-arch-fallback.h:949 ./include/linux/atomic/atomic-instrumented.h:401 ./include/linux/refcount.h:389 ./include/linux/refcount.h:432 ./include/linux/mmap_lock.h:143 ./include/linux/mmap_lock.h:182 arch/x86/mm/fault.c:1338) [ 36.033111][ T324] do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) [ 36.033396][ T324] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [ 36.033766][ T324] RIP: 0033:0x7f6b57fd6257 [ 36.034063][ T324] Code: 0f 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 48 89 54 24 18 48 89 74 24 All code ======== 0: 0f 00 (bad) 2: f7 d8 neg %eax 4: 64 89 02 mov %eax,%fs:(%rdx) 7: 48 c7 c0 ff ff ff ff mov $0xffffffffffffffff,%rax e: eb b7 jmp 0xffffffffffffffc7 10: 0f 1f 00 nopl (%rax) 13: f3 0f 1e fa endbr64 17: 64 8b 04 25 18 00 00 mov %fs:0x18,%eax 1e: 00 1f: 85 c0 test %eax,%eax 21: 75 10 jne 0x33 23: b8 01 00 00 00 mov $0x1,%eax 28: 0f 05 syscall 2a:* 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax <-- trapping instruction 30: 77 51 ja 0x83 32: c3 ret 33: 48 83 ec 28 sub $0x28,%rsp 37: 48 89 54 24 18 mov %rdx,0x18(%rsp) 3c: 48 rex.W 3d: 89 .byte 0x89 3e: 74 24 je 0x64 Code starting with the faulting instruction =========================================== 0: 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax 6: 77 51 ja 0x59 8: c3 ret 9: 48 83 ec 28 sub $0x28,%rsp d: 48 89 54 24 18 mov %rdx,0x18(%rsp) 12: 48 rex.W 13: 89 .byte 0x89 14: 74 24 je 0x3a [ 36.035095][ T324] RSP: 002b:00007ffee8f3bc08 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 36.035537][ T324] RAX: ffffffffffffffda RBX: 00007f6b580d2780 RCX: 00007f6b57fd6257 [ 36.035982][ T324] RDX: 0000000000000005 RSI: 0000562ec8ab22f0 RDI: 0000000000000001 [ 36.036414][ T324] RBP: 0000000000000005 R08: 0000000000000004 R09: 0000000000000077 [ 36.036842][ T324] R10: 0000000000000063 R11: 0000000000000246 R12: 0000000000000005 Finger prints: print_report:kasan_report:kobject_put:netdev_run_todo:ops_undo_list netdev_release:device_release:kobject_cleanup:netdev_run_todo:nsim_destroy refcount_warn_saturate:netdev_run_todo:ops_undo_list:cleanup_net:process_one_work