====================================== | [ 19.473215][ T69] ================================================================== | [ 19.473501][ T69] BUG: KASAN: slab-use-after-free in kobject_put (lib/kobject.c:733) | [ 19.473740][ T69] Read of size 1 at addr ffff88800880c6c4 by task kworker/u16:1/69 | [ 19.473964][ T69] [ 19.474063][ T69] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 19.474067][ T69] Workqueue: netns cleanup_net [ 19.474074][ T69] Call Trace: [ 19.474078][ T69] [ 19.474080][ T69] dump_stack_lvl (lib/dump_stack.c:123) [ 19.474087][ T69] print_address_description.constprop.0 (mm/kasan/report.c:379) [ 19.474094][ T69] ? kobject_put (lib/kobject.c:733) [ 19.474097][ T69] print_report (mm/kasan/report.c:483) [ 19.474102][ T69] ? kobject_put (lib/kobject.c:733) [ 19.474105][ T69] ? kasan_addr_to_slab (./include/linux/mm.h:1245 mm/kasan/../slab.h:191 mm/kasan/common.c:47) [ 19.474109][ T69] ? kobject_put (lib/kobject.c:733) [ 19.474112][ T69] kasan_report (mm/kasan/report.c:597) [ 19.474116][ T69] ? kobject_put (lib/kobject.c:733) [ 19.474121][ T69] kobject_put (lib/kobject.c:733) [ 19.474125][ T69] netdev_run_todo (./include/linux/list.h:381 net/core/dev.c:11670) [ 19.474130][ T69] ? dev_ingress_queue_create (net/core/dev.c:12299) [ 19.474135][ T69] ? generic_xdp_install (net/core/dev.c:11630) [ 19.474138][ T69] ? net_generic (./include/linux/rcupdate.h:341 ./include/linux/rcupdate.h:897 ./include/net/netns/generic.h:48) [ 19.474146][ T69] ops_undo_list (net/core/net_namespace.c:190 net/core/net_namespace.c:248) [ 19.474152][ T69] ? rtnl_net_dumpid_one (net/core/net_namespace.c:223) [ 19.474155][ T69] ? cleanup_net (./include/linux/list.h:191 net/core/net_namespace.c:693) [ 19.474161][ T69] cleanup_net (net/core/net_namespace.c:698) [ 19.474165][ T69] ? net_passive_dec (net/core/net_namespace.c:660) [ 19.474170][ T69] ? rcu_is_watching (./include/linux/context_tracking.h:128 kernel/rcu/tree.c:751) [ 19.474176][ T69] process_one_work (kernel/workqueue.c:3268) [ 19.474184][ T69] ? pwq_dec_nr_in_flight (kernel/workqueue.c:3165) [ 19.474190][ T69] ? assign_work (kernel/workqueue.c:1206) [ 19.474194][ T69] worker_thread (kernel/workqueue.c:3340 kernel/workqueue.c:3427) [ 19.474200][ T69] ? rescuer_thread (kernel/workqueue.c:3373) [ 19.474204][ T69] kthread (kernel/kthread.c:463) [ 19.474207][ T69] ? kthread_is_per_cpu (kernel/kthread.c:412) [ 19.474210][ T69] ? ret_from_fork (arch/x86/kernel/process.c:157) [ 19.474214][ T69] ? __lock_release (kernel/locking/lockdep.c:5536) [ 19.474221][ T69] ? rcu_is_watching (./include/linux/context_tracking.h:128 kernel/rcu/tree.c:751) [ 19.474224][ T69] ? kthread_is_per_cpu (kernel/kthread.c:412) [ 19.474228][ T69] ret_from_fork (arch/x86/kernel/process.c:164) [ 19.474230][ T69] ? kthread_is_per_cpu (kernel/kthread.c:412) [ 19.474233][ T69] ret_from_fork_asm (arch/x86/entry/entry_64.S:255) | [ 19.492159][ T69] refcount_t: underflow; use-after-free. | [ 19.492389][ T69] WARNING: CPU: 0 PID: 69 at lib/refcount.c:28 refcount_warn_saturate (lib/refcount.c:28 (discriminator 3)) | [ 19.493274][ T69] Modules linked in: netdevsim psample | [ 19.494339][ T69] Tainted: [B]=BAD_PAGE [ 19.494468][ T69] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 19.494727][ T69] Workqueue: netns cleanup_net [ 19.494897][ T69] RIP: 0010:refcount_warn_saturate (lib/refcount.c:28 (discriminator 3)) [ 19.495102][ T69] Code: cc 38 03 80 fb 01 0f 87 29 33 d7 fe 83 e3 01 0f 85 51 ff ff ff c6 05 17 cc 38 03 01 90 48 c7 c7 40 ba 65 b7 e8 62 d6 16 ff 90 <0f> 0b 90 90 e9 33 ff ff ff 48 89 df e8 c0 9d a0 ff e9 ba fe ff ff All code ======== 0: cc int3 1: 38 03 cmp %al,(%rbx) 3: 80 fb 01 cmp $0x1,%bl 6: 0f 87 29 33 d7 fe ja 0xfffffffffed73335 c: 83 e3 01 and $0x1,%ebx f: 0f 85 51 ff ff ff jne 0xffffffffffffff66 15: c6 05 17 cc 38 03 01 movb $0x1,0x338cc17(%rip) # 0x338cc33 1c: 90 nop 1d: 48 c7 c7 40 ba 65 b7 mov $0xffffffffb765ba40,%rdi 24: e8 62 d6 16 ff call 0xffffffffff16d68b 29: 90 nop 2a:* 0f 0b ud2 <-- trapping instruction 2c: 90 nop 2d: 90 nop 2e: e9 33 ff ff ff jmp 0xffffffffffffff66 33: 48 89 df mov %rbx,%rdi 36: e8 c0 9d a0 ff call 0xffffffffffa09dfb 3b: e9 ba fe ff ff jmp 0xfffffffffffffefa Code starting with the faulting instruction =========================================== 0: 0f 0b ud2 2: 90 nop 3: 90 nop 4: e9 33 ff ff ff jmp 0xffffffffffffff3c 9: 48 89 df mov %rbx,%rdi c: e8 c0 9d a0 ff call 0xffffffffffa09dd1 11: e9 ba fe ff ff jmp 0xfffffffffffffed0 [ 19.495735][ T69] RSP: 0018:ffffc900004a7a08 EFLAGS: 00010282 [ 19.495943][ T69] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 19.496173][ T69] RDX: 0000000000000002 RSI: 0000000000000004 RDI: 0000000000000001 [ 19.496422][ T69] RBP: 0000000000000003 R08: 0000000000000000 R09: fffffbfff70c0934 [ 19.496731][ T69] R10: 0000000000000003 R11: ffffc900004a7580 R12: 0000000000000001 [ 19.496968][ T69] R13: dffffc0000000000 R14: dead000000000122 R15: dead000000000100 [ 19.497208][ T69] FS: 0000000000000000(0000) GS:ffff8880ad108000(0000) knlGS:0000000000000000 [ 19.497489][ T69] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 19.497756][ T69] CR2: 000055ff9ca8d388 CR3: 0000000078349004 CR4: 0000000000772ef0 [ 19.497995][ T69] PKRU: 55555554 [ 19.498119][ T69] Call Trace: [ 19.498238][ T69] [ 19.498331][ T69] netdev_run_todo (./include/linux/list.h:381 net/core/dev.c:11670) [ 19.498569][ T69] ? dev_ingress_queue_create (net/core/dev.c:12299) [ 19.498728][ T69] ? generic_xdp_install (net/core/dev.c:11630) [ 19.498896][ T69] ? net_generic (./include/linux/rcupdate.h:341 ./include/linux/rcupdate.h:897 ./include/net/netns/generic.h:48) [ 19.499053][ T69] ops_undo_list (net/core/net_namespace.c:190 net/core/net_namespace.c:248) [ 19.499215][ T69] ? rtnl_net_dumpid_one (net/core/net_namespace.c:223) [ 19.499376][ T69] ? cleanup_net (./include/linux/list.h:191 net/core/net_namespace.c:693) [ 19.499588][ T69] cleanup_net (net/core/net_namespace.c:698) [ 19.499744][ T69] ? net_passive_dec (net/core/net_namespace.c:660) [ 19.499890][ T69] ? rcu_is_watching (./include/linux/context_tracking.h:128 kernel/rcu/tree.c:751) [ 19.500040][ T69] process_one_work (kernel/workqueue.c:3268) [ 19.500196][ T69] ? pwq_dec_nr_in_flight (kernel/workqueue.c:3165) [ 19.500355][ T69] ? assign_work (kernel/workqueue.c:1206) [ 19.500503][ T69] worker_thread (kernel/workqueue.c:3340 kernel/workqueue.c:3427) [ 19.500711][ T69] ? rescuer_thread (kernel/workqueue.c:3373) [ 19.500864][ T69] kthread (kernel/kthread.c:463) [ 19.500976][ T69] ? kthread_is_per_cpu (kernel/kthread.c:412) [ 19.501126][ T69] ? ret_from_fork (arch/x86/kernel/process.c:157) [ 19.501279][ T69] ? __lock_release (kernel/locking/lockdep.c:5536) [ 19.501437][ T69] ? rcu_is_watching (./include/linux/context_tracking.h:128 kernel/rcu/tree.c:751) [ 19.501645][ T69] ? kthread_is_per_cpu (kernel/kthread.c:412) [ 19.501796][ T69] ret_from_fork (arch/x86/kernel/process.c:164) [ 19.501942][ T69] ? kthread_is_per_cpu (kernel/kthread.c:412) [ 19.502088][ T69] ret_from_fork_asm (arch/x86/entry/entry_64.S:255) | [ 29.187738][ T255] ------------[ cut here ]------------ | [ 29.188027][ T255] kernel BUG at net/core/net-sysfs.c:2246! | [ 29.188322][ T255] Oops: invalid opcode: 0000 [#1] SMP KASAN | [ 29.188982][ T255] Tainted: [B]=BAD_PAGE, [W]=WARN [ 29.189178][ T255] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 29.189432][ T255] RIP: 0010:netdev_release (net/core/net-sysfs.c:2246 net/core/net-sysfs.c:2242) [ 29.189638][ T255] Code: 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 75 20 48 8b bb b0 fa ff ff e8 9c 81 d1 fe 48 89 ef 5b 5d e9 62 8e d1 fe 90 <0f> 0b e8 0a 65 d8 fe eb bc e8 63 65 d8 fe eb d9 90 f3 0f 1e fa 0f All code ======== 0: 00 00 add %al,(%rax) 2: 00 fc add %bh,%ah 4: ff lcall (bad) 5: df 48 89 fisttps -0x77(%rax) 8: fa cli 9: 48 c1 ea 03 shr $0x3,%rdx d: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) 11: 75 20 jne 0x33 13: 48 8b bb b0 fa ff ff mov -0x550(%rbx),%rdi 1a: e8 9c 81 d1 fe call 0xfffffffffed181bb 1f: 48 89 ef mov %rbp,%rdi 22: 5b pop %rbx 23: 5d pop %rbp 24: e9 62 8e d1 fe jmp 0xfffffffffed18e8b 29: 90 nop 2a:* 0f 0b ud2 <-- trapping instruction 2c: e8 0a 65 d8 fe call 0xfffffffffed8653b 31: eb bc jmp 0xffffffffffffffef 33: e8 63 65 d8 fe call 0xfffffffffed8659b 38: eb d9 jmp 0x13 3a: 90 nop 3b: f3 0f 1e fa endbr64 3f: 0f .byte 0xf Code starting with the faulting instruction =========================================== 0: 0f 0b ud2 2: e8 0a 65 d8 fe call 0xfffffffffed86511 7: eb bc jmp 0xffffffffffffffc5 9: e8 63 65 d8 fe call 0xfffffffffed86571 e: eb d9 jmp 0xffffffffffffffe9 10: 90 nop 11: f3 0f 1e fa endbr64 15: 0f .byte 0xf [ 29.190380][ T255] RSP: 0018:ffffc90000ba78a8 EFLAGS: 00010297 [ 29.190673][ T255] RAX: 0000000000000000 RBX: ffff88800ce82688 RCX: ffffffffb717ab51 [ 29.191002][ T255] RDX: 1ffff110019d04cc RSI: ffffffffb76602c0 RDI: ffff88800ce82660 [ 29.191317][ T255] RBP: ffff88800ce82000 R08: 0000000000000001 R09: ffffed10019d04d8 [ 29.191628][ T255] R10: ffff88800ce826c3 R11: ffffffffb48000b0 R12: ffff8880090e6200 [ 29.191941][ T255] R13: 0000000000000000 R14: dead000000000122 R15: dead000000000100 [ 29.192256][ T255] FS: 00007f2b733a5740(0000) GS:ffff8880ad208000(0000) knlGS:0000000000000000 [ 29.192619][ T255] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 29.192873][ T255] CR2: 00007f2b65d73810 CR3: 000000000b7f6006 CR4: 0000000000772ef0 [ 29.193188][ T255] PKRU: 55555554 [ 29.193347][ T255] Call Trace: [ 29.193501][ T255] [ 29.193606][ T255] device_release (drivers/base/core.c:2570) [ 29.193815][ T255] kobject_cleanup (lib/kobject.c:693) [ 29.194011][ T255] netdev_run_todo (./include/linux/list.h:381 net/core/dev.c:11670) [ 29.194202][ T255] ? generic_xdp_install (net/core/dev.c:11630) [ 29.194397][ T255] ? kfree (mm/slub.c:6630 mm/slub.c:6837) [ 29.194546][ T255] nsim_destroy (drivers/net/netdevsim/netdev.c:1186) netdevsim [ 29.194749][ T255] __nsim_dev_port_del (drivers/net/netdevsim/dev.c:441 drivers/net/netdevsim/dev.c:1474) netdevsim [ 29.194987][ T255] nsim_dev_reload_destroy (drivers/net/netdevsim/dev.c:1483 drivers/net/netdevsim/dev.c:1707) netdevsim [ 29.195225][ T255] nsim_drv_remove (drivers/net/netdevsim/dev.c:1724) netdevsim [ 29.195419][ T255] device_release_driver_internal (drivers/base/dd.c:1276 drivers/base/dd.c:1297) [ 29.195647][ T255] ? klist_put (lib/klist.c:220) [ 29.195791][ T255] bus_remove_device (./include/linux/kobject.h:193 drivers/base/base.h:73 drivers/base/bus.c:586) [ 29.195977][ T255] device_del (drivers/base/core.c:3879) [ 29.196120][ T255] ? __device_link_del (drivers/base/core.c:3833) [ 29.196306][ T255] ? kernfs_fop_write_iter (fs/kernfs/file.c:77 fs/kernfs/file.c:344) [ 29.196495][ T255] device_unregister (drivers/base/core.c:3796 drivers/base/core.c:3920) [ 29.196683][ T255] del_device_store (drivers/net/netdevsim/bus.c:248) netdevsim [ 29.196923][ T255] ? sysfs_file_kobj (./include/linux/rcupdate.h:341 ./include/linux/rcupdate.h:897 ./include/linux/rcupdate.h:1195 fs/sysfs/file.c:24) [ 29.197110][ T255] ? rcu_is_watching (./include/linux/context_tracking.h:128 kernel/rcu/tree.c:751) [ 29.197303][ T255] ? nsim_bus_dev_numvfs_show (drivers/net/netdevsim/bus.c:215) netdevsim [ 29.197547][ T255] ? sysfs_file_kobj (fs/sysfs/file.c:26) [ 29.197731][ T255] ? sysfs_file_ops (fs/sysfs/file.c:135) [ 29.197915][ T255] kernfs_fop_write_iter (fs/kernfs/file.c:88 fs/kernfs/file.c:356) [ 29.198101][ T255] vfs_write (fs/read_write.c:594 fs/read_write.c:686) [ 29.198248][ T255] ? kernel_write (fs/read_write.c:667) [ 29.198452][ T255] ? lock_vma_under_rcu (mm/mmap_lock.c:259) [ 29.198642][ T255] ? __handle_mm_fault (mm/memory.c:6454) [ 29.198836][ T255] ksys_write (fs/read_write.c:738) [ 29.198977][ T255] ? __ia32_sys_read (fs/read_write.c:728) [ 29.199161][ T255] ? do_user_addr_fault (./arch/x86/include/asm/atomic.h:93 ./include/linux/atomic/atomic-arch-fallback.h:949 ./include/linux/atomic/atomic-instrumented.h:401 ./include/linux/refcount.h:389 ./include/linux/refcount.h:432 ./include/linux/mmap_lock.h:143 ./include/linux/mmap_lock.h:182 arch/x86/mm/fault.c:1338) [ 29.199357][ T255] do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) [ 29.199545][ T255] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [ 29.199777][ T255] RIP: 0033:0x7f2b73584257 [ 29.199971][ T255] Code: 0f 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 48 89 54 24 18 48 89 74 24 All code ======== 0: 0f 00 (bad) 2: f7 d8 neg %eax 4: 64 89 02 mov %eax,%fs:(%rdx) 7: 48 c7 c0 ff ff ff ff mov $0xffffffffffffffff,%rax e: eb b7 jmp 0xffffffffffffffc7 10: 0f 1f 00 nopl (%rax) 13: f3 0f 1e fa endbr64 17: 64 8b 04 25 18 00 00 mov %fs:0x18,%eax 1e: 00 1f: 85 c0 test %eax,%eax 21: 75 10 jne 0x33 23: b8 01 00 00 00 mov $0x1,%eax 28: 0f 05 syscall 2a:* 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax <-- trapping instruction 30: 77 51 ja 0x83 32: c3 ret 33: 48 83 ec 28 sub $0x28,%rsp 37: 48 89 54 24 18 mov %rdx,0x18(%rsp) 3c: 48 rex.W 3d: 89 .byte 0x89 3e: 74 24 je 0x64 Code starting with the faulting instruction =========================================== 0: 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax 6: 77 51 ja 0x59 8: c3 ret 9: 48 83 ec 28 sub $0x28,%rsp d: 48 89 54 24 18 mov %rdx,0x18(%rsp) 12: 48 rex.W 13: 89 .byte 0x89 14: 74 24 je 0x3a [ 29.200639][ T255] RSP: 002b:00007ffd04d6b8d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 29.200921][ T255] RAX: ffffffffffffffda RBX: 00007f2b733a56e0 RCX: 00007f2b73584257 [ 29.201201][ T255] RDX: 0000000000000005 RSI: 0000559ea6a57090 RDI: 0000000000000005 [ 29.201493][ T255] RBP: 0000000000000005 R08: 0000000000000000 R09: 0000000000000002 [ 29.201804][ T255] R10: 0000000000000002 R11: 0000000000000246 R12: 00007f2b65161940 Finger prints: print_report:kasan_report:kobject_put:netdev_run_todo:ops_undo_list netdev_release:device_release:kobject_cleanup:netdev_run_todo:nsim_destroy refcount_warn_saturate:netdev_run_todo:ops_undo_list:cleanup_net:process_one_work