Bug#921542: tc qdisc kernel crash
On Sun, Feb 10, 2019 at 7:54 AM Ben Hutchings wrote: > > Control: tag -1 confirmed upstream > Control: found -1 4.20-1~exp1 > > Adrian (cc'd) reported (https://bugs.debian.org/921542) that a script > using tc could trigger a kernel crash. I've simplified the script he > provided down to: > > --- BEGIN --- > #!/bin/sh -ex > > modprobe ifb > > while true; do > tc qdisc add dev ifb0 root handle 2:0 prio bands 5 > tc qdisc add dev ifb0 parent 2:5 sfq > tc filter add dev ifb0 parent 2:0 protocol ip prio 5 handle 0 tcindex > mask 0 classid 2:5 pass_on > tc qdisc del dev ifb0 root || true > done > --- END --- > > The crash is still reproducible in 4.20 and 5.0-rc5. KASan shows a > use-after-free: Thanks for the reproducer and report! I will send a fix.
Bug#921542: tc qdisc kernel crash
Control: tag -1 confirmed upstream Control: found -1 4.20-1~exp1 Adrian (cc'd) reported (https://bugs.debian.org/921542) that a script using tc could trigger a kernel crash. I've simplified the script he provided down to: --- BEGIN --- #!/bin/sh -ex modprobe ifb while true; do tc qdisc add dev ifb0 root handle 2:0 prio bands 5 tc qdisc add dev ifb0 parent 2:5 sfq tc filter add dev ifb0 parent 2:0 protocol ip prio 5 handle 0 tcindex mask 0 classid 2:5 pass_on tc qdisc del dev ifb0 root || true done --- END --- The crash is still reproducible in 4.20 and 5.0-rc5. KASan shows a use-after-free: + modprobe ifb + true + tc qdisc add dev ifb0 root handle 2:0 prio bands 5 + tc qdisc add dev ifb0 parent 2:5 sfq + tc filter add dev ifb0 parent 2:0 protocol ip prio 5 handle 0 tcindex mask 0 classid 2:5 pass_on + tc qdisc del dev ifb0 root + true + tc qdisc add dev ifb0 root handle 2:0 prio bands 5 [ 63.926983] == [ 63.929429] BUG: KASAN: use-after-free in worker_thread+0x327/0x5b0 [ 63.931489] Read of size 8 at addr 88804fd22130 by task kworker/u8:1/32 [ 63.933766] [ 63.934397] CPU: 0 PID: 32 Comm: kworker/u8:1 Not tainted 5.0.0-rc5 #3 [ 63.936629] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 63.939537] Workqueue:(null) (events_unbound) [ 63.942039] Call Trace: [ 63.943187] dump_stack+0x71/0xa0 [ 63.944386] ? worker_thread+0x327/0x5b0 [ 63.945881] print_address_description+0x65/0x22e [ 63.947980] ? worker_thread+0x327/0x5b0 [ 63.949588] ? worker_thread+0x327/0x5b0 [ 63.951254] kasan_report.cold.3+0x1a/0x40 [ 63.953036] ? worker_thread+0x327/0x5b0 [ 63.954692] worker_thread+0x327/0x5b0 [ 63.956236] ? flush_rcu_work+0x40/0x40 [ 63.957722] kthread+0x1ae/0x1d0 [ 63.959067] ? __kthread_parkme+0x90/0x90 [ 63.960451] ret_from_fork+0x35/0x40 [ 63.962020] [ 63.962817] Allocated by task 757: [ 63.964465] __kasan_kmalloc.constprop.13+0xc1/0xd0 [ 63.966670] tcindex_alloc_perfect_hash+0x37/0x150 [cls_tcindex] [ 63.969287] tcindex_set_parms+0xb38/0xd30 [cls_tcindex] [ 63.972539] tcindex_change+0x13d/0x1c2 [cls_tcindex] [ 63.974796] tc_new_tfilter+0x7ec/0xaf0 [ 63.976546] rtnetlink_rcv_msg+0x35c/0x490 [ 63.978302] netlink_rcv_skb+0xc6/0x1f0 [ 63.980050] netlink_unicast+0x309/0x3d0 [ 63.981990] netlink_sendmsg+0x37d/0x5e0 [ 63.983849] sock_sendmsg+0x6d/0x80 [ 63.985538] ___sys_sendmsg+0x46a/0x4e0 [ 63.987328] __sys_sendmsg+0xd3/0x160 [ 63.988974] do_syscall_64+0x73/0x140 [ 63.990616] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 63.992538] [ 63.993430] Freed by task 9: [ 63.994660] __kasan_slab_free+0x125/0x170 [ 63.996239] kfree+0x90/0x1d0 [ 63.997496] __tcindex_destroy+0x1f/0x40 [cls_tcindex] [ 63.999316] rcu_process_callbacks+0x3cb/0x650 [ 64.000889] __do_softirq+0x115/0x3b4 [ 64.003254] [ 64.004138] The buggy address belongs to the object at 88804fd22100 [ 64.004138] which belongs to the cache kmalloc-8k of size 8192 [ 64.009001] The buggy address is located 48 bytes inside of [ 64.009001] 8192-byte region [88804fd22100, 88804fd24100) [ 64.013752] The buggy address belongs to the page: [ 64.015906] page:ea00013f4800 count:1 mapcount:0 mapping:888051002700 index:0x0 compound_mapcount: 0 [ 64.020237] flags: 0xc10200(slab|head) [ 64.022176] raw: 00c10200 dead0100 dead0200 888051002700 [ 64.025247] raw: 80030003 0001 [ 64.028847] page dumped because: kasan: bad access detected [ 64.031367] [ 64.033285] Memory state around the buggy address: [ 64.035276] 88804fd22000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 64.037741] 88804fd22080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 64.040138] >88804fd22100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 64.042717] ^ [ 64.044794] 88804fd22180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 64.047431] 88804fd22200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 64.049993] == Ben. -- Ben Hutchings The world is coming to an end. Please log off. signature.asc Description: This is a digitally signed message part
Bug#921542: tc qdisc kernel crash
Package: src:linux
Version: 4.19.16-1
Severity: critical
When I'm trying to use this script:
#!/bin/bash
ifaces[0]="tun0"
ifaces[1]="ens192"
ifaceIn="ifb0"
ifaceOut="ifb1"
#echo ${#iface[@]}
#exit
tc qdisc del dev $ifaceIn root
for iface in ${ifaces[@]}; do
echo "Delete qdisc ingress on ${iface}"
tc qdisc del dev ${iface} handle : ingress
echo "Add qdisc ingress on ${iface}"
tc qdisc add dev ${iface} handle : ingress
#tc filter add dev ${iface} parent : protocol ip u32 match u32 0 0
action mirred egress redirect dev ${ifaceIn}
done
#tc qdisc add dev $ifaceIn root handle 1: prio bands 5
#tc qdisc add dev $ifaceIn parent 1:1 handle 10: sfq
#tc qdisc add dev $ifaceIn parent 1:2 handle 20: sfq
#tc qdisc add dev $ifaceIn parent 1:3 handle 30: sfq
#tc qdisc add dev $ifaceIn parent 1:4 handle 40: sfq
#tc qdisc add dev $ifaceIn parent 1:5 handle 50: sfq
### Create a root qdisc type DSmark
echo "Add qdisc root on ${ifaceIn} type DSmark"
tc qdisc add dev $ifaceIn handle 1:0 root dsmark indices 64 set_tc_index
### filter to copy the correct DS filed from the IP packet to skb->tc_index
echo "Add filter on parent 1:0 ${ifaceIn} for set the tcindex"
tc filter add dev $ifaceIn parent 1:0 protocol ip prio 1 tcindex mask 0xfc
shift 2
### Add a PRIO class with 5 bands on 1:0
echo "Add qdisc on parent 1:0 ${ifaceIn} as PRIO with 5 bands"
tc qdisc add dev $ifaceIn parent 1:0 handle 2:0 prio bands 5
### Add a qdisc on the leaf PRIO 2:1
#tc qdisc add dev $ifaceIn parent 2:1 tbf rate 1.5Mbit burst 1.5kB limit 1.6kB
echo "Add qdisc on leaf parent 2:1 ${ifaceIn} as SFQ"
tc qdisc add dev $ifaceIn parent 2:1 sfq
### Match the traffic with DSCP EF (ToS 0xb8 / DSCP 0x2e) mark
echo "Add filter on parent 2:0 ${ifaceIn} to match DSCP EF (ToS 0xb8 / DSCP
0x2e) mark and send the traffic to class 2:1"
tc filter add dev $ifaceIn parent 2:0 protocol ip prio 1 handle 0x2e tcindex
classid 2:1 pass_on
### Add a qdisck on leaf PRIO 2:2 - IPTV services
echo "Add qdisc on leaf parent 2:1 ${ifaceIn} as SFQ"
tc qdisc add dev $ifaceIn parent 2:2 sfq
### Match the traffic with DSCP AF41 (ToS 0x88 / DSCP 0x22) mark
echo "Add filter on parent 2:0 ${ifaceIn} to match DSCP AF41 (ToS 0x88 / DSCP
0x22 mark) and send the traffic to class 2:2"
tc filter add dev $ifaceIn parent 2:0 protocol ip prio 2 handle 0x22 tcindex
classid 2:2 pass_on
### Best Effort traffic move to 2:5
#BE class(2:2)
#tc qdisc add dev $ifaceIn parent 2:5 red limit 60KB min 15KB max 45KB burst 20
avpkt 1000 bandwidth 10Mbit probability 0.4
echo "Add qdisc on leaf parent 2:5 ${ifaceIn} as SFQ"
tc qdisc add dev $ifaceIn parent 2:5 sfq
echo "Add filter on parent 2:0 ${ifaceIn} to match DSCP BE (ToS 0x0 / DSCP 0x0
mark) and send the traffic to class 2:5"
tc filter add dev $ifaceIn parent 2:0 protocol ip prio 5 handle 0 tcindex mask
0 classid 2:5 pass_on
exit
And run it 2-3 times I'm getting a severe kernel crash:
Feb 6 17:15:34 Telenet-PC kernel: [ 511.608275] general protection fault:
[#1] SMP PTI
Feb 6 17:15:34 Telenet-PC kernel: [ 511.608279] CPU: 2 PID: 3889 Comm: tc Not
tainted 4.19.0-2-amd64 #1 Debian 4.19.16-1
Feb 6 17:15:34 Telenet-PC kernel: [ 511.608281] Hardware name: VMware, Inc.
VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 05/19/2017
Feb 6 17:15:34 Telenet-PC kernel: [ 511.608285] RIP:
0010:__kmalloc_node+0x195/0x2b0
Feb 6 17:15:34 Telenet-PC kernel: [ 511.608288] Code: fa 48 8b 74 24 08 e8 7a
54 7d 00 4c 8b 13 58 4d 85 d2 75 d7 e9 75 ff ff ff 41 8b 5a 20 49 8b 3a 48 8d
4a 01 4c 89 f8 4c 01 fb <48> 33 1b 49 33 9a 38 01 00 00 65 48 0f c7 0f 0f 94 c0
84 c0 0f 84
Feb 6 17:15:34 Telenet-PC kernel: [ 511.608289] RSP: 0018:b4ad4322b978
EFLAGS: 00010286
Feb 6 17:15:34 Telenet-PC kernel: [ 511.608291] RAX: d36cc438 RBX:
d36cc438 RCX: 0181
Feb 6 17:15:34 Telenet-PC kernel: [ 511.608292] RDX: 0180 RSI:
006012c0 RDI: 00025120
Feb 6 17:15:34 Telenet-PC kernel: [ 511.608294] RBP: 006012c0 R08:
984037ca5120 R09: 984037807900
Feb 6 17:15:34 Telenet-PC kernel: [ 511.608295] R10: 984037806a00 R11:
R12: 1c00
Feb 6 17:15:34 Telenet-PC kernel: [ 511.608296] R13: R14:
984037806a00 R15: d36cc438
Feb 6 17:15:34 Telenet-PC kernel: [ 511.608298] FS: 7fc881130800()
GS:984037c8() knlGS:
Feb 6 17:15:34 Telenet-PC kernel: [ 511.608299] CS: 0010 DS: ES:
CR0: 80050033
Feb 6 17:15:34 Telenet-PC kernel: [ 511.608300] CR2: 7fc88153fee0 CR3:
000141b9e006 CR4: 003606e0
Feb 6 17:15:34 Telenet-PC kernel: [ 511.608336] DR0: DR1:
DR2:
Feb 6 17:15:34 Telenet-PC kernel: [ 511.608337] DR3: DR6:
fffe0ff0 DR7: 0400
Feb 6 17:15:34 Telenet-PC kernel: [ 511.608338] Call Trace:
Feb 6 17:15:34 Telenet-PC kernel: [ 511.608342
