Hi David, Our tests detected a new problem on net-next (v4.20-rc4-1241-g83af01ba1c2d).
[ 92.949574] ================================================================== [ 92.949794] BUG: KASAN: use-after-free in neigh_mark_dead+0x192/0x1c0 [ 92.949950] Write of size 8 at addr ffff8881d9bc9438 by task kworker/u4:1/37 [ 92.950108] [ 92.950254] CPU: 1 PID: 37 Comm: kworker/u4:1 Not tainted 4.20.0-rc4+ #1 [ 92.950257] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 92.950263] Workqueue: netns cleanup_net [ 92.950267] Call Trace: [ 92.950276] dump_stack+0x5b/0x8b [ 92.950284] print_address_description+0x6a/0x270 [ 92.950290] kasan_report+0x260/0x380 [ 92.950295] ? neigh_mark_dead+0x192/0x1c0 [ 92.950301] neigh_mark_dead+0x192/0x1c0 [ 92.950307] neigh_flush_dev+0x1ad/0x510 [ 92.950318] __neigh_ifdown+0x49/0x2a0 [ 92.950327] neigh_ifdown+0xc/0x10 [ 92.950333] fib_netdev_event+0x1f5/0x300 [ 92.950342] notifier_call_chain+0xbf/0x130 [ 92.950352] dev_close_many+0x249/0x4d0 [ 92.950360] ? __dev_close_many+0x280/0x280 [ 92.950364] ? default_device_exit_batch+0xf3/0x3b0 [ 92.950374] rollback_registered_many+0x34c/0xd00 [ 92.950378] ? default_device_exit_batch+0xf3/0x3b0 [ 92.950383] ? wait_for_completion+0x2d0/0x2d0 [ 92.950386] ? __mutex_lock+0x31f/0x1000 [ 92.950391] ? generic_xdp_install+0x3c0/0x3c0 [ 92.950397] ? default_device_exit_batch+0x1b6/0x3b0 [ 92.950403] ? find_held_lock+0x32/0x1c0 [ 92.950408] ? default_device_exit_batch+0x1b6/0x3b0 [ 92.950416] ? rtnl_is_locked+0x16/0x30 [ 92.950420] ? unregister_netdevice_queue+0x69/0x3f0 [ 92.950424] ? rollback_registered_many+0xd00/0xd00 [ 92.950432] unregister_netdevice_many.part.124+0x17/0x210 [ 92.950439] default_device_exit_batch+0x2d6/0x3b0 [ 92.950444] ? unregister_netdevice_many+0x40/0x40 [ 92.950450] ? dev_change_net_namespace+0xb90/0xb90 [ 92.950459] ? do_wait_intr_irq+0x210/0x210 [ 92.950466] ? ops_exit_list.isra.6+0x94/0x140 [ 92.950473] cleanup_net+0x309/0x650 [ 92.950478] ? process_one_work+0x8ae/0x16c0 [ 92.950482] ? net_drop_ns+0x60/0x60 [ 92.950490] ? lock_acquire+0xfe/0x290 [ 92.950497] ? strscpy+0x96/0x300 [ 92.950505] process_one_work+0x96c/0x16c0 [ 92.950516] ? pwq_dec_nr_in_flight+0x2c0/0x2c0 [ 92.950520] ? do_raw_spin_lock+0x120/0x290 [ 92.950532] worker_thread+0x87/0xe80 [ 92.950541] ? __kthread_parkme+0x82/0xf0 [ 92.950546] ? process_one_work+0x16c0/0x16c0 [ 92.950550] kthread+0x2e9/0x3a0 [ 92.950554] ? kthread_park+0x120/0x120 [ 92.950560] ret_from_fork+0x35/0x40 [ 92.950572] [ 92.950713] Allocated by task 8903: [ 92.950863] kasan_kmalloc+0xa0/0xd0 [ 92.950868] __kmalloc+0x132/0x250 [ 92.950872] ___neigh_create+0x4d6/0x18e0 [ 92.950877] ip_finish_output2+0x4e7/0xff0 [ 92.950880] ip_output+0x1c5/0x3f0 [ 92.950884] __ip_queue_xmit+0x7c9/0x1990 [ 92.950888] __tcp_transmit_skb+0x1872/0x33e0 [ 92.950891] do_tcp_setsockopt.isra.41+0x1712/0x1c70 [ 92.950895] __sys_setsockopt+0x114/0x1e0 [ 92.950899] __x64_sys_setsockopt+0xba/0x150 [ 92.950904] do_syscall_64+0x94/0x280 [ 92.950908] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 92.950909] [ 92.951049] Freed by task 8936: [ 92.951200] __kasan_slab_free+0x130/0x180 [ 92.951204] kfree+0xc2/0x1e0 [ 92.951209] rcu_process_callbacks+0x647/0xbe0 [ 92.951213] __do_softirq+0x199/0x658 [ 92.951215] [ 92.951356] The buggy address belongs to the object at ffff8881d9bc9200 [ 92.951356] which belongs to the cache kmalloc-1k of size 1024 [ 92.951530] The buggy address is located 568 bytes inside of [ 92.951530] 1024-byte region [ffff8881d9bc9200, ffff8881d9bc9600) [ 92.951702] The buggy address belongs to the page: [ 92.951856] page:ffffea000766f200 count:1 mapcount:0 mapping:ffff8881dac02a00 index:0x0 compound_mapcount: 0 [ 92.952026] flags: 0x17fff8000010200(slab|head) [ 92.952185] raw: 017fff8000010200 dead000000000100 dead000000000200 ffff8881dac02a00 [ 92.952351] raw: 0000000000000000 00000000000e000e 00000001ffffffff 0000000000000000 [ 92.952515] page dumped because: kasan: bad access detected [ 92.952662] [ 92.952815] Memory state around the buggy address: [ 92.952981] ffff8881d9bc9300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 92.953168] ffff8881d9bc9380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 92.953348] >ffff8881d9bc9400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 92.953527] ^ [ 92.953688] ffff8881d9bc9480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 92.953871] ffff8881d9bc9500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 92.954048] ================================================================== [ 92.954233] Disabling lock debugging due to kernel taint Here is more more details (config, dmest, etc): https://travis-ci.org/avagin/linux/jobs/465254438 I can give more details on the next week. Let me know if you need anything. Thanks, Andrei
