[syzbot] WARNING: ODEBUG bug in route4_destroy

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 57f780f1c433 atlantic: Fix driver resume flow.
git tree: net
console output: https://syzkaller.appspot.com/x/log.txt?x=162590a5300000
kernel config: https://syzkaller.appspot.com/x/.config?x=765eea9a273a8879
dashboard link: https://syzkaller.appspot.com/bug?extid=2e3efb5eb71cb5075ba7
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.1
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11979286300000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=14391933300000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+2e3efb...@syzkaller.appspotmail.com

------------[ cut here ]------------
ODEBUG: activate active (active state 1) object type: rcu_head hint: 0x0
WARNING: CPU: 0 PID: 8461 at lib/debugobjects.c:505 debug_print_object+0x16e/0x250 lib/debugobjects.c:505
Modules linked in:
CPU: 0 PID: 8461 Comm: syz-executor318 Not tainted 5.14.0-rc7-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:debug_print_object+0x16e/0x250 lib/debugobjects.c:505
Code: ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 af 00 00 00 48 8b 14 dd e0 c8 e3 89 4c 89 ee 48 c7 c7 e0 bc e3 89 e8 f0 de 0d 05 <0f> 0b 83 05 95 53 92 09 01 48 83 c4 18 5b 5d 41 5c 41 5d 41 5e c3
RSP: 0018:ffffc9000160efb0 EFLAGS: 00010286
RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000000
RDX: ffff8880224a8000 RSI: ffffffff815d85b5 RDI: fffff520002c1de8
RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000
R10: ffffffff815d23ee R11: 0000000000000000 R12: ffffffff898d3320
R13: ffffffff89e3c3a0 R14: 0000000000000000 R15: ffffffff898d3320
FS: 00007f00d3339700(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f00d3318718 CR3: 0000000018f1d000 CR4: 00000000001506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
debug_object_activate+0x2da/0x3e0 lib/debugobjects.c:672
debug_rcu_head_queue kernel/rcu/rcu.h:176 [inline]
__call_rcu kernel/rcu/tree.c:3013 [inline]
call_rcu+0x2c/0x750 kernel/rcu/tree.c:3109
queue_rcu_work+0x82/0xa0 kernel/workqueue.c:1754
route4_queue_work net/sched/cls_route.c:272 [inline]
route4_destroy+0x4b9/0x9a0 net/sched/cls_route.c:299
tcf_proto_destroy+0x6a/0x2d0 net/sched/cls_api.c:297
tcf_proto_put+0x8c/0xc0 net/sched/cls_api.c:309
tcf_chain_flush+0x21a/0x360 net/sched/cls_api.c:615
tcf_block_flush_all_chains net/sched/cls_api.c:1016 [inline]
__tcf_block_put+0x15a/0x510 net/sched/cls_api.c:1178
tcf_block_put_ext net/sched/cls_api.c:1383 [inline]
tcf_block_put_ext net/sched/cls_api.c:1375 [inline]
tcf_block_put+0xde/0x130 net/sched/cls_api.c:1393
drr_destroy_qdisc+0x44/0x1d0 net/sched/sch_drr.c:458
qdisc_destroy+0xc4/0x4d0 net/sched/sch_generic.c:1025
qdisc_put+0xcd/0xe0 net/sched/sch_generic.c:1044
notify_and_destroy net/sched/sch_api.c:1006 [inline]
qdisc_graft+0xc7c/0x1260 net/sched/sch_api.c:1078
tc_modify_qdisc+0xba4/0x1a60 net/sched/sch_api.c:1674
rtnetlink_rcv_msg+0x413/0xb80 net/core/rtnetlink.c:5575
netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2504
netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline]
netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1340
netlink_sendmsg+0x86d/0xdb0 net/netlink/af_netlink.c:1929
sock_sendmsg_nosec net/socket.c:703 [inline]
sock_sendmsg+0xcf/0x120 net/socket.c:723
____sys_sendmsg+0x6e8/0x810 net/socket.c:2394
___sys_sendmsg+0xf3/0x170 net/socket.c:2448
__sys_sendmsg+0xe5/0x1b0 net/socket.c:2477
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x445ef9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 11 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f00d3339308 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00000000004cb468 RCX: 0000000000445ef9
RDX: 0000000000000000 RSI: 0000000020000040 RDI: 0000000000000004
RBP: 00000000004cb460 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000008 R11: 0000000000000246 R12: 00000000004cb46c
R13: 000000000049b074 R14: 6d32cc5e8ead0600 R15: 0000000000022000


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches

[syzbot]

> This looks like route4_destroy is deleting the 'fold' which has been freed
> by tcf_queue_work in route4_change. It means fold is still in the table...
> Try this simple patch to validate.
>
> #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git

I see the command but can't find the corresponding bug.
Please resend the email to syzbo...@syzkaller.appspotmail.com address
that is the sender of the bug report (also present in the Reported-by tag).

> master

> --
> You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bug...@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/c1137532-e42c-4097-84ea-07379f6e1866n%40googlegroups.com.

[syzbot]

> To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/2a6f86c4-9d15-436f-810c-1c0bc426860fn%40googlegroups.com.

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-and-tested-by: syzbot+2e3efb...@syzkaller.appspotmail.com

Tested on:

commit: 619c010a octeontx2-vf: Add support for adaptive interr..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git master
console output: https://syzkaller.appspot.com/x/log.txt?x=1062c208080000
kernel config: https://syzkaller.appspot.com/x/.config?x=7073de63d8bcd46e
dashboard link: https://syzkaller.appspot.com/bug?extid=2e3efb5eb71cb5075ba7
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
patch: https://syzkaller.appspot.com/x/patch.diff?x=165c6687f00000

Note: testing is done by a robot and is best-effort only.

[Zhen Chen]

This looks like route4_destroy is deleting the 'fold' which has been freed by tcf_queue_work in route4_change. It means 'fold' is still in the table.

I have tested this patch on syzbot and it works well, but I am not sure whether it will introduce other issues...

diff --git a/net/sched/cls_route.c b/net/sched/cls_route.c
index a35ab8c27866..758c21f9d628 100644
--- a/net/sched/cls_route.c
+++ b/net/sched/cls_route.c
@@ -526,7 +526,7 @@ static int route4_change(struct net *net, struct sk_buff *in_skb,
rcu_assign_pointer(f->next, f1);
rcu_assign_pointer(*fp, f);

- if (fold && fold->handle && f->handle != fold->handle) {
+ if (fold && f->handle != fold->handle) {
th = to_hash(fold->handle);
h = from_hash(fold->handle >> 16);
b = rtnl_dereference(head->table[th]);

[Dan Carpenter]

On Tue, Jun 14, 2022 at 10:35:44PM +0800, 'Zhen Chen' via syzkaller-bugs wrote:
>
> This looks like route4_destroy is deleting the 'fold' which has been
> freed by tcf_queue_work in route4_change. It means 'fold' is still in
> the table.
> I have tested this patch on syzbot and it works well, but I am not
> sure whether it will introduce other issues...
>
> diff --git a/net/sched/cls_route.c b/net/sched/cls_route.c
> index a35ab8c27866..758c21f9d628 100644
> --- a/net/sched/cls_route.c
> +++ b/net/sched/cls_route.c
> @@ -526,7 +526,7 @@ static int route4_change(struct net *net, struct sk_buff *in_skb,
> rcu_assign_pointer(f->next, f1);
> rcu_assign_pointer(*fp, f);
>
> - if (fold && fold->handle && f->handle != fold->handle) {
> + if (fold && f->handle != fold->handle) {

^^^^^^^^^^^^
There is still a dereference here so your patch doesn't make sense. :/

regards,
dan carpenter

> th = to_hash(fold->handle);
> h = from_hash(fold->handle >> 16);
> b = rtnl_dereference(head->table[th]);
>

> --
> You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bug...@googlegroups.com.

> To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/0c0468ae-5fe3-a71f-c987-18475756caca%40huawei.com.

[Hillf Danton]

On Date: Sat, 04 Sep 2021 09:46:34 -0700

> syzbot found the following issue on:
>
> HEAD commit: 57f780f1c433 atlantic: Fix driver resume flow.
> git tree: net
> console output: https://syzkaller.appspot.com/x/log.txt?x=162590a5300000
> kernel config: https://syzkaller.appspot.com/x/.config?x=765eea9a273a8879
> dashboard link: https://syzkaller.appspot.com/bug?extid=2e3efb5eb71cb5075ba7
> compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.1
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11979286300000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=14391933300000
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+2e3efb...@syzkaller.appspotmail.com

See if it can be reproduced with the mainline.

#syz test git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
WARNING: ODEBUG bug in route4_destroy

------------[ cut here ]------------
ODEBUG: activate active (active state 1) object type: rcu_head hint: 0x0

WARNING: CPU: 0 PID: 4132 at lib/debugobjects.c:502 debug_print_object+0x16e/0x250 lib/debugobjects.c:502
Modules linked in:
CPU: 0 PID: 4132 Comm: syz-executor.0 Not tainted 5.19.0-rc2-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011

RIP: 0010:debug_print_object+0x16e/0x250 lib/debugobjects.c:502
Code: ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 af 00 00 00 48 8b 14 dd e0 c5 27 8a 4c 89 ee 48 c7 c7 c0 b9 27 8a e8 f6 1b 30 05 <0f> 0b 83 05 35 22 c5 09 01 48 83 c4 18 5b 5d 41 5c 41 5d 41 5e c3
RSP: 0018:ffffc9000339efb0 EFLAGS: 00010286

RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000000

RDX: ffff8880221057c0 RSI: ffffffff815fcd08 RDI: fffff52000673de8
RBP: 0000000000000001 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000080000000 R11: 0000000000000001 R12: ffffffff89cde060
R13: ffffffff8a27c080 R14: 0000000000000000 R15: ffffffff89cde060
FS: 00007fd48e521700(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 00007fd48e500718 CR3: 000000001b202000 CR4: 00000000003506e0

DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:

<TASK>
debug_object_activate+0x2da/0x3e0 lib/debugobjects.c:674
debug_rcu_head_queue kernel/rcu/rcu.h:178 [inline]
call_rcu+0x2c/0x790 kernel/rcu/tree.c:3111
queue_rcu_work+0x82/0xa0 kernel/workqueue.c:1774

route4_queue_work net/sched/cls_route.c:272 [inline]
route4_destroy+0x4b9/0x9a0 net/sched/cls_route.c:299

tcf_proto_destroy+0x6a/0x2d0 net/sched/cls_api.c:314
tcf_proto_put+0x8c/0xc0 net/sched/cls_api.c:326
tcf_chain_flush+0x21a/0x360 net/sched/cls_api.c:632
tcf_block_flush_all_chains net/sched/cls_api.c:1034 [inline]
__tcf_block_put+0x15a/0x510 net/sched/cls_api.c:1196
tcf_block_put_ext net/sched/cls_api.c:1396 [inline]
tcf_block_put+0xb3/0x100 net/sched/cls_api.c:1411
drr_destroy_qdisc+0x44/0x1d0 net/sched/sch_drr.c:455
qdisc_destroy+0xc4/0x4e0 net/sched/sch_generic.c:1067
qdisc_put+0xcd/0xe0 net/sched/sch_generic.c:1086
notify_and_destroy net/sched/sch_api.c:1012 [inline]
qdisc_graft+0xeb1/0x1270 net/sched/sch_api.c:1084
tc_modify_qdisc+0xbb7/0x1a00 net/sched/sch_api.c:1671
rtnetlink_rcv_msg+0x43a/0xc90 net/core/rtnetlink.c:6089
netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2501
netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
netlink_unicast+0x543/0x7f0 net/netlink/af_netlink.c:1345
netlink_sendmsg+0x917/0xe10 net/netlink/af_netlink.c:1921
sock_sendmsg_nosec net/socket.c:714 [inline]
sock_sendmsg+0xcf/0x120 net/socket.c:734
____sys_sendmsg+0x6eb/0x810 net/socket.c:2492
___sys_sendmsg+0xf3/0x170 net/socket.c:2546
__sys_sendmsg net/socket.c:2575 [inline]
__do_sys_sendmsg net/socket.c:2584 [inline]
__se_sys_sendmsg net/socket.c:2582 [inline]
__x64_sys_sendmsg+0x132/0x220 net/socket.c:2582
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0x80 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x46/0xb0
RIP: 0033:0x4665f9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fd48e521188 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 000000000056bf80 RCX: 00000000004665f9

RDX: 0000000000000000 RSI: 0000000020000040 RDI: 0000000000000004

RBP: 00000000004bfcc4 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf80
R13: 00007ffefe84a09f R14: 00007fd48e521300 R15: 0000000000022000
</TASK>


Tested on:

commit: 018ab4fa netfs: fix up netfs_inode_init() docbook comm..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=169cf608080000
kernel config: https://syzkaller.appspot.com/x/.config?x=f21890d74080ef72
dashboard link: https://syzkaller.appspot.com/bug?extid=2e3efb5eb71cb5075ba7
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2

Note: no patches were applied.

[Zhen Chen]

On 22/6/14 22:46, Dan Carpenter wrote:
> On Tue, Jun 14, 2022 at 10:35:44PM +0800, 'Zhen Chen' via syzkaller-bugs wrote:
>>
>> This looks like route4_destroy is deleting the 'fold' which has been
>> freed by tcf_queue_work in route4_change. It means 'fold' is still in
>> the table.
>> I have tested this patch on syzbot and it works well, but I am not
>> sure whether it will introduce other issues...
>>
>> diff --git a/net/sched/cls_route.c b/net/sched/cls_route.c
>> index a35ab8c27866..758c21f9d628 100644
>> --- a/net/sched/cls_route.c
>> +++ b/net/sched/cls_route.c
>> @@ -526,7 +526,7 @@ static int route4_change(struct net *net, struct sk_buff *in_skb,
>> rcu_assign_pointer(f->next, f1);
>> rcu_assign_pointer(*fp, f);
>>
>> - if (fold && fold->handle && f->handle != fold->handle) {
>> + if (fold && f->handle != fold->handle) {
> ^^^^^^^^^^^^
> There is still a dereference here so your patch doesn't make sense. :/
>
> regards,
> dan carpenter

Thanks for your reply but I think the dereference may not be the point.
If fold->handle equals 0, it will not be removed from the hash table, but afterwards the old filter will be freed because it only checks the pointer 'fold' is null or not.

if (fold) {
tcf_unbind_filter(tp, &fold->res);
tcf_exts_get_net(&fold->exts);
tcf_queue_work(&fold->rwork, route4_delete_filter_work);
}

So my patch simply eliminates the handle judgement and it seems to work fine on syzbot.
If I misunderstood anything, pleaese let me know :) Thanks!

[Hillf Danton]

On Wed, 15 Jun 2022 03:55:07 -0700

To quiesce the warning, try to not queue rcu work more than once.

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 018ab4fa

--- y/net/sched/cls_route.c
+++ c/net/sched/cls_route.c
@@ -43,10 +43,15 @@ struct route4_bucket {
struct rcu_head rcu;
};

+enum {
+ RT4_FILTER_FL_RCU_PENDING = 0,
+};
+
struct route4_filter {
struct route4_filter __rcu *next;
u32 id;
int iif;
+ unsigned long flag;

struct tcf_result res;
struct tcf_exts exts;
@@ -269,6 +274,8 @@ static void route4_delete_filter_work(st

static void route4_queue_work(struct route4_filter *f)
{
+ if (test_and_set_bit(RT4_FILTER_FL_RCU_PENDING, &f->flag))
+ return;
tcf_queue_work(&f->rwork, route4_delete_filter_work);
}

--

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:

KASAN: use-after-free Read in route4_destroy

==================================================================
BUG: KASAN: use-after-free in route4_destroy+0x861/0x9d0 net/sched/cls_route.c:302
Read of size 8 at addr ffff888021de7700 by task syz-executor.0/4141

CPU: 1 PID: 4141 Comm: syz-executor.0 Not tainted 5.19.0-rc2-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011

Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
print_address_description.constprop.0.cold+0xeb/0x495 mm/kasan/report.c:313
print_report mm/kasan/report.c:429 [inline]
kasan_report.cold+0xf4/0x1c6 mm/kasan/report.c:491
route4_destroy+0x861/0x9d0 net/sched/cls_route.c:302

RSP: 002b:00007f157e77d188 EFLAGS: 00000246 ORIG_RAX: 000000000000002e

RAX: ffffffffffffffda RBX: 000000000056bf80 RCX: 00000000004665f9
RDX: 0000000000000000 RSI: 0000000020000040 RDI: 0000000000000004
RBP: 00000000004bfcc4 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf80

R13: 00007ffd57f086af R14: 00007f157e77d300 R15: 0000000000022000
</TASK>

Allocated by task 4137:
kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
kasan_set_track mm/kasan/common.c:45 [inline]
set_alloc_info mm/kasan/common.c:436 [inline]
____kasan_kmalloc mm/kasan/common.c:515 [inline]
____kasan_kmalloc mm/kasan/common.c:474 [inline]
__kasan_kmalloc+0xa9/0xd0 mm/kasan/common.c:524
kmalloc include/linux/slab.h:600 [inline]
kzalloc include/linux/slab.h:733 [inline]
route4_change+0x28c/0x24a0 net/sched/cls_route.c:500
tc_new_tfilter+0x98d/0x2200 net/sched/cls_api.c:2148
rtnetlink_rcv_msg+0x946/0xc90 net/core/rtnetlink.c:6080

netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2501
netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
netlink_unicast+0x543/0x7f0 net/netlink/af_netlink.c:1345
netlink_sendmsg+0x917/0xe10 net/netlink/af_netlink.c:1921
sock_sendmsg_nosec net/socket.c:714 [inline]
sock_sendmsg+0xcf/0x120 net/socket.c:734
____sys_sendmsg+0x6eb/0x810 net/socket.c:2492
___sys_sendmsg+0xf3/0x170 net/socket.c:2546
__sys_sendmsg net/socket.c:2575 [inline]
__do_sys_sendmsg net/socket.c:2584 [inline]
__se_sys_sendmsg net/socket.c:2582 [inline]
__x64_sys_sendmsg+0x132/0x220 net/socket.c:2582
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0x80 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x46/0xb0

Freed by task 42:
kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
kasan_set_track+0x21/0x30 mm/kasan/common.c:45
kasan_set_free_info+0x20/0x30 mm/kasan/generic.c:370
____kasan_slab_free mm/kasan/common.c:366 [inline]
____kasan_slab_free+0x166/0x1a0 mm/kasan/common.c:328
kasan_slab_free include/linux/kasan.h:200 [inline]
slab_free_hook mm/slub.c:1727 [inline]
slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1753
slab_free mm/slub.c:3507 [inline]
kfree+0xd6/0x4d0 mm/slub.c:4555
__route4_delete_filter net/sched/cls_route.c:262 [inline]
route4_delete_filter_work+0xb0/0xf0 net/sched/cls_route.c:271
process_one_work+0x996/0x1610 kernel/workqueue.c:2289
worker_thread+0x665/0x1080 kernel/workqueue.c:2436
kthread+0x2e9/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302

Last potentially related work creation:
kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
__kasan_record_aux_stack+0xbe/0xd0 mm/kasan/generic.c:348
insert_work+0x48/0x350 kernel/workqueue.c:1358
__queue_work+0x62f/0x1150 kernel/workqueue.c:1517
rcu_work_rcufn+0x58/0x80 kernel/workqueue.c:1754
rcu_do_batch kernel/rcu/tree.c:2578 [inline]
rcu_core+0x7b1/0x1880 kernel/rcu/tree.c:2838
__do_softirq+0x29b/0x9c2 kernel/softirq.c:571

Second to last potentially related work creation:
kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
__kasan_record_aux_stack+0xbe/0xd0 mm/kasan/generic.c:348
call_rcu+0x99/0x790 kernel/rcu/tree.c:3126
queue_rcu_work+0x82/0xa0 kernel/workqueue.c:1774
route4_change+0x19ed/0x24a0 net/sched/cls_route.c:557
tc_new_tfilter+0x98d/0x2200 net/sched/cls_api.c:2148
rtnetlink_rcv_msg+0x946/0xc90 net/core/rtnetlink.c:6080

netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2501
netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
netlink_unicast+0x543/0x7f0 net/netlink/af_netlink.c:1345
netlink_sendmsg+0x917/0xe10 net/netlink/af_netlink.c:1921
sock_sendmsg_nosec net/socket.c:714 [inline]
sock_sendmsg+0xcf/0x120 net/socket.c:734
____sys_sendmsg+0x6eb/0x810 net/socket.c:2492
___sys_sendmsg+0xf3/0x170 net/socket.c:2546
__sys_sendmsg net/socket.c:2575 [inline]
__do_sys_sendmsg net/socket.c:2584 [inline]
__se_sys_sendmsg net/socket.c:2582 [inline]
__x64_sys_sendmsg+0x132/0x220 net/socket.c:2582
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0x80 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x46/0xb0

The buggy address belongs to the object at ffff888021de7700
which belongs to the cache kmalloc-192 of size 192
The buggy address is located 0 bytes inside of
192-byte region [ffff888021de7700, ffff888021de77c0)

The buggy address belongs to the physical page:
page:ffffea00008779c0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x21de7
flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000200 ffffea0000841500 dead000000000003 ffff888010c41a00
raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 1, tgid 1 (swapper/0), ts 10074698598, free_ts 0
prep_new_page mm/page_alloc.c:2456 [inline]
get_page_from_freelist+0x1290/0x3b70 mm/page_alloc.c:4198
__alloc_pages+0x1c7/0x510 mm/page_alloc.c:5426
alloc_page_interleave+0x1e/0x200 mm/mempolicy.c:2105
alloc_pages+0x2b1/0x310 mm/mempolicy.c:2267
alloc_slab_page mm/slub.c:1797 [inline]
allocate_slab+0x26c/0x3c0 mm/slub.c:1942
new_slab mm/slub.c:2002 [inline]
___slab_alloc+0x985/0xd90 mm/slub.c:3002
__slab_alloc.constprop.0+0x4d/0xa0 mm/slub.c:3089
slab_alloc_node mm/slub.c:3180 [inline]
slab_alloc mm/slub.c:3222 [inline]
kmem_cache_alloc_trace+0x310/0x3f0 mm/slub.c:3253
kmalloc include/linux/slab.h:600 [inline]
kzalloc include/linux/slab.h:733 [inline]
call_usermodehelper_setup+0x97/0x340 kernel/umh.c:365
kobject_uevent_env+0xefa/0x1660 lib/kobject_uevent.c:614
driver_register+0x2db/0x3a0 drivers/base/driver.c:248
usb_register_driver+0x249/0x460 drivers/usb/core/driver.c:1062
do_one_initcall+0x103/0x650 init/main.c:1295
do_initcall_level init/main.c:1368 [inline]
do_initcalls init/main.c:1384 [inline]
do_basic_setup init/main.c:1403 [inline]
kernel_init_freeable+0x6b1/0x73a init/main.c:1610
kernel_init+0x1a/0x1d0 init/main.c:1499
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302
page_owner free stack trace missing

Memory state around the buggy address:
ffff888021de7600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff888021de7680: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
>ffff888021de7700: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888021de7780: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
ffff888021de7800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================

Tested on:

commit: 018ab4fa netfs: fix up netfs_inode_init() docbook comm..

git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=12a20787f00000

kernel config: https://syzkaller.appspot.com/x/.config?x=f21890d74080ef72
dashboard link: https://syzkaller.appspot.com/bug?extid=2e3efb5eb71cb5075ba7
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2

patch: https://syzkaller.appspot.com/x/patch.diff?x=14dcf608080000

[Hillf Danton]

On Wed, 15 Jun 2022 05:32:08 -0700

To quiesce the warning,
v1, try to not queue rcu work more than once.
v2, serialize the change and destroy pathes.

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 018ab4fa

--- y/net/sched/cls_route.c
+++ c/net/sched/cls_route.c
@@ -43,10 +43,15 @@ struct route4_bucket {
struct rcu_head rcu;
};

+enum {
+ RT4_FILTER_FL_RCU_PENDING = 0,
+};
+
struct route4_filter {
struct route4_filter __rcu *next;
u32 id;
int iif;
+ unsigned long flag;

struct tcf_result res;
struct tcf_exts exts;
@@ -269,6 +274,8 @@ static void route4_delete_filter_work(st

static void route4_queue_work(struct route4_filter *f)
{
+ if (test_and_set_bit(RT4_FILTER_FL_RCU_PENDING, &f->flag))
+ return;
tcf_queue_work(&f->rwork, route4_delete_filter_work);
}

@@ -545,9 +552,13 @@ static int route4_change(struct net *net
route4_reset_fastmap(head);
*arg = f;
if (fold) {
+ if (flags & TCA_ACT_FLAGS_NO_RTNL)
+ rtnl_lock();

tcf_unbind_filter(tp, &fold->res);
tcf_exts_get_net(&fold->exts);
tcf_queue_work(&fold->rwork, route4_delete_filter_work);

+ if (flags & TCA_ACT_FLAGS_NO_RTNL)
+ rtnl_unlock();
}
return 0;

--

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:

WARNING: ODEBUG bug in route4_destroy

------------[ cut here ]------------
ODEBUG: activate active (active state 1) object type: rcu_head hint: 0x0

WARNING: CPU: 1 PID: 4134 at lib/debugobjects.c:502 debug_print_object+0x16e/0x250 lib/debugobjects.c:502
Modules linked in:
CPU: 0 PID: 4134 Comm: syz-executor.0 Not tainted 5.19.0-rc2-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011

RIP: 0010:debug_print_object+0x16e/0x250 lib/debugobjects.c:502
Code: ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 af 00 00 00 48 8b 14 dd e0 c5 27 8a 4c 89 ee 48 c7 c7 c0 b9 27 8a e8 f6 1b 30 05 <0f> 0b 83 05 35 22 c5 09 01 48 83 c4 18 5b 5d 41 5c 41 5d 41 5e c3

RSP: 0018:ffffc900031befb0 EFLAGS: 00010286

RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000000

RDX: ffff888025440000 RSI: ffffffff815fcd08 RDI: fffff52000637de8

RBP: 0000000000000001 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000080000000 R11: 0000000000000001 R12: ffffffff89cde060
R13: ffffffff8a27c080 R14: 0000000000000000 R15: ffffffff89cde060

FS: 00007f1daf655700(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 00007f1daf634718 CR3: 0000000024a07000 CR4: 00000000003506f0

DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
debug_object_activate+0x2da/0x3e0 lib/debugobjects.c:674
debug_rcu_head_queue kernel/rcu/rcu.h:178 [inline]
call_rcu+0x2c/0x790 kernel/rcu/tree.c:3111
queue_rcu_work+0x82/0xa0 kernel/workqueue.c:1774

route4_queue_work net/sched/cls_route.c:279 [inline]
route4_destroy+0x4e7/0x9d0 net/sched/cls_route.c:306

RSP: 002b:00007f1daf655188 EFLAGS: 00000246 ORIG_RAX: 000000000000002e

RAX: ffffffffffffffda RBX: 000000000056bf80 RCX: 00000000004665f9
RDX: 0000000000000000 RSI: 0000000020000040 RDI: 0000000000000004
RBP: 00000000004bfcc4 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf80

R13: 00007ffc31782fcf R14: 00007f1daf655300 R15: 0000000000022000
</TASK>

Tested on:

commit: 018ab4fa netfs: fix up netfs_inode_init() docbook comm..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git

console output: https://syzkaller.appspot.com/x/log.txt?x=107ff687f00000

kernel config: https://syzkaller.appspot.com/x/.config?x=f21890d74080ef72
dashboard link: https://syzkaller.appspot.com/bug?extid=2e3efb5eb71cb5075ba7
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2

patch: https://syzkaller.appspot.com/x/patch.diff?x=1703e12ff00000

[Hillf Danton]

On Wed, 15 Jun 2022 05:32:08 -0700

To quiesce the warning,
v1, try to not queue rcu work more than once.
v2, serialize the change and destroy pathes.

v3, put every tcf_queue_work() in route4_queue_work().

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 018ab4fa

--- y/net/sched/cls_route.c
+++ c/net/sched/cls_route.c
@@ -43,10 +43,15 @@ struct route4_bucket {
struct rcu_head rcu;
};

+enum {
+ RT4_FILTER_FL_RCU_PENDING = 0,
+};
+
struct route4_filter {
struct route4_filter __rcu *next;
u32 id;
int iif;
+ unsigned long flag;

struct tcf_result res;
struct tcf_exts exts;
@@ -269,6 +274,8 @@ static void route4_delete_filter_work(st

static void route4_queue_work(struct route4_filter *f)
{
+ if (test_and_set_bit(RT4_FILTER_FL_RCU_PENDING, &f->flag))
+ return;
tcf_queue_work(&f->rwork, route4_delete_filter_work);
}

@@ -341,7 +348,7 @@ static int route4_delete(struct tcf_prot
/* Delete it */
tcf_unbind_filter(tp, &f->res);
tcf_exts_get_net(&f->exts);
- tcf_queue_work(&f->rwork, route4_delete_filter_work);
+ route4_queue_work(f);

/* Strip RTNL protected tree */
for (i = 0; i <= 32; i++) {
@@ -547,7 +554,7 @@ static int route4_change(struct net *net
if (fold) {

tcf_unbind_filter(tp, &fold->res);
tcf_exts_get_net(&fold->exts);

- tcf_queue_work(&fold->rwork, route4_delete_filter_work);
+ route4_queue_work(fold);
}
return 0;

--

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: use-after-free Read in route4_destroy

==================================================================

BUG: KASAN: use-after-free in route4_destroy+0x82b/0x9a0 net/sched/cls_route.c:302
Read of size 8 at addr ffff88801f531d00 by task syz-executor.0/4165

CPU: 1 PID: 4165 Comm: syz-executor.0 Not tainted 5.19.0-rc2-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
print_address_description.constprop.0.cold+0xeb/0x495 mm/kasan/report.c:313
print_report mm/kasan/report.c:429 [inline]
kasan_report.cold+0xf4/0x1c6 mm/kasan/report.c:491

route4_destroy+0x82b/0x9a0 net/sched/cls_route.c:302

RSP: 002b:00007f6148fc7188 EFLAGS: 00000246 ORIG_RAX: 000000000000002e

RAX: ffffffffffffffda RBX: 000000000056bf80 RCX: 00000000004665f9
RDX: 0000000000000000 RSI: 0000000020000040 RDI: 0000000000000004
RBP: 00000000004bfcc4 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf80

R13: 00007ffdd1fe3e1f R14: 00007f6148fc7300 R15: 0000000000022000
</TASK>

Allocated by task 4161:

kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
kasan_set_track mm/kasan/common.c:45 [inline]
set_alloc_info mm/kasan/common.c:436 [inline]
____kasan_kmalloc mm/kasan/common.c:515 [inline]
____kasan_kmalloc mm/kasan/common.c:474 [inline]
__kasan_kmalloc+0xa9/0xd0 mm/kasan/common.c:524
kmalloc include/linux/slab.h:600 [inline]
kzalloc include/linux/slab.h:733 [inline]

route4_change+0x28c/0x2490 net/sched/cls_route.c:500

tc_new_tfilter+0x98d/0x2200 net/sched/cls_api.c:2148
rtnetlink_rcv_msg+0x946/0xc90 net/core/rtnetlink.c:6080
netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2501
netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
netlink_unicast+0x543/0x7f0 net/netlink/af_netlink.c:1345
netlink_sendmsg+0x917/0xe10 net/netlink/af_netlink.c:1921
sock_sendmsg_nosec net/socket.c:714 [inline]
sock_sendmsg+0xcf/0x120 net/socket.c:734
____sys_sendmsg+0x6eb/0x810 net/socket.c:2492
___sys_sendmsg+0xf3/0x170 net/socket.c:2546
__sys_sendmsg net/socket.c:2575 [inline]
__do_sys_sendmsg net/socket.c:2584 [inline]
__se_sys_sendmsg net/socket.c:2582 [inline]
__x64_sys_sendmsg+0x132/0x220 net/socket.c:2582
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0x80 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x46/0xb0

Freed by task 8:

route4_queue_work+0x46/0x50 net/sched/cls_route.c:279
route4_change+0x19e5/0x2490 net/sched/cls_route.c:557

tc_new_tfilter+0x98d/0x2200 net/sched/cls_api.c:2148
rtnetlink_rcv_msg+0x946/0xc90 net/core/rtnetlink.c:6080
netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2501
netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
netlink_unicast+0x543/0x7f0 net/netlink/af_netlink.c:1345
netlink_sendmsg+0x917/0xe10 net/netlink/af_netlink.c:1921
sock_sendmsg_nosec net/socket.c:714 [inline]
sock_sendmsg+0xcf/0x120 net/socket.c:734
____sys_sendmsg+0x6eb/0x810 net/socket.c:2492
___sys_sendmsg+0xf3/0x170 net/socket.c:2546
__sys_sendmsg net/socket.c:2575 [inline]
__do_sys_sendmsg net/socket.c:2584 [inline]
__se_sys_sendmsg net/socket.c:2582 [inline]
__x64_sys_sendmsg+0x132/0x220 net/socket.c:2582
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0x80 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x46/0xb0

The buggy address belongs to the object at ffff88801f531d00

which belongs to the cache kmalloc-192 of size 192
The buggy address is located 0 bytes inside of

192-byte region [ffff88801f531d00, ffff88801f531dc0)

The buggy address belongs to the physical page:

page:ffffea00007d4c40 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1f531

flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)

raw: 00fff00000000200 ffffea00007d2200 dead000000000002 ffff888010c41a00

raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated

page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 1, tgid 1 (swapper/0), ts 7564804891, free_ts 7198223118

prep_new_page mm/page_alloc.c:2456 [inline]
get_page_from_freelist+0x1290/0x3b70 mm/page_alloc.c:4198
__alloc_pages+0x1c7/0x510 mm/page_alloc.c:5426
alloc_page_interleave+0x1e/0x200 mm/mempolicy.c:2105
alloc_pages+0x2b1/0x310 mm/mempolicy.c:2267
alloc_slab_page mm/slub.c:1797 [inline]
allocate_slab+0x26c/0x3c0 mm/slub.c:1942
new_slab mm/slub.c:2002 [inline]
___slab_alloc+0x985/0xd90 mm/slub.c:3002
__slab_alloc.constprop.0+0x4d/0xa0 mm/slub.c:3089
slab_alloc_node mm/slub.c:3180 [inline]
slab_alloc mm/slub.c:3222 [inline]
kmem_cache_alloc_trace+0x310/0x3f0 mm/slub.c:3253
kmalloc include/linux/slab.h:600 [inline]

__usb_create_hcd+0x7af/0xa70 drivers/usb/core/hcd.c:2588
vhci_hcd_probe+0xfb/0x3a0 drivers/usb/usbip/vhci_hcd.c:1351
platform_probe+0xfc/0x1f0 drivers/base/platform.c:1400
call_driver_probe drivers/base/dd.c:555 [inline]
really_probe+0x23e/0xb90 drivers/base/dd.c:634
__driver_probe_device+0x338/0x4d0 drivers/base/dd.c:764
driver_probe_device+0x4c/0x1a0 drivers/base/dd.c:794
__device_attach_driver+0x20b/0x2f0 drivers/base/dd.c:917
bus_for_each_drv+0x15f/0x1e0 drivers/base/bus.c:427
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1371 [inline]
free_pcp_prepare+0x549/0xd20 mm/page_alloc.c:1421
free_unref_page_prepare mm/page_alloc.c:3343 [inline]
free_unref_page+0x19/0x6a0 mm/page_alloc.c:3438
__vunmap+0x85d/0xd30 mm/vmalloc.c:2665
free_work+0x58/0x70 mm/vmalloc.c:97

process_one_work+0x996/0x1610 kernel/workqueue.c:2289
worker_thread+0x665/0x1080 kernel/workqueue.c:2436
kthread+0x2e9/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302

Memory state around the buggy address:

ffff88801f531c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff88801f531c80: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc
>ffff88801f531d00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88801f531d80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
ffff88801f531e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

==================================================================


Tested on:

commit: 018ab4fa netfs: fix up netfs_inode_init() docbook comm..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git

console output: https://syzkaller.appspot.com/x/log.txt?x=12b25a7ff00000

kernel config: https://syzkaller.appspot.com/x/.config?x=f21890d74080ef72
dashboard link: https://syzkaller.appspot.com/bug?extid=2e3efb5eb71cb5075ba7
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2

patch: https://syzkaller.appspot.com/x/patch.diff?x=17eb91a7f00000

[Hillf Danton]

On Wed, 15 Jun 2022 05:32:08 -0700

To quiesce the warning,
v1, try to not queue rcu work more than once.
v2, serialize the change and destroy pathes.
v3, put every tcf_queue_work() in route4_queue_work().

v4, v2 + v3

@@ -514,6 +521,8 @@ static int route4_change(struct net *net
if (err < 0)
goto errout;

+ if (flags & TCA_ACT_FLAGS_NO_RTNL)
+ rtnl_lock();

h = from_hash(f->handle >> 16);
fp = &f->bkt->ht[h];
for (pfp = rtnl_dereference(*fp);
@@ -547,8 +556,10 @@ static int route4_change(struct net *net

if (fold) {
tcf_unbind_filter(tp, &fold->res);
tcf_exts_get_net(&fold->exts);
- tcf_queue_work(&fold->rwork, route4_delete_filter_work);
+ route4_queue_work(fold);
}

+ if (flags & TCA_ACT_FLAGS_NO_RTNL)
+ rtnl_unlock();
return 0;

errout:
--

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: use-after-free Read in route4_destroy

==================================================================

BUG: KASAN: use-after-free in route4_destroy+0x82b/0x9a0 net/sched/cls_route.c:302
BUG: KASAN: use-after-free in route4_destroy+0x82b/0x9a0 net/sched/cls_route.c:302
Read of size 8 at addr ffff88802160ec00 by task syz-executor.0/4173

CPU: 0 PID: 4173 Comm: syz-executor.0 Not tainted 5.19.0-rc2-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
print_address_description.constprop.0.cold+0xeb/0x495 mm/kasan/report.c:313
print_report mm/kasan/report.c:429 [inline]
kasan_report.cold+0xf4/0x1c6 mm/kasan/report.c:491

route4_destroy+0x82b/0x9a0 net/sched/cls_route.c:302

RSP: 002b:00007fe70b8b5188 EFLAGS: 00000246 ORIG_RAX: 000000000000002e

RAX: ffffffffffffffda RBX: 000000000056bf80 RCX: 00000000004665f9
RDX: 0000000000000000 RSI: 0000000020000040 RDI: 0000000000000004
RBP: 00000000004bfcc4 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf80

R13: 00007ffdfeb02b6f R14: 00007fe70b8b5300 R15: 0000000000022000
</TASK>

Allocated by task 4169:

kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
kasan_set_track mm/kasan/common.c:45 [inline]
set_alloc_info mm/kasan/common.c:436 [inline]
____kasan_kmalloc mm/kasan/common.c:515 [inline]
____kasan_kmalloc mm/kasan/common.c:474 [inline]
__kasan_kmalloc+0xa9/0xd0 mm/kasan/common.c:524
kmalloc include/linux/slab.h:600 [inline]
kzalloc include/linux/slab.h:733 [inline]

route4_change+0x28c/0x2450 net/sched/cls_route.c:500

tc_new_tfilter+0x98d/0x2200 net/sched/cls_api.c:2148
rtnetlink_rcv_msg+0x946/0xc90 net/core/rtnetlink.c:6080
netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2501
netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
netlink_unicast+0x543/0x7f0 net/netlink/af_netlink.c:1345
netlink_sendmsg+0x917/0xe10 net/netlink/af_netlink.c:1921
sock_sendmsg_nosec net/socket.c:714 [inline]
sock_sendmsg+0xcf/0x120 net/socket.c:734
____sys_sendmsg+0x6eb/0x810 net/socket.c:2492
___sys_sendmsg+0xf3/0x170 net/socket.c:2546
__sys_sendmsg net/socket.c:2575 [inline]
__do_sys_sendmsg net/socket.c:2584 [inline]
__se_sys_sendmsg net/socket.c:2582 [inline]
__x64_sys_sendmsg+0x132/0x220 net/socket.c:2582
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0x80 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x46/0xb0

Freed by task 1312:

route4_queue_work+0x46/0x50 net/sched/cls_route.c:279
route4_change+0x1a73/0x2450 net/sched/cls_route.c:559

tc_new_tfilter+0x98d/0x2200 net/sched/cls_api.c:2148
rtnetlink_rcv_msg+0x946/0xc90 net/core/rtnetlink.c:6080
netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2501
netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
netlink_unicast+0x543/0x7f0 net/netlink/af_netlink.c:1345
netlink_sendmsg+0x917/0xe10 net/netlink/af_netlink.c:1921
sock_sendmsg_nosec net/socket.c:714 [inline]
sock_sendmsg+0xcf/0x120 net/socket.c:734
____sys_sendmsg+0x6eb/0x810 net/socket.c:2492
___sys_sendmsg+0xf3/0x170 net/socket.c:2546
__sys_sendmsg net/socket.c:2575 [inline]
__do_sys_sendmsg net/socket.c:2584 [inline]
__se_sys_sendmsg net/socket.c:2582 [inline]
__x64_sys_sendmsg+0x132/0x220 net/socket.c:2582
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0x80 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x46/0xb0

The buggy address belongs to the object at ffff88802160ec00

which belongs to the cache kmalloc-192 of size 192
The buggy address is located 0 bytes inside of

192-byte region [ffff88802160ec00, ffff88802160ecc0)

The buggy address belongs to the physical page:

page:ffffea0000858380 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2160e

flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)

raw: 00fff00000000200 ffffea0000848740 dead000000000002 ffff888010c41a00

raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated

page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 1, tgid 1 (swapper/0), ts 9272225302, free_ts 9271655317

page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1371 [inline]
free_pcp_prepare+0x549/0xd20 mm/page_alloc.c:1421
free_unref_page_prepare mm/page_alloc.c:3343 [inline]

free_unref_page_list+0x16f/0xf80 mm/page_alloc.c:3475
release_pages+0xff1/0x2290 mm/swap.c:980
tlb_batch_pages_flush+0xa8/0x1a0 mm/mmu_gather.c:58
tlb_flush_mmu_free mm/mmu_gather.c:255 [inline]
tlb_flush_mmu mm/mmu_gather.c:262 [inline]
tlb_finish_mmu+0x147/0x7e0 mm/mmu_gather.c:353
exit_mmap+0x1de/0x4a0 mm/mmap.c:3164
__mmput+0x122/0x4b0 kernel/fork.c:1187
mmput+0x56/0x60 kernel/fork.c:1208
free_bprm+0x65/0x2e0 fs/exec.c:1486
kernel_execve+0x3fa/0x500 fs/exec.c:2005
call_usermodehelper_exec_async+0x2e3/0x580 kernel/umh.c:112
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302

Memory state around the buggy address:

ffff88802160eb00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff88802160eb80: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc
>ffff88802160ec00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88802160ec80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
ffff88802160ed00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

==================================================================


Tested on:

commit: 018ab4fa netfs: fix up netfs_inode_init() docbook comm..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git

console output: https://syzkaller.appspot.com/x/log.txt?x=144269e8080000

kernel config: https://syzkaller.appspot.com/x/.config?x=f21890d74080ef72
dashboard link: https://syzkaller.appspot.com/bug?extid=2e3efb5eb71cb5075ba7
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2

patch: https://syzkaller.appspot.com/x/patch.diff?x=1461c9a7f00000

[Hillf Danton]

On Wed, 15 Jun 2022 05:32:08 -0700

To quiesce the warning,
v1, try to not queue rcu work more than once.
v2, serialize the change and destroy pathes.
v3, put every tcf_queue_work() in route4_queue_work().
v4, v2 + v3

v5, see if rtnl_held is not s mess.

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 018ab4fa

--- y/net/sched/cls_route.c
+++ c/net/sched/cls_route.c
@@ -43,10 +43,15 @@ struct route4_bucket {
struct rcu_head rcu;
};

+enum {
+ RT4_FILTER_FL_RCU_PENDING = 0,
+};
+
struct route4_filter {
struct route4_filter __rcu *next;
u32 id;
int iif;
+ unsigned long flag;

struct tcf_result res;
struct tcf_exts exts;
@@ -269,6 +274,8 @@ static void route4_delete_filter_work(st

static void route4_queue_work(struct route4_filter *f)
{
+ if (test_and_set_bit(RT4_FILTER_FL_RCU_PENDING, &f->flag))
+ return;
tcf_queue_work(&f->rwork, route4_delete_filter_work);
}

@@ -281,6 +288,9 @@ static void route4_destroy(struct tcf_pr
if (head == NULL)
return;

+ BUG_ON(rtnl_held && rtnl_trylock());
+ if (!rtnl_held)
+ rtnl_lock();
for (h1 = 0; h1 <= 256; h1++) {
struct route4_bucket *b;

@@ -306,6 +316,8 @@ static void route4_destroy(struct tcf_pr
}
}
kfree_rcu(head, rcu);
+ if (!rtnl_held)
+ rtnl_unlock();
}

static int route4_delete(struct tcf_proto *tp, void *arg, bool *last,
@@ -341,7 +353,7 @@ static int route4_delete(struct tcf_prot

/* Delete it */
tcf_unbind_filter(tp, &f->res);
tcf_exts_get_net(&f->exts);
- tcf_queue_work(&f->rwork, route4_delete_filter_work);
+ route4_queue_work(f);

/* Strip RTNL protected tree */
for (i = 0; i <= 32; i++) {

@@ -514,6 +526,8 @@ static int route4_change(struct net *net

if (err < 0)
goto errout;

+ if (flags & TCA_ACT_FLAGS_NO_RTNL)
+ rtnl_lock();
h = from_hash(f->handle >> 16);
fp = &f->bkt->ht[h];
for (pfp = rtnl_dereference(*fp);

@@ -547,8 +561,10 @@ static int route4_change(struct net *net

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: use-after-free Read in route4_destroy

==================================================================

BUG: KASAN: use-after-free in route4_destroy+0x852/0xa10 net/sched/cls_route.c:305
Read of size 8 at addr ffff88801fcbe000 by task syz-executor.0/4164

CPU: 1 PID: 4164 Comm: syz-executor.0 Not tainted 5.19.0-rc2-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
print_address_description.constprop.0.cold+0xeb/0x495 mm/kasan/report.c:313
print_report mm/kasan/report.c:429 [inline]
kasan_report.cold+0xf4/0x1c6 mm/kasan/report.c:491

route4_destroy+0x852/0xa10 net/sched/cls_route.c:305

RSP: 002b:00007fd7310da188 EFLAGS: 00000246 ORIG_RAX: 000000000000002e

RAX: ffffffffffffffda RBX: 000000000056bf80 RCX: 00000000004665f9
RDX: 0000000000000000 RSI: 0000000020000040 RDI: 0000000000000004
RBP: 00000000004bfcc4 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf80

R13: 00007ffc67b9e05f R14: 00007fd7310da300 R15: 0000000000022000
</TASK>

Allocated by task 4160:

kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
kasan_set_track mm/kasan/common.c:45 [inline]
set_alloc_info mm/kasan/common.c:436 [inline]
____kasan_kmalloc mm/kasan/common.c:515 [inline]
____kasan_kmalloc mm/kasan/common.c:474 [inline]
__kasan_kmalloc+0xa9/0xd0 mm/kasan/common.c:524
kmalloc include/linux/slab.h:600 [inline]
kzalloc include/linux/slab.h:733 [inline]

route4_change+0x28c/0x2450 net/sched/cls_route.c:505

tc_new_tfilter+0x98d/0x2200 net/sched/cls_api.c:2148
rtnetlink_rcv_msg+0x946/0xc90 net/core/rtnetlink.c:6080
netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2501
netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
netlink_unicast+0x543/0x7f0 net/netlink/af_netlink.c:1345
netlink_sendmsg+0x917/0xe10 net/netlink/af_netlink.c:1921
sock_sendmsg_nosec net/socket.c:714 [inline]
sock_sendmsg+0xcf/0x120 net/socket.c:734
____sys_sendmsg+0x6eb/0x810 net/socket.c:2492
___sys_sendmsg+0xf3/0x170 net/socket.c:2546
__sys_sendmsg net/socket.c:2575 [inline]
__do_sys_sendmsg net/socket.c:2584 [inline]
__se_sys_sendmsg net/socket.c:2582 [inline]
__x64_sys_sendmsg+0x132/0x220 net/socket.c:2582
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0x80 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x46/0xb0

Freed by task 1095:

route4_queue_work+0x46/0x50 net/sched/cls_route.c:279
route4_change+0x1a73/0x2450 net/sched/cls_route.c:564

tc_new_tfilter+0x98d/0x2200 net/sched/cls_api.c:2148
rtnetlink_rcv_msg+0x946/0xc90 net/core/rtnetlink.c:6080
netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2501
netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
netlink_unicast+0x543/0x7f0 net/netlink/af_netlink.c:1345
netlink_sendmsg+0x917/0xe10 net/netlink/af_netlink.c:1921
sock_sendmsg_nosec net/socket.c:714 [inline]
sock_sendmsg+0xcf/0x120 net/socket.c:734
____sys_sendmsg+0x6eb/0x810 net/socket.c:2492
___sys_sendmsg+0xf3/0x170 net/socket.c:2546
__sys_sendmsg net/socket.c:2575 [inline]
__do_sys_sendmsg net/socket.c:2584 [inline]
__se_sys_sendmsg net/socket.c:2582 [inline]
__x64_sys_sendmsg+0x132/0x220 net/socket.c:2582
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0x80 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x46/0xb0

The buggy address belongs to the object at ffff88801fcbe000

which belongs to the cache kmalloc-192 of size 192
The buggy address is located 0 bytes inside of

192-byte region [ffff88801fcbe000, ffff88801fcbe0c0)

The buggy address belongs to the physical page:

page:ffffea00007f2f80 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1fcbe

flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)

raw: 00fff00000000200 ffffea00007d50c0 dead000000000002 ffff888010c41a00
raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000

page dumped because: kasan: bad access detected
page_owner tracks the page as allocated

page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12c00(GFP_NOIO|__GFP_NOWARN|__GFP_NORETRY), pid 146, tgid 146 (kworker/0:2), ts 9150330232, free_ts 9143712005

prep_new_page mm/page_alloc.c:2456 [inline]
get_page_from_freelist+0x1290/0x3b70 mm/page_alloc.c:4198
__alloc_pages+0x1c7/0x510 mm/page_alloc.c:5426

alloc_pages+0x1aa/0x310 mm/mempolicy.c:2272

alloc_slab_page mm/slub.c:1797 [inline]
allocate_slab+0x26c/0x3c0 mm/slub.c:1942
new_slab mm/slub.c:2002 [inline]
___slab_alloc+0x985/0xd90 mm/slub.c:3002
__slab_alloc.constprop.0+0x4d/0xa0 mm/slub.c:3089
slab_alloc_node mm/slub.c:3180 [inline]
slab_alloc mm/slub.c:3222 [inline]

__kmalloc+0x318/0x350 mm/slub.c:4413
kmalloc include/linux/slab.h:605 [inline]
usb_alloc_urb+0xa5/0xb0 drivers/usb/core/urb.c:74
usb_internal_control_msg drivers/usb/core/message.c:95 [inline]
usb_control_msg+0x1c9/0x4a0 drivers/usb/core/message.c:153
get_port_status drivers/usb/core/hub.c:580 [inline]
hub_ext_port_status+0x112/0x450 drivers/usb/core/hub.c:597
hub_port_status drivers/usb/core/hub.c:619 [inline]
hub_activate+0xa5c/0x1c90 drivers/usb/core/hub.c:1129

process_one_work+0x996/0x1610 kernel/workqueue.c:2289
worker_thread+0x665/0x1080 kernel/workqueue.c:2436
kthread+0x2e9/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302

page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1371 [inline]
free_pcp_prepare+0x549/0xd20 mm/page_alloc.c:1421
free_unref_page_prepare mm/page_alloc.c:3343 [inline]

free_unref_page+0x19/0x6a0 mm/page_alloc.c:3438
mm_free_pgd kernel/fork.c:737 [inline]
__mmdrop+0xcb/0x3f0 kernel/fork.c:788
mmdrop include/linux/sched/mm.h:50 [inline]
__mmput+0x3f1/0x4b0 kernel/fork.c:1197

mmput+0x56/0x60 kernel/fork.c:1208
free_bprm+0x65/0x2e0 fs/exec.c:1486
kernel_execve+0x3fa/0x500 fs/exec.c:2005
call_usermodehelper_exec_async+0x2e3/0x580 kernel/umh.c:112
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302

Memory state around the buggy address:

ffff88801fcbdf00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88801fcbdf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88801fcbe000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88801fcbe080: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
ffff88801fcbe100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

==================================================================


Tested on:

commit: 018ab4fa netfs: fix up netfs_inode_init() docbook comm..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git

console output: https://syzkaller.appspot.com/x/log.txt?x=13ff8ac3f00000

kernel config: https://syzkaller.appspot.com/x/.config?x=f21890d74080ef72
dashboard link: https://syzkaller.appspot.com/bug?extid=2e3efb5eb71cb5075ba7
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2

patch: https://syzkaller.appspot.com/x/patch.diff?x=14a571a7f00000

[Hillf Danton]

On Wed, 15 Jun 2022 05:32:08 -0700

To quiesce the warning,
v1, try to not queue rcu work more than once.
v2, serialize the change and destroy pathes.
v3, put every tcf_queue_work() in route4_queue_work().
v4, v2 + v3
v5, see if rtnl_held is not s mess.

v6, select victim to free.

@@ -476,6 +488,7 @@ static int route4_change(struct net *net
unsigned int h, th;
int err;
bool new = true;
+ struct route4_filter *victim = NULL;

if (opt == NULL)
return handle ? -EINVAL : 0;
@@ -514,6 +527,8 @@ static int route4_change(struct net *net

if (err < 0)
goto errout;

+ if (flags & TCA_ACT_FLAGS_NO_RTNL)
+ rtnl_lock();
h = from_hash(f->handle >> 16);
fp = &f->bkt->ht[h];
for (pfp = rtnl_dereference(*fp);

@@ -536,6 +551,7 @@ static int route4_change(struct net *net
fp = &pfp->next, pfp = rtnl_dereference(*fp)) {
if (pfp == fold) {
rcu_assign_pointer(*fp, fold->next);
+ victim = fold;
break;
}
}
@@ -544,11 +560,14 @@ static int route4_change(struct net *net

route4_reset_fastmap(head);
*arg = f;
- if (fold) {
+ if (victim) {
+ fold = victim;

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-and-tested-by: syzbot+2e3efb...@syzkaller.appspotmail.com

Tested on:

commit: 018ab4fa netfs: fix up netfs_inode_init() docbook comm..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git

console output: https://syzkaller.appspot.com/x/log.txt?x=167212c3f00000

kernel config: https://syzkaller.appspot.com/x/.config?x=f21890d74080ef72
dashboard link: https://syzkaller.appspot.com/bug?extid=2e3efb5eb71cb5075ba7
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2

patch: https://syzkaller.appspot.com/x/patch.diff?x=15b2f608080000

[Hillf Danton]

On Wed, 15 Jun 2022 05:32:08 -0700

To quiesce the warning,
v1, try to not queue rcu work more than once.
v2, serialize the change and destroy pathes.
v3, put every tcf_queue_work() in route4_queue_work().
v4, v2 + v3
v5, see if rtnl_held is not s mess.
v6, select victim to free.

v7, v6 with nothing else.

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 018ab4fa

--- y/net/sched/cls_route.c
+++ c/net/sched/cls_route.c

@@ -476,6 +476,7 @@ static int route4_change(struct net *net

unsigned int h, th;
int err;
bool new = true;
+ struct route4_filter *victim = NULL;

if (opt == NULL)
return handle ? -EINVAL : 0;

@@ -536,6 +537,7 @@ static int route4_change(struct net *net

fp = &pfp->next, pfp = rtnl_dereference(*fp)) {
if (pfp == fold) {
rcu_assign_pointer(*fp, fold->next);
+ victim = fold;
break;
}
}

@@ -544,7 +546,8 @@ static int route4_change(struct net *net

route4_reset_fastmap(head);
*arg = f;
- if (fold) {
+ if (victim) {
+ fold = victim;
tcf_unbind_filter(tp, &fold->res);
tcf_exts_get_net(&fold->exts);

tcf_queue_work(&fold->rwork, route4_delete_filter_work);
--

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-and-tested-by: syzbot+2e3efb...@syzkaller.appspotmail.com

Tested on:

commit: 018ab4fa netfs: fix up netfs_inode_init() docbook comm..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git

console output: https://syzkaller.appspot.com/x/log.txt?x=10c31fbff00000

kernel config: https://syzkaller.appspot.com/x/.config?x=f21890d74080ef72
dashboard link: https://syzkaller.appspot.com/bug?extid=2e3efb5eb71cb5075ba7
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2

patch: https://syzkaller.appspot.com/x/patch.diff?x=1627e7a0080000

[Zhen Chen]

#syz test git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

---
diff --git a/net/sched/cls_route.c b/net/sched/cls_route.c
index a35ab8c27866..3917b84700b4 100644
--- a/net/sched/cls_route.c
+++ b/net/sched/cls_route.c
@@ -536,6 +536,9 @@ static int route4_change(struct net *net, struct sk_buff *in_skb,

fp = &pfp->next, pfp = rtnl_dereference(*fp)) {
if (pfp == fold) {
rcu_assign_pointer(*fp, fold->next);

+ tcf_unbind_filter(tp, &fold->res);
+ tcf_exts_get_net(&fold->exts);
+ tcf_queue_work(&fold->rwork, route4_delete_filter_work);
break;
}
}
@@ -544,11 +547,6 @@ static int route4_change(struct net *net, struct sk_buff *in_skb,

route4_reset_fastmap(head);
*arg = f;
- if (fold) {

- tcf_unbind_filter(tp, &fold->res);
- tcf_exts_get_net(&fold->exts);
- tcf_queue_work(&fold->rwork, route4_delete_filter_work);
- }
return 0;

errout:
--

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-and-tested-by: syzbot+2e3efb...@syzkaller.appspotmail.com

Tested on:

commit: 4b35035b Merge tag 'nfs-for-5.19-2' of git://git.linux..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1303abe8080000
kernel config: https://syzkaller.appspot.com/x/.config?x=439fe1b4cca59451

dashboard link: https://syzkaller.appspot.com/bug?extid=2e3efb5eb71cb5075ba7
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2

patch: https://syzkaller.appspot.com/x/patch.diff?x=13da787bf00000

[syzbot]

Auto-closing this bug as obsolete.
No recent activity, existing reproducers are no longer triggering the issue.