Jamie Iles
b9ad3e9f5a
bonding: wait for sysfs kobject destruction before freeing struct slave ...
syzkaller found that with CONFIG_DEBUG_KOBJECT_RELEASE=y, releasing a
struct slave device could result in the following splat:
kobject: 'bonding_slave' (00000000cecdd4fe): kobject_release, parent 0000000074ceb2b2 (delayed 1000)
bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
------------[ cut here ]------------
ODEBUG: free active (active state 0) object type: timer_list hint: workqueue_select_cpu_near kernel/workqueue.c:1549 [inline]
ODEBUG: free active (active state 0) object type: timer_list hint: delayed_work_timer_fn+0x0/0x98 kernel/workqueue.c:1600
WARNING: CPU: 1 PID: 842 at lib/debugobjects.c:485 debug_print_object+0x180/0x240 lib/debugobjects.c:485
Kernel panic - not syncing: panic_on_warn set ...
CPU: 1 PID: 842 Comm: kworker/u4:4 Tainted: G S 5.9.0-rc8+ #96
Hardware name: linux,dummy-virt (DT)
Workqueue: netns cleanup_net
Call trace:
dump_backtrace+0x0/0x4d8 include/linux/bitmap.h:239
show_stack+0x34/0x48 arch/arm64/kernel/traps.c:142
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x174/0x1f8 lib/dump_stack.c:118
panic+0x360/0x7a0 kernel/panic.c:231
__warn+0x244/0x2ec kernel/panic.c:600
report_bug+0x240/0x398 lib/bug.c:198
bug_handler+0x50/0xc0 arch/arm64/kernel/traps.c:974
call_break_hook+0x160/0x1d8 arch/arm64/kernel/debug-monitors.c:322
brk_handler+0x30/0xc0 arch/arm64/kernel/debug-monitors.c:329
do_debug_exception+0x184/0x340 arch/arm64/mm/fault.c:864
el1_dbg+0x48/0xb0 arch/arm64/kernel/entry-common.c:65
el1_sync_handler+0x170/0x1c8 arch/arm64/kernel/entry-common.c:93
el1_sync+0x80/0x100 arch/arm64/kernel/entry.S:594
debug_print_object+0x180/0x240 lib/debugobjects.c:485
__debug_check_no_obj_freed lib/debugobjects.c:967 [inline]
debug_check_no_obj_freed+0x200/0x430 lib/debugobjects.c:998
slab_free_hook mm/slub.c:1536 [inline]
slab_free_freelist_hook+0x190/0x210 mm/slub.c:1577
slab_free mm/slub.c:3138 [inline]
kfree+0x13c/0x460 mm/slub.c:4119
bond_free_slave+0x8c/0xf8 drivers/net/bonding/bond_main.c:1492
__bond_release_one+0xe0c/0xec8 drivers/net/bonding/bond_main.c:2190
bond_slave_netdev_event drivers/net/bonding/bond_main.c:3309 [inline]
bond_netdev_event+0x8f0/0xa70 drivers/net/bonding/bond_main.c:3420
notifier_call_chain+0xf0/0x200 kernel/notifier.c:83
__raw_notifier_call_chain kernel/notifier.c:361 [inline]
raw_notifier_call_chain+0x44/0x58 kernel/notifier.c:368
call_netdevice_notifiers_info+0xbc/0x150 net/core/dev.c:2033
call_netdevice_notifiers_extack net/core/dev.c:2045 [inline]
call_netdevice_notifiers net/core/dev.c:2059 [inline]
rollback_registered_many+0x6a4/0xec0 net/core/dev.c:9347
unregister_netdevice_many.part.0+0x2c/0x1c0 net/core/dev.c:10509
unregister_netdevice_many net/core/dev.c:10508 [inline]
default_device_exit_batch+0x294/0x338 net/core/dev.c:10992
ops_exit_list.isra.0+0xec/0x150 net/core/net_namespace.c:189
cleanup_net+0x44c/0x888 net/core/net_namespace.c:603
process_one_work+0x96c/0x18c0 kernel/workqueue.c:2269
worker_thread+0x3f0/0xc30 kernel/workqueue.c:2415
kthread+0x390/0x498 kernel/kthread.c:292
ret_from_fork+0x10/0x18 arch/arm64/kernel/entry.S:925
This is a potential use-after-free if the sysfs nodes are being accessed
whilst removing the struct slave, so wait for the object destruction to
complete before freeing the struct slave itself.
Fixes: 07699f9a7c8d ("bonding: add sysfs /slave dir for bond slave devices.")
Fixes: a068aab42258 ("bonding: Fix reference count leak in bond_sysfs_slave_add.")
Cc: Qiushi Wu <wu000273@umn.edu>
Cc: Jay Vosburgh <j.vosburgh@gmail.com>
Cc: Veaceslav Falico <vfalico@gmail.com>
Cc: Andy Gospodarek <andy@greyhouse.net>
Signed-off-by: Jamie Iles <jamie@nuviainc.com>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Link: https://lore.kernel.org/r/20201120142827.879226-1-jamie@nuviainc.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2020-11-21 13:07:00 -08:00
2020-07-15 20:34:11 -07:00
2020-09-25 20:21:55 +02:00
2020-09-29 14:02:53 -07:00
2020-05-19 12:50:14 -07:00
2020-10-20 13:54:54 +02:00
2020-10-12 10:06:39 +02:00
2020-02-27 12:06:20 -08:00
2019-06-05 17:37:07 +02:00
2020-09-20 14:15:12 -07:00
2020-10-15 12:43:21 -07:00
2020-02-28 14:51:30 +01:00
2020-09-24 19:46:21 -07:00
2020-08-18 15:58:53 -07:00
2019-05-30 11:26:41 -07:00
2020-08-20 18:21:28 +01:00
2020-02-28 12:12:53 -08:00
2019-12-11 15:01:23 -08:00
2019-11-06 16:14:48 -08:00
2019-01-23 11:18:00 -08:00
2019-06-19 17:09:55 +02:00
2020-07-21 18:30:47 -07:00
2019-05-24 17:37:53 +02:00
2020-05-01 12:15:37 -07:00
2019-07-04 12:30:48 -07:00
2020-11-21 13:07:00 -08:00
2020-09-25 13:58:01 -07:00
2020-06-20 17:30:59 -07:00
2019-05-21 11:28:45 +02:00
2019-06-19 17:09:55 +02:00
2020-10-30 10:06:09 +01:00
2020-02-29 14:39:08 +01:00
2020-08-20 15:45:15 -04:00
2020-07-15 07:45:24 -07:00
2020-03-27 19:40:38 -07:00
2020-07-19 18:16:40 -07:00
2019-05-30 11:29:52 -07:00
2019-05-30 11:29:52 -07:00
2020-10-09 12:06:53 -07:00
2020-02-29 21:52:20 -08:00
2019-05-21 11:52:39 +02:00
2019-05-21 11:52:39 +02:00
2020-10-05 05:56:48 -07:00
2019-12-16 16:09:44 -08:00
2020-05-08 21:33:33 -07:00
2020-08-31 12:33:34 -07:00
2020-05-05 13:23:29 -07:00
2020-02-19 13:52:32 +01:00
2020-04-20 07:34:16 +02:00
2019-06-19 17:09:55 +02:00
2019-12-24 22:37:30 -08:00
2020-07-28 17:42:31 -07:00
2020-07-24 15:23:31 -07:00
2020-08-05 20:13:21 -07:00
2020-09-14 14:54:56 -07:00
2020-07-31 09:24:24 +02:00
2020-07-31 09:24:24 +02:00
2019-12-09 10:36:44 -08:00
2019-11-05 18:20:55 -08:00
2020-10-05 18:40:01 -07:00
2019-03-22 12:09:31 -07:00
2018-12-10 15:53:04 -08:00
2020-06-22 21:12:44 -07:00
2019-10-25 16:24:32 -07:00
2020-02-13 14:19:00 -08:00
2020-07-31 09:27:00 +02:00
2019-05-30 11:26:41 -07:00
2020-05-11 13:18:54 -07:00
2019-04-22 21:50:53 -07:00
2019-05-30 11:26:32 -07:00
2019-05-30 11:26:32 -07:00
2020-03-30 13:45:04 -07:00
2020-05-09 00:48:20 +02:00
2020-09-30 14:21:30 -07:00
2020-07-03 14:34:53 -07:00
2019-08-08 15:55:10 -07:00
2020-06-09 13:26:23 -07:00
2020-08-26 07:33:19 -07:00
2019-09-27 12:05:02 +02:00
2019-02-08 21:50:15 -08:00
2020-06-20 17:47:53 -07:00
2020-07-15 20:34:11 -07:00
2020-05-18 17:35:02 -07:00
2019-06-18 20:48:45 -04:00
2020-05-26 16:06:07 -07:00
2020-11-13 16:58:10 -08:00
2020-08-31 23:06:51 +02:00
2020-10-05 18:40:01 -07:00
2020-11-19 10:49:50 -08:00
2020-08-31 12:26:39 -07:00
2020-11-19 10:49:50 -08:00
2020-02-05 14:28:09 +01:00
2019-06-19 17:09:55 +02:00
2020-06-20 17:22:22 -07:00
2019-10-08 13:23:05 -07:00
2020-03-29 22:30:57 -07:00
2020-10-30 10:06:09 +01:00
2019-05-30 11:26:41 -07:00
2020-03-26 20:17:36 -07:00
2020-03-02 11:16:27 -08:00
2020-02-29 21:52:20 -08:00
2020-02-28 12:08:37 -08:00
2020-05-29 21:20:20 -07:00
2020-09-24 20:17:01 -07:00
2019-12-09 10:36:44 -08:00
2020-08-24 06:40:07 -07:00
2020-11-13 14:24:39 -08:00
2020-09-30 11:50:35 -07:00
2019-05-21 11:28:45 +02:00
2020-10-09 20:22:32 -07:00
2019-11-12 08:18:03 -08:00
2019-04-11 13:59:49 -07:00
2020-09-15 16:31:11 -07:00
2020-02-20 10:09:25 -08:00
2020-03-04 13:25:55 -08:00
2019-05-30 11:26:32 -07:00
2020-07-16 16:48:34 -07:00
2020-10-09 08:08:08 -07:00
2019-05-30 11:26:32 -07:00
2019-09-16 09:18:03 +02:00
2019-05-30 11:26:32 -07:00
2020-03-14 21:03:46 -07:00
2020-07-31 09:24:23 +02:00
2020-08-24 14:35:00 -07:00
2020-03-23 21:57:44 -07:00
2020-06-23 20:27:09 -07:00
2018-11-06 15:00:45 -08:00
2019-04-22 21:47:25 -07:00
2020-10-09 08:08:08 -07:00
2020-07-13 11:03:44 -07:00
2019-05-30 11:26:32 -07:00
2019-05-30 11:26:32 -07:00
2020-06-04 15:39:32 -07:00
2020-09-28 15:19:03 -07:00
2019-10-05 16:29:00 -07:00
2020-02-29 21:52:19 -08:00
2020-09-24 19:58:34 -07:00
2019-06-19 17:09:55 +02:00
2020-09-15 13:21:47 -07:00
2019-05-30 11:26:32 -07:00
2020-10-02 11:34:48 -07:00
2019-05-30 11:26:32 -07:00
2019-10-04 14:07:07 -07:00
2020-11-17 14:41:20 -08:00
2020-06-23 20:10:15 -07:00
2020-06-18 20:46:23 -07:00
2020-09-28 12:50:12 -07:00
2020-07-24 15:41:54 -07:00
2019-11-14 18:12:17 -08:00
2020-09-14 16:49:39 -07:00
2020-07-15 20:34:02 -07:00
2019-12-09 10:28:43 -08:00
2019-11-16 12:39:10 -08:00
2020-08-31 21:15:04 +02:00
2020-08-31 21:15:04 +02:00
2020-07-25 20:37:02 -07:00
2020-10-05 18:40:01 -07:00
2020-10-29 15:19:56 +01:00
b9ad3e9f5a