forked from Minki/linux
914a7b5000
This module uses reference tracker, forcing two issues. 1) Double free of a tracker 2) leak of two trackers, one being allocated from softirq context. "modprobe test_ref_tracker" would emit the following traces. (Use scripts/decode_stacktrace.sh if necessary) [ 171.648681] reference already released. [ 171.653213] allocated in: [ 171.656523] alloctest_ref_tracker_alloc2+0x1c/0x20 [test_ref_tracker] [ 171.656526] init_module+0x86/0x1000 [test_ref_tracker] [ 171.656528] do_one_initcall+0x9c/0x220 [ 171.656532] do_init_module+0x60/0x240 [ 171.656536] load_module+0x32b5/0x3610 [ 171.656538] __do_sys_init_module+0x148/0x1a0 [ 171.656540] __x64_sys_init_module+0x1d/0x20 [ 171.656542] do_syscall_64+0x4a/0xb0 [ 171.656546] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 171.656549] freed in: [ 171.659520] alloctest_ref_tracker_free+0x13/0x20 [test_ref_tracker] [ 171.659522] init_module+0xec/0x1000 [test_ref_tracker] [ 171.659523] do_one_initcall+0x9c/0x220 [ 171.659525] do_init_module+0x60/0x240 [ 171.659527] load_module+0x32b5/0x3610 [ 171.659529] __do_sys_init_module+0x148/0x1a0 [ 171.659532] __x64_sys_init_module+0x1d/0x20 [ 171.659534] do_syscall_64+0x4a/0xb0 [ 171.659536] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 171.659575] ------------[ cut here ]------------ [ 171.659576] WARNING: CPU: 5 PID: 13016 at lib/ref_tracker.c:112 ref_tracker_free+0x224/0x270 [ 171.659581] Modules linked in: test_ref_tracker(+) [ 171.659591] CPU: 5 PID: 13016 Comm: modprobe Tainted: G S 5.16.0-smp-DEV #290 [ 171.659595] RIP: 0010:ref_tracker_free+0x224/0x270 [ 171.659599] Code: 5e 41 5f 5d c3 48 c7 c7 04 9c 74 a6 31 c0 e8 62 ee 67 00 83 7b 14 00 75 1a 83 7b 18 00 75 30 4c 89 ff 4c 89 f6 e8 9c 00 69 00 <0f> 0b bb ea ff ff ff eb ae 48 c7 c7 3a 0a 77 a6 31 c0 e8 34 ee 67 [ 171.659601] RSP: 0018:ffff89058ba0bbd0 EFLAGS: 00010286 [ 171.659603] RAX: 0000000000000029 RBX: ffff890586b19780 RCX: 08895bff57c7d100 [ 171.659604] RDX: c0000000ffff7fff RSI: 0000000000000282 RDI: ffffffffc0407000 [ 171.659606] RBP: ffff89058ba0bc88 R08: 0000000000000000 R09: ffffffffa6f342e0 [ 171.659607] R10: 00000000ffff7fff R11: 0000000000000000 R12: 000000008f000000 [ 171.659608] R13: 0000000000000014 R14: 0000000000000282 R15: ffffffffc0407000 [ 171.659609] FS: 00007f97ea29d740(0000) GS:ffff8923ff940000(0000) knlGS:0000000000000000 [ 171.659611] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 171.659613] CR2: 00007f97ea299000 CR3: 0000000186b4a004 CR4: 00000000001706e0 [ 171.659614] Call Trace: [ 171.659615] <TASK> [ 171.659631] ? alloctest_ref_tracker_free+0x13/0x20 [test_ref_tracker] [ 171.659633] ? init_module+0x105/0x1000 [test_ref_tracker] [ 171.659636] ? do_one_initcall+0x9c/0x220 [ 171.659638] ? do_init_module+0x60/0x240 [ 171.659641] ? load_module+0x32b5/0x3610 [ 171.659644] ? __do_sys_init_module+0x148/0x1a0 [ 171.659646] ? __x64_sys_init_module+0x1d/0x20 [ 171.659649] ? do_syscall_64+0x4a/0xb0 [ 171.659652] ? entry_SYSCALL_64_after_hwframe+0x44/0xae [ 171.659656] ? 0xffffffffc040a000 [ 171.659658] alloctest_ref_tracker_free+0x13/0x20 [test_ref_tracker] [ 171.659660] init_module+0x105/0x1000 [test_ref_tracker] [ 171.659663] do_one_initcall+0x9c/0x220 [ 171.659666] do_init_module+0x60/0x240 [ 171.659669] load_module+0x32b5/0x3610 [ 171.659672] __do_sys_init_module+0x148/0x1a0 [ 171.659676] __x64_sys_init_module+0x1d/0x20 [ 171.659678] do_syscall_64+0x4a/0xb0 [ 171.659694] ? exc_page_fault+0x6e/0x140 [ 171.659696] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 171.659698] RIP: 0033:0x7f97ea3dbe7a [ 171.659700] Code: 48 8b 0d 61 8d 06 00 f7 d8 64 89 01 48 83 c8 ff c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 49 89 ca b8 af 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 2e 8d 06 00 f7 d8 64 89 01 48 [ 171.659701] RSP: 002b:00007ffea67ce608 EFLAGS: 00000246 ORIG_RAX: 00000000000000af [ 171.659703] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f97ea3dbe7a [ 171.659704] RDX: 00000000013a0ba0 RSI: 0000000000002808 RDI: 00007f97ea299000 [ 171.659705] RBP: 00007ffea67ce670 R08: 0000000000000003 R09: 0000000000000000 [ 171.659706] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000013a1048 [ 171.659707] R13: 00000000013a0ba0 R14: 0000000001399930 R15: 00000000013a1030 [ 171.659709] </TASK> [ 171.659710] ---[ end trace f5dbd6afa41e60a9 ]--- [ 171.659712] leaked reference. [ 171.663393] alloctest_ref_tracker_alloc0+0x1c/0x20 [test_ref_tracker] [ 171.663395] test_ref_tracker_timer_func+0x9/0x20 [test_ref_tracker] [ 171.663397] call_timer_fn+0x31/0x140 [ 171.663401] expire_timers+0x46/0x110 [ 171.663403] __run_timers+0x16f/0x1b0 [ 171.663404] run_timer_softirq+0x1d/0x40 [ 171.663406] __do_softirq+0x148/0x2d3 [ 171.663408] leaked reference. [ 171.667101] alloctest_ref_tracker_alloc1+0x1c/0x20 [test_ref_tracker] [ 171.667103] init_module+0x81/0x1000 [test_ref_tracker] [ 171.667104] do_one_initcall+0x9c/0x220 [ 171.667106] do_init_module+0x60/0x240 [ 171.667108] load_module+0x32b5/0x3610 [ 171.667111] __do_sys_init_module+0x148/0x1a0 [ 171.667113] __x64_sys_init_module+0x1d/0x20 [ 171.667115] do_syscall_64+0x4a/0xb0 [ 171.667117] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 171.667131] ------------[ cut here ]------------ [ 171.667132] WARNING: CPU: 5 PID: 13016 at lib/ref_tracker.c:30 ref_tracker_dir_exit+0x104/0x130 [ 171.667136] Modules linked in: test_ref_tracker(+) [ 171.667144] CPU: 5 PID: 13016 Comm: modprobe Tainted: G S W 5.16.0-smp-DEV #290 [ 171.667147] RIP: 0010:ref_tracker_dir_exit+0x104/0x130 [ 171.667150] Code: 01 00 00 00 00 ad de 48 89 03 4c 89 63 08 48 89 df e8 20 a0 d5 ff 4c 89 f3 4d 39 ee 75 a8 4c 89 ff 48 8b 75 d0 e8 7c 05 69 00 <0f> 0b eb 0c 4c 89 ff 48 8b 75 d0 e8 6c 05 69 00 41 8b 47 08 83 f8 [ 171.667151] RSP: 0018:ffff89058ba0bc68 EFLAGS: 00010286 [ 171.667154] RAX: 08895bff57c7d100 RBX: ffffffffc0407010 RCX: 000000000000003b [ 171.667156] RDX: 000000000000003c RSI: 0000000000000282 RDI: ffffffffc0407000 [ 171.667157] RBP: ffff89058ba0bc98 R08: 0000000000000000 R09: ffffffffa6f342e0 [ 171.667159] R10: 00000000ffff7fff R11: 0000000000000000 R12: dead000000000122 [ 171.667160] R13: ffffffffc0407010 R14: ffffffffc0407010 R15: ffffffffc0407000 [ 171.667162] FS: 00007f97ea29d740(0000) GS:ffff8923ff940000(0000) knlGS:0000000000000000 [ 171.667164] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 171.667166] CR2: 00007f97ea299000 CR3: 0000000186b4a004 CR4: 00000000001706e0 [ 171.667169] Call Trace: [ 171.667170] <TASK> [ 171.667171] ? 0xffffffffc040a000 [ 171.667173] init_module+0x126/0x1000 [test_ref_tracker] [ 171.667175] do_one_initcall+0x9c/0x220 [ 171.667179] do_init_module+0x60/0x240 [ 171.667182] load_module+0x32b5/0x3610 [ 171.667186] __do_sys_init_module+0x148/0x1a0 [ 171.667189] __x64_sys_init_module+0x1d/0x20 [ 171.667192] do_syscall_64+0x4a/0xb0 [ 171.667194] ? exc_page_fault+0x6e/0x140 [ 171.667196] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 171.667199] RIP: 0033:0x7f97ea3dbe7a [ 171.667200] Code: 48 8b 0d 61 8d 06 00 f7 d8 64 89 01 48 83 c8 ff c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 49 89 ca b8 af 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 2e 8d 06 00 f7 d8 64 89 01 48 [ 171.667201] RSP: 002b:00007ffea67ce608 EFLAGS: 00000246 ORIG_RAX: 00000000000000af [ 171.667203] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f97ea3dbe7a [ 171.667204] RDX: 00000000013a0ba0 RSI: 0000000000002808 RDI: 00007f97ea299000 [ 171.667205] RBP: 00007ffea67ce670 R08: 0000000000000003 R09: 0000000000000000 [ 171.667206] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000013a1048 [ 171.667207] R13: 00000000013a0ba0 R14: 0000000001399930 R15: 00000000013a1030 [ 171.667209] </TASK> [ 171.667210] ---[ end trace f5dbd6afa41e60aa ]--- Signed-off-by: Eric Dumazet <edumazet@google.com> Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
---|---|---|
.. | ||
842 | ||
crypto | ||
dim | ||
fonts | ||
kunit | ||
livepatch | ||
lz4 | ||
lzo | ||
math | ||
mpi | ||
pldmfw | ||
raid6 | ||
reed_solomon | ||
test_fortify | ||
vdso | ||
xz | ||
zlib_deflate | ||
zlib_dfltcc | ||
zlib_inflate | ||
zstd | ||
.gitignore | ||
argv_split.c | ||
ashldi3.c | ||
ashrdi3.c | ||
asn1_decoder.c | ||
asn1_encoder.c | ||
assoc_array.c | ||
atomic64_test.c | ||
atomic64.c | ||
audit.c | ||
bcd.c | ||
bch.c | ||
bitfield_kunit.c | ||
bitmap.c | ||
bitrev.c | ||
bootconfig.c | ||
bsearch.c | ||
btree.c | ||
bucket_locks.c | ||
bug.c | ||
build_OID_registry | ||
buildid.c | ||
bust_spinlocks.c | ||
check_signature.c | ||
checksum.c | ||
clz_ctz.c | ||
clz_tab.c | ||
cmdline_kunit.c | ||
cmdline.c | ||
cmpdi2.c | ||
compat_audit.c | ||
cpu_rmap.c | ||
cpumask.c | ||
crc4.c | ||
crc7.c | ||
crc8.c | ||
crc16.c | ||
crc32.c | ||
crc32defs.h | ||
crc32test.c | ||
crc64.c | ||
crc-ccitt.c | ||
crc-itu-t.c | ||
crc-t10dif.c | ||
ctype.c | ||
debug_info.c | ||
debug_locks.c | ||
debugobjects.c | ||
dec_and_lock.c | ||
decompress_bunzip2.c | ||
decompress_inflate.c | ||
decompress_unlz4.c | ||
decompress_unlzma.c | ||
decompress_unlzo.c | ||
decompress_unxz.c | ||
decompress_unzstd.c | ||
decompress.c | ||
devmem_is_allowed.c | ||
devres.c | ||
digsig.c | ||
dump_stack.c | ||
dynamic_debug.c | ||
dynamic_queue_limits.c | ||
earlycpio.c | ||
errname.c | ||
error-inject.c | ||
errseq.c | ||
extable.c | ||
fault-inject-usercopy.c | ||
fault-inject.c | ||
fdt_addresses.c | ||
fdt_empty_tree.c | ||
fdt_ro.c | ||
fdt_rw.c | ||
fdt_strerror.c | ||
fdt_sw.c | ||
fdt_wip.c | ||
fdt.c | ||
find_bit_benchmark.c | ||
find_bit.c | ||
flex_proportions.c | ||
gen_crc32table.c | ||
gen_crc64table.c | ||
genalloc.c | ||
generic-radix-tree.c | ||
glob.c | ||
globtest.c | ||
hexdump.c | ||
hweight.c | ||
idr.c | ||
inflate.c | ||
interval_tree_test.c | ||
interval_tree.c | ||
iomap_copy.c | ||
iomap.c | ||
iommu-helper.c | ||
iov_iter.c | ||
irq_poll.c | ||
irq_regs.c | ||
is_single_threaded.c | ||
kasprintf.c | ||
Kconfig | ||
Kconfig.debug | ||
Kconfig.kasan | ||
Kconfig.kcsan | ||
Kconfig.kfence | ||
Kconfig.kgdb | ||
Kconfig.ubsan | ||
kfifo.c | ||
klist.c | ||
kobject_uevent.c | ||
kobject.c | ||
kstrtox.c | ||
kstrtox.h | ||
libcrc32c.c | ||
linear_ranges.c | ||
list_debug.c | ||
list_sort.c | ||
list-test.c | ||
llist.c | ||
locking-selftest-hardirq.h | ||
locking-selftest-mutex.h | ||
locking-selftest-rlock-hardirq.h | ||
locking-selftest-rlock-softirq.h | ||
locking-selftest-rlock.h | ||
locking-selftest-rsem.h | ||
locking-selftest-rtmutex.h | ||
locking-selftest-softirq.h | ||
locking-selftest-spin-hardirq.h | ||
locking-selftest-spin-softirq.h | ||
locking-selftest-spin.h | ||
locking-selftest-wlock-hardirq.h | ||
locking-selftest-wlock-softirq.h | ||
locking-selftest-wlock.h | ||
locking-selftest-wsem.h | ||
locking-selftest.c | ||
lockref.c | ||
logic_iomem.c | ||
logic_pio.c | ||
lru_cache.c | ||
lshrdi3.c | ||
Makefile | ||
memcat_p.c | ||
memcpy_kunit.c | ||
memory-notifier-error-inject.c | ||
memregion.c | ||
memweight.c | ||
muldi3.c | ||
net_utils.c | ||
netdev-notifier-error-inject.c | ||
nlattr.c | ||
nmi_backtrace.c | ||
nodemask.c | ||
notifier-error-inject.c | ||
notifier-error-inject.h | ||
objagg.c | ||
of-reconfig-notifier-error-inject.c | ||
oid_registry.c | ||
once.c | ||
packing.c | ||
parman.c | ||
parser.c | ||
pci_iomap.c | ||
percpu_counter.c | ||
percpu_test.c | ||
percpu-refcount.c | ||
plist.c | ||
pm-notifier-error-inject.c | ||
radix-tree.c | ||
random32.c | ||
ratelimit.c | ||
rbtree_test.c | ||
rbtree.c | ||
ref_tracker.c | ||
refcount.c | ||
rhashtable.c | ||
sbitmap.c | ||
scatterlist.c | ||
seq_buf.c | ||
sg_pool.c | ||
sg_split.c | ||
sha1.c | ||
show_mem.c | ||
siphash.c | ||
slub_kunit.c | ||
smp_processor_id.c | ||
sort.c | ||
stackdepot.c | ||
stmp_device.c | ||
string_helpers.c | ||
string.c | ||
strncpy_from_user.c | ||
strnlen_user.c | ||
syscall.c | ||
test_bitmap.c | ||
test_bitops.c | ||
test_bits.c | ||
test_blackhole_dev.c | ||
test_bpf.c | ||
test_debug_virtual.c | ||
test_firmware.c | ||
test_fpu.c | ||
test_free_pages.c | ||
test_hash.c | ||
test_hexdump.c | ||
test_hmm_uapi.h | ||
test_hmm.c | ||
test_ida.c | ||
test_kasan_module.c | ||
test_kasan.c | ||
test_kmod.c | ||
test_kprobes.c | ||
test_linear_ranges.c | ||
test_list_sort.c | ||
test_lockup.c | ||
test_memcat_p.c | ||
test_meminit.c | ||
test_min_heap.c | ||
test_module.c | ||
test_objagg.c | ||
test_overflow.c | ||
test_parman.c | ||
test_printf.c | ||
test_ref_tracker.c | ||
test_rhashtable.c | ||
test_scanf.c | ||
test_siphash.c | ||
test_sort.c | ||
test_stackinit.c | ||
test_static_key_base.c | ||
test_static_keys.c | ||
test_string.c | ||
test_strscpy.c | ||
test_sysctl.c | ||
test_ubsan.c | ||
test_user_copy.c | ||
test_uuid.c | ||
test_vmalloc.c | ||
test_xarray.c | ||
test-kstrtox.c | ||
test-string_helpers.c | ||
textsearch.c | ||
timerqueue.c | ||
ts_bm.c | ||
ts_fsm.c | ||
ts_kmp.c | ||
ubsan.c | ||
ubsan.h | ||
ucmpdi2.c | ||
ucs2_string.c | ||
usercopy.c | ||
uuid.c | ||
vsprintf.c | ||
win_minmax.c | ||
xarray.c | ||
xxhash.c |