[BUG] WARNING in dev_fill_forward_path

[Farhad Alemi]

Hello,

We are reporting the following crash (reproducer attached and a
proposed patch forthcoming):
Linux version 7.3.0-rc2 50d05c7c76c96b90462f24debacca971d2e86713
Build Config: UpstreamAppArmorKASAN (KASAN + UBSAN, panic_on_warn=1)


[   45.799560][ T9488] last_dev == ctx->dev
[   45.799566][ T9488] WARNING: net/core/dev.c:792 at
dev_fill_forward_path+0x4bf/0x560, CPU#1: repro/9488
[   45.801619][ T9488] Modules linked in:
[   45.802014][ T9488] CPU: 1 UID: 0 PID: 9488 Comm: repro Not tainted
7.3.0-rc2-00099-g50d05c7c76c9 #1 PREEMPT(full)
[   45.803017][ T9488] Hardware name: QEMU Standard PC (Q35 + ICH9,
2009), BIOS 1.17.0-debian-1.17.0-1ubuntu1 04/01/2014
[   45.804019][ T9488] RIP: 0010:dev_fill_forward_path+0x4bf/0x560
[   45.804616][ T9488] Code: 48 8b 44 24 08 42 0f b6 04 28 84 c0 0f 85
93 00 00 00 41 ff 07 e9 c4 fd ff ff e8 cc 1a 2e f8 e9 f2 fd ff ff e8
c2 1a 2e f8 90 <0f> 0b 90 e9 e8 fd ff ff 44 89 f9 80 e1 07 80 c1 03 38
c1 0f 8c 68
[   45.806463][ T9488] RSP: 0018:ffffc9000276e988 EFLAGS: 00010293
[   45.807057][ T9488] RAX: ffffffff899981be RBX: ffff888106e34000
RCX: ffff8881129f0000
[   45.807826][ T9488] RDX: 0000000000000000 RSI: 0000000000000000
RDI: 0000000000000000
[   45.808575][ T9488] RBP: 0000000000000000 R08: ffff8881061ad443
R09: 1ffff11020c35a88
[   45.809387][ T9488] R10: dffffc0000000000 R11: ffffed1020c35a89
R12: ffffc9000276eae0
[   45.810156][ T9488] R13: dffffc0000000000 R14: ffffc9000276eaa0
R15: ffff888106e34000
[   45.810906][ T9488] FS:  000000003e3ab400(0000)
GS:ffff8881da588000(0000) knlGS:0000000000000000
[   45.811743][ T9488] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   45.812356][ T9488] CR2: 00005653de6aef80 CR3: 0000000028114000
CR4: 0000000000752ef0
[   45.813109][ T9488] PKRU: 55555554
[   45.813466][ T9488] Call Trace:
[   45.813791][ T9488]  <TASK>
[   45.814082][ T9488]  nft_dev_forward_path+0x4a3/0x1d60
[   45.814595][ T9488]  ? dst_init+0xd9/0x480
[   45.815004][ T9488]  ? dst_alloc+0x12a/0x170
[   45.815435][ T9488]  ? ip_route_output_key_hash_rcu+0x14d0/0x25d0
[   45.816031][ T9488]  ? nft_do_chain_ipv4+0x195/0x290
[   45.816528][ T9488]  ? NF_HOOK+0x25a/0x3b0
[   45.816940][ T9488]  ? netif_receive_skb+0x45b/0xbf0
[   45.817435][ T9488]  ? tun_rx_batched+0x1de/0x790
[   45.817901][ T9488]  ? tun_get_user+0x2c20/0x4490
[   45.818368][ T9488]  ? trace_kmem_cache_alloc+0x29/0xe0
[   45.818890][ T9488]  ? dst_alloc+0x105/0x170
[   45.819375][ T9488]  ? __pfx_nft_dev_forward_path+0x10/0x10
[   45.819938][ T9488]  ? rt_cache_route+0x229/0x2a0
[   45.820450][ T9488]  ? __pfx_ip_route_output_key_hash+0x10/0x10
[   45.821032][ T9488]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[   45.821596][ T9488]  ? ip_route_output_flow+0xe6/0x150
[   45.822095][ T9488]  nft_flow_route+0x8c0/0xdd0
[   45.822562][ T9488]  ? __pfx_nft_flow_route+0x10/0x10
[   45.823068][ T9488]  nft_flow_offload_eval+0x6a6/0xae0
[   45.823585][ T9488]  ? __pfx_nft_flow_offload_eval+0x10/0x10
[   45.824145][ T9488]  nft_do_chain+0x48d/0x1b10
[   45.824607][ T9488]  ? stack_depot_save_flags+0x33/0x7f0
[   45.825133][ T9488]  ? kasan_save_track+0x3e/0x80
[   45.825618][ T9488]  ? __pfx_nft_do_chain+0x10/0x10
[   45.826097][ T9488]  ? ip_forward+0xc58/0x1520
[   45.826587][ T9488]  ? __lock_acquire+0x74c/0x2db0
[   45.827087][ T9488]  nft_do_chain_ipv4+0x195/0x290
[   45.827593][ T9488]  ? __pfx_nft_do_chain_ipv4+0x10/0x10
[   45.828123][ T9488]  ? lock_acquire+0x115/0x350
[   45.828591][ T9488]  ? __pfx_nft_do_chain_ipv4+0x10/0x10
[   45.829203][ T9488]  nf_hook_slow+0xc5/0x220
[   45.829670][ T9488]  NF_HOOK+0x25a/0x3b0
[   45.830080][ T9488]  ? NF_HOOK+0xf6/0x3b0
[   45.830505][ T9488]  ? __pfx_NF_HOOK+0x10/0x10
[   45.830933][ T9488]  ? __pfx_ip_forward_finish+0x10/0x10
[   45.831437][ T9488]  NF_HOOK+0x336/0x3c0
[   45.831814][ T9488]  ? sock_wfree+0x2aa/0x740
[   45.832236][ T9488]  ? __pfx_ip_rcv_finish+0x10/0x10
[   45.832746][ T9488]  ? NF_HOOK+0x9e/0x3c0
[   45.833150][ T9488]  ? __pfx_NF_HOOK+0x10/0x10
[   45.833600][ T9488]  ? __pfx_ip_rcv_finish+0x10/0x10
[   45.834082][ T9488]  ? netif_receive_skb+0x102/0xbf0
[   45.834551][ T9488]  ? __pfx_ip_rcv+0x10/0x10
[   45.834970][ T9488]  netif_receive_skb+0x45b/0xbf0
[   45.835427][ T9488]  ? __pfx_netif_receive_skb+0x10/0x10
[   45.835925][ T9488]  ? tun_rx_batched+0x185/0x790
[   45.836395][ T9488]  tun_rx_batched+0x1de/0x790
[   45.836856][ T9488]  ? __pfx_tun_rx_batched+0x10/0x10
[   45.837361][ T9488]  ? lock_acquire+0x115/0x350
[   45.837819][ T9488]  ? tun_get_user+0x23c9/0x4490
[   45.838276][ T9488]  ? __local_bh_enable_ip+0xd6/0x140
[   45.838758][ T9488]  tun_get_user+0x2c20/0x4490
[   45.839290][ T9488]  ? tun_get_user+0x27eb/0x4490
[   45.839779][ T9488]  ? aa_file_perm+0x192/0x15e0
[   45.840242][ T9488]  ? aa_file_perm+0x50e/0x15e0
[   45.840705][ T9488]  ? __pfx_tun_get_user+0x10/0x10
[   45.841190][ T9488]  ? __lock_acquire+0x74c/0x2db0
[   45.841683][ T9488]  ? ref_tracker_alloc+0x35c/0x4c0
[   45.842152][ T9488]  ? __pfx_ref_tracker_alloc+0x10/0x10
[   45.842653][ T9488]  ? lock_acquire+0x115/0x350
[   45.843087][ T9488]  ? tun_get+0x1c/0x2f0
[   45.843475][ T9488]  ? tun_get+0x1c/0x2f0
[   45.843858][ T9488]  ? tun_get+0x1c/0x2f0
[   45.844244][ T9488]  tun_chr_write_iter+0x113/0x200
[   45.844746][ T9488]  vfs_write+0x61d/0xb90
[   45.845164][ T9488]  ? __pfx_vfs_write+0x10/0x10
[   45.845646][ T9488]  ksys_write+0x150/0x270
[   45.846070][ T9488]  ? __pfx_ksys_write+0x10/0x10
[   45.846546][ T9488]  do_syscall_64+0x155/0x510
[   45.846996][ T9488]  ? trace_irq_disable+0x3b/0x140
[   45.847483][ T9488]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   45.848034][ T9488]  ? clear_bhb_loop+0x30/0x80
[   45.848494][ T9488]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   45.849110][ T9488] RIP: 0033:0x42fb46
[   45.849497][ T9488] Code: 47 ba 04 00 00 00 48 c7 c0 f0 ff ff ff 64
89 10 48 c7 c2 ff ff ff ff c9 48 89 d0 c3 0f 1f 84 00 00 00 00 00 48
8b 45 10 0f 05 <48> 89 c2 48 3d 00 f0 ff ff 77 0f c9 48 89 d0 c3 66 2e
0f 1f 84 00
[   45.851281][ T9488] RSP: 002b:00007ffe031de340 EFLAGS: 00000202
ORIG_RAX: 0000000000000001
[   45.852049][ T9488] RAX: ffffffffffffffda RBX: 0000000000000001
RCX: 000000000042fb46
[   45.852833][ T9488] RDX: 0000000000000032 RSI: 00007ffe031de4a0
RDI: 0000000000000003
[   45.853604][ T9488] RBP: 00007ffe031de350 R08: 0000000000000000
R09: 0000000000000000
[   45.854372][ T9488] R10: 0000000000000000 R11: 0000000000000202
R12: 00007ffe031de618
[   45.855123][ T9488] R13: 00007ffe031de628 R14: 0000000000000002
R15: 00000000004b0140
[   45.855915][ T9488]  </TASK>
[   45.856236][ T9488] Kernel panic - not syncing: kernel: panic_on_warn set ...
[   45.856927][ T9488] CPU: 1 UID: 0 PID: 9488 Comm: repro Not tainted
7.3.0-rc2-00099-g50d05c7c76c9 #1 PREEMPT(full)
[   45.857959][ T9488] Hardware name: QEMU Standard PC (Q35 + ICH9,
2009), BIOS 1.17.0-debian-1.17.0-1ubuntu1 04/01/2014
[   45.859245][ T9488] Call Trace:
[   45.859604][ T9488]  <TASK>
[   45.859928][ T9488]  vpanic+0x56d/0xa60
[   45.860335][ T9488]  ? __pfx__printk+0x10/0x10
[   45.860802][ T9488]  ? __pfx_vpanic+0x10/0x10
[   45.861238][ T9488]  ? is_bpf_text_address+0x292/0x2b0
[   45.861752][ T9488]  ? is_bpf_text_address+0x26/0x2b0
[   45.862255][ T9488]  panic+0xc5/0xd0
[   45.862626][ T9488]  ? __pfx_panic+0x10/0x10
[   45.863063][ T9488]  __warn+0x315/0x4c0
[   45.863453][ T9488]  ? dev_fill_forward_path+0x4bf/0x560
[   45.863974][ T9488]  ? dev_fill_forward_path+0x4bf/0x560
[   45.864498][ T9488]  __report_bug+0x273/0x580
[   45.864943][ T9488]  ? dev_fill_forward_path+0x4bf/0x560
[   45.865466][ T9488]  ? __pfx___report_bug+0x10/0x10
[   45.865954][ T9488]  ? __lock_acquire+0x74c/0x2db0
[   45.866435][ T9488]  ? ip_route_output_flow+0xe6/0x150
[   45.866946][ T9488]  ? dev_fill_forward_path+0x4bf/0x560
[   45.867469][ T9488]  report_bug+0x16b/0x220
[   45.867888][ T9488]  ? dev_fill_forward_path+0x4bf/0x560
[   45.868411][ T9488]  ? dev_fill_forward_path+0x4c1/0x560
[   45.868929][ T9488]  handle_bug+0x9c/0x200
[   45.869404][ T9488]  exc_invalid_op+0x1a/0x50
[   45.869841][ T9488]  asm_exc_invalid_op+0x1a/0x20
[   45.870311][ T9488] RIP: 0010:dev_fill_forward_path+0x4bf/0x560
[   45.870888][ T9488] Code: 48 8b 44 24 08 42 0f b6 04 28 84 c0 0f 85
93 00 00 00 41 ff 07 e9 c4 fd ff ff e8 cc 1a 2e f8 e9 f2 fd ff ff e8
c2 1a 2e f8 90 <0f> 0b 90 e9 e8 fd ff ff 44 89 f9 80 e1 07 80 c1 03 38
c1 0f 8c 68
[   45.872668][ T9488] RSP: 0018:ffffc9000276e988 EFLAGS: 00010293
[   45.873242][ T9488] RAX: ffffffff899981be RBX: ffff888106e34000
RCX: ffff8881129f0000
[   45.873988][ T9488] RDX: 0000000000000000 RSI: 0000000000000000
RDI: 0000000000000000
[   45.874734][ T9488] RBP: 0000000000000000 R08: ffff8881061ad443
R09: 1ffff11020c35a88
[   45.875492][ T9488] R10: dffffc0000000000 R11: ffffed1020c35a89
R12: ffffc9000276eae0
[   45.876198][ T9488] R13: dffffc0000000000 R14: ffffc9000276eaa0
R15: ffff888106e34000
[   45.876957][ T9488]  ? dev_fill_forward_path+0x4be/0x560
[   45.877481][ T9488]  ? dev_fill_forward_path+0x4be/0x560
[   45.878000][ T9488]  nft_dev_forward_path+0x4a3/0x1d60
[   45.878507][ T9488]  ? dst_init+0xd9/0x480
[   45.878914][ T9488]  ? dst_alloc+0x12a/0x170
[   45.879436][ T9488]  ? ip_route_output_key_hash_rcu+0x14d0/0x25d0
[   45.880030][ T9488]  ? nft_do_chain_ipv4+0x195/0x290
[   45.880552][ T9488]  ? NF_HOOK+0x25a/0x3b0
[   45.880965][ T9488]  ? netif_receive_skb+0x45b/0xbf0
[   45.881457][ T9488]  ? tun_rx_batched+0x1de/0x790
[   45.881923][ T9488]  ? tun_get_user+0x2c20/0x4490
[   45.882393][ T9488]  ? trace_kmem_cache_alloc+0x29/0xe0
[   45.882907][ T9488]  ? dst_alloc+0x105/0x170
[   45.883366][ T9488]  ? __pfx_nft_dev_forward_path+0x10/0x10
[   45.883924][ T9488]  ? rt_cache_route+0x229/0x2a0
[   45.884420][ T9488]  ? __pfx_ip_route_output_key_hash+0x10/0x10
[   45.885014][ T9488]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[   45.885594][ T9488]  ? ip_route_output_flow+0xe6/0x150
[   45.886117][ T9488]  nft_flow_route+0x8c0/0xdd0
[   45.886588][ T9488]  ? __pfx_nft_flow_route+0x10/0x10
[   45.887115][ T9488]  nft_flow_offload_eval+0x6a6/0xae0
[   45.887635][ T9488]  ? __pfx_nft_flow_offload_eval+0x10/0x10
[   45.888176][ T9488]  nft_do_chain+0x48d/0x1b10
[   45.888639][ T9488]  ? stack_depot_save_flags+0x33/0x7f0
[   45.889215][ T9488]  ? kasan_save_track+0x3e/0x80
[   45.889693][ T9488]  ? __pfx_nft_do_chain+0x10/0x10
[   45.890175][ T9488]  ? ip_forward+0xc58/0x1520
[   45.890635][ T9488]  ? __lock_acquire+0x74c/0x2db0
[   45.891116][ T9488]  nft_do_chain_ipv4+0x195/0x290
[   45.891603][ T9488]  ? __pfx_nft_do_chain_ipv4+0x10/0x10
[   45.892103][ T9488]  ? lock_acquire+0x115/0x350
[   45.892566][ T9488]  ? __pfx_nft_do_chain_ipv4+0x10/0x10
[   45.893088][ T9488]  nf_hook_slow+0xc5/0x220
[   45.893522][ T9488]  NF_HOOK+0x25a/0x3b0
[   45.893918][ T9488]  ? NF_HOOK+0xf6/0x3b0
[   45.894324][ T9488]  ? __pfx_NF_HOOK+0x10/0x10
[   45.894771][ T9488]  ? __pfx_ip_forward_finish+0x10/0x10
[   45.895299][ T9488]  NF_HOOK+0x336/0x3c0
[   45.895694][ T9488]  ? sock_wfree+0x2aa/0x740
[   45.896113][ T9488]  ? __pfx_ip_rcv_finish+0x10/0x10
[   45.896613][ T9488]  ? NF_HOOK+0x9e/0x3c0
[   45.897015][ T9488]  ? __pfx_NF_HOOK+0x10/0x10
[   45.897466][ T9488]  ? __pfx_ip_rcv_finish+0x10/0x10
[   45.897958][ T9488]  ? netif_receive_skb+0x102/0xbf0
[   45.898453][ T9488]  ? __pfx_ip_rcv+0x10/0x10
[   45.898890][ T9488]  netif_receive_skb+0x45b/0xbf0
[   45.899436][ T9488]  ? __pfx_netif_receive_skb+0x10/0x10
[   45.899971][ T9488]  ? tun_rx_batched+0x185/0x790
[   45.900461][ T9488]  tun_rx_batched+0x1de/0x790
[   45.900915][ T9488]  ? __pfx_tun_rx_batched+0x10/0x10
[   45.901417][ T9488]  ? lock_acquire+0x115/0x350
[   45.901877][ T9488]  ? tun_get_user+0x23c9/0x4490
[   45.902348][ T9488]  ? __local_bh_enable_ip+0xd6/0x140
[   45.902856][ T9488]  tun_get_user+0x2c20/0x4490
[   45.903312][ T9488]  ? tun_get_user+0x27eb/0x4490
[   45.903787][ T9488]  ? aa_file_perm+0x192/0x15e0
[   45.904229][ T9488]  ? aa_file_perm+0x50e/0x15e0
[   45.904704][ T9488]  ? __pfx_tun_get_user+0x10/0x10
[   45.905188][ T9488]  ? __lock_acquire+0x74c/0x2db0
[   45.905674][ T9488]  ? ref_tracker_alloc+0x35c/0x4c0
[   45.906164][ T9488]  ? __pfx_ref_tracker_alloc+0x10/0x10
[   45.906688][ T9488]  ? lock_acquire+0x115/0x350
[   45.907141][ T9488]  ? tun_get+0x1c/0x2f0
[   45.907555][ T9488]  ? tun_get+0x1c/0x2f0
[   45.907939][ T9488]  ? tun_get+0x1c/0x2f0
[   45.908345][ T9488]  tun_chr_write_iter+0x113/0x200
[   45.908828][ T9488]  vfs_write+0x61d/0xb90
[   45.909311][ T9488]  ? __pfx_vfs_write+0x10/0x10
[   45.909777][ T9488]  ksys_write+0x150/0x270
[   45.910195][ T9488]  ? __pfx_ksys_write+0x10/0x10
[   45.910668][ T9488]  do_syscall_64+0x155/0x510
[   45.911115][ T9488]  ? trace_irq_disable+0x3b/0x140
[   45.911624][ T9488]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   45.912217][ T9488]  ? clear_bhb_loop+0x30/0x80
[   45.912685][ T9488]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   45.913264][ T9488] RIP: 0033:0x42fb46
[   45.913645][ T9488] Code: 47 ba 04 00 00 00 48 c7 c0 f0 ff ff ff 64
89 10 48 c7 c2 ff ff ff ff c9 48 89 d0 c3 0f 1f 84 00 00 00 00 00 48
8b 45 10 0f 05 <48> 89 c2 48 3d 00 f0 ff ff 77 0f c9 48 89 d0 c3 66 2e
0f 1f 84 00
[   45.915443][ T9488] RSP: 002b:00007ffe031de340 EFLAGS: 00000202
ORIG_RAX: 0000000000000001
[   45.916225][ T9488] RAX: ffffffffffffffda RBX: 0000000000000001
RCX: 000000000042fb46
[   45.916969][ T9488] RDX: 0000000000000032 RSI: 00007ffe031de4a0
RDI: 0000000000000003
[   45.917713][ T9488] RBP: 00007ffe031de350 R08: 0000000000000000
R09: 0000000000000000
[   45.918460][ T9488] R10: 0000000000000000 R11: 0000000000000202
R12: 00007ffe031de618
[   45.919267][ T9488] R13: 00007ffe031de628 R14: 0000000000000002
R15: 00000000004b0140
[   45.920021][ T9488]  </TASK>
[   45.920650][ T9488] Kernel Offset: disabled
[   45.921194][ T9488] Rebooting in 86400 seconds..

Regards,
SEFCOM Lab @ ASU

Attachment: reproducer.c
Description: Binary data