Re: TLS record double free
From: Jakub Kicinski <hidden>
Date: 2019-08-26 21:32:59
Also in:
bpf
Thank you for the report. On Sun, 25 Aug 2019 22:21:50 +0530, Mallesham Jatharakonda wrote:
Hi All, Am facing one tls double while using the Nitrox(cavium) card and n5pf driver over the TLS module. Please see the below details: TLS module is crashing While running SSL record encryption using Klts_send_[file] Precondition: 1) Installed 5.3-rc4. 2) Nitrox5 card pluggin.
Presumably this card contains a crypto accelerator? Does it have any special characteristic which could help us narrow down the bug search? Before we proceed - are you able to reproduce this issue with an pure upstream kernel? It seems the kernel in the BUG report is tainted.
Steps to produce the issue:
1) Install n5pf.ko.(drivers/crypto/cavium/nitrox)
2) Install tls.ko if not is installed by default(net/tls)
3) Taken uperf tool from git.
3.1) Modified uperf to use tls module by using setsocket.
3.2) Modified uperf tool to support sendfile with SSL.
Test:
1) Running uperf with 4threads.
2) Each Thread send the data using sendfile over SSL protocol.
After few seconds kernel is crashing because of record list corruption
[ 270.888952] ------------[ cut here ]------------
[ 270.890450] list_del corruption, ffff91cc3753a800->prev is
LIST_POISON2 (dead000000000122)
[ 270.891194] WARNING: CPU: 1 PID: 7387 at lib/list_debug.c:50
__list_del_entry_valid+0x62/0x90
[ 270.892037] Modules linked in: n5pf(OE) netconsole tls(OE) bonding
intel_rapl_msr intel_rapl_common sb_edac x86_pkg_temp_thermal
intel_powerclamp coretemp kvm_intel kvm iTCO_wdt iTCO_vendor_support
irqbypass crct10dif_pclmul crc32_pclmul ghash_clmulni_intel
aesni_intel crypto_simd mei_me cryptd glue_helper ipmi_si sg mei
lpc_ich pcspkr joydev ioatdma i2c_i801 ipmi_devintf ipmi_msghandler
wmi ip_tables xfs libcrc32c sd_mod mgag200 drm_vram_helper ttm
drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops drm isci
libsas ahci scsi_transport_sas libahci crc32c_intel serio_raw igb
libata ptp pps_core dca i2c_algo_bit dm_mirror dm_region_hash dm_log
dm_mod [last unloaded: nitrox_drv]
[ 270.896836] CPU: 1 PID: 7387 Comm: uperf Kdump: loaded Tainted: G
OE 5.3.0-rc4 #1