ptpt52 / natcap

A code very difficult to read, an implementation of transparent proxy protocol to break through the firewall.
GNU Affero General Public License v3.0
81 stars 34 forks source link

BUG kmalloc-256 (Not tainted): Object already free #7

Closed ptpt52 closed 2 years ago

ptpt52 commented 2 years ago
[  840.929405] =============================================================================
[  840.937689] BUG kmalloc-256 (Not tainted): Object already free
[  840.943599] -----------------------------------------------------------------------------

[  840.953366] Disabling lock debugging due to kernel taint
[  840.958762] INFO: Allocated in natflow_session_init+0xb6/0x170 [natflow] age=3 cpu=13 pid=0
[  840.967218] INFO: Freed in krealloc+0x77/0xb0 age=3 cpu=13 pid=0
[  840.973303] INFO: Slab 0x000000007186eef7 objects=42 used=8 fp=0x0000000003de3e06 flags=0x4500000010201
[  840.982799] INFO: Object 0x0000000003de3e06 @offset=24832 fp=0x0000000000000000

[  840.991698] Redzone  00000000dc40141b: bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb  ................
[  841.001276] Redzone  0000000094bbbe75: bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb  ................
[  841.010854] Redzone  000000006de4d399: bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb  ................
[  841.020428] Redzone  00000000c0355f74: bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb  ................
[  841.030007] Redzone  00000000e6eb6122: bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb  ................
[  841.039583] Redzone  0000000080181548: bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb  ................
[  841.049160] Redzone  00000000dcd3b963: bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb  ................
[  841.058735] Redzone  0000000053a3aefa: bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb  ................
[  841.068313] Redzone  00000000100e3485: bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb  ................
[  841.077891] Redzone  00000000bf7bb09b: bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb  ................
[  841.087476] Redzone  000000006758e4fc: bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb  ................
[  841.097059] Redzone  0000000096bb104e: bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb  ................
[  841.106638] Redzone  0000000083c41219: bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb  ................
[  841.116221] Redzone  0000000056eec869: bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb  ................
[  841.133512] Redzone  00000000405059b8: bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb  ................
[  841.143089] Redzone  000000003892597f: bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb  ................
[  841.152667] Object   0000000003de3e06: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
[  841.162250] Object   00000000cc962408: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
[  841.171828] Object   00000000e65ba2f7: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
[  841.181404] Object   00000000b9552bb9: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
[  841.190989] Object   000000006fc6007f: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
[  841.200566] Object   00000000745d565d: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
[  841.210141] Object   000000007e49aee1: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
[  841.219718] Object   0000000055412f98: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
[  841.229295] Object   00000000ce806e7d: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
[  841.238873] Object   0000000044060afe: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
[  841.248456] Object   00000000363f716d: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
[  841.258033] Object   0000000051f751c2: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
[  841.267611] Object   00000000e8721438: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
[  841.277188] Object   0000000027757e7a: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
[  841.286772] Object   00000000779f6e77: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
[  841.296348] Object   00000000b65ee3c4: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b a5  kkkkkkkkkkkkkkk.
[  841.305925] Redzone  00000000a6130231: bb bb bb bb bb bb bb bb                          ........
[  841.314807] Padding  00000000639cce74: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a  ZZZZZZZZZZZZZZZZ
[  841.324384] Padding  0000000097771770: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a  ZZZZZZZZZZZZZZZZ
[  841.333961] Padding  0000000049e6b04d: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a  ZZZZZZZZZZZZZZZZ
[  841.343538] Padding  000000003117432b: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a  ZZZZZZZZZZZZZZZZ
[  841.353113] Padding  0000000060c3ced0: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a  ZZZZZZZZZZZZZZZZ
[  841.362692] Padding  0000000009c23ebd: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a  ZZZZZZZZZZZZZZZZ
[  841.372267] Padding  000000009bcd22e8: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a  ZZZZZZZZZZZZZZZZ
[  841.381845] Padding  000000000a890837: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a  ZZZZZZZZZZZZZZZZ
[  841.391421] Padding  00000000431b2e06: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a  ZZZZZZZZZZZZZZZZ
[  841.400998] Padding  00000000e3fd6714: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a  ZZZZZZZZZZZZZZZZ
[  841.410575] Padding  000000003faaa4d1: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a  ZZZZZZZZZZZZZZZZ
[  841.420158] Padding  00000000a691511f: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a  ZZZZZZZZZZZZZZZZ
[  841.429737] CPU: 16 PID: 1975 Comm: kworker/16:1 Kdump: loaded Tainted: G    B             5.10.112 #0
[  841.439146] Hardware name: Inspur SA5112M4/YZMB-00370-102, BIOS 4.1.10 09/26/2016
[  841.446728] Workqueue: events macvlan_process_broadcast [macvlan]
[  841.452903] Call Trace:
[  841.455434]  <IRQ>
[  841.457536]  dump_stack+0x70/0x8b
[  841.460933]  print_trailer+0x18c/0x195
[  841.464764]  object_err+0x30/0x38
[  841.468159]  free_debug_processing.cold+0xc2/0x12a
[  841.473033]  ? krealloc+0x77/0xb0
[  841.476427]  ? krealloc+0x77/0xb0
[  841.479827]  __slab_free+0x1d0/0x330
[  841.483485]  ? natcap_session_init.part.0+0xab/0x170 [natcap]
[  841.489312]  ? krealloc+0x77/0xb0
[  841.492713]  kfree+0x26c/0x2b0
[  841.495849]  krealloc+0x77/0xb0
[  841.499075]  natcap_session_init.part.0+0xab/0x170 [natcap]
[  841.504729]  natcap_common_cone_in_hook+0x248/0x2f0 [natcap]
[  841.510475]  ? natflow_user_pre_hook+0xb8/0x9a0 [natflow]
[  841.515952]  ? skb_ensure_writable+0x63/0xa0
[  841.520310]  nf_hook_slow+0x3f/0xb0
[  841.523879]  ? natcap_common_cone_snat_hook+0x630/0x630 [natcap]
[  841.529967]  ? nf_hook_slow+0x3f/0xb0
[  841.533714]  ip_rcv+0x74/0xc0
[  841.536764]  ? ip_rcv_finish_core.constprop.0+0x3c0/0x3c0
[  841.542245]  __netif_receive_skb_one_core+0x63/0x70
[  841.547202]  process_backlog+0xb2/0x1d0
[  841.551116]  __napi_poll+0x2a/0xe0
[  841.554600]  net_rx_action+0xca/0x1f0
[  841.558347]  __do_softirq+0xbe/0x1f1
[  841.562001]  asm_call_irq_on_stack+0x12/0x20
[  841.566351]  </IRQ>
[  841.568537]  do_softirq_own_stack+0x38/0x50
[  841.572801]  do_softirq+0x61/0x70
[  841.576197]  netif_rx_ni+0x29/0x40
[  841.579681]  macvlan_broadcast+0x70/0x170 [macvlan]
[  841.584642]  macvlan_process_broadcast+0x149/0x150 [macvlan]
[  841.590382]  process_one_work+0x1c7/0x320
[  841.594476]  worker_thread+0x4e/0x430
[  841.598221]  kthread+0x126/0x140
[  841.601528]  ? process_one_work+0x320/0x320
[  841.605795]  ? kthread_associate_blkcg+0xb0/0xb0
[  841.610494]  ret_from_fork+0x22/0x30
[  841.614157] FIX kmalloc-256: Object at 0x0000000003de3e06 not freed
[  841.620686] general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6b6b: 0000 [#1] SMP PTI
[  841.630786] CPU: 16 PID: 91 Comm: ksoftirqd/16 Kdump: loaded Tainted: G    B             5.10.112 #0
[  841.640020] Hardware name: Inspur SA5112M4/YZMB-00370-102, BIOS 4.1.10 09/26/2016
[  841.647604] RIP: 0010:nf_ct_remove_expectations+0x3a/0x80 [nf_conntrack]
[  841.654385] Code: d2 74 63 55 48 01 d0 48 89 e5 41 54 53 48 89 c3 74 4e 48 c7 c7 40 54 aa a0 e8 f2 b7 f9 e0 48 8b 5b 08 48 85 db 74 2d 49 89 dc <48> 8b 1b 49 8d 7c 24 78 e8 79 97 67 e0 85 c0 74 e7 31 d2 31 f6 4c
[  841.673277] RSP: 0018:ffffc9000046fc10 EFLAGS: 00010202
[  841.678588] RAX: 0000000000000000 RBX: 6b6b6b6b6b6b6b6b RCX: 0000000000000001
[  841.685802] RDX: 0000000000000001 RSI: 000000001fc33075 RDI: ffffffffa0aa5440
[  841.693021] RBP: ffffc9000046fc20 R08: 0000000000000000 R09: 0000000000000000
[  841.700239] R10: ffff88810e9de800 R11: ffffc9000046fb5c R12: 6b6b6b6b6b6b6b6b
[  841.707459] R13: 0000000000000001 R14: ffff8881116c1000 R15: ffff88903fa25d90
[  841.714679] FS:  0000000000000000(0000) GS:ffff88903fa00000(0000) knlGS:0000000000000000
[  841.722870] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  841.728697] CR2: 00007ffdfd731d0f CR3: 000000000240a002 CR4: 00000000003706e0
[  841.735912] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  841.743130] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  841.750342] Call Trace:
[  841.752874]  destroy_conntrack+0x52/0x120 [nf_conntrack]
[  841.758268]  nf_conntrack_destroy+0x19/0x30
[  841.762531]  skb_release_head_state+0x85/0xb0
[  841.766967]  kfree_skb+0x21/0x70
[  841.770276]  ip_forward+0x1e2/0x4a0
[  841.773849]  ? ip_rcv_finish_core.constprop.0+0x53/0x3c0
[  841.779243]  ip_rcv_finish+0x82/0xa0
[  841.782896]  ip_rcv+0xa4/0xc0
[  841.785945]  ? ip_rcv_finish_core.constprop.0+0x3c0/0x3c0
[  841.791427]  __netif_receive_skb_one_core+0x63/0x70
[  841.796384]  process_backlog+0xb2/0x1d0
[  841.800298]  __napi_poll+0x2a/0xe0
[  841.803781]  net_rx_action+0xca/0x1f0
[  841.807526]  __do_softirq+0xbe/0x1f1
[  841.811184]  run_ksoftirqd+0x26/0x40
[  841.814841]  smpboot_thread_fn+0xcb/0x170
[  841.818931]  kthread+0x126/0x140
[  841.822239]  ? smpboot_register_percpu_thread+0xe0/0xe0
[  841.827550]  ? kthread_associate_blkcg+0xb0/0xb0
[  841.832244]  ret_from_fork+0x22/0x30
[  841.835898] Modules linked in: ksmbd ath9k iwl4965 iwl3945 ath9k_common rt2800usb rt2800lib rt2500usb qcserial pppoe ppp_async option mt76x0u mt76x0_common l2tp_ppp iwlmvm iwlegacy iwldvm cdc_mbim brcmsmac brcmfmac ath9k_hw ath6kl_usb ath6kl_core ath10k_pci ath10k_core ath wireguard usb_wwan sierra_net sierra rtl8187 rt73usb rt2x00usb rt2x00lib rndis_host qmi_wwan pptp pppox ppp_mppe ppp_generic nft_fib_inet nf_flow_table_ipv6 nf_flow_table_ipv4 nf_flow_table_inet mt76x02_usb mt76x02_lib mt7601u mt76_usb mt76 mac80211 libchacha20poly1305 libblake2s iwlwifi ipt_REJECT huawei_cdc_ncm curve25519_x86_64 chacha_x86_64 cfg80211 cdc_ncm cdc_ether blake2s_x86_64 zstd xt_time xt_tcpudp xt_tcpmss xt_statistic xt_state xt_recent xt_policy xt_nat xt_multiport xt_mark xt_mac xt_limit xt_length xt_hl xt_helper xt_esp xt_ecn xt_dscp xt_conntrack xt_connmark xt_connlimit xt_connbytes xt_comment xt_TCPMSS xt_REDIRECT xt_MASQUERADE xt_LOG xt_HL xt_DSCP xt_CT xt_CLASSIFY xfrm_interface usbserial usbnet usblp
[  841.835959]  ums_usbat ums_sddr55 ums_sddr09 ums_karma ums_jumpshot ums_isd200 ums_freecom ums_datafab ums_cypress ums_alauda ts_fsm ts_bm tcp_scalable tcp_bbr slhc r8152 r8125 poly1305_x86_64 pcnet32 ntfs3 nft_tproxy nft_socket nft_reject_ipv6 nft_reject_ipv4 nft_reject_inet nft_reject_bridge nft_reject nft_redir nft_quota nft_queue nft_objref nft_numgen nft_nat nft_meta_bridge nft_masq nft_log nft_limit nft_hash nft_fwd_netdev nft_flow_offload nft_fib_ipv6 nft_fib_ipv4 nft_fib nft_dup_netdev nft_ct nft_counter nft_compat nft_chain_nat nfnetlink_queue nf_tproxy_ipv6 nf_tproxy_ipv4 nf_tables nf_socket_ipv6 nf_socket_ipv4 nf_reject_ipv4 nf_nat_tftp nf_nat_snmp_basic nf_nat_sip nf_nat_pptp nf_nat_irc nf_nat_h323 nf_nat_ftp nf_nat_amanda nf_log_ipv6 nf_log_ipv4 nf_log_common nf_flow_table nf_dup_netdev nf_conntrack_tftp nf_conntrack_snmp nf_conntrack_sip nf_conntrack_pptp nf_conntrack_irc nf_conntrack_h323 nf_conntrack_ftp nf_conntrack_broadcast nf_conntrack_bridge ts_kmp nf_conntrack_amanda
[  841.923957]  nf_conncount mmc_spi mlx5_core mlx4_en mlx4_core macvlan lzo_rle lzo libcurve25519_generic libchacha libblake2s_generic ipvlan iptable_raw iptable_nat iptable_mangle iptable_filter ipt_ah ipt_ECN ipheth ip_tables igc i40e forcedeth crc8 crc7 crc_itu_t crc_ccitt cordic compat cdc_wdm brcmutil br_netfilter bnx2x bnx2 atl2 atl1e atl1c atl1 asn1_decoder alx natflow natcap nf_nat nf_conntrack evdev i2c_piix4 i2c_i801 i2c_smbus i2c_dev ledtrig_usbport xt_set ip_set_list_set ip_set_hash_netportnet ip_set_hash_netport ip_set_hash_netnet ip_set_hash_netiface ip_set_hash_net ip_set_hash_mac ip_set_hash_ipportnet ip_set_hash_ipportip ip_set_hash_ipport ip_set_hash_ipmark ip_set_hash_ip ip_set_bitmap_port ip_set_bitmap_ipmac ip_set_bitmap_ip ip_set nfnetlink jool_siit jool nf_defrag_ipv6 nf_defrag_ipv4 jool_common ip6table_mangle ip6table_filter ip6_tables ip6t_REJECT x_tables nf_reject_ipv6 nfsv4 nfsv3 nfsd nfs nfs_ssc msdos bonding ip6_gre ip_gre gre ixgbe e1000e e1000 amd_xgbe
[  842.011866]  mdio_devres ifb nat46 l2tp_ip6 l2tp_ip l2tp_eth ip6_vti ip_vti sit mdio l2tp_netlink l2tp_core udp_tunnel ip6_udp_tunnel ipcomp6 xfrm6_tunnel esp6 ah6 xfrm4_tunnel ipcomp esp4 ah4 ip6_tunnel tunnel6 tunnel4 ip_tunnel rpcsec_gss_krb5 auth_rpcgss oid_registry dm_raid tun xfrm_user xfrm_ipcomp af_key xfrm_algo virtiofs fuse vfat fat lockd sunrpc grace autofs4 dns_resolver multipath bcma raid456 async_raid6_recov async_pq async_xor async_memcpy async_tx raid10 raid1 raid0 linear md_mod nls_utf8 nls_iso8859_1 nls_cp437 eeprom_93cx6 ena sha512_ssse3 sha512_generic sha256_ssse3 sha256_generic libsha256 sha1_ssse3 sha1_generic seqiv jitterentropy_rng drbg md5 md4 hmac echainiv des_generic libdes deflate cts cmac cbc authenc crypto_acompress uas sdhci_pltfm xhci_plat_hcd softdog sata_mv fsl_mph_dr_of ehci_platform ehci_fsl mvsas igb xfs btrfs zstd_decompress zstd_compress xxhash xor raid6_pq lzo_decompress lzo_compress libcrc32c exfat dm_mirror dm_region_hash dm_log dm_crypt dm_mod dax
[  842.106808]  libsas tg3 ssb ptp pps_core mii libphy
ptpt52 commented 2 years ago

may fixed after https://github.com/ptpt52/natcap/commit/6b22e81b3fcd2d077a97c274078860bd0440f005