{"action":"created","issue":{"url":"https://api.github.com/repos/tbarbette/fastclick/issues/73","repository_url":"https://api.github.com/repos/tbarbette/fastclick","labels_url":"https://api.github.com/repos/tbarbette/fastclick/issues/73/labels{/name}","comments_url":"https://api.github.com/repos/tbarbette/fastclick/issues/73/comments","events_url":"https://api.github.com/repos/tbarbette/fastclick/issues/73/events","html_url":"https://github.com/tbarbette/fastclick/issues/73","id":309914598,"number":73,"title":"Double free after Packet::expensive_push with enable-netmap-pool","user":{"login":"piotrjurkiewicz","id":2237894,"avatar_url":"https://avatars0.githubusercontent.com/u/2237894?v=4","gravatar_id":"","url":"https://api.github.com/users/piotrjurkiewicz","html_url":"https://github.com/piotrjurkiewicz","followers_url":"https://api.github.com/users/piotrjurkiewicz/followers","following_url":"https://api.github.com/users/piotrjurkiewicz/following{/other_user}","gists_url":"https://api.github.com/users/piotrjurkiewicz/gists{/gist_id}","starred_url":"https://api.github.com/users/piotrjurkiewicz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/piotrjurkiewicz/subscriptions","organizations_url":"https://api.github.com/users/piotrjurkiewicz/orgs","repos_url":"https://api.github.com/users/piotrjurkiewicz/repos","events_url":"https://api.github.com/users/piotrjurkiewicz/events{/privacy}","received_events_url":"https://api.github.com/users/piotrjurkiewicz/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-03-29T21:47:53Z","updated_at":"2018-03-30T11:25:44Z","closed_at":null,"author_association":"CONTRIBUTOR","body":"Results in a crash.\r\n\r\nDoes not occur without `--enable-netmap-pool`.\r\n\r\nThe simplest way to reproduce is to forward a packet received with `FromNetmapDevice` to `KernelTap` element. `KernelTap` calls `Packet::push(4)`, which turns into `Packet::expensive_push`, since there is no headroom in a Netmap packet. `Packet::expensive_push` calls `Packet::expensive_uniqueify` which frees the packet and allocates a new one. After the push, `KernelTap` writes packet content to TAP and calls `Packet::kill`. Probably this is the moment, when the double free happens.\r\n\r\nTo reproduce you can use a veth pair, either patched or emulated.\r\n\r\nPreparation:\r\n\r\n```\r\ninsmod /usr/local/lib/netmap.ko\r\nip link add type veth\r\nip link set veth0 up\r\nip link set veth1 up\r\n```\r\n\r\nThen run the following configuration:\r\n\r\n```\r\ndefine($burst 32)\r\n\r\nkt :: KernelTap(192.168.5.1/24);\r\nkt -> Discard;\r\nFromNetmapDevice(\"netmap:veth1\", BURST $burst) -> Print(\"Received FromNetmapDevice, forwarded to KernelTap\", ACTIVE 1) -> kt;\r\n```\r\n\r\nClick process will crash after a while, when kernel will send any packet to veth0:\r\n\r\n```\r\nroot@localhost:/merged# click famtar/test/kill.click\r\n[  136.367326] 966.520454 [1262] generic_netmap_attach     Emulated adapter for veth1 created (prev was           (null))\r\n966.520336 nm_open [861] overriding ARG3 4096\r\n[  136.455915] 966.609050 [ 441] generic_netmap_register   Emulated adapter for veth1 activated\r\n[  136.457532] 966.610669 [ 486] generic_netmap_register   Emulated adapter: ring 'veth1 RX0' activated\r\n[  136.459186] 966.612324 [ 493] generic_netmap_register   Emulated adapter: ring 'veth1 TX0' activated\r\n[  136.460879] 966.614016 [ 818] tc_configure              ifp veth1 qdisc netmapemu parent 4294967295 handle 0\r\nAllocated 4096 buffers from Netmap buffer pool\r\n966.617968 nm_open [874] overriding ifname veth1 ringid 0x1000 flags 0x4\r\n966.617997 nm_mmap [984] do not mmap, inherit from parent\r\nReceived FromNetmapDevice, forwarded to KernelTap:   70 | 33330000 00026631 82953e2d 86dd6000 00000010 3afffe80\r\nexpensive Packet::push; have 0 wanted 4\r\nfree(): invalid pointer\r\n[  160.758624] 990.912471 [ 818] tc_configure              ifp veth1 qdisc pfifo parent 4294967295 handle 0\r\n[  160.761353] 990.915204 [ 352] generic_netmap_unregister Emulated adapter: ring 'veth1 RX0' deactivated\r\n[  160.763998] 990.917850 [ 359] generic_netmap_unregister Emulated adapter: ring 'veth1 TX0' deactivated\r\n[  160.766231] 990.920084 [ 416] generic_netmap_unregister Emulated adapter for veth1 deactivated\r\n[  160.768852] 990.922704 [1168] generic_netmap_dtor       Emulated netmap adapter for veth1 destroyed\r\nAborted\r\n```\r\n\r\nTo induce a crash faster, you can set some IP address on veth0 and ping some random IP address in the same subnet. Kernel will send an ARP request to veth0, which received in Click from veth1 will crash it.\r\n\r\n```\r\nip addr add 192.168.6.1/24 dev veth0\r\nping 192.168.6.2\r\n```\r\n\r\nAs I already have mentioned, the same happens with patched veth module. The only difference is that kernel prints:\r\n\r\n    [ 8661.060906] 237.928916 [1056] netmap_obj_free           ouch, double free on buffer 53250\r\n\r\nat the crash moment."},"comment":{"url":"https://api.github.com/repos/tbarbette/fastclick/issues/comments/377505495","html_url":"https://github.com/tbarbette/fastclick/issues/73#issuecomment-377505495","issue_url":"https://api.github.com/repos/tbarbette/fastclick/issues/73","id":377505495,"user":{"login":"tbarbette","id":248961,"avatar_url":"https://avatars1.githubusercontent.com/u/248961?v=4","gravatar_id":"","url":"https://api.github.com/users/tbarbette","html_url":"https://github.com/tbarbette","followers_url":"https://api.github.com/users/tbarbette/followers","following_url":"https://api.github.com/users/tbarbette/following{/other_user}","gists_url":"https://api.github.com/users/tbarbette/gists{/gist_id}","starred_url":"https://api.github.com/users/tbarbette/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tbarbette/subscriptions","organizations_url":"https://api.github.com/users/tbarbette/orgs","repos_url":"https://api.github.com/users/tbarbette/repos","events_url":"https://api.github.com/users/tbarbette/events{/privacy}","received_events_url":"https://api.github.com/users/tbarbette/received_events","type":"User","site_admin":false},"created_at":"2018-03-30T11:25:44Z","updated_at":"2018-03-30T11:25:44Z","author_association":"OWNER","body":"Tanks for the detailed issue ! I always used --enable-netmap-pool lately.  And more generally DPDK... \r\n\r\nI'm looking into that right now."}}
{"actor":{"display_login":"tbarbette"}}