Repository: microsoft/ebpf-for-windows

Issue #2326: ebpf_native_release_reference use after free
Created: 2023-04-13T22:00:29Z
3: kd> .cxr; .ecxr ; kb
Unable to get exception context, HRESULT 0x8000FFFF
 # RetAddr               : Args to Child                                                           : Call Site
00 fffff802`0b727fd2     : ffff8c07`cbb36670 fffff802`0b5928e0 00000000`00000000 00000000`00000000 : nt!DbgBreakPointWithStatus [minkernel\ntos\rtl\amd64\debugstb.asm @ 124] 
01 fffff802`0b7275b6     : 00000000`00000003 ffff8c07`cbb36670 fffff802`0b622fc0 00000000`0000000a : nt!KiBugCheckDebugBreak+0x12 [minkernel\ntos\ke\bugcheck.c @ 658] 
02 fffff802`0b60e1f7     : ffffffff`ffffffff 00000000`00000000 ffffa70d`4c20cfb8 ffff88c4`62311888 : nt!KeBugCheck2+0x946 [minkernel\ntos\ke\bugcheck.c @ 2027] 
03 fffff802`0b620069     : 00000000`0000000a ffffa70d`4c20cfb8 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx+0x107 [minkernel\ntos\ke\amd64\procstat.asm @ 237] 
04 fffff802`0b61c369     : 00000000`00000000 00000004`00000000 00000000`00000014 00000000`000010b1 : nt!KiBugCheckDispatch+0x69 [minkernel\ntos\ke\amd64\trap.asm @ 3770] 
05 fffff802`0b4bea33     : 00000000`00000001 fffff802`0bbd8c66 00000000`00000000 ffff8c07`00000000 : nt!KiPageFault+0x469 [minkernel\ntos\ke\amd64\trap.asm @ 1565] 
06 (Inline Function)     : --------`-------- --------`-------- --------`-------- --------`-------- : nt!KiSetVpThreadSpinLockCount+0x10 [minkernel\ntos\ke\thredsup.c @ 14956] 
07 (Inline Function)     : --------`-------- --------`-------- --------`-------- --------`-------- : nt!KxAcquireSpinLock+0x2b [minkernel\ntos\ke\spinlock.c @ 392] 
08 fffff802`0cb0005e     : 00000000`00000001 ffffa70d`4c20cfb8 ffff8c07`cbb31000 ffff8c07`cbb38000 : nt!KeAcquireSpinLockRaiseToDpc+0x53 [minkernel\ntos\ke\spinlock.c @ 526] 
09 fffff802`0bbeefbc     : ffffa70d`4c20cfb8 ffff8c07`cbb37470 00000000`00000001 ffffa70d`40454508 : VerifierExt!KeAcquireSpinLockRaiseToDpc_wrapper+0x17e [minkernel\verifier\xdv\rules\group_x64.c @ 9697] 
0a fffff802`0bbeda02     : ffffa70d`4a4d0910 00000000`00000000 00000000`00000000 00000000`00000000 : nt!ViKeAcquireSpinLockRaiseToDpcCommon+0x3c [minkernel\ntos\verifier\vfke.c @ 1548] 
0b fffff802`cbb79fd4     : ffffa70d`4a4d0910 ffff8c07`cbb373c0 00000000`00000000 fffff802`0b74b495 : nt!VerifierKeAcquireSpinLockRaiseToDpc+0x12 [minkernel\ntos\verifier\vfke.c @ 1600] 
0c fffff802`cbb6f3e8     : ffffa70d`4c20cfb8 fffff802`0d2cc644 00000000`00000000 fffff802`0be63c00 : eBPFCore!ebpf_lock_lock+0x14 [E:\ebpf-for-windows\libs\platform\kernel\ebpf_platform_kernel.c @ 388] 
0d fffff802`cbb6b5d5     : ffffa70d`4c20cf70 ffffa70d`4c20cf00 ffff8c07`cbb372d8 00000000`00000000 : eBPFCore!ebpf_native_release_reference+0x178 [E:\ebpf-for-windows\libs\execution_context\ebpf_native.c @ 280] 
0e fffff802`0d26f764     : ffffa70d`4c20cf70 00000000`00000000 ffffa70d`461ea180 00000000`00000000 : eBPFCore!_ebpf_native_provider_detach_client_callback+0x225 [E:\ebpf-for-windows\libs\execution_context\ebpf_native.c @ 477] 
0f fffff802`0d26f695     : ffff8c07`cbb37440 ffffb700`53dc0180 ffffa70d`461ea040 fffff802`0b4275df : NETIO!NmrpNotifyBindingDetach+0x44 [minio\netio\nmr\binding.c @ 494] 
10 fffff802`0d26f622     : ffffa70d`483fd6e8 00000000`00000000 ffff8c07`cbb374bc 00000000`00000000 : NETIO!NmrpDetachList+0x21 [minio\netio\nmr\module.c @ 494] 
11 fffff802`0d297ec6     : ffffa70d`461ea040 ffffa70d`40453ce0 ffff8c07`cb81f110 00000000`00000000 : NETIO!NmrpDeregisterModule+0xd2 [minio\netio\nmr\module.c @ 564] 
12 fffff802`cba51276     : ffffa70d`00000000 ffffa70d`00000000 00000000`00000000 00000000`00000000 : NETIO!NmrDeregisterClient+0x16 [minio\netio\nmr\module.c @ 740] 
13 fffff802`0ba5fc23     : ffffa70d`462bc520 fffff802`0b894840 fffff802`0bf3a440 00000000`00000000 : cgroup_sock_addr40!DriverUnload+0x16 [E:\ebpf-for-windows\x64\Debug\cgroup_sock_addr_km\cgroup_sock_addr_driver.c @ 119] 
14 fffff802`0b467b65     : ffffa70d`00000000 00000000`00000000 ffffa70d`461ea040 00000000`00000000 : nt!IopLoadUnloadDriver+0xd6793 [minkernel\ntos\io\iomgr\internal.c @ 5482] 
15 fffff802`0b486d25     : ffffa70d`461ea040 00000000`00000080 ffffa70d`404a4040 47474747`47474700 : nt!ExpWorkerThread+0x105 [minkernel\ntos\ex\worker.c @ 4315] 
16 fffff802`0b615778     : fffff802`0a0ed180 ffffa70d`461ea040 fffff802`0b486cd0 47474747`47474747 : nt!PspSystemThreadStartup+0x55 [minkernel\ntos\ps\psexec.c @ 9746] 
17 00000000`00000000     : ffff8c07`cbb38000 ffff8c07`cbb31000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+

Duplicate issue #2130: Bugcheck during native program driver unload / NMR
Created: 2023-02-23T19:36:34Z
Describe the bug
A bugcheck occurred when a native eBPF program was being unloaded.
OS information
17763.1.amd64fre.rs5_release.180914-1434
Steps taken to reproduce bug
Ran XDP stress test in the XDP project's CI/CD pipeline.
Expected behavior
eBPF programs and drivers shouldn't cause bugchecks.
Actual outcome
The system bugchecked.
Additional details
nt!KeBugCheckEx+0x0 [minkernel\ntos\ke\amd64\procstat.asm @ 140]
nt!KiBugCheckDispatch+0x69 [minkernel\ntos\ke\amd64\trap.asm @ 3595]
nt!KiPageFault+0x44e [minkernel\ntos\ke\amd64\trap.asm @ 1560]
nt!KiAcquireSpinLockInstrumented+0x7f [minkernel\ntos\ke\spinlock.c @ 310]
nt!KeAcquireSpinLockRaiseToDpc+0x1ce3ca [minkernel\ntos\ke\spinlock.c @ 525]
verifierext!KeAcquireSpinLockRaiseToDpc_wrapper+0x65 [minkernel\verifier\xdv\rules\group_x64.c @ 6138]
nt!ViKeAcquireSpinLockRaiseToDpcCommon+0x3c [minkernel\ntos\verifier\vfke.c @ 1536]
nt!VerifierKeAcquireSpinLockRaiseToDpc+0x12 [minkernel\ntos\verifier\vfke.c @ 1588]
ebpfcore!+0x10e79  [D:\a\ebpf-for-windows\ebpf-for-windows\libs\execution_context\ebpf_native.c @ 271] (00000001`40010dd0)   eBPFCore!ebpf_native_release_reference+0xa9
ebpfcore!+0xeeb0  [D:\a\ebpf-for-windows\ebpf-for-windows\libs\execution_context\ebpf_native.c @ 467] (00000001`4000eda0)   eBPFCore!_ebpf_native_provider_detach_client_callback+0x110
netio!NmrpNotifyBindingDetach+0x48 [minio\netio\nmr\binding.c @ 494]
netio!NmrpDetachList+0x21 [minio\netio\nmr\module.c @ 494]
netio!NmrpDeregisterModule+0xc4 [minio\netio\nmr\module.c @ 564]
netio!NmrDeregisterClient+0x16 [minio\netio\nmr\module.c @ 740]
pass!+0x1256  [D:\a\1\s\artifacts\bin\x64_Release\bpf\pass_km\pass_driver.c @ 119] (00000001`40001240)   pass!DriverUnload+0x16
nt!IopLoadUnloadDriver+0x8d [minkernel\ntos\io\iomgr\internal.c @ 5250]
nt!ExpWorkerThread+0x16a [minkernel\ntos\ex\worker.c @ 4303]
nt!PspSystemThreadStartup+0x55 [minkernel\ntos\ps\psexec.c @ 8813]
nt!KiStartSystemThread+0x1c [minkernel\ntos\ke\amd64\threadbg.asm @ 81]

Closing comment (2023-04-26T00:56:07Z): This is fixed by #2355. Resolving this as duplicate of #2326