bpftool: Allow building statically #27
Closed
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Master branch: 9b6eb04 |
|
Master branch: 1b8c924 |
kernel-patches-bot
force-pushed
the
series/615375=>bpf-next
branch
from
4d2fcee
to
3de937a
Compare
|
Master branch: 9e98ace |
kernel-patches-bot
force-pushed
the
series/615375=>bpf-next
branch
from
3de937a
to
340e311
Compare
kernel-patches-bot
force-pushed
the
bpf-next
branch
from
9e98ace
to
1b8c924
Compare
|
Master branch: 1b8c924 |
kernel-patches-bot
force-pushed
the
series/615375=>bpf-next
branch
from
340e311
to
4d70485
Compare
|
Master branch: b38101c |
kernel-patches-bot
force-pushed
the
series/615375=>bpf-next
branch
from
4d70485
to
dfaa2a8
Compare
|
Master branch: b75daca |
kernel-patches-bot
force-pushed
the
series/615375=>bpf-next
branch
from
dfaa2a8
to
b94b746
Compare
|
Master branch: d24d2a2 |
kernel-patches-bot
force-pushed
the
series/615375=>bpf-next
branch
from
b94b746
to
6045b5c
Compare
|
Master branch: 086d490 |
Sometime it can be useful to haul around a statically built version of bpftool. Simply add support for passing STATIC=1 while building to build the tool statically. Signed-off-by: Nikolay Borisov <[email protected]>
kernel-patches-bot
force-pushed
the
series/615375=>bpf-next
branch
from
6045b5c
to
cb07d4f
Compare
|
At least one diff in series https://patchwork.kernel.org/project/netdevbpf/list/?series=615375 expired. Closing PR. |
kernel-patches-bot
pushed a commit
that referenced
this pull request
Mar 18, 2022
high_memory used to be initialized in mem_init, way after setup_bootmem. But a call to dma_contiguous_reserve in this function gives rise to the below warning because high_memory is equal to 0 and is used at the very beginning at cma_declare_contiguous_nid. It went unnoticed since the move of the kasan region redefined KERN_VIRT_SIZE so that it does not encompass -1 anymore. Fix this by initializing high_memory in setup_bootmem. ------------[ cut here ]------------ virt_to_phys used for non-linear address: ffffffffffffffff (0xffffffffffffffff) WARNING: CPU: 0 PID: 0 at arch/riscv/mm/physaddr.c:14 __virt_to_phys+0xac/0x1b8 Modules linked in: CPU: 0 PID: 0 Comm: swapper Not tainted 5.17.0-rc1-00007-ga68b89289e26 #27 Hardware name: riscv-virtio,qemu (DT) epc : __virt_to_phys+0xac/0x1b8 ra : __virt_to_phys+0xac/0x1b8 epc : ffffffff80014922 ra : ffffffff80014922 sp : ffffffff84a03c30 gp : ffffffff85866c80 tp : ffffffff84a3f180 t0 : ffffffff86bce657 t1 : fffffffef09406e8 t2 : 0000000000000000 s0 : ffffffff84a03c70 s1 : ffffffffffffffff a0 : 000000000000004f a1 : 00000000000f0000 a2 : 0000000000000002 a3 : ffffffff8011f408 a4 : 0000000000000000 a5 : 0000000000000000 a6 : 0000000000f00000 a7 : ffffffff84a03747 s2 : ffffffd800000000 s3 : ffffffff86ef4000 s4 : ffffffff8467f828 s5 : fffffff800000000 s6 : 8000000000006800 s7 : 0000000000000000 s8 : 0000000480000000 s9 : 0000000080038ea0 s10: 0000000000000000 s11: ffffffffffffffff t3 : ffffffff84a035c0 t4 : fffffffef09406e8 t5 : fffffffef09406e9 t6 : ffffffff84a03758 status: 0000000000000100 badaddr: 0000000000000000 cause: 0000000000000003 [<ffffffff8322ef4c>] cma_declare_contiguous_nid+0xf2/0x64a [<ffffffff83212a58>] dma_contiguous_reserve_area+0x46/0xb4 [<ffffffff83212c3a>] dma_contiguous_reserve+0x174/0x18e [<ffffffff83208fc2>] paging_init+0x12c/0x35e [<ffffffff83206bd2>] setup_arch+0x120/0x74e [<ffffffff83201416>] start_kernel+0xce/0x68c irq event stamp: 0 hardirqs last enabled at (0): [<0000000000000000>] 0x0 hardirqs last disabled at (0): [<0000000000000000>] 0x0 softirqs last enabled at (0): [<0000000000000000>] 0x0 softirqs last disabled at (0): [<0000000000000000>] 0x0 ---[ end trace 0000000000000000 ]--- Fixes: f7ae023 ("riscv: Move KASAN mapping next to the kernel mapping") Signed-off-by: Alexandre Ghiti <[email protected]> Cc: [email protected] Signed-off-by: Palmer Dabbelt <[email protected]>
kernel-patches-bot
pushed a commit
that referenced
this pull request
Apr 9, 2022
when get fiemap starting from MAX_LFS_FILESIZE, (maxbytes - *len) < start will always true , then *len set zero. because of start offset is beyond file size, for erofs filesystem it will always return iomap.length with zero,iomap iterate will enter infinite loop. it is necessary cover this corner case to avoid this situation. ------------[ cut here ]------------ WARNING: CPU: 7 PID: 905 at fs/iomap/iter.c:35 iomap_iter+0x97f/0xc70 Modules linked in: xfs erofs CPU: 7 PID: 905 Comm: iomap Tainted: G W 5.17.0-rc8 #27 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 RIP: 0010:iomap_iter+0x97f/0xc70 Code: 85 a1 fc ff ff e8 71 be 9c ff 0f 1f 44 00 00 e9 92 fc ff ff e8 62 be 9c ff 0f 0b b8 fb ff ff ff e9 fc f8 ff ff e8 51 be 9c ff <0f> 0b e9 2b fc ff ff e8 45 be 9c ff 0f 0b e9 e1 fb ff ff e8 39 be RSP: 0018:ffff888060a37ab0 EFLAGS: 00010293 RAX: 0000000000000000 RBX: ffff888060a37bb0 RCX: 0000000000000000 RDX: ffff88807e19a900 RSI: ffffffff81a7da7f RDI: ffff888060a37be0 RBP: 7fffffffffffffff R08: 0000000000000000 R09: ffff888060a37c20 R10: ffff888060a37c67 R11: ffffed100c146f8c R12: 7fffffffffffffff R13: 0000000000000000 R14: ffff888060a37bd8 R15: ffff888060a37c20 FS: 00007fd3cca01540(0000) GS:ffff888108780000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020010820 CR3: 0000000054b92000 CR4: 00000000000006e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> iomap_fiemap+0x1c9/0x2f0 erofs_fiemap+0x64/0x90 [erofs] do_vfs_ioctl+0x40d/0x12e0 __x64_sys_ioctl+0xaa/0x1c0 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x44/0xae </TASK> ---[ end trace 0000000000000000 ]--- watchdog: BUG: soft lockup - CPU#7 stuck for 26s! [iomap:905] Reported-by: Hulk Robot <[email protected]> Signed-off-by: Guo Xuenan <[email protected]> Reviewed-by: Christoph Hellwig <[email protected]> [djwong: fix some typos] Reviewed-by: Darrick J. Wong <[email protected]> Signed-off-by: Darrick J. Wong <[email protected]>
kernel-patches-bot
pushed a commit
that referenced
this pull request
Apr 27, 2022
+new file mode 100644 +WARNING: Missing or malformed SPDX-License-Identifier tag in line 1 +#27: FILE: Documentation/virt/kvm/x86/errata.rst:1: Opportunistically update all other non-added KVM documents and remove a new extra blank line at EOF for x86/errata.rst. Signed-off-by: Like Xu <[email protected]> Message-Id: <[email protected]> Signed-off-by: Paolo Bonzini <[email protected]>
kernel-patches-bot
pushed a commit
that referenced
this pull request
Apr 27, 2022
Given a sufficiently large number of actions, while copying and reserving memory for a new action of a new flow, if next_offset is greater than MAX_ACTIONS_BUFSIZE, the function reserve_sfa_size() does not return -EMSGSIZE as expected, but it allocates MAX_ACTIONS_BUFSIZE bytes increasing actions_len by req_size. This can then lead to an OOB write access, especially when further actions need to be copied. Fix it by rearranging the flow action size check. KASAN splat below: ================================================================== BUG: KASAN: slab-out-of-bounds in reserve_sfa_size+0x1ba/0x380 [openvswitch] Write of size 65360 at addr ffff888147e4001c by task handler15/836 CPU: 1 PID: 836 Comm: handler15 Not tainted 5.18.0-rc1+ #27 ... Call Trace: <TASK> dump_stack_lvl+0x45/0x5a print_report.cold+0x5e/0x5db ? __lock_text_start+0x8/0x8 ? reserve_sfa_size+0x1ba/0x380 [openvswitch] kasan_report+0xb5/0x130 ? reserve_sfa_size+0x1ba/0x380 [openvswitch] kasan_check_range+0xf5/0x1d0 memcpy+0x39/0x60 reserve_sfa_size+0x1ba/0x380 [openvswitch] __add_action+0x24/0x120 [openvswitch] ovs_nla_add_action+0xe/0x20 [openvswitch] ovs_ct_copy_action+0x29d/0x1130 [openvswitch] ? __kernel_text_address+0xe/0x30 ? unwind_get_return_address+0x56/0xa0 ? create_prof_cpu_mask+0x20/0x20 ? ovs_ct_verify+0xf0/0xf0 [openvswitch] ? prep_compound_page+0x198/0x2a0 ? __kasan_check_byte+0x10/0x40 ? kasan_unpoison+0x40/0x70 ? ksize+0x44/0x60 ? reserve_sfa_size+0x75/0x380 [openvswitch] __ovs_nla_copy_actions+0xc26/0x2070 [openvswitch] ? __zone_watermark_ok+0x420/0x420 ? validate_set.constprop.0+0xc90/0xc90 [openvswitch] ? __alloc_pages+0x1a9/0x3e0 ? __alloc_pages_slowpath.constprop.0+0x1da0/0x1da0 ? unwind_next_frame+0x991/0x1e40 ? __mod_node_page_state+0x99/0x120 ? __mod_lruvec_page_state+0x2e3/0x470 ? __kasan_kmalloc_large+0x90/0xe0 ovs_nla_copy_actions+0x1b4/0x2c0 [openvswitch] ovs_flow_cmd_new+0x3cd/0xb10 [openvswitch] ... Cc: [email protected] Fixes: f28cd2a ("openvswitch: fix flow actions reallocation") Signed-off-by: Paolo Valerio <[email protected]> Acked-by: Eelco Chaudron <[email protected]> Signed-off-by: David S. Miller <[email protected]>
kernel-patches-bot
pushed a commit
that referenced
this pull request
Mar 21, 2023
Add instruction dump (Code:) output to RISC-V splats. Dump 16b parcels. An example: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 Oops [#1] Modules linked in: CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.2.0-rc3-00302-g840ff44c571d-dirty #27 Hardware name: riscv-virtio,qemu (DT) epc : kernel_init+0xc8/0x10e ra : kernel_init+0x70/0x10e epc : ffffffff80bd9a40 ra : ffffffff80bd99e8 sp : ff2000000060bec0 gp : ffffffff81730b28 tp : ff6000007ff00000 t0 : 7974697275636573 t1 : 0000000000000000 t2 : 3030303270393d6e s0 : ff2000000060bee0 s1 : ffffffff81732028 a0 : 0000000000000000 a1 : ff60000080dd1780 a2 : 0000000000000002 a3 : ffffffff8176a470 a4 : 0000000000000000 a5 : 000000000000000a a6 : 0000000000000081 a7 : ff60000080dd1780 s2 : 0000000000000000 s3 : 0000000000000000 s4 : 0000000000000000 s5 : 0000000000000000 s6 : 0000000000000000 s7 : 0000000000000000 s8 : 0000000000000000 s9 : 0000000000000000 s10: 0000000000000000 s11: 0000000000000000 t3 : ffffffff81186018 t4 : 0000000000000022 t5 : 000000000000003d t6 : 0000000000000000 status: 0000000200000120 badaddr: 0000000000000000 cause: 000000000000000f [<ffffffff80003528>] ret_from_exception+0x0/0x16 Code: 862a d179 608c a517 0069 0513 2be5 d0ef db2e 47a9 (c11c) a517 ---[ end trace 0000000000000000 ]--- Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b SMP: stopping secondary CPUs ---[ end Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b ]--- Signed-off-by: Björn Töpel <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Palmer Dabbelt <[email protected]>
kernel-patches-daemon-bpf-rc bot
pushed a commit
that referenced
this pull request
May 30, 2023
The cited commit adds a compeletion to remove dependency on rtnl lock. But it causes a deadlock for multiple encapsulations: crash> bt ffff8aece8a64000 PID: 1514557 TASK: ffff8aece8a64000 CPU: 3 COMMAND: "tc" #0 [ffffa6d14183f368] __schedule at ffffffffb8ba7f45 #1 [ffffa6d14183f3f8] schedule at ffffffffb8ba8418 #2 [ffffa6d14183f418] schedule_preempt_disabled at ffffffffb8ba8898 #3 [ffffa6d14183f428] __mutex_lock at ffffffffb8baa7f8 #4 [ffffa6d14183f4d0] mutex_lock_nested at ffffffffb8baabeb #5 [ffffa6d14183f4e0] mlx5e_attach_encap at ffffffffc0f48c17 [mlx5_core] #6 [ffffa6d14183f628] mlx5e_tc_add_fdb_flow at ffffffffc0f39680 [mlx5_core] #7 [ffffa6d14183f688] __mlx5e_add_fdb_flow at ffffffffc0f3b636 [mlx5_core] #8 [ffffa6d14183f6f0] mlx5e_tc_add_flow at ffffffffc0f3bcdf [mlx5_core] #9 [ffffa6d14183f728] mlx5e_configure_flower at ffffffffc0f3c1d1 [mlx5_core] #10 [ffffa6d14183f790] mlx5e_rep_setup_tc_cls_flower at ffffffffc0f3d529 [mlx5_core] #11 [ffffa6d14183f7a0] mlx5e_rep_setup_tc_cb at ffffffffc0f3d714 [mlx5_core] #12 [ffffa6d14183f7b0] tc_setup_cb_add at ffffffffb8931bb8 #13 [ffffa6d14183f810] fl_hw_replace_filter at ffffffffc0dae901 [cls_flower] #14 [ffffa6d14183f8d8] fl_change at ffffffffc0db5c57 [cls_flower] #15 [ffffa6d14183f970] tc_new_tfilter at ffffffffb8936047 #16 [ffffa6d14183fac8] rtnetlink_rcv_msg at ffffffffb88c7c31 #17 [ffffa6d14183fb50] netlink_rcv_skb at ffffffffb8942853 #18 [ffffa6d14183fbc0] rtnetlink_rcv at ffffffffb88c1835 #19 [ffffa6d14183fbd0] netlink_unicast at ffffffffb8941f27 #20 [ffffa6d14183fc18] netlink_sendmsg at ffffffffb8942245 #21 [ffffa6d14183fc98] sock_sendmsg at ffffffffb887d482 #22 [ffffa6d14183fcb8] ____sys_sendmsg at ffffffffb887d81a #23 [ffffa6d14183fd38] ___sys_sendmsg at ffffffffb88806e2 #24 [ffffa6d14183fe90] __sys_sendmsg at ffffffffb88807a2 #25 [ffffa6d14183ff28] __x64_sys_sendmsg at ffffffffb888080f #26 [ffffa6d14183ff38] do_syscall_64 at ffffffffb8b9b6a8 #27 [ffffa6d14183ff50] entry_SYSCALL_64_after_hwframe at ffffffffb8c0007c crash> bt 0xffff8aeb07544000 PID: 1110766 TASK: ffff8aeb07544000 CPU: 0 COMMAND: "kworker/u20:9" #0 [ffffa6d14e6b7bd8] __schedule at ffffffffb8ba7f45 #1 [ffffa6d14e6b7c68] schedule at ffffffffb8ba8418 #2 [ffffa6d14e6b7c88] schedule_timeout at ffffffffb8baef88 #3 [ffffa6d14e6b7d10] wait_for_completion at ffffffffb8ba968b #4 [ffffa6d14e6b7d60] mlx5e_take_all_encap_flows at ffffffffc0f47ec4 [mlx5_core] #5 [ffffa6d14e6b7da0] mlx5e_rep_update_flows at ffffffffc0f3e734 [mlx5_core] #6 [ffffa6d14e6b7df8] mlx5e_rep_neigh_update at ffffffffc0f400bb [mlx5_core] #7 [ffffa6d14e6b7e50] process_one_work at ffffffffb80acc9c #8 [ffffa6d14e6b7ed0] worker_thread at ffffffffb80ad012 #9 [ffffa6d14e6b7f10] kthread at ffffffffb80b615d #10 [ffffa6d14e6b7f50] ret_from_fork at ffffffffb8001b2f After the first encap is attached, flow will be added to encap entry's flows list. If neigh update is running at this time, the following encaps of the flow can't hold the encap_tbl_lock and sleep. If neigh update thread is waiting for that flow's init_done, deadlock happens. Fix it by holding lock outside of the for loop. If neigh update is running, prevent encap flows from offloading. Since the lock is held outside of the for loop, concurrent creation of encap entries is not allowed. So remove unnecessary wait_for_completion call for res_ready. Fixes: 95435ad ("net/mlx5e: Only access fully initialized flows in neigh update") Signed-off-by: Chris Mi <[email protected]> Reviewed-by: Roi Dayan <[email protected]> Reviewed-by: Vlad Buslov <[email protected]> Signed-off-by: Saeed Mahameed <[email protected]>
kernel-patches-daemon-bpf-rc bot
pushed a commit
that referenced
this pull request
Sep 21, 2023
The following processes run into a deadlock. CPU 41 was waiting for CPU 29 to handle a CSD request while holding spinlock "crashdump_lock", but CPU 29 was hung by that spinlock with IRQs disabled. PID: 17360 TASK: ffff95c1090c5c40 CPU: 41 COMMAND: "mrdiagd" !# 0 [ffffb80edbf37b58] __read_once_size at ffffffff9b871a40 include/linux/compiler.h:185:0 !# 1 [ffffb80edbf37b58] atomic_read at ffffffff9b871a40 arch/x86/include/asm/atomic.h:27:0 !# 2 [ffffb80edbf37b58] dump_stack at ffffffff9b871a40 lib/dump_stack.c:54:0 # 3 [ffffb80edbf37b78] csd_lock_wait_toolong at ffffffff9b131ad5 kernel/smp.c:364:0 # 4 [ffffb80edbf37b78] __csd_lock_wait at ffffffff9b131ad5 kernel/smp.c:384:0 # 5 [ffffb80edbf37bf8] csd_lock_wait at ffffffff9b13267a kernel/smp.c:394:0 # 6 [ffffb80edbf37bf8] smp_call_function_many at ffffffff9b13267a kernel/smp.c:843:0 # 7 [ffffb80edbf37c50] smp_call_function at ffffffff9b13279d kernel/smp.c:867:0 # 8 [ffffb80edbf37c50] on_each_cpu at ffffffff9b13279d kernel/smp.c:976:0 # 9 [ffffb80edbf37c78] flush_tlb_kernel_range at ffffffff9b085c4b arch/x86/mm/tlb.c:742:0 #10 [ffffb80edbf37cb8] __purge_vmap_area_lazy at ffffffff9b23a1e0 mm/vmalloc.c:701:0 #11 [ffffb80edbf37ce0] try_purge_vmap_area_lazy at ffffffff9b23a2cc mm/vmalloc.c:722:0 #12 [ffffb80edbf37ce0] free_vmap_area_noflush at ffffffff9b23a2cc mm/vmalloc.c:754:0 #13 [ffffb80edbf37cf8] free_unmap_vmap_area at ffffffff9b23bb3b mm/vmalloc.c:764:0 #14 [ffffb80edbf37cf8] remove_vm_area at ffffffff9b23bb3b mm/vmalloc.c:1509:0 #15 [ffffb80edbf37d18] __vunmap at ffffffff9b23bb8a mm/vmalloc.c:1537:0 #16 [ffffb80edbf37d40] vfree at ffffffff9b23bc85 mm/vmalloc.c:1612:0 #17 [ffffb80edbf37d58] megasas_free_host_crash_buffer [megaraid_sas] at ffffffffc020b7f2 drivers/scsi/megaraid/megaraid_sas_fusion.c:3932:0 #18 [ffffb80edbf37d80] fw_crash_state_store [megaraid_sas] at ffffffffc01f804d drivers/scsi/megaraid/megaraid_sas_base.c:3291:0 #19 [ffffb80edbf37dc0] dev_attr_store at ffffffff9b56dd7b drivers/base/core.c:758:0 #20 [ffffb80edbf37dd0] sysfs_kf_write at ffffffff9b326acf fs/sysfs/file.c:144:0 #21 [ffffb80edbf37de0] kernfs_fop_write at ffffffff9b325fd4 fs/kernfs/file.c:316:0 #22 [ffffb80edbf37e20] __vfs_write at ffffffff9b29418a fs/read_write.c:480:0 #23 [ffffb80edbf37ea8] vfs_write at ffffffff9b294462 fs/read_write.c:544:0 #24 [ffffb80edbf37ee8] SYSC_write at ffffffff9b2946ec fs/read_write.c:590:0 #25 [ffffb80edbf37ee8] SyS_write at ffffffff9b2946ec fs/read_write.c:582:0 #26 [ffffb80edbf37f30] do_syscall_64 at ffffffff9b003ca9 arch/x86/entry/common.c:298:0 #27 [ffffb80edbf37f58] entry_SYSCALL_64 at ffffffff9ba001b1 arch/x86/entry/entry_64.S:238:0 PID: 17355 TASK: ffff95c1090c3d80 CPU: 29 COMMAND: "mrdiagd" !# 0 [ffffb80f2d3c7d30] __read_once_size at ffffffff9b0f2ab0 include/linux/compiler.h:185:0 !# 1 [ffffb80f2d3c7d30] native_queued_spin_lock_slowpath at ffffffff9b0f2ab0 kernel/locking/qspinlock.c:368:0 # 2 [ffffb80f2d3c7d58] pv_queued_spin_lock_slowpath at ffffffff9b0f244b arch/x86/include/asm/paravirt.h:674:0 # 3 [ffffb80f2d3c7d58] queued_spin_lock_slowpath at ffffffff9b0f244b arch/x86/include/asm/qspinlock.h:53:0 # 4 [ffffb80f2d3c7d68] queued_spin_lock at ffffffff9b8961a6 include/asm-generic/qspinlock.h:90:0 # 5 [ffffb80f2d3c7d68] do_raw_spin_lock_flags at ffffffff9b8961a6 include/linux/spinlock.h:173:0 # 6 [ffffb80f2d3c7d68] __raw_spin_lock_irqsave at ffffffff9b8961a6 include/linux/spinlock_api_smp.h:122:0 # 7 [ffffb80f2d3c7d68] _raw_spin_lock_irqsave at ffffffff9b8961a6 kernel/locking/spinlock.c:160:0 # 8 [ffffb80f2d3c7d88] fw_crash_buffer_store [megaraid_sas] at ffffffffc01f8129 drivers/scsi/megaraid/megaraid_sas_base.c:3205:0 # 9 [ffffb80f2d3c7dc0] dev_attr_store at ffffffff9b56dd7b drivers/base/core.c:758:0 #10 [ffffb80f2d3c7dd0] sysfs_kf_write at ffffffff9b326acf fs/sysfs/file.c:144:0 #11 [ffffb80f2d3c7de0] kernfs_fop_write at ffffffff9b325fd4 fs/kernfs/file.c:316:0 #12 [ffffb80f2d3c7e20] __vfs_write at ffffffff9b29418a fs/read_write.c:480:0 #13 [ffffb80f2d3c7ea8] vfs_write at ffffffff9b294462 fs/read_write.c:544:0 #14 [ffffb80f2d3c7ee8] SYSC_write at ffffffff9b2946ec fs/read_write.c:590:0 #15 [ffffb80f2d3c7ee8] SyS_write at ffffffff9b2946ec fs/read_write.c:582:0 #16 [ffffb80f2d3c7f30] do_syscall_64 at ffffffff9b003ca9 arch/x86/entry/common.c:298:0 #17 [ffffb80f2d3c7f58] entry_SYSCALL_64 at ffffffff9ba001b1 arch/x86/entry/entry_64.S:238:0 The lock is used to synchronize different sysfs operations, it doesn't protect any resource that will be touched by an interrupt. Consequently it's not required to disable IRQs. Replace the spinlock with a mutex to fix the deadlock. Signed-off-by: Junxiao Bi <[email protected]> Link: https://lore.kernel.org/r/[email protected] Reviewed-by: Mike Christie <[email protected]> Cc: [email protected] Signed-off-by: Martin K. Petersen <[email protected]>
kernel-patches-daemon-bpf-rc bot
pushed a commit
that referenced
this pull request
Mar 13, 2024
It appears the client object tree has no locking unless I've missed something else. Fix races around adding/removing client objects, mostly vram bar mappings. 4562.099306] general protection fault, probably for non-canonical address 0x6677ed422bceb80c: 0000 [#1] PREEMPT SMP PTI [ 4562.099314] CPU: 2 PID: 23171 Comm: deqp-vk Not tainted 6.8.0-rc6+ #27 [ 4562.099324] Hardware name: Gigabyte Technology Co., Ltd. Z390 I AORUS PRO WIFI/Z390 I AORUS PRO WIFI-CF, BIOS F8 11/05/2021 [ 4562.099330] RIP: 0010:nvkm_object_search+0x1d/0x70 [nouveau] [ 4562.099503] Code: 90 90 90 90 90 90 90 90 90 90 90 90 90 66 0f 1f 00 0f 1f 44 00 00 48 89 f8 48 85 f6 74 39 48 8b 87 a0 00 00 00 48 85 c0 74 12 <48> 8b 48 f8 48 39 ce 73 15 48 8b 40 10 48 85 c0 75 ee 48 c7 c0 fe [ 4562.099506] RSP: 0000:ffffa94cc420bbf8 EFLAGS: 00010206 [ 4562.099512] RAX: 6677ed422bceb814 RBX: ffff98108791f400 RCX: ffff9810f26b8f58 [ 4562.099517] RDX: 0000000000000000 RSI: ffff9810f26b9158 RDI: ffff98108791f400 [ 4562.099519] RBP: ffff9810f26b9158 R08: 0000000000000000 R09: 0000000000000000 [ 4562.099521] R10: ffffa94cc420bc48 R11: 0000000000000001 R12: ffff9810f02a7cc0 [ 4562.099526] R13: 0000000000000000 R14: 00000000000000ff R15: 0000000000000007 [ 4562.099528] FS: 00007f629c5017c0(0000) GS:ffff98142c700000(0000) knlGS:0000000000000000 [ 4562.099534] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 4562.099536] CR2: 00007f629a882000 CR3: 000000017019e004 CR4: 00000000003706f0 [ 4562.099541] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 4562.099542] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 4562.099544] Call Trace: [ 4562.099555] <TASK> [ 4562.099573] ? die_addr+0x36/0x90 [ 4562.099583] ? exc_general_protection+0x246/0x4a0 [ 4562.099593] ? asm_exc_general_protection+0x26/0x30 [ 4562.099600] ? nvkm_object_search+0x1d/0x70 [nouveau] [ 4562.099730] nvkm_ioctl+0xa1/0x250 [nouveau] [ 4562.099861] nvif_object_map_handle+0xc8/0x180 [nouveau] [ 4562.099986] nouveau_ttm_io_mem_reserve+0x122/0x270 [nouveau] [ 4562.100156] ? dma_resv_test_signaled+0x26/0xb0 [ 4562.100163] ttm_bo_vm_fault_reserved+0x97/0x3c0 [ttm] [ 4562.100182] ? __mutex_unlock_slowpath+0x2a/0x270 [ 4562.100189] nouveau_ttm_fault+0x69/0xb0 [nouveau] [ 4562.100356] __do_fault+0x32/0x150 [ 4562.100362] do_fault+0x7c/0x560 [ 4562.100369] __handle_mm_fault+0x800/0xc10 [ 4562.100382] handle_mm_fault+0x17c/0x3e0 [ 4562.100388] do_user_addr_fault+0x208/0x860 [ 4562.100395] exc_page_fault+0x7f/0x200 [ 4562.100402] asm_exc_page_fault+0x26/0x30 [ 4562.100412] RIP: 0033:0x9b9870 [ 4562.100419] Code: 85 a8 f7 ff ff 8b 8d 80 f7 ff ff 89 08 e9 18 f2 ff ff 0f 1f 84 00 00 00 00 00 44 89 32 e9 90 fa ff ff 0f 1f 84 00 00 00 00 00 <44> 89 32 e9 f8 f1 ff ff 0f 1f 84 00 00 00 00 00 66 44 89 32 e9 e7 [ 4562.100422] RSP: 002b:00007fff9ba2dc70 EFLAGS: 00010246 [ 4562.100426] RAX: 0000000000000004 RBX: 000000000dd65e10 RCX: 000000fff0000000 [ 4562.100428] RDX: 00007f629a882000 RSI: 00007f629a882000 RDI: 0000000000000066 [ 4562.100432] RBP: 00007fff9ba2e570 R08: 0000000000000000 R09: 0000000123ddf000 [ 4562.100434] R10: 0000000000000001 R11: 0000000000000246 R12: 000000007fffffff [ 4562.100436] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 4562.100446] </TASK> [ 4562.100448] Modules linked in: nf_conntrack_netbios_ns nf_conntrack_broadcast nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nf_tables libcrc32c nfnetlink cmac bnep sunrpc iwlmvm intel_rapl_msr intel_rapl_common snd_sof_pci_intel_cnl x86_pkg_temp_thermal intel_powerclamp snd_sof_intel_hda_common mac80211 coretemp snd_soc_acpi_intel_match kvm_intel snd_soc_acpi snd_soc_hdac_hda snd_sof_pci snd_sof_xtensa_dsp snd_sof_intel_hda_mlink snd_sof_intel_hda snd_sof kvm snd_sof_utils snd_soc_core snd_hda_codec_realtek libarc4 snd_hda_codec_generic snd_compress snd_hda_ext_core vfat fat snd_hda_intel snd_intel_dspcfg irqbypass iwlwifi snd_hda_codec snd_hwdep snd_hda_core btusb btrtl mei_hdcp iTCO_wdt rapl mei_pxp btintel snd_seq iTCO_vendor_support btbcm snd_seq_device intel_cstate bluetooth snd_pcm cfg80211 intel_wmi_thunderbolt wmi_bmof intel_uncore snd_timer mei_me snd ecdh_generic i2c_i801 [ 4562.100541] ecc mei i2c_smbus soundcore rfkill intel_pch_thermal acpi_pad zram nouveau drm_ttm_helper ttm gpu_sched i2c_algo_bit drm_gpuvm drm_exec mxm_wmi drm_display_helper drm_kms_helper drm crct10dif_pclmul crc32_pclmul nvme e1000e crc32c_intel nvme_core ghash_clmulni_intel video wmi pinctrl_cannonlake ip6_tables ip_tables fuse [ 4562.100616] ---[ end trace 0000000000000000 ]--- Signed-off-by: Dave Airlie <[email protected]> Cc: [email protected]
kernel-patches-daemon-bpf-rc bot
pushed a commit
that referenced
this pull request
Apr 27, 2024
Running a lot of VK CTS in parallel against nouveau, once every few hours you might see something like this crash. BUG: kernel NULL pointer dereference, address: 0000000000000008 PGD 8000000114e6e067 P4D 8000000114e6e067 PUD 109046067 PMD 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 7 PID: 53891 Comm: deqp-vk Not tainted 6.8.0-rc6+ #27 Hardware name: Gigabyte Technology Co., Ltd. Z390 I AORUS PRO WIFI/Z390 I AORUS PRO WIFI-CF, BIOS F8 11/05/2021 RIP: 0010:gp100_vmm_pgt_mem+0xe3/0x180 [nouveau] Code: c7 48 01 c8 49 89 45 58 85 d2 0f 84 95 00 00 00 41 0f b7 46 12 49 8b 7e 08 89 da 42 8d 2c f8 48 8b 47 08 41 83 c7 01 48 89 ee <48> 8b 40 08 ff d0 0f 1f 00 49 8b 7e 08 48 89 d9 48 8d 75 04 48 c1 RSP: 0000:ffffac20c5857838 EFLAGS: 00010202 RAX: 0000000000000000 RBX: 00000000004d8001 RCX: 0000000000000001 RDX: 00000000004d8001 RSI: 00000000000006d8 RDI: ffffa07afe332180 RBP: 00000000000006d8 R08: ffffac20c5857ad0 R09: 0000000000ffff10 R10: 0000000000000001 R11: ffffa07af27e2de0 R12: 000000000000001c R13: ffffac20c5857ad0 R14: ffffa07a96fe9040 R15: 000000000000001c FS: 00007fe395eed7c0(0000) GS:ffffa07e2c980000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000008 CR3: 000000011febe001 CR4: 00000000003706f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: ... ? gp100_vmm_pgt_mem+0xe3/0x180 [nouveau] ? gp100_vmm_pgt_mem+0x37/0x180 [nouveau] nvkm_vmm_iter+0x351/0xa20 [nouveau] ? __pfx_nvkm_vmm_ref_ptes+0x10/0x10 [nouveau] ? __pfx_gp100_vmm_pgt_mem+0x10/0x10 [nouveau] ? __pfx_gp100_vmm_pgt_mem+0x10/0x10 [nouveau] ? __lock_acquire+0x3ed/0x2170 ? __pfx_gp100_vmm_pgt_mem+0x10/0x10 [nouveau] nvkm_vmm_ptes_get_map+0xc2/0x100 [nouveau] ? __pfx_nvkm_vmm_ref_ptes+0x10/0x10 [nouveau] ? __pfx_gp100_vmm_pgt_mem+0x10/0x10 [nouveau] nvkm_vmm_map_locked+0x224/0x3a0 [nouveau] Adding any sort of useful debug usually makes it go away, so I hand wrote the function in a line, and debugged the asm. Every so often pt->memory->ptrs is NULL. This ptrs ptr is set in the nv50_instobj_acquire called from nvkm_kmap. If Thread A and Thread B both get to nv50_instobj_acquire around the same time, and Thread A hits the refcount_set line, and in lockstep thread B succeeds at refcount_inc_not_zero, there is a chance the ptrs value won't have been stored since refcount_set is unordered. Force a memory barrier here, I picked smp_mb, since we want it on all CPUs and it's write followed by a read. v2: use paired smp_rmb/smp_wmb. Cc: <[email protected]> Fixes: be55287 ("drm/nouveau/imem/nv50: embed nvkm_instobj directly into nv04_instobj") Signed-off-by: Dave Airlie <[email protected]> Signed-off-by: Danilo Krummrich <[email protected]> Link: https://patchwork.freedesktop.org/patch/msgid/[email protected]
kernel-patches-daemon-bpf-rc bot
pushed a commit
that referenced
this pull request
May 28, 2024
When request_irq() fails, error path calls vp_del_vqs(). There, as vq is present in the list, free_irq() is called for the same vector. That causes following splat: [ 0.414355] Trying to free already-free IRQ 27 [ 0.414403] WARNING: CPU: 1 PID: 1 at kernel/irq/manage.c:1899 free_irq+0x1a1/0x2d0 [ 0.414510] Modules linked in: [ 0.414540] CPU: 1 PID: 1 Comm: swapper/0 Not tainted 6.9.0-rc4+ #27 [ 0.414540] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-1.fc39 04/01/2014 [ 0.414540] RIP: 0010:free_irq+0x1a1/0x2d0 [ 0.414540] Code: 1e 00 48 83 c4 08 48 89 e8 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc 90 8b 74 24 04 48 c7 c7 98 80 6c b1 e8 00 c9 f7 ff 90 <0f> 0b 90 90 48 89 ee 4c 89 ef e8 e0 20 b8 00 49 8b 47 40 48 8b 40 [ 0.414540] RSP: 0000:ffffb71480013ae0 EFLAGS: 00010086 [ 0.414540] RAX: 0000000000000000 RBX: ffffa099c2722000 RCX: 0000000000000000 [ 0.414540] RDX: 0000000000000000 RSI: ffffb71480013998 RDI: 0000000000000001 [ 0.414540] RBP: 0000000000000246 R08: 00000000ffffdfff R09: 0000000000000001 [ 0.414540] R10: 00000000ffffdfff R11: ffffffffb18729c0 R12: ffffa099c1c91760 [ 0.414540] R13: ffffa099c1c916a4 R14: ffffa099c1d2f200 R15: ffffa099c1c91600 [ 0.414540] FS: 0000000000000000(0000) GS:ffffa099fec40000(0000) knlGS:0000000000000000 [ 0.414540] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 0.414540] CR2: 0000000000000000 CR3: 0000000008e3e001 CR4: 0000000000370ef0 [ 0.414540] Call Trace: [ 0.414540] <TASK> [ 0.414540] ? __warn+0x80/0x120 [ 0.414540] ? free_irq+0x1a1/0x2d0 [ 0.414540] ? report_bug+0x164/0x190 [ 0.414540] ? handle_bug+0x3b/0x70 [ 0.414540] ? exc_invalid_op+0x17/0x70 [ 0.414540] ? asm_exc_invalid_op+0x1a/0x20 [ 0.414540] ? free_irq+0x1a1/0x2d0 [ 0.414540] vp_del_vqs+0xc1/0x220 [ 0.414540] vp_find_vqs_msix+0x305/0x470 [ 0.414540] vp_find_vqs+0x3e/0x1a0 [ 0.414540] vp_modern_find_vqs+0x1b/0x70 [ 0.414540] init_vqs+0x387/0x600 [ 0.414540] virtnet_probe+0x50a/0xc80 [ 0.414540] virtio_dev_probe+0x1e0/0x2b0 [ 0.414540] really_probe+0xc0/0x2c0 [ 0.414540] ? __pfx___driver_attach+0x10/0x10 [ 0.414540] __driver_probe_device+0x73/0x120 [ 0.414540] driver_probe_device+0x1f/0xe0 [ 0.414540] __driver_attach+0x88/0x180 [ 0.414540] bus_for_each_dev+0x85/0xd0 [ 0.414540] bus_add_driver+0xec/0x1f0 [ 0.414540] driver_register+0x59/0x100 [ 0.414540] ? __pfx_virtio_net_driver_init+0x10/0x10 [ 0.414540] virtio_net_driver_init+0x90/0xb0 [ 0.414540] do_one_initcall+0x58/0x230 [ 0.414540] kernel_init_freeable+0x1a3/0x2d0 [ 0.414540] ? __pfx_kernel_init+0x10/0x10 [ 0.414540] kernel_init+0x1a/0x1c0 [ 0.414540] ret_from_fork+0x31/0x50 [ 0.414540] ? __pfx_kernel_init+0x10/0x10 [ 0.414540] ret_from_fork_asm+0x1a/0x30 [ 0.414540] </TASK> Fix this by calling deleting the current vq when request_irq() fails. Fixes: 0b0f9dc ("Revert "virtio_pci: use shared interrupts for virtqueues"") Signed-off-by: Jiri Pirko <[email protected]> Message-Id: <[email protected]> Signed-off-by: Michael S. Tsirkin <[email protected]>
kernel-patches-daemon-bpf-rc bot
pushed a commit
that referenced
this pull request
Jul 26, 2024
When cpu_map has been redirected, first the pointer to the bpf_cpu_map_entry has been copied, then freed, and read from the copy. To fix it, this commit introduced the refcount cpu_map_parent during redirections to prevent use after free. syzbot reported: [ 61.581464][T11670] ================================================================== [ 61.583323][T11670] BUG: KASAN: slab-use-after-free in cpu_map_enqueue+0xba/0x370 [ 61.585419][T11670] Read of size 8 at addr ffff888122d75208 by task syzbot-repro/11670 [ 61.587541][T11670] [ 61.588237][T11670] CPU: 1 PID: 11670 Comm: syzbot-repro Not tainted 6.9.0-rc6-00053-g0106679839f7 #27 [ 61.590542][T11670] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.1 11/11/2019 [ 61.592798][T11670] Call Trace: [ 61.593885][T11670] <TASK> [ 61.594805][T11670] dump_stack_lvl+0x241/0x360 [ 61.595974][T11670] ? tcp_gro_dev_warn+0x260/0x260 [ 61.598242][T11670] ? __wake_up_klogd+0xcc/0x100 [ 61.599407][T11670] ? panic+0x850/0x850 [ 61.600516][T11670] ? __virt_addr_valid+0x182/0x510 [ 61.602073][T11670] ? __virt_addr_valid+0x182/0x510 [ 61.603496][T11670] print_address_description+0x7b/0x360 [ 61.605170][T11670] print_report+0xfd/0x210 [ 61.606370][T11670] ? __virt_addr_valid+0x182/0x510 [ 61.607925][T11670] ? __virt_addr_valid+0x182/0x510 [ 61.609577][T11670] ? __virt_addr_valid+0x43d/0x510 [ 61.610948][T11670] ? __phys_addr+0xb9/0x170 [ 61.612103][T11670] ? cpu_map_enqueue+0xba/0x370 [ 61.613448][T11670] kasan_report+0x143/0x180 [ 61.615000][T11670] ? cpu_map_enqueue+0xba/0x370 [ 61.616181][T11670] cpu_map_enqueue+0xba/0x370 [ 61.617620][T11670] xdp_do_redirect+0x685/0xbf0 [ 61.618787][T11670] tun_xdp_act+0xe7/0x9e0 [ 61.619856][T11670] ? __tun_build_skb+0x2e0/0x2e0 [ 61.621356][T11670] tun_build_skb+0xac6/0x1140 [ 61.622602][T11670] ? tun_build_skb+0xb4/0x1140 [ 61.623880][T11670] ? tun_get_user+0x2760/0x2760 [ 61.625341][T11670] tun_get_user+0x7fa/0x2760 [ 61.626532][T11670] ? rcu_read_unlock+0xa0/0xa0 [ 61.627725][T11670] ? tun_get+0x1e/0x2f0 [ 61.629147][T11670] ? tun_get+0x1e/0x2f0 [ 61.630265][T11670] ? tun_get+0x27d/0x2f0 [ 61.631486][T11670] tun_chr_write_iter+0x111/0x1f0 [ 61.632855][T11670] vfs_write+0xa84/0xcb0 [ 61.634185][T11670] ? __lock_acquire+0x1f60/0x1f60 [ 61.635501][T11670] ? kernel_write+0x330/0x330 [ 61.636757][T11670] ? lockdep_hardirqs_on_prepare+0x43c/0x780 [ 61.638445][T11670] ? __fget_files+0x3ea/0x460 [ 61.639448][T11670] ? seqcount_lockdep_reader_access+0x157/0x220 [ 61.641217][T11670] ? __fdget_pos+0x19e/0x320 [ 61.642426][T11670] ksys_write+0x19f/0x2c0 [ 61.643576][T11670] ? __ia32_sys_read+0x90/0x90 [ 61.644841][T11670] ? ktime_get_coarse_real_ts64+0x10b/0x120 [ 61.646549][T11670] do_syscall_64+0xec/0x210 [ 61.647832][T11670] entry_SYSCALL_64_after_hwframe+0x67/0x6f [ 61.649485][T11670] RIP: 0033:0x472a4f [ 61.650539][T11670] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 c9 d8 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 0c d9 02 00 48 [ 61.655476][T11670] RSP: 002b:00007f7a7a90f5c0 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 61.657675][T11670] RAX: ffffffffffffffda RBX: 00007f7a7a911640 RCX: 0000000000472a4f [ 61.659658][T11670] RDX: 0000000000000066 RSI: 0000000020000440 RDI: 00000000000000c8 [ 61.661980][T11670] RBP: 00007f7a7a90f620 R08: 0000000000000000 R09: 0000000100000000 [ 61.663982][T11670] R10: 0000000100000000 R11: 0000000000000293 R12: 00007f7a7a911640 [ 61.666425][T11670] R13: 000000000000006e R14: 000000000042f2f0 R15: 00007f7a7a8f1000 [ 61.668443][T11670] </TASK> [ 61.669233][T11670] [ 61.669754][T11670] Allocated by task 11643: [ 61.670855][T11670] kasan_save_track+0x3f/0x70 [ 61.672094][T11670] __kasan_kmalloc+0x98/0xb0 [ 61.673466][T11670] __kmalloc_node+0x259/0x4f0 [ 61.674687][T11670] bpf_map_kmalloc_node+0xd3/0x1c0 [ 61.676069][T11670] cpu_map_update_elem+0x2f0/0x1000 [ 61.677619][T11670] bpf_map_update_value+0x1b2/0x540 [ 61.679006][T11670] map_update_elem+0x52f/0x6e0 [ 61.680076][T11670] __sys_bpf+0x7a9/0x850 [ 61.681610][T11670] __x64_sys_bpf+0x7c/0x90 [ 61.682772][T11670] do_syscall_64+0xec/0x210 [ 61.683967][T11670] entry_SYSCALL_64_after_hwframe+0x67/0x6f [ 61.685648][T11670] [ 61.686282][T11670] Freed by task 1064: [ 61.687296][T11670] kasan_save_track+0x3f/0x70 [ 61.688498][T11670] kasan_save_free_info+0x40/0x50 [ 61.689786][T11670] poison_slab_object+0xa6/0xe0 [ 61.691059][T11670] __kasan_slab_free+0x37/0x60 [ 61.692336][T11670] kfree+0x136/0x2f0 [ 61.693549][T11670] __cpu_map_entry_free+0x6f3/0x770 [ 61.695004][T11670] cpu_map_free+0xc0/0x180 [ 61.696191][T11670] bpf_map_free_deferred+0xe3/0x100 [ 61.697703][T11670] process_scheduled_works+0x9cb/0x14a0 [ 61.699330][T11670] worker_thread+0x85c/0xd50 [ 61.700546][T11670] kthread+0x2ef/0x390 [ 61.701791][T11670] ret_from_fork+0x4d/0x80 [ 61.702942][T11670] ret_from_fork_asm+0x11/0x20 [ 61.704195][T11670] [ 61.704825][T11670] The buggy address belongs to the object at ffff888122d75200 [ 61.704825][T11670] which belongs to the cache kmalloc-cg-256 of size 256 [ 61.708516][T11670] The buggy address is located 8 bytes inside of [ 61.708516][T11670] freed 256-byte region [ffff888122d75200, ffff888122d75300) [ 61.712215][T11670] [ 61.712824][T11670] The buggy address belongs to the physical page: [ 61.714883][T11670] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x122d74 [ 61.717300][T11670] head: order:1 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 61.719037][T11670] memcg:ffff888120d85f01 [ 61.720006][T11670] flags: 0x17ff00000000840(slab|head|node=0|zone=2|lastcpupid=0x7ff) [ 61.722181][T11670] page_type: 0xffffffff() [ 61.723318][T11670] raw: 017ff00000000840 ffff88810004dcc0 dead000000000122 0000000000000000 [ 61.725650][T11670] raw: 0000000000000000 0000000080100010 00000001ffffffff ffff888120d85f01 [ 61.727943][T11670] head: 017ff00000000840 ffff88810004dcc0 dead000000000122 0000000000000000 [ 61.730237][T11670] head: 0000000000000000 0000000080100010 00000001ffffffff ffff888120d85f01 [ 61.732671][T11670] head: 017ff00000000001 ffffea00048b5d01 dead000000000122 00000000ffffffff [ 61.735029][T11670] head: 0000000200000000 0000000000000000 00000000ffffffff 0000000000000000 [ 61.737400][T11670] page dumped because: kasan: bad access detected [ 61.740100][T11670] page_owner tracks the page as allocated [ 61.743121][T11670] page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 8343, tgid -2092279795 (syzbot-repro), ts 8343, free_ts 43505720198 [ 61.754038][T11670] post_alloc_hook+0x1e6/0x210 [ 61.756046][T11670] get_page_from_freelist+0x7d2/0x850 [ 61.759460][T11670] __alloc_pages+0x25e/0x580 [ 61.761428][T11670] alloc_slab_page+0x6b/0x1a0 [ 61.764199][T11670] allocate_slab+0x5d/0x200 [ 61.766122][T11670] ___slab_alloc+0xac5/0xf20 [ 61.767195][T11670] __kmalloc+0x2e0/0x4b0 [ 61.769028][T11670] fib_default_rule_add+0x4a/0x350 [ 61.770394][T11670] fib6_rules_net_init+0x42/0x100 [ 61.771731][T11670] ops_init+0x39d/0x670 [ 61.773061][T11670] setup_net+0x3bc/0xae0 [ 61.774102][T11670] copy_net_ns+0x399/0x5e0 [ 61.775628][T11670] create_new_namespaces+0x4de/0x8d0 [ 61.776950][T11670] unshare_nsproxy_namespaces+0x127/0x190 [ 61.778352][T11670] ksys_unshare+0x5e6/0xbf0 [ 61.779741][T11670] __x64_sys_unshare+0x38/0x40 [ 61.781302][T11670] page last free pid 4619 tgid 4619 stack trace: [ 61.783542][T11670] free_unref_page_prepare+0x72f/0x7c0 [ 61.785018][T11670] free_unref_page+0x37/0x3f0 [ 61.786030][T11670] __slab_free+0x351/0x3f0 [ 61.786991][T11670] qlist_free_all+0x60/0xd0 [ 61.788827][T11670] kasan_quarantine_reduce+0x15a/0x170 [ 61.789951][T11670] __kasan_slab_alloc+0x23/0x70 [ 61.790999][T11670] kmem_cache_alloc_node+0x193/0x390 [ 61.792331][T11670] kmalloc_reserve+0xa7/0x2a0 [ 61.793345][T11670] __alloc_skb+0x1ec/0x430 [ 61.794435][T11670] netlink_sendmsg+0x615/0xc80 [ 61.796439][T11670] __sock_sendmsg+0x21f/0x270 [ 61.797467][T11670] ____sys_sendmsg+0x540/0x860 [ 61.798505][T11670] __sys_sendmsg+0x2b7/0x3a0 [ 61.799512][T11670] do_syscall_64+0xec/0x210 [ 61.800674][T11670] entry_SYSCALL_64_after_hwframe+0x67/0x6f [ 61.802021][T11670] [ 61.802526][T11670] Memory state around the buggy address: [ 61.803701][T11670] ffff888122d75100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 61.805694][T11670] ffff888122d75180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 61.808104][T11670] >ffff888122d75200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 61.809769][T11670] ^ [ 61.810672][T11670] ffff888122d75280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 61.812532][T11670] ffff888122d75300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 61.814846][T11670] ================================================================== [ 61.816914][T11670] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 61.818415][T11670] CPU: 1 PID: 11670 Comm: syzbot-repro Not tainted 6.9.0-rc6-00053-g0106679839f7 #27 [ 61.821191][T11670] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.1 11/11/2019 [ 61.822911][T11670] Call Trace: [ 61.823632][T11670] <TASK> [ 61.824525][T11670] dump_stack_lvl+0x241/0x360 [ 61.825545][T11670] ? tcp_gro_dev_warn+0x260/0x260 [ 61.826706][T11670] ? panic+0x850/0x850 [ 61.828594][T11670] ? lock_release+0x85/0x860 [ 61.829749][T11670] ? vscnprintf+0x5d/0x80 [ 61.830951][T11670] panic+0x335/0x850 [ 61.832316][T11670] ? check_panic_on_warn+0x21/0xa0 [ 61.834475][T11670] ? __memcpy_flushcache+0x2c0/0x2c0 [ 61.835809][T11670] ? _raw_spin_unlock_irqrestore+0xd8/0x140 [ 61.838063][T11670] ? _raw_spin_unlock_irqrestore+0xdd/0x140 [ 61.842056][T11670] ? _raw_spin_unlock+0x40/0x40 [ 61.843116][T11670] ? print_report+0x1cc/0x210 [ 61.844527][T11670] check_panic_on_warn+0x82/0xa0 [ 61.845336][T11670] ? cpu_map_enqueue+0xba/0x370 [ 61.846117][T11670] end_report+0x48/0xa0 [ 61.846790][T11670] kasan_report+0x154/0x180 [ 61.847520][T11670] ? cpu_map_enqueue+0xba/0x370 [ 61.848471][T11670] cpu_map_enqueue+0xba/0x370 [ 61.849968][T11670] xdp_do_redirect+0x685/0xbf0 [ 61.850994][T11670] tun_xdp_act+0xe7/0x9e0 [ 61.851703][T11670] ? __tun_build_skb+0x2e0/0x2e0 [ 61.852598][T11670] tun_build_skb+0xac6/0x1140 [ 61.853362][T11670] ? tun_build_skb+0xb4/0x1140 [ 61.854454][T11670] ? tun_get_user+0x2760/0x2760 [ 61.855806][T11670] tun_get_user+0x7fa/0x2760 [ 61.856734][T11670] ? rcu_read_unlock+0xa0/0xa0 [ 61.857502][T11670] ? tun_get+0x1e/0x2f0 [ 61.858171][T11670] ? tun_get+0x1e/0x2f0 [ 61.858952][T11670] ? tun_get+0x27d/0x2f0 [ 61.859637][T11670] tun_chr_write_iter+0x111/0x1f0 [ 61.860913][T11670] vfs_write+0xa84/0xcb0 [ 61.861578][T11670] ? __lock_acquire+0x1f60/0x1f60 [ 61.862376][T11670] ? kernel_write+0x330/0x330 [ 61.863221][T11670] ? lockdep_hardirqs_on_prepare+0x43c/0x780 [ 61.864230][T11670] ? __fget_files+0x3ea/0x460 [ 61.864955][T11670] ? seqcount_lockdep_reader_access+0x157/0x220 [ 61.866571][T11670] ? __fdget_pos+0x19e/0x320 [ 61.867414][T11670] ksys_write+0x19f/0x2c0 [ 61.868263][T11670] ? __ia32_sys_read+0x90/0x90 [ 61.868996][T11670] ? ktime_get_coarse_real_ts64+0x10b/0x120 [ 61.869896][T11670] do_syscall_64+0xec/0x210 [ 61.870592][T11670] entry_SYSCALL_64_after_hwframe+0x67/0x6f [ 61.871595][T11670] RIP: 0033:0x472a4f [ 61.873158][T11670] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 c9 d8 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 0c d9 02 00 48 [ 61.876447][T11670] RSP: 002b:00007f7a7a90f5c0 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 61.877944][T11670] RAX: ffffffffffffffda RBX: 00007f7a7a911640 RCX: 0000000000472a4f [ 61.879751][T11670] RDX: 0000000000000066 RSI: 0000000020000440 RDI: 00000000000000c8 [ 61.881100][T11670] RBP: 00007f7a7a90f620 R08: 0000000000000000 R09: 0000000100000000 [ 61.882298][T11670] R10: 0000000100000000 R11: 0000000000000293 R12: 00007f7a7a911640 [ 61.883501][T11670] R13: 000000000000006e R14: 000000000042f2f0 R15: 00007f7a7a8f1000 [ 61.885999][T11670] </TASK> Signed-off-by: Radoslaw Zielonek <[email protected]>
kernel-patches-daemon-bpf-rc bot
pushed a commit
that referenced
this pull request
Jul 29, 2024
When cpu_map has been redirected, first the pointer to the bpf_cpu_map_entry has been copied, then freed, and read from the copy. To fix it, this commit introduced the refcount cpu_map_parent during redirections to prevent use after free. syzbot reported: [ 61.581464][T11670] ================================================================== [ 61.583323][T11670] BUG: KASAN: slab-use-after-free in cpu_map_enqueue+0xba/0x370 [ 61.585419][T11670] Read of size 8 at addr ffff888122d75208 by task syzbot-repro/11670 [ 61.587541][T11670] [ 61.588237][T11670] CPU: 1 PID: 11670 Comm: syzbot-repro Not tainted 6.9.0-rc6-00053-g0106679839f7 #27 [ 61.590542][T11670] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.1 11/11/2019 [ 61.592798][T11670] Call Trace: [ 61.593885][T11670] <TASK> [ 61.594805][T11670] dump_stack_lvl+0x241/0x360 [ 61.595974][T11670] ? tcp_gro_dev_warn+0x260/0x260 [ 61.598242][T11670] ? __wake_up_klogd+0xcc/0x100 [ 61.599407][T11670] ? panic+0x850/0x850 [ 61.600516][T11670] ? __virt_addr_valid+0x182/0x510 [ 61.602073][T11670] ? __virt_addr_valid+0x182/0x510 [ 61.603496][T11670] print_address_description+0x7b/0x360 [ 61.605170][T11670] print_report+0xfd/0x210 [ 61.606370][T11670] ? __virt_addr_valid+0x182/0x510 [ 61.607925][T11670] ? __virt_addr_valid+0x182/0x510 [ 61.609577][T11670] ? __virt_addr_valid+0x43d/0x510 [ 61.610948][T11670] ? __phys_addr+0xb9/0x170 [ 61.612103][T11670] ? cpu_map_enqueue+0xba/0x370 [ 61.613448][T11670] kasan_report+0x143/0x180 [ 61.615000][T11670] ? cpu_map_enqueue+0xba/0x370 [ 61.616181][T11670] cpu_map_enqueue+0xba/0x370 [ 61.617620][T11670] xdp_do_redirect+0x685/0xbf0 [ 61.618787][T11670] tun_xdp_act+0xe7/0x9e0 [ 61.619856][T11670] ? __tun_build_skb+0x2e0/0x2e0 [ 61.621356][T11670] tun_build_skb+0xac6/0x1140 [ 61.622602][T11670] ? tun_build_skb+0xb4/0x1140 [ 61.623880][T11670] ? tun_get_user+0x2760/0x2760 [ 61.625341][T11670] tun_get_user+0x7fa/0x2760 [ 61.626532][T11670] ? rcu_read_unlock+0xa0/0xa0 [ 61.627725][T11670] ? tun_get+0x1e/0x2f0 [ 61.629147][T11670] ? tun_get+0x1e/0x2f0 [ 61.630265][T11670] ? tun_get+0x27d/0x2f0 [ 61.631486][T11670] tun_chr_write_iter+0x111/0x1f0 [ 61.632855][T11670] vfs_write+0xa84/0xcb0 [ 61.634185][T11670] ? __lock_acquire+0x1f60/0x1f60 [ 61.635501][T11670] ? kernel_write+0x330/0x330 [ 61.636757][T11670] ? lockdep_hardirqs_on_prepare+0x43c/0x780 [ 61.638445][T11670] ? __fget_files+0x3ea/0x460 [ 61.639448][T11670] ? seqcount_lockdep_reader_access+0x157/0x220 [ 61.641217][T11670] ? __fdget_pos+0x19e/0x320 [ 61.642426][T11670] ksys_write+0x19f/0x2c0 [ 61.643576][T11670] ? __ia32_sys_read+0x90/0x90 [ 61.644841][T11670] ? ktime_get_coarse_real_ts64+0x10b/0x120 [ 61.646549][T11670] do_syscall_64+0xec/0x210 [ 61.647832][T11670] entry_SYSCALL_64_after_hwframe+0x67/0x6f [ 61.649485][T11670] RIP: 0033:0x472a4f [ 61.650539][T11670] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 c9 d8 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 0c d9 02 00 48 [ 61.655476][T11670] RSP: 002b:00007f7a7a90f5c0 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 61.657675][T11670] RAX: ffffffffffffffda RBX: 00007f7a7a911640 RCX: 0000000000472a4f [ 61.659658][T11670] RDX: 0000000000000066 RSI: 0000000020000440 RDI: 00000000000000c8 [ 61.661980][T11670] RBP: 00007f7a7a90f620 R08: 0000000000000000 R09: 0000000100000000 [ 61.663982][T11670] R10: 0000000100000000 R11: 0000000000000293 R12: 00007f7a7a911640 [ 61.666425][T11670] R13: 000000000000006e R14: 000000000042f2f0 R15: 00007f7a7a8f1000 [ 61.668443][T11670] </TASK> [ 61.669233][T11670] [ 61.669754][T11670] Allocated by task 11643: [ 61.670855][T11670] kasan_save_track+0x3f/0x70 [ 61.672094][T11670] __kasan_kmalloc+0x98/0xb0 [ 61.673466][T11670] __kmalloc_node+0x259/0x4f0 [ 61.674687][T11670] bpf_map_kmalloc_node+0xd3/0x1c0 [ 61.676069][T11670] cpu_map_update_elem+0x2f0/0x1000 [ 61.677619][T11670] bpf_map_update_value+0x1b2/0x540 [ 61.679006][T11670] map_update_elem+0x52f/0x6e0 [ 61.680076][T11670] __sys_bpf+0x7a9/0x850 [ 61.681610][T11670] __x64_sys_bpf+0x7c/0x90 [ 61.682772][T11670] do_syscall_64+0xec/0x210 [ 61.683967][T11670] entry_SYSCALL_64_after_hwframe+0x67/0x6f [ 61.685648][T11670] [ 61.686282][T11670] Freed by task 1064: [ 61.687296][T11670] kasan_save_track+0x3f/0x70 [ 61.688498][T11670] kasan_save_free_info+0x40/0x50 [ 61.689786][T11670] poison_slab_object+0xa6/0xe0 [ 61.691059][T11670] __kasan_slab_free+0x37/0x60 [ 61.692336][T11670] kfree+0x136/0x2f0 [ 61.693549][T11670] __cpu_map_entry_free+0x6f3/0x770 [ 61.695004][T11670] cpu_map_free+0xc0/0x180 [ 61.696191][T11670] bpf_map_free_deferred+0xe3/0x100 [ 61.697703][T11670] process_scheduled_works+0x9cb/0x14a0 [ 61.699330][T11670] worker_thread+0x85c/0xd50 [ 61.700546][T11670] kthread+0x2ef/0x390 [ 61.701791][T11670] ret_from_fork+0x4d/0x80 [ 61.702942][T11670] ret_from_fork_asm+0x11/0x20 [ 61.704195][T11670] [ 61.704825][T11670] The buggy address belongs to the object at ffff888122d75200 [ 61.704825][T11670] which belongs to the cache kmalloc-cg-256 of size 256 [ 61.708516][T11670] The buggy address is located 8 bytes inside of [ 61.708516][T11670] freed 256-byte region [ffff888122d75200, ffff888122d75300) [ 61.712215][T11670] [ 61.712824][T11670] The buggy address belongs to the physical page: [ 61.714883][T11670] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x122d74 [ 61.717300][T11670] head: order:1 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 61.719037][T11670] memcg:ffff888120d85f01 [ 61.720006][T11670] flags: 0x17ff00000000840(slab|head|node=0|zone=2|lastcpupid=0x7ff) [ 61.722181][T11670] page_type: 0xffffffff() [ 61.723318][T11670] raw: 017ff00000000840 ffff88810004dcc0 dead000000000122 0000000000000000 [ 61.725650][T11670] raw: 0000000000000000 0000000080100010 00000001ffffffff ffff888120d85f01 [ 61.727943][T11670] head: 017ff00000000840 ffff88810004dcc0 dead000000000122 0000000000000000 [ 61.730237][T11670] head: 0000000000000000 0000000080100010 00000001ffffffff ffff888120d85f01 [ 61.732671][T11670] head: 017ff00000000001 ffffea00048b5d01 dead000000000122 00000000ffffffff [ 61.735029][T11670] head: 0000000200000000 0000000000000000 00000000ffffffff 0000000000000000 [ 61.737400][T11670] page dumped because: kasan: bad access detected [ 61.740100][T11670] page_owner tracks the page as allocated [ 61.743121][T11670] page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 8343, tgid -2092279795 (syzbot-repro), ts 8343, free_ts 43505720198 [ 61.754038][T11670] post_alloc_hook+0x1e6/0x210 [ 61.756046][T11670] get_page_from_freelist+0x7d2/0x850 [ 61.759460][T11670] __alloc_pages+0x25e/0x580 [ 61.761428][T11670] alloc_slab_page+0x6b/0x1a0 [ 61.764199][T11670] allocate_slab+0x5d/0x200 [ 61.766122][T11670] ___slab_alloc+0xac5/0xf20 [ 61.767195][T11670] __kmalloc+0x2e0/0x4b0 [ 61.769028][T11670] fib_default_rule_add+0x4a/0x350 [ 61.770394][T11670] fib6_rules_net_init+0x42/0x100 [ 61.771731][T11670] ops_init+0x39d/0x670 [ 61.773061][T11670] setup_net+0x3bc/0xae0 [ 61.774102][T11670] copy_net_ns+0x399/0x5e0 [ 61.775628][T11670] create_new_namespaces+0x4de/0x8d0 [ 61.776950][T11670] unshare_nsproxy_namespaces+0x127/0x190 [ 61.778352][T11670] ksys_unshare+0x5e6/0xbf0 [ 61.779741][T11670] __x64_sys_unshare+0x38/0x40 [ 61.781302][T11670] page last free pid 4619 tgid 4619 stack trace: [ 61.783542][T11670] free_unref_page_prepare+0x72f/0x7c0 [ 61.785018][T11670] free_unref_page+0x37/0x3f0 [ 61.786030][T11670] __slab_free+0x351/0x3f0 [ 61.786991][T11670] qlist_free_all+0x60/0xd0 [ 61.788827][T11670] kasan_quarantine_reduce+0x15a/0x170 [ 61.789951][T11670] __kasan_slab_alloc+0x23/0x70 [ 61.790999][T11670] kmem_cache_alloc_node+0x193/0x390 [ 61.792331][T11670] kmalloc_reserve+0xa7/0x2a0 [ 61.793345][T11670] __alloc_skb+0x1ec/0x430 [ 61.794435][T11670] netlink_sendmsg+0x615/0xc80 [ 61.796439][T11670] __sock_sendmsg+0x21f/0x270 [ 61.797467][T11670] ____sys_sendmsg+0x540/0x860 [ 61.798505][T11670] __sys_sendmsg+0x2b7/0x3a0 [ 61.799512][T11670] do_syscall_64+0xec/0x210 [ 61.800674][T11670] entry_SYSCALL_64_after_hwframe+0x67/0x6f [ 61.802021][T11670] [ 61.802526][T11670] Memory state around the buggy address: [ 61.803701][T11670] ffff888122d75100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 61.805694][T11670] ffff888122d75180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 61.808104][T11670] >ffff888122d75200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 61.809769][T11670] ^ [ 61.810672][T11670] ffff888122d75280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 61.812532][T11670] ffff888122d75300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 61.814846][T11670] ================================================================== [ 61.816914][T11670] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 61.818415][T11670] CPU: 1 PID: 11670 Comm: syzbot-repro Not tainted 6.9.0-rc6-00053-g0106679839f7 #27 [ 61.821191][T11670] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.1 11/11/2019 [ 61.822911][T11670] Call Trace: [ 61.823632][T11670] <TASK> [ 61.824525][T11670] dump_stack_lvl+0x241/0x360 [ 61.825545][T11670] ? tcp_gro_dev_warn+0x260/0x260 [ 61.826706][T11670] ? panic+0x850/0x850 [ 61.828594][T11670] ? lock_release+0x85/0x860 [ 61.829749][T11670] ? vscnprintf+0x5d/0x80 [ 61.830951][T11670] panic+0x335/0x850 [ 61.832316][T11670] ? check_panic_on_warn+0x21/0xa0 [ 61.834475][T11670] ? __memcpy_flushcache+0x2c0/0x2c0 [ 61.835809][T11670] ? _raw_spin_unlock_irqrestore+0xd8/0x140 [ 61.838063][T11670] ? _raw_spin_unlock_irqrestore+0xdd/0x140 [ 61.842056][T11670] ? _raw_spin_unlock+0x40/0x40 [ 61.843116][T11670] ? print_report+0x1cc/0x210 [ 61.844527][T11670] check_panic_on_warn+0x82/0xa0 [ 61.845336][T11670] ? cpu_map_enqueue+0xba/0x370 [ 61.846117][T11670] end_report+0x48/0xa0 [ 61.846790][T11670] kasan_report+0x154/0x180 [ 61.847520][T11670] ? cpu_map_enqueue+0xba/0x370 [ 61.848471][T11670] cpu_map_enqueue+0xba/0x370 [ 61.849968][T11670] xdp_do_redirect+0x685/0xbf0 [ 61.850994][T11670] tun_xdp_act+0xe7/0x9e0 [ 61.851703][T11670] ? __tun_build_skb+0x2e0/0x2e0 [ 61.852598][T11670] tun_build_skb+0xac6/0x1140 [ 61.853362][T11670] ? tun_build_skb+0xb4/0x1140 [ 61.854454][T11670] ? tun_get_user+0x2760/0x2760 [ 61.855806][T11670] tun_get_user+0x7fa/0x2760 [ 61.856734][T11670] ? rcu_read_unlock+0xa0/0xa0 [ 61.857502][T11670] ? tun_get+0x1e/0x2f0 [ 61.858171][T11670] ? tun_get+0x1e/0x2f0 [ 61.858952][T11670] ? tun_get+0x27d/0x2f0 [ 61.859637][T11670] tun_chr_write_iter+0x111/0x1f0 [ 61.860913][T11670] vfs_write+0xa84/0xcb0 [ 61.861578][T11670] ? __lock_acquire+0x1f60/0x1f60 [ 61.862376][T11670] ? kernel_write+0x330/0x330 [ 61.863221][T11670] ? lockdep_hardirqs_on_prepare+0x43c/0x780 [ 61.864230][T11670] ? __fget_files+0x3ea/0x460 [ 61.864955][T11670] ? seqcount_lockdep_reader_access+0x157/0x220 [ 61.866571][T11670] ? __fdget_pos+0x19e/0x320 [ 61.867414][T11670] ksys_write+0x19f/0x2c0 [ 61.868263][T11670] ? __ia32_sys_read+0x90/0x90 [ 61.868996][T11670] ? ktime_get_coarse_real_ts64+0x10b/0x120 [ 61.869896][T11670] do_syscall_64+0xec/0x210 [ 61.870592][T11670] entry_SYSCALL_64_after_hwframe+0x67/0x6f [ 61.871595][T11670] RIP: 0033:0x472a4f [ 61.873158][T11670] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 c9 d8 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 0c d9 02 00 48 [ 61.876447][T11670] RSP: 002b:00007f7a7a90f5c0 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 61.877944][T11670] RAX: ffffffffffffffda RBX: 00007f7a7a911640 RCX: 0000000000472a4f [ 61.879751][T11670] RDX: 0000000000000066 RSI: 0000000020000440 RDI: 00000000000000c8 [ 61.881100][T11670] RBP: 00007f7a7a90f620 R08: 0000000000000000 R09: 0000000100000000 [ 61.882298][T11670] R10: 0000000100000000 R11: 0000000000000293 R12: 00007f7a7a911640 [ 61.883501][T11670] R13: 000000000000006e R14: 000000000042f2f0 R15: 00007f7a7a8f1000 [ 61.885999][T11670] </TASK> Signed-off-by: Radoslaw Zielonek <[email protected]>
kernel-patches-daemon-bpf-rc bot
pushed a commit
that referenced
this pull request
Jul 29, 2024
When cpu_map has been redirected, first the pointer to the bpf_cpu_map_entry has been copied, then freed, and read from the copy. To fix it, this commit introduced the refcount cpu_map_parent during redirections to prevent use after free. syzbot reported: [ 61.581464][T11670] ================================================================== [ 61.583323][T11670] BUG: KASAN: slab-use-after-free in cpu_map_enqueue+0xba/0x370 [ 61.585419][T11670] Read of size 8 at addr ffff888122d75208 by task syzbot-repro/11670 [ 61.587541][T11670] [ 61.588237][T11670] CPU: 1 PID: 11670 Comm: syzbot-repro Not tainted 6.9.0-rc6-00053-g0106679839f7 #27 [ 61.590542][T11670] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.1 11/11/2019 [ 61.592798][T11670] Call Trace: [ 61.593885][T11670] <TASK> [ 61.594805][T11670] dump_stack_lvl+0x241/0x360 [ 61.595974][T11670] ? tcp_gro_dev_warn+0x260/0x260 [ 61.598242][T11670] ? __wake_up_klogd+0xcc/0x100 [ 61.599407][T11670] ? panic+0x850/0x850 [ 61.600516][T11670] ? __virt_addr_valid+0x182/0x510 [ 61.602073][T11670] ? __virt_addr_valid+0x182/0x510 [ 61.603496][T11670] print_address_description+0x7b/0x360 [ 61.605170][T11670] print_report+0xfd/0x210 [ 61.606370][T11670] ? __virt_addr_valid+0x182/0x510 [ 61.607925][T11670] ? __virt_addr_valid+0x182/0x510 [ 61.609577][T11670] ? __virt_addr_valid+0x43d/0x510 [ 61.610948][T11670] ? __phys_addr+0xb9/0x170 [ 61.612103][T11670] ? cpu_map_enqueue+0xba/0x370 [ 61.613448][T11670] kasan_report+0x143/0x180 [ 61.615000][T11670] ? cpu_map_enqueue+0xba/0x370 [ 61.616181][T11670] cpu_map_enqueue+0xba/0x370 [ 61.617620][T11670] xdp_do_redirect+0x685/0xbf0 [ 61.618787][T11670] tun_xdp_act+0xe7/0x9e0 [ 61.619856][T11670] ? __tun_build_skb+0x2e0/0x2e0 [ 61.621356][T11670] tun_build_skb+0xac6/0x1140 [ 61.622602][T11670] ? tun_build_skb+0xb4/0x1140 [ 61.623880][T11670] ? tun_get_user+0x2760/0x2760 [ 61.625341][T11670] tun_get_user+0x7fa/0x2760 [ 61.626532][T11670] ? rcu_read_unlock+0xa0/0xa0 [ 61.627725][T11670] ? tun_get+0x1e/0x2f0 [ 61.629147][T11670] ? tun_get+0x1e/0x2f0 [ 61.630265][T11670] ? tun_get+0x27d/0x2f0 [ 61.631486][T11670] tun_chr_write_iter+0x111/0x1f0 [ 61.632855][T11670] vfs_write+0xa84/0xcb0 [ 61.634185][T11670] ? __lock_acquire+0x1f60/0x1f60 [ 61.635501][T11670] ? kernel_write+0x330/0x330 [ 61.636757][T11670] ? lockdep_hardirqs_on_prepare+0x43c/0x780 [ 61.638445][T11670] ? __fget_files+0x3ea/0x460 [ 61.639448][T11670] ? seqcount_lockdep_reader_access+0x157/0x220 [ 61.641217][T11670] ? __fdget_pos+0x19e/0x320 [ 61.642426][T11670] ksys_write+0x19f/0x2c0 [ 61.643576][T11670] ? __ia32_sys_read+0x90/0x90 [ 61.644841][T11670] ? ktime_get_coarse_real_ts64+0x10b/0x120 [ 61.646549][T11670] do_syscall_64+0xec/0x210 [ 61.647832][T11670] entry_SYSCALL_64_after_hwframe+0x67/0x6f [ 61.649485][T11670] RIP: 0033:0x472a4f [ 61.650539][T11670] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 c9 d8 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 0c d9 02 00 48 [ 61.655476][T11670] RSP: 002b:00007f7a7a90f5c0 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 61.657675][T11670] RAX: ffffffffffffffda RBX: 00007f7a7a911640 RCX: 0000000000472a4f [ 61.659658][T11670] RDX: 0000000000000066 RSI: 0000000020000440 RDI: 00000000000000c8 [ 61.661980][T11670] RBP: 00007f7a7a90f620 R08: 0000000000000000 R09: 0000000100000000 [ 61.663982][T11670] R10: 0000000100000000 R11: 0000000000000293 R12: 00007f7a7a911640 [ 61.666425][T11670] R13: 000000000000006e R14: 000000000042f2f0 R15: 00007f7a7a8f1000 [ 61.668443][T11670] </TASK> [ 61.669233][T11670] [ 61.669754][T11670] Allocated by task 11643: [ 61.670855][T11670] kasan_save_track+0x3f/0x70 [ 61.672094][T11670] __kasan_kmalloc+0x98/0xb0 [ 61.673466][T11670] __kmalloc_node+0x259/0x4f0 [ 61.674687][T11670] bpf_map_kmalloc_node+0xd3/0x1c0 [ 61.676069][T11670] cpu_map_update_elem+0x2f0/0x1000 [ 61.677619][T11670] bpf_map_update_value+0x1b2/0x540 [ 61.679006][T11670] map_update_elem+0x52f/0x6e0 [ 61.680076][T11670] __sys_bpf+0x7a9/0x850 [ 61.681610][T11670] __x64_sys_bpf+0x7c/0x90 [ 61.682772][T11670] do_syscall_64+0xec/0x210 [ 61.683967][T11670] entry_SYSCALL_64_after_hwframe+0x67/0x6f [ 61.685648][T11670] [ 61.686282][T11670] Freed by task 1064: [ 61.687296][T11670] kasan_save_track+0x3f/0x70 [ 61.688498][T11670] kasan_save_free_info+0x40/0x50 [ 61.689786][T11670] poison_slab_object+0xa6/0xe0 [ 61.691059][T11670] __kasan_slab_free+0x37/0x60 [ 61.692336][T11670] kfree+0x136/0x2f0 [ 61.693549][T11670] __cpu_map_entry_free+0x6f3/0x770 [ 61.695004][T11670] cpu_map_free+0xc0/0x180 [ 61.696191][T11670] bpf_map_free_deferred+0xe3/0x100 [ 61.697703][T11670] process_scheduled_works+0x9cb/0x14a0 [ 61.699330][T11670] worker_thread+0x85c/0xd50 [ 61.700546][T11670] kthread+0x2ef/0x390 [ 61.701791][T11670] ret_from_fork+0x4d/0x80 [ 61.702942][T11670] ret_from_fork_asm+0x11/0x20 [ 61.704195][T11670] [ 61.704825][T11670] The buggy address belongs to the object at ffff888122d75200 [ 61.704825][T11670] which belongs to the cache kmalloc-cg-256 of size 256 [ 61.708516][T11670] The buggy address is located 8 bytes inside of [ 61.708516][T11670] freed 256-byte region [ffff888122d75200, ffff888122d75300) [ 61.712215][T11670] [ 61.712824][T11670] The buggy address belongs to the physical page: [ 61.714883][T11670] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x122d74 [ 61.717300][T11670] head: order:1 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 61.719037][T11670] memcg:ffff888120d85f01 [ 61.720006][T11670] flags: 0x17ff00000000840(slab|head|node=0|zone=2|lastcpupid=0x7ff) [ 61.722181][T11670] page_type: 0xffffffff() [ 61.723318][T11670] raw: 017ff00000000840 ffff88810004dcc0 dead000000000122 0000000000000000 [ 61.725650][T11670] raw: 0000000000000000 0000000080100010 00000001ffffffff ffff888120d85f01 [ 61.727943][T11670] head: 017ff00000000840 ffff88810004dcc0 dead000000000122 0000000000000000 [ 61.730237][T11670] head: 0000000000000000 0000000080100010 00000001ffffffff ffff888120d85f01 [ 61.732671][T11670] head: 017ff00000000001 ffffea00048b5d01 dead000000000122 00000000ffffffff [ 61.735029][T11670] head: 0000000200000000 0000000000000000 00000000ffffffff 0000000000000000 [ 61.737400][T11670] page dumped because: kasan: bad access detected [ 61.740100][T11670] page_owner tracks the page as allocated [ 61.743121][T11670] page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 8343, tgid -2092279795 (syzbot-repro), ts 8343, free_ts 43505720198 [ 61.754038][T11670] post_alloc_hook+0x1e6/0x210 [ 61.756046][T11670] get_page_from_freelist+0x7d2/0x850 [ 61.759460][T11670] __alloc_pages+0x25e/0x580 [ 61.761428][T11670] alloc_slab_page+0x6b/0x1a0 [ 61.764199][T11670] allocate_slab+0x5d/0x200 [ 61.766122][T11670] ___slab_alloc+0xac5/0xf20 [ 61.767195][T11670] __kmalloc+0x2e0/0x4b0 [ 61.769028][T11670] fib_default_rule_add+0x4a/0x350 [ 61.770394][T11670] fib6_rules_net_init+0x42/0x100 [ 61.771731][T11670] ops_init+0x39d/0x670 [ 61.773061][T11670] setup_net+0x3bc/0xae0 [ 61.774102][T11670] copy_net_ns+0x399/0x5e0 [ 61.775628][T11670] create_new_namespaces+0x4de/0x8d0 [ 61.776950][T11670] unshare_nsproxy_namespaces+0x127/0x190 [ 61.778352][T11670] ksys_unshare+0x5e6/0xbf0 [ 61.779741][T11670] __x64_sys_unshare+0x38/0x40 [ 61.781302][T11670] page last free pid 4619 tgid 4619 stack trace: [ 61.783542][T11670] free_unref_page_prepare+0x72f/0x7c0 [ 61.785018][T11670] free_unref_page+0x37/0x3f0 [ 61.786030][T11670] __slab_free+0x351/0x3f0 [ 61.786991][T11670] qlist_free_all+0x60/0xd0 [ 61.788827][T11670] kasan_quarantine_reduce+0x15a/0x170 [ 61.789951][T11670] __kasan_slab_alloc+0x23/0x70 [ 61.790999][T11670] kmem_cache_alloc_node+0x193/0x390 [ 61.792331][T11670] kmalloc_reserve+0xa7/0x2a0 [ 61.793345][T11670] __alloc_skb+0x1ec/0x430 [ 61.794435][T11670] netlink_sendmsg+0x615/0xc80 [ 61.796439][T11670] __sock_sendmsg+0x21f/0x270 [ 61.797467][T11670] ____sys_sendmsg+0x540/0x860 [ 61.798505][T11670] __sys_sendmsg+0x2b7/0x3a0 [ 61.799512][T11670] do_syscall_64+0xec/0x210 [ 61.800674][T11670] entry_SYSCALL_64_after_hwframe+0x67/0x6f [ 61.802021][T11670] [ 61.802526][T11670] Memory state around the buggy address: [ 61.803701][T11670] ffff888122d75100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 61.805694][T11670] ffff888122d75180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 61.808104][T11670] >ffff888122d75200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 61.809769][T11670] ^ [ 61.810672][T11670] ffff888122d75280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 61.812532][T11670] ffff888122d75300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 61.814846][T11670] ================================================================== [ 61.816914][T11670] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 61.818415][T11670] CPU: 1 PID: 11670 Comm: syzbot-repro Not tainted 6.9.0-rc6-00053-g0106679839f7 #27 [ 61.821191][T11670] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.1 11/11/2019 [ 61.822911][T11670] Call Trace: [ 61.823632][T11670] <TASK> [ 61.824525][T11670] dump_stack_lvl+0x241/0x360 [ 61.825545][T11670] ? tcp_gro_dev_warn+0x260/0x260 [ 61.826706][T11670] ? panic+0x850/0x850 [ 61.828594][T11670] ? lock_release+0x85/0x860 [ 61.829749][T11670] ? vscnprintf+0x5d/0x80 [ 61.830951][T11670] panic+0x335/0x850 [ 61.832316][T11670] ? check_panic_on_warn+0x21/0xa0 [ 61.834475][T11670] ? __memcpy_flushcache+0x2c0/0x2c0 [ 61.835809][T11670] ? _raw_spin_unlock_irqrestore+0xd8/0x140 [ 61.838063][T11670] ? _raw_spin_unlock_irqrestore+0xdd/0x140 [ 61.842056][T11670] ? _raw_spin_unlock+0x40/0x40 [ 61.843116][T11670] ? print_report+0x1cc/0x210 [ 61.844527][T11670] check_panic_on_warn+0x82/0xa0 [ 61.845336][T11670] ? cpu_map_enqueue+0xba/0x370 [ 61.846117][T11670] end_report+0x48/0xa0 [ 61.846790][T11670] kasan_report+0x154/0x180 [ 61.847520][T11670] ? cpu_map_enqueue+0xba/0x370 [ 61.848471][T11670] cpu_map_enqueue+0xba/0x370 [ 61.849968][T11670] xdp_do_redirect+0x685/0xbf0 [ 61.850994][T11670] tun_xdp_act+0xe7/0x9e0 [ 61.851703][T11670] ? __tun_build_skb+0x2e0/0x2e0 [ 61.852598][T11670] tun_build_skb+0xac6/0x1140 [ 61.853362][T11670] ? tun_build_skb+0xb4/0x1140 [ 61.854454][T11670] ? tun_get_user+0x2760/0x2760 [ 61.855806][T11670] tun_get_user+0x7fa/0x2760 [ 61.856734][T11670] ? rcu_read_unlock+0xa0/0xa0 [ 61.857502][T11670] ? tun_get+0x1e/0x2f0 [ 61.858171][T11670] ? tun_get+0x1e/0x2f0 [ 61.858952][T11670] ? tun_get+0x27d/0x2f0 [ 61.859637][T11670] tun_chr_write_iter+0x111/0x1f0 [ 61.860913][T11670] vfs_write+0xa84/0xcb0 [ 61.861578][T11670] ? __lock_acquire+0x1f60/0x1f60 [ 61.862376][T11670] ? kernel_write+0x330/0x330 [ 61.863221][T11670] ? lockdep_hardirqs_on_prepare+0x43c/0x780 [ 61.864230][T11670] ? __fget_files+0x3ea/0x460 [ 61.864955][T11670] ? seqcount_lockdep_reader_access+0x157/0x220 [ 61.866571][T11670] ? __fdget_pos+0x19e/0x320 [ 61.867414][T11670] ksys_write+0x19f/0x2c0 [ 61.868263][T11670] ? __ia32_sys_read+0x90/0x90 [ 61.868996][T11670] ? ktime_get_coarse_real_ts64+0x10b/0x120 [ 61.869896][T11670] do_syscall_64+0xec/0x210 [ 61.870592][T11670] entry_SYSCALL_64_after_hwframe+0x67/0x6f [ 61.871595][T11670] RIP: 0033:0x472a4f [ 61.873158][T11670] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 c9 d8 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 0c d9 02 00 48 [ 61.876447][T11670] RSP: 002b:00007f7a7a90f5c0 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 61.877944][T11670] RAX: ffffffffffffffda RBX: 00007f7a7a911640 RCX: 0000000000472a4f [ 61.879751][T11670] RDX: 0000000000000066 RSI: 0000000020000440 RDI: 00000000000000c8 [ 61.881100][T11670] RBP: 00007f7a7a90f620 R08: 0000000000000000 R09: 0000000100000000 [ 61.882298][T11670] R10: 0000000100000000 R11: 0000000000000293 R12: 00007f7a7a911640 [ 61.883501][T11670] R13: 000000000000006e R14: 000000000042f2f0 R15: 00007f7a7a8f1000 [ 61.885999][T11670] </TASK> Signed-off-by: Radoslaw Zielonek <[email protected]>
kernel-patches-daemon-bpf-rc bot
pushed a commit
that referenced
this pull request
Jul 30, 2024
When cpu_map has been redirected, first the pointer to the bpf_cpu_map_entry has been copied, then freed, and read from the copy. To fix it, this commit introduced the refcount cpu_map_parent during redirections to prevent use after free. syzbot reported: [ 61.581464][T11670] ================================================================== [ 61.583323][T11670] BUG: KASAN: slab-use-after-free in cpu_map_enqueue+0xba/0x370 [ 61.585419][T11670] Read of size 8 at addr ffff888122d75208 by task syzbot-repro/11670 [ 61.587541][T11670] [ 61.588237][T11670] CPU: 1 PID: 11670 Comm: syzbot-repro Not tainted 6.9.0-rc6-00053-g0106679839f7 #27 [ 61.590542][T11670] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.1 11/11/2019 [ 61.592798][T11670] Call Trace: [ 61.593885][T11670] <TASK> [ 61.594805][T11670] dump_stack_lvl+0x241/0x360 [ 61.595974][T11670] ? tcp_gro_dev_warn+0x260/0x260 [ 61.598242][T11670] ? __wake_up_klogd+0xcc/0x100 [ 61.599407][T11670] ? panic+0x850/0x850 [ 61.600516][T11670] ? __virt_addr_valid+0x182/0x510 [ 61.602073][T11670] ? __virt_addr_valid+0x182/0x510 [ 61.603496][T11670] print_address_description+0x7b/0x360 [ 61.605170][T11670] print_report+0xfd/0x210 [ 61.606370][T11670] ? __virt_addr_valid+0x182/0x510 [ 61.607925][T11670] ? __virt_addr_valid+0x182/0x510 [ 61.609577][T11670] ? __virt_addr_valid+0x43d/0x510 [ 61.610948][T11670] ? __phys_addr+0xb9/0x170 [ 61.612103][T11670] ? cpu_map_enqueue+0xba/0x370 [ 61.613448][T11670] kasan_report+0x143/0x180 [ 61.615000][T11670] ? cpu_map_enqueue+0xba/0x370 [ 61.616181][T11670] cpu_map_enqueue+0xba/0x370 [ 61.617620][T11670] xdp_do_redirect+0x685/0xbf0 [ 61.618787][T11670] tun_xdp_act+0xe7/0x9e0 [ 61.619856][T11670] ? __tun_build_skb+0x2e0/0x2e0 [ 61.621356][T11670] tun_build_skb+0xac6/0x1140 [ 61.622602][T11670] ? tun_build_skb+0xb4/0x1140 [ 61.623880][T11670] ? tun_get_user+0x2760/0x2760 [ 61.625341][T11670] tun_get_user+0x7fa/0x2760 [ 61.626532][T11670] ? rcu_read_unlock+0xa0/0xa0 [ 61.627725][T11670] ? tun_get+0x1e/0x2f0 [ 61.629147][T11670] ? tun_get+0x1e/0x2f0 [ 61.630265][T11670] ? tun_get+0x27d/0x2f0 [ 61.631486][T11670] tun_chr_write_iter+0x111/0x1f0 [ 61.632855][T11670] vfs_write+0xa84/0xcb0 [ 61.634185][T11670] ? __lock_acquire+0x1f60/0x1f60 [ 61.635501][T11670] ? kernel_write+0x330/0x330 [ 61.636757][T11670] ? lockdep_hardirqs_on_prepare+0x43c/0x780 [ 61.638445][T11670] ? __fget_files+0x3ea/0x460 [ 61.639448][T11670] ? seqcount_lockdep_reader_access+0x157/0x220 [ 61.641217][T11670] ? __fdget_pos+0x19e/0x320 [ 61.642426][T11670] ksys_write+0x19f/0x2c0 [ 61.643576][T11670] ? __ia32_sys_read+0x90/0x90 [ 61.644841][T11670] ? ktime_get_coarse_real_ts64+0x10b/0x120 [ 61.646549][T11670] do_syscall_64+0xec/0x210 [ 61.647832][T11670] entry_SYSCALL_64_after_hwframe+0x67/0x6f [ 61.649485][T11670] RIP: 0033:0x472a4f [ 61.650539][T11670] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 c9 d8 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 0c d9 02 00 48 [ 61.655476][T11670] RSP: 002b:00007f7a7a90f5c0 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 61.657675][T11670] RAX: ffffffffffffffda RBX: 00007f7a7a911640 RCX: 0000000000472a4f [ 61.659658][T11670] RDX: 0000000000000066 RSI: 0000000020000440 RDI: 00000000000000c8 [ 61.661980][T11670] RBP: 00007f7a7a90f620 R08: 0000000000000000 R09: 0000000100000000 [ 61.663982][T11670] R10: 0000000100000000 R11: 0000000000000293 R12: 00007f7a7a911640 [ 61.666425][T11670] R13: 000000000000006e R14: 000000000042f2f0 R15: 00007f7a7a8f1000 [ 61.668443][T11670] </TASK> [ 61.669233][T11670] [ 61.669754][T11670] Allocated by task 11643: [ 61.670855][T11670] kasan_save_track+0x3f/0x70 [ 61.672094][T11670] __kasan_kmalloc+0x98/0xb0 [ 61.673466][T11670] __kmalloc_node+0x259/0x4f0 [ 61.674687][T11670] bpf_map_kmalloc_node+0xd3/0x1c0 [ 61.676069][T11670] cpu_map_update_elem+0x2f0/0x1000 [ 61.677619][T11670] bpf_map_update_value+0x1b2/0x540 [ 61.679006][T11670] map_update_elem+0x52f/0x6e0 [ 61.680076][T11670] __sys_bpf+0x7a9/0x850 [ 61.681610][T11670] __x64_sys_bpf+0x7c/0x90 [ 61.682772][T11670] do_syscall_64+0xec/0x210 [ 61.683967][T11670] entry_SYSCALL_64_after_hwframe+0x67/0x6f [ 61.685648][T11670] [ 61.686282][T11670] Freed by task 1064: [ 61.687296][T11670] kasan_save_track+0x3f/0x70 [ 61.688498][T11670] kasan_save_free_info+0x40/0x50 [ 61.689786][T11670] poison_slab_object+0xa6/0xe0 [ 61.691059][T11670] __kasan_slab_free+0x37/0x60 [ 61.692336][T11670] kfree+0x136/0x2f0 [ 61.693549][T11670] __cpu_map_entry_free+0x6f3/0x770 [ 61.695004][T11670] cpu_map_free+0xc0/0x180 [ 61.696191][T11670] bpf_map_free_deferred+0xe3/0x100 [ 61.697703][T11670] process_scheduled_works+0x9cb/0x14a0 [ 61.699330][T11670] worker_thread+0x85c/0xd50 [ 61.700546][T11670] kthread+0x2ef/0x390 [ 61.701791][T11670] ret_from_fork+0x4d/0x80 [ 61.702942][T11670] ret_from_fork_asm+0x11/0x20 [ 61.704195][T11670] [ 61.704825][T11670] The buggy address belongs to the object at ffff888122d75200 [ 61.704825][T11670] which belongs to the cache kmalloc-cg-256 of size 256 [ 61.708516][T11670] The buggy address is located 8 bytes inside of [ 61.708516][T11670] freed 256-byte region [ffff888122d75200, ffff888122d75300) [ 61.712215][T11670] [ 61.712824][T11670] The buggy address belongs to the physical page: [ 61.714883][T11670] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x122d74 [ 61.717300][T11670] head: order:1 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 61.719037][T11670] memcg:ffff888120d85f01 [ 61.720006][T11670] flags: 0x17ff00000000840(slab|head|node=0|zone=2|lastcpupid=0x7ff) [ 61.722181][T11670] page_type: 0xffffffff() [ 61.723318][T11670] raw: 017ff00000000840 ffff88810004dcc0 dead000000000122 0000000000000000 [ 61.725650][T11670] raw: 0000000000000000 0000000080100010 00000001ffffffff ffff888120d85f01 [ 61.727943][T11670] head: 017ff00000000840 ffff88810004dcc0 dead000000000122 0000000000000000 [ 61.730237][T11670] head: 0000000000000000 0000000080100010 00000001ffffffff ffff888120d85f01 [ 61.732671][T11670] head: 017ff00000000001 ffffea00048b5d01 dead000000000122 00000000ffffffff [ 61.735029][T11670] head: 0000000200000000 0000000000000000 00000000ffffffff 0000000000000000 [ 61.737400][T11670] page dumped because: kasan: bad access detected [ 61.740100][T11670] page_owner tracks the page as allocated [ 61.743121][T11670] page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 8343, tgid -2092279795 (syzbot-repro), ts 8343, free_ts 43505720198 [ 61.754038][T11670] post_alloc_hook+0x1e6/0x210 [ 61.756046][T11670] get_page_from_freelist+0x7d2/0x850 [ 61.759460][T11670] __alloc_pages+0x25e/0x580 [ 61.761428][T11670] alloc_slab_page+0x6b/0x1a0 [ 61.764199][T11670] allocate_slab+0x5d/0x200 [ 61.766122][T11670] ___slab_alloc+0xac5/0xf20 [ 61.767195][T11670] __kmalloc+0x2e0/0x4b0 [ 61.769028][T11670] fib_default_rule_add+0x4a/0x350 [ 61.770394][T11670] fib6_rules_net_init+0x42/0x100 [ 61.771731][T11670] ops_init+0x39d/0x670 [ 61.773061][T11670] setup_net+0x3bc/0xae0 [ 61.774102][T11670] copy_net_ns+0x399/0x5e0 [ 61.775628][T11670] create_new_namespaces+0x4de/0x8d0 [ 61.776950][T11670] unshare_nsproxy_namespaces+0x127/0x190 [ 61.778352][T11670] ksys_unshare+0x5e6/0xbf0 [ 61.779741][T11670] __x64_sys_unshare+0x38/0x40 [ 61.781302][T11670] page last free pid 4619 tgid 4619 stack trace: [ 61.783542][T11670] free_unref_page_prepare+0x72f/0x7c0 [ 61.785018][T11670] free_unref_page+0x37/0x3f0 [ 61.786030][T11670] __slab_free+0x351/0x3f0 [ 61.786991][T11670] qlist_free_all+0x60/0xd0 [ 61.788827][T11670] kasan_quarantine_reduce+0x15a/0x170 [ 61.789951][T11670] __kasan_slab_alloc+0x23/0x70 [ 61.790999][T11670] kmem_cache_alloc_node+0x193/0x390 [ 61.792331][T11670] kmalloc_reserve+0xa7/0x2a0 [ 61.793345][T11670] __alloc_skb+0x1ec/0x430 [ 61.794435][T11670] netlink_sendmsg+0x615/0xc80 [ 61.796439][T11670] __sock_sendmsg+0x21f/0x270 [ 61.797467][T11670] ____sys_sendmsg+0x540/0x860 [ 61.798505][T11670] __sys_sendmsg+0x2b7/0x3a0 [ 61.799512][T11670] do_syscall_64+0xec/0x210 [ 61.800674][T11670] entry_SYSCALL_64_after_hwframe+0x67/0x6f [ 61.802021][T11670] [ 61.802526][T11670] Memory state around the buggy address: [ 61.803701][T11670] ffff888122d75100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 61.805694][T11670] ffff888122d75180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 61.808104][T11670] >ffff888122d75200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 61.809769][T11670] ^ [ 61.810672][T11670] ffff888122d75280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 61.812532][T11670] ffff888122d75300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 61.814846][T11670] ================================================================== [ 61.816914][T11670] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 61.818415][T11670] CPU: 1 PID: 11670 Comm: syzbot-repro Not tainted 6.9.0-rc6-00053-g0106679839f7 #27 [ 61.821191][T11670] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.1 11/11/2019 [ 61.822911][T11670] Call Trace: [ 61.823632][T11670] <TASK> [ 61.824525][T11670] dump_stack_lvl+0x241/0x360 [ 61.825545][T11670] ? tcp_gro_dev_warn+0x260/0x260 [ 61.826706][T11670] ? panic+0x850/0x850 [ 61.828594][T11670] ? lock_release+0x85/0x860 [ 61.829749][T11670] ? vscnprintf+0x5d/0x80 [ 61.830951][T11670] panic+0x335/0x850 [ 61.832316][T11670] ? check_panic_on_warn+0x21/0xa0 [ 61.834475][T11670] ? __memcpy_flushcache+0x2c0/0x2c0 [ 61.835809][T11670] ? _raw_spin_unlock_irqrestore+0xd8/0x140 [ 61.838063][T11670] ? _raw_spin_unlock_irqrestore+0xdd/0x140 [ 61.842056][T11670] ? _raw_spin_unlock+0x40/0x40 [ 61.843116][T11670] ? print_report+0x1cc/0x210 [ 61.844527][T11670] check_panic_on_warn+0x82/0xa0 [ 61.845336][T11670] ? cpu_map_enqueue+0xba/0x370 [ 61.846117][T11670] end_report+0x48/0xa0 [ 61.846790][T11670] kasan_report+0x154/0x180 [ 61.847520][T11670] ? cpu_map_enqueue+0xba/0x370 [ 61.848471][T11670] cpu_map_enqueue+0xba/0x370 [ 61.849968][T11670] xdp_do_redirect+0x685/0xbf0 [ 61.850994][T11670] tun_xdp_act+0xe7/0x9e0 [ 61.851703][T11670] ? __tun_build_skb+0x2e0/0x2e0 [ 61.852598][T11670] tun_build_skb+0xac6/0x1140 [ 61.853362][T11670] ? tun_build_skb+0xb4/0x1140 [ 61.854454][T11670] ? tun_get_user+0x2760/0x2760 [ 61.855806][T11670] tun_get_user+0x7fa/0x2760 [ 61.856734][T11670] ? rcu_read_unlock+0xa0/0xa0 [ 61.857502][T11670] ? tun_get+0x1e/0x2f0 [ 61.858171][T11670] ? tun_get+0x1e/0x2f0 [ 61.858952][T11670] ? tun_get+0x27d/0x2f0 [ 61.859637][T11670] tun_chr_write_iter+0x111/0x1f0 [ 61.860913][T11670] vfs_write+0xa84/0xcb0 [ 61.861578][T11670] ? __lock_acquire+0x1f60/0x1f60 [ 61.862376][T11670] ? kernel_write+0x330/0x330 [ 61.863221][T11670] ? lockdep_hardirqs_on_prepare+0x43c/0x780 [ 61.864230][T11670] ? __fget_files+0x3ea/0x460 [ 61.864955][T11670] ? seqcount_lockdep_reader_access+0x157/0x220 [ 61.866571][T11670] ? __fdget_pos+0x19e/0x320 [ 61.867414][T11670] ksys_write+0x19f/0x2c0 [ 61.868263][T11670] ? __ia32_sys_read+0x90/0x90 [ 61.868996][T11670] ? ktime_get_coarse_real_ts64+0x10b/0x120 [ 61.869896][T11670] do_syscall_64+0xec/0x210 [ 61.870592][T11670] entry_SYSCALL_64_after_hwframe+0x67/0x6f [ 61.871595][T11670] RIP: 0033:0x472a4f [ 61.873158][T11670] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 c9 d8 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 0c d9 02 00 48 [ 61.876447][T11670] RSP: 002b:00007f7a7a90f5c0 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 61.877944][T11670] RAX: ffffffffffffffda RBX: 00007f7a7a911640 RCX: 0000000000472a4f [ 61.879751][T11670] RDX: 0000000000000066 RSI: 0000000020000440 RDI: 00000000000000c8 [ 61.881100][T11670] RBP: 00007f7a7a90f620 R08: 0000000000000000 R09: 0000000100000000 [ 61.882298][T11670] R10: 0000000100000000 R11: 0000000000000293 R12: 00007f7a7a911640 [ 61.883501][T11670] R13: 000000000000006e R14: 000000000042f2f0 R15: 00007f7a7a8f1000 [ 61.885999][T11670] </TASK> Signed-off-by: Radoslaw Zielonek <[email protected]>
kernel-patches-daemon-bpf-rc bot
pushed a commit
that referenced
this pull request
Jul 30, 2024
When cpu_map has been redirected, first the pointer to the bpf_cpu_map_entry has been copied, then freed, and read from the copy. To fix it, this commit introduced the refcount cpu_map_parent during redirections to prevent use after free. syzbot reported: [ 61.581464][T11670] ================================================================== [ 61.583323][T11670] BUG: KASAN: slab-use-after-free in cpu_map_enqueue+0xba/0x370 [ 61.585419][T11670] Read of size 8 at addr ffff888122d75208 by task syzbot-repro/11670 [ 61.587541][T11670] [ 61.588237][T11670] CPU: 1 PID: 11670 Comm: syzbot-repro Not tainted 6.9.0-rc6-00053-g0106679839f7 #27 [ 61.590542][T11670] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.1 11/11/2019 [ 61.592798][T11670] Call Trace: [ 61.593885][T11670] <TASK> [ 61.594805][T11670] dump_stack_lvl+0x241/0x360 [ 61.595974][T11670] ? tcp_gro_dev_warn+0x260/0x260 [ 61.598242][T11670] ? __wake_up_klogd+0xcc/0x100 [ 61.599407][T11670] ? panic+0x850/0x850 [ 61.600516][T11670] ? __virt_addr_valid+0x182/0x510 [ 61.602073][T11670] ? __virt_addr_valid+0x182/0x510 [ 61.603496][T11670] print_address_description+0x7b/0x360 [ 61.605170][T11670] print_report+0xfd/0x210 [ 61.606370][T11670] ? __virt_addr_valid+0x182/0x510 [ 61.607925][T11670] ? __virt_addr_valid+0x182/0x510 [ 61.609577][T11670] ? __virt_addr_valid+0x43d/0x510 [ 61.610948][T11670] ? __phys_addr+0xb9/0x170 [ 61.612103][T11670] ? cpu_map_enqueue+0xba/0x370 [ 61.613448][T11670] kasan_report+0x143/0x180 [ 61.615000][T11670] ? cpu_map_enqueue+0xba/0x370 [ 61.616181][T11670] cpu_map_enqueue+0xba/0x370 [ 61.617620][T11670] xdp_do_redirect+0x685/0xbf0 [ 61.618787][T11670] tun_xdp_act+0xe7/0x9e0 [ 61.619856][T11670] ? __tun_build_skb+0x2e0/0x2e0 [ 61.621356][T11670] tun_build_skb+0xac6/0x1140 [ 61.622602][T11670] ? tun_build_skb+0xb4/0x1140 [ 61.623880][T11670] ? tun_get_user+0x2760/0x2760 [ 61.625341][T11670] tun_get_user+0x7fa/0x2760 [ 61.626532][T11670] ? rcu_read_unlock+0xa0/0xa0 [ 61.627725][T11670] ? tun_get+0x1e/0x2f0 [ 61.629147][T11670] ? tun_get+0x1e/0x2f0 [ 61.630265][T11670] ? tun_get+0x27d/0x2f0 [ 61.631486][T11670] tun_chr_write_iter+0x111/0x1f0 [ 61.632855][T11670] vfs_write+0xa84/0xcb0 [ 61.634185][T11670] ? __lock_acquire+0x1f60/0x1f60 [ 61.635501][T11670] ? kernel_write+0x330/0x330 [ 61.636757][T11670] ? lockdep_hardirqs_on_prepare+0x43c/0x780 [ 61.638445][T11670] ? __fget_files+0x3ea/0x460 [ 61.639448][T11670] ? seqcount_lockdep_reader_access+0x157/0x220 [ 61.641217][T11670] ? __fdget_pos+0x19e/0x320 [ 61.642426][T11670] ksys_write+0x19f/0x2c0 [ 61.643576][T11670] ? __ia32_sys_read+0x90/0x90 [ 61.644841][T11670] ? ktime_get_coarse_real_ts64+0x10b/0x120 [ 61.646549][T11670] do_syscall_64+0xec/0x210 [ 61.647832][T11670] entry_SYSCALL_64_after_hwframe+0x67/0x6f [ 61.649485][T11670] RIP: 0033:0x472a4f [ 61.650539][T11670] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 c9 d8 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 0c d9 02 00 48 [ 61.655476][T11670] RSP: 002b:00007f7a7a90f5c0 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 61.657675][T11670] RAX: ffffffffffffffda RBX: 00007f7a7a911640 RCX: 0000000000472a4f [ 61.659658][T11670] RDX: 0000000000000066 RSI: 0000000020000440 RDI: 00000000000000c8 [ 61.661980][T11670] RBP: 00007f7a7a90f620 R08: 0000000000000000 R09: 0000000100000000 [ 61.663982][T11670] R10: 0000000100000000 R11: 0000000000000293 R12: 00007f7a7a911640 [ 61.666425][T11670] R13: 000000000000006e R14: 000000000042f2f0 R15: 00007f7a7a8f1000 [ 61.668443][T11670] </TASK> [ 61.669233][T11670] [ 61.669754][T11670] Allocated by task 11643: [ 61.670855][T11670] kasan_save_track+0x3f/0x70 [ 61.672094][T11670] __kasan_kmalloc+0x98/0xb0 [ 61.673466][T11670] __kmalloc_node+0x259/0x4f0 [ 61.674687][T11670] bpf_map_kmalloc_node+0xd3/0x1c0 [ 61.676069][T11670] cpu_map_update_elem+0x2f0/0x1000 [ 61.677619][T11670] bpf_map_update_value+0x1b2/0x540 [ 61.679006][T11670] map_update_elem+0x52f/0x6e0 [ 61.680076][T11670] __sys_bpf+0x7a9/0x850 [ 61.681610][T11670] __x64_sys_bpf+0x7c/0x90 [ 61.682772][T11670] do_syscall_64+0xec/0x210 [ 61.683967][T11670] entry_SYSCALL_64_after_hwframe+0x67/0x6f [ 61.685648][T11670] [ 61.686282][T11670] Freed by task 1064: [ 61.687296][T11670] kasan_save_track+0x3f/0x70 [ 61.688498][T11670] kasan_save_free_info+0x40/0x50 [ 61.689786][T11670] poison_slab_object+0xa6/0xe0 [ 61.691059][T11670] __kasan_slab_free+0x37/0x60 [ 61.692336][T11670] kfree+0x136/0x2f0 [ 61.693549][T11670] __cpu_map_entry_free+0x6f3/0x770 [ 61.695004][T11670] cpu_map_free+0xc0/0x180 [ 61.696191][T11670] bpf_map_free_deferred+0xe3/0x100 [ 61.697703][T11670] process_scheduled_works+0x9cb/0x14a0 [ 61.699330][T11670] worker_thread+0x85c/0xd50 [ 61.700546][T11670] kthread+0x2ef/0x390 [ 61.701791][T11670] ret_from_fork+0x4d/0x80 [ 61.702942][T11670] ret_from_fork_asm+0x11/0x20 [ 61.704195][T11670] [ 61.704825][T11670] The buggy address belongs to the object at ffff888122d75200 [ 61.704825][T11670] which belongs to the cache kmalloc-cg-256 of size 256 [ 61.708516][T11670] The buggy address is located 8 bytes inside of [ 61.708516][T11670] freed 256-byte region [ffff888122d75200, ffff888122d75300) [ 61.712215][T11670] [ 61.712824][T11670] The buggy address belongs to the physical page: [ 61.714883][T11670] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x122d74 [ 61.717300][T11670] head: order:1 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 61.719037][T11670] memcg:ffff888120d85f01 [ 61.720006][T11670] flags: 0x17ff00000000840(slab|head|node=0|zone=2|lastcpupid=0x7ff) [ 61.722181][T11670] page_type: 0xffffffff() [ 61.723318][T11670] raw: 017ff00000000840 ffff88810004dcc0 dead000000000122 0000000000000000 [ 61.725650][T11670] raw: 0000000000000000 0000000080100010 00000001ffffffff ffff888120d85f01 [ 61.727943][T11670] head: 017ff00000000840 ffff88810004dcc0 dead000000000122 0000000000000000 [ 61.730237][T11670] head: 0000000000000000 0000000080100010 00000001ffffffff ffff888120d85f01 [ 61.732671][T11670] head: 017ff00000000001 ffffea00048b5d01 dead000000000122 00000000ffffffff [ 61.735029][T11670] head: 0000000200000000 0000000000000000 00000000ffffffff 0000000000000000 [ 61.737400][T11670] page dumped because: kasan: bad access detected [ 61.740100][T11670] page_owner tracks the page as allocated [ 61.743121][T11670] page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 8343, tgid -2092279795 (syzbot-repro), ts 8343, free_ts 43505720198 [ 61.754038][T11670] post_alloc_hook+0x1e6/0x210 [ 61.756046][T11670] get_page_from_freelist+0x7d2/0x850 [ 61.759460][T11670] __alloc_pages+0x25e/0x580 [ 61.761428][T11670] alloc_slab_page+0x6b/0x1a0 [ 61.764199][T11670] allocate_slab+0x5d/0x200 [ 61.766122][T11670] ___slab_alloc+0xac5/0xf20 [ 61.767195][T11670] __kmalloc+0x2e0/0x4b0 [ 61.769028][T11670] fib_default_rule_add+0x4a/0x350 [ 61.770394][T11670] fib6_rules_net_init+0x42/0x100 [ 61.771731][T11670] ops_init+0x39d/0x670 [ 61.773061][T11670] setup_net+0x3bc/0xae0 [ 61.774102][T11670] copy_net_ns+0x399/0x5e0 [ 61.775628][T11670] create_new_namespaces+0x4de/0x8d0 [ 61.776950][T11670] unshare_nsproxy_namespaces+0x127/0x190 [ 61.778352][T11670] ksys_unshare+0x5e6/0xbf0 [ 61.779741][T11670] __x64_sys_unshare+0x38/0x40 [ 61.781302][T11670] page last free pid 4619 tgid 4619 stack trace: [ 61.783542][T11670] free_unref_page_prepare+0x72f/0x7c0 [ 61.785018][T11670] free_unref_page+0x37/0x3f0 [ 61.786030][T11670] __slab_free+0x351/0x3f0 [ 61.786991][T11670] qlist_free_all+0x60/0xd0 [ 61.788827][T11670] kasan_quarantine_reduce+0x15a/0x170 [ 61.789951][T11670] __kasan_slab_alloc+0x23/0x70 [ 61.790999][T11670] kmem_cache_alloc_node+0x193/0x390 [ 61.792331][T11670] kmalloc_reserve+0xa7/0x2a0 [ 61.793345][T11670] __alloc_skb+0x1ec/0x430 [ 61.794435][T11670] netlink_sendmsg+0x615/0xc80 [ 61.796439][T11670] __sock_sendmsg+0x21f/0x270 [ 61.797467][T11670] ____sys_sendmsg+0x540/0x860 [ 61.798505][T11670] __sys_sendmsg+0x2b7/0x3a0 [ 61.799512][T11670] do_syscall_64+0xec/0x210 [ 61.800674][T11670] entry_SYSCALL_64_after_hwframe+0x67/0x6f [ 61.802021][T11670] [ 61.802526][T11670] Memory state around the buggy address: [ 61.803701][T11670] ffff888122d75100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 61.805694][T11670] ffff888122d75180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 61.808104][T11670] >ffff888122d75200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 61.809769][T11670] ^ [ 61.810672][T11670] ffff888122d75280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 61.812532][T11670] ffff888122d75300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 61.814846][T11670] ================================================================== [ 61.816914][T11670] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 61.818415][T11670] CPU: 1 PID: 11670 Comm: syzbot-repro Not tainted 6.9.0-rc6-00053-g0106679839f7 #27 [ 61.821191][T11670] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.1 11/11/2019 [ 61.822911][T11670] Call Trace: [ 61.823632][T11670] <TASK> [ 61.824525][T11670] dump_stack_lvl+0x241/0x360 [ 61.825545][T11670] ? tcp_gro_dev_warn+0x260/0x260 [ 61.826706][T11670] ? panic+0x850/0x850 [ 61.828594][T11670] ? lock_release+0x85/0x860 [ 61.829749][T11670] ? vscnprintf+0x5d/0x80 [ 61.830951][T11670] panic+0x335/0x850 [ 61.832316][T11670] ? check_panic_on_warn+0x21/0xa0 [ 61.834475][T11670] ? __memcpy_flushcache+0x2c0/0x2c0 [ 61.835809][T11670] ? _raw_spin_unlock_irqrestore+0xd8/0x140 [ 61.838063][T11670] ? _raw_spin_unlock_irqrestore+0xdd/0x140 [ 61.842056][T11670] ? _raw_spin_unlock+0x40/0x40 [ 61.843116][T11670] ? print_report+0x1cc/0x210 [ 61.844527][T11670] check_panic_on_warn+0x82/0xa0 [ 61.845336][T11670] ? cpu_map_enqueue+0xba/0x370 [ 61.846117][T11670] end_report+0x48/0xa0 [ 61.846790][T11670] kasan_report+0x154/0x180 [ 61.847520][T11670] ? cpu_map_enqueue+0xba/0x370 [ 61.848471][T11670] cpu_map_enqueue+0xba/0x370 [ 61.849968][T11670] xdp_do_redirect+0x685/0xbf0 [ 61.850994][T11670] tun_xdp_act+0xe7/0x9e0 [ 61.851703][T11670] ? __tun_build_skb+0x2e0/0x2e0 [ 61.852598][T11670] tun_build_skb+0xac6/0x1140 [ 61.853362][T11670] ? tun_build_skb+0xb4/0x1140 [ 61.854454][T11670] ? tun_get_user+0x2760/0x2760 [ 61.855806][T11670] tun_get_user+0x7fa/0x2760 [ 61.856734][T11670] ? rcu_read_unlock+0xa0/0xa0 [ 61.857502][T11670] ? tun_get+0x1e/0x2f0 [ 61.858171][T11670] ? tun_get+0x1e/0x2f0 [ 61.858952][T11670] ? tun_get+0x27d/0x2f0 [ 61.859637][T11670] tun_chr_write_iter+0x111/0x1f0 [ 61.860913][T11670] vfs_write+0xa84/0xcb0 [ 61.861578][T11670] ? __lock_acquire+0x1f60/0x1f60 [ 61.862376][T11670] ? kernel_write+0x330/0x330 [ 61.863221][T11670] ? lockdep_hardirqs_on_prepare+0x43c/0x780 [ 61.864230][T11670] ? __fget_files+0x3ea/0x460 [ 61.864955][T11670] ? seqcount_lockdep_reader_access+0x157/0x220 [ 61.866571][T11670] ? __fdget_pos+0x19e/0x320 [ 61.867414][T11670] ksys_write+0x19f/0x2c0 [ 61.868263][T11670] ? __ia32_sys_read+0x90/0x90 [ 61.868996][T11670] ? ktime_get_coarse_real_ts64+0x10b/0x120 [ 61.869896][T11670] do_syscall_64+0xec/0x210 [ 61.870592][T11670] entry_SYSCALL_64_after_hwframe+0x67/0x6f [ 61.871595][T11670] RIP: 0033:0x472a4f [ 61.873158][T11670] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 c9 d8 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 0c d9 02 00 48 [ 61.876447][T11670] RSP: 002b:00007f7a7a90f5c0 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 61.877944][T11670] RAX: ffffffffffffffda RBX: 00007f7a7a911640 RCX: 0000000000472a4f [ 61.879751][T11670] RDX: 0000000000000066 RSI: 0000000020000440 RDI: 00000000000000c8 [ 61.881100][T11670] RBP: 00007f7a7a90f620 R08: 0000000000000000 R09: 0000000100000000 [ 61.882298][T11670] R10: 0000000100000000 R11: 0000000000000293 R12: 00007f7a7a911640 [ 61.883501][T11670] R13: 000000000000006e R14: 000000000042f2f0 R15: 00007f7a7a8f1000 [ 61.885999][T11670] </TASK> Signed-off-by: Radoslaw Zielonek <[email protected]>
kernel-patches-daemon-bpf-rc bot
pushed a commit
that referenced
this pull request
Jul 30, 2024
When cpu_map has been redirected, first the pointer to the bpf_cpu_map_entry has been copied, then freed, and read from the copy. To fix it, this commit introduced the refcount cpu_map_parent during redirections to prevent use after free. syzbot reported: [ 61.581464][T11670] ================================================================== [ 61.583323][T11670] BUG: KASAN: slab-use-after-free in cpu_map_enqueue+0xba/0x370 [ 61.585419][T11670] Read of size 8 at addr ffff888122d75208 by task syzbot-repro/11670 [ 61.587541][T11670] [ 61.588237][T11670] CPU: 1 PID: 11670 Comm: syzbot-repro Not tainted 6.9.0-rc6-00053-g0106679839f7 #27 [ 61.590542][T11670] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.1 11/11/2019 [ 61.592798][T11670] Call Trace: [ 61.593885][T11670] <TASK> [ 61.594805][T11670] dump_stack_lvl+0x241/0x360 [ 61.595974][T11670] ? tcp_gro_dev_warn+0x260/0x260 [ 61.598242][T11670] ? __wake_up_klogd+0xcc/0x100 [ 61.599407][T11670] ? panic+0x850/0x850 [ 61.600516][T11670] ? __virt_addr_valid+0x182/0x510 [ 61.602073][T11670] ? __virt_addr_valid+0x182/0x510 [ 61.603496][T11670] print_address_description+0x7b/0x360 [ 61.605170][T11670] print_report+0xfd/0x210 [ 61.606370][T11670] ? __virt_addr_valid+0x182/0x510 [ 61.607925][T11670] ? __virt_addr_valid+0x182/0x510 [ 61.609577][T11670] ? __virt_addr_valid+0x43d/0x510 [ 61.610948][T11670] ? __phys_addr+0xb9/0x170 [ 61.612103][T11670] ? cpu_map_enqueue+0xba/0x370 [ 61.613448][T11670] kasan_report+0x143/0x180 [ 61.615000][T11670] ? cpu_map_enqueue+0xba/0x370 [ 61.616181][T11670] cpu_map_enqueue+0xba/0x370 [ 61.617620][T11670] xdp_do_redirect+0x685/0xbf0 [ 61.618787][T11670] tun_xdp_act+0xe7/0x9e0 [ 61.619856][T11670] ? __tun_build_skb+0x2e0/0x2e0 [ 61.621356][T11670] tun_build_skb+0xac6/0x1140 [ 61.622602][T11670] ? tun_build_skb+0xb4/0x1140 [ 61.623880][T11670] ? tun_get_user+0x2760/0x2760 [ 61.625341][T11670] tun_get_user+0x7fa/0x2760 [ 61.626532][T11670] ? rcu_read_unlock+0xa0/0xa0 [ 61.627725][T11670] ? tun_get+0x1e/0x2f0 [ 61.629147][T11670] ? tun_get+0x1e/0x2f0 [ 61.630265][T11670] ? tun_get+0x27d/0x2f0 [ 61.631486][T11670] tun_chr_write_iter+0x111/0x1f0 [ 61.632855][T11670] vfs_write+0xa84/0xcb0 [ 61.634185][T11670] ? __lock_acquire+0x1f60/0x1f60 [ 61.635501][T11670] ? kernel_write+0x330/0x330 [ 61.636757][T11670] ? lockdep_hardirqs_on_prepare+0x43c/0x780 [ 61.638445][T11670] ? __fget_files+0x3ea/0x460 [ 61.639448][T11670] ? seqcount_lockdep_reader_access+0x157/0x220 [ 61.641217][T11670] ? __fdget_pos+0x19e/0x320 [ 61.642426][T11670] ksys_write+0x19f/0x2c0 [ 61.643576][T11670] ? __ia32_sys_read+0x90/0x90 [ 61.644841][T11670] ? ktime_get_coarse_real_ts64+0x10b/0x120 [ 61.646549][T11670] do_syscall_64+0xec/0x210 [ 61.647832][T11670] entry_SYSCALL_64_after_hwframe+0x67/0x6f [ 61.649485][T11670] RIP: 0033:0x472a4f [ 61.650539][T11670] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 c9 d8 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 0c d9 02 00 48 [ 61.655476][T11670] RSP: 002b:00007f7a7a90f5c0 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 61.657675][T11670] RAX: ffffffffffffffda RBX: 00007f7a7a911640 RCX: 0000000000472a4f [ 61.659658][T11670] RDX: 0000000000000066 RSI: 0000000020000440 RDI: 00000000000000c8 [ 61.661980][T11670] RBP: 00007f7a7a90f620 R08: 0000000000000000 R09: 0000000100000000 [ 61.663982][T11670] R10: 0000000100000000 R11: 0000000000000293 R12: 00007f7a7a911640 [ 61.666425][T11670] R13: 000000000000006e R14: 000000000042f2f0 R15: 00007f7a7a8f1000 [ 61.668443][T11670] </TASK> [ 61.669233][T11670] [ 61.669754][T11670] Allocated by task 11643: [ 61.670855][T11670] kasan_save_track+0x3f/0x70 [ 61.672094][T11670] __kasan_kmalloc+0x98/0xb0 [ 61.673466][T11670] __kmalloc_node+0x259/0x4f0 [ 61.674687][T11670] bpf_map_kmalloc_node+0xd3/0x1c0 [ 61.676069][T11670] cpu_map_update_elem+0x2f0/0x1000 [ 61.677619][T11670] bpf_map_update_value+0x1b2/0x540 [ 61.679006][T11670] map_update_elem+0x52f/0x6e0 [ 61.680076][T11670] __sys_bpf+0x7a9/0x850 [ 61.681610][T11670] __x64_sys_bpf+0x7c/0x90 [ 61.682772][T11670] do_syscall_64+0xec/0x210 [ 61.683967][T11670] entry_SYSCALL_64_after_hwframe+0x67/0x6f [ 61.685648][T11670] [ 61.686282][T11670] Freed by task 1064: [ 61.687296][T11670] kasan_save_track+0x3f/0x70 [ 61.688498][T11670] kasan_save_free_info+0x40/0x50 [ 61.689786][T11670] poison_slab_object+0xa6/0xe0 [ 61.691059][T11670] __kasan_slab_free+0x37/0x60 [ 61.692336][T11670] kfree+0x136/0x2f0 [ 61.693549][T11670] __cpu_map_entry_free+0x6f3/0x770 [ 61.695004][T11670] cpu_map_free+0xc0/0x180 [ 61.696191][T11670] bpf_map_free_deferred+0xe3/0x100 [ 61.697703][T11670] process_scheduled_works+0x9cb/0x14a0 [ 61.699330][T11670] worker_thread+0x85c/0xd50 [ 61.700546][T11670] kthread+0x2ef/0x390 [ 61.701791][T11670] ret_from_fork+0x4d/0x80 [ 61.702942][T11670] ret_from_fork_asm+0x11/0x20 [ 61.704195][T11670] [ 61.704825][T11670] The buggy address belongs to the object at ffff888122d75200 [ 61.704825][T11670] which belongs to the cache kmalloc-cg-256 of size 256 [ 61.708516][T11670] The buggy address is located 8 bytes inside of [ 61.708516][T11670] freed 256-byte region [ffff888122d75200, ffff888122d75300) [ 61.712215][T11670] [ 61.712824][T11670] The buggy address belongs to the physical page: [ 61.714883][T11670] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x122d74 [ 61.717300][T11670] head: order:1 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 61.719037][T11670] memcg:ffff888120d85f01 [ 61.720006][T11670] flags: 0x17ff00000000840(slab|head|node=0|zone=2|lastcpupid=0x7ff) [ 61.722181][T11670] page_type: 0xffffffff() [ 61.723318][T11670] raw: 017ff00000000840 ffff88810004dcc0 dead000000000122 0000000000000000 [ 61.725650][T11670] raw: 0000000000000000 0000000080100010 00000001ffffffff ffff888120d85f01 [ 61.727943][T11670] head: 017ff00000000840 ffff88810004dcc0 dead000000000122 0000000000000000 [ 61.730237][T11670] head: 0000000000000000 0000000080100010 00000001ffffffff ffff888120d85f01 [ 61.732671][T11670] head: 017ff00000000001 ffffea00048b5d01 dead000000000122 00000000ffffffff [ 61.735029][T11670] head: 0000000200000000 0000000000000000 00000000ffffffff 0000000000000000 [ 61.737400][T11670] page dumped because: kasan: bad access detected [ 61.740100][T11670] page_owner tracks the page as allocated [ 61.743121][T11670] page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 8343, tgid -2092279795 (syzbot-repro), ts 8343, free_ts 43505720198 [ 61.754038][T11670] post_alloc_hook+0x1e6/0x210 [ 61.756046][T11670] get_page_from_freelist+0x7d2/0x850 [ 61.759460][T11670] __alloc_pages+0x25e/0x580 [ 61.761428][T11670] alloc_slab_page+0x6b/0x1a0 [ 61.764199][T11670] allocate_slab+0x5d/0x200 [ 61.766122][T11670] ___slab_alloc+0xac5/0xf20 [ 61.767195][T11670] __kmalloc+0x2e0/0x4b0 [ 61.769028][T11670] fib_default_rule_add+0x4a/0x350 [ 61.770394][T11670] fib6_rules_net_init+0x42/0x100 [ 61.771731][T11670] ops_init+0x39d/0x670 [ 61.773061][T11670] setup_net+0x3bc/0xae0 [ 61.774102][T11670] copy_net_ns+0x399/0x5e0 [ 61.775628][T11670] create_new_namespaces+0x4de/0x8d0 [ 61.776950][T11670] unshare_nsproxy_namespaces+0x127/0x190 [ 61.778352][T11670] ksys_unshare+0x5e6/0xbf0 [ 61.779741][T11670] __x64_sys_unshare+0x38/0x40 [ 61.781302][T11670] page last free pid 4619 tgid 4619 stack trace: [ 61.783542][T11670] free_unref_page_prepare+0x72f/0x7c0 [ 61.785018][T11670] free_unref_page+0x37/0x3f0 [ 61.786030][T11670] __slab_free+0x351/0x3f0 [ 61.786991][T11670] qlist_free_all+0x60/0xd0 [ 61.788827][T11670] kasan_quarantine_reduce+0x15a/0x170 [ 61.789951][T11670] __kasan_slab_alloc+0x23/0x70 [ 61.790999][T11670] kmem_cache_alloc_node+0x193/0x390 [ 61.792331][T11670] kmalloc_reserve+0xa7/0x2a0 [ 61.793345][T11670] __alloc_skb+0x1ec/0x430 [ 61.794435][T11670] netlink_sendmsg+0x615/0xc80 [ 61.796439][T11670] __sock_sendmsg+0x21f/0x270 [ 61.797467][T11670] ____sys_sendmsg+0x540/0x860 [ 61.798505][T11670] __sys_sendmsg+0x2b7/0x3a0 [ 61.799512][T11670] do_syscall_64+0xec/0x210 [ 61.800674][T11670] entry_SYSCALL_64_after_hwframe+0x67/0x6f [ 61.802021][T11670] [ 61.802526][T11670] Memory state around the buggy address: [ 61.803701][T11670] ffff888122d75100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 61.805694][T11670] ffff888122d75180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 61.808104][T11670] >ffff888122d75200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 61.809769][T11670] ^ [ 61.810672][T11670] ffff888122d75280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 61.812532][T11670] ffff888122d75300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 61.814846][T11670] ================================================================== [ 61.816914][T11670] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 61.818415][T11670] CPU: 1 PID: 11670 Comm: syzbot-repro Not tainted 6.9.0-rc6-00053-g0106679839f7 #27 [ 61.821191][T11670] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.1 11/11/2019 [ 61.822911][T11670] Call Trace: [ 61.823632][T11670] <TASK> [ 61.824525][T11670] dump_stack_lvl+0x241/0x360 [ 61.825545][T11670] ? tcp_gro_dev_warn+0x260/0x260 [ 61.826706][T11670] ? panic+0x850/0x850 [ 61.828594][T11670] ? lock_release+0x85/0x860 [ 61.829749][T11670] ? vscnprintf+0x5d/0x80 [ 61.830951][T11670] panic+0x335/0x850 [ 61.832316][T11670] ? check_panic_on_warn+0x21/0xa0 [ 61.834475][T11670] ? __memcpy_flushcache+0x2c0/0x2c0 [ 61.835809][T11670] ? _raw_spin_unlock_irqrestore+0xd8/0x140 [ 61.838063][T11670] ? _raw_spin_unlock_irqrestore+0xdd/0x140 [ 61.842056][T11670] ? _raw_spin_unlock+0x40/0x40 [ 61.843116][T11670] ? print_report+0x1cc/0x210 [ 61.844527][T11670] check_panic_on_warn+0x82/0xa0 [ 61.845336][T11670] ? cpu_map_enqueue+0xba/0x370 [ 61.846117][T11670] end_report+0x48/0xa0 [ 61.846790][T11670] kasan_report+0x154/0x180 [ 61.847520][T11670] ? cpu_map_enqueue+0xba/0x370 [ 61.848471][T11670] cpu_map_enqueue+0xba/0x370 [ 61.849968][T11670] xdp_do_redirect+0x685/0xbf0 [ 61.850994][T11670] tun_xdp_act+0xe7/0x9e0 [ 61.851703][T11670] ? __tun_build_skb+0x2e0/0x2e0 [ 61.852598][T11670] tun_build_skb+0xac6/0x1140 [ 61.853362][T11670] ? tun_build_skb+0xb4/0x1140 [ 61.854454][T11670] ? tun_get_user+0x2760/0x2760 [ 61.855806][T11670] tun_get_user+0x7fa/0x2760 [ 61.856734][T11670] ? rcu_read_unlock+0xa0/0xa0 [ 61.857502][T11670] ? tun_get+0x1e/0x2f0 [ 61.858171][T11670] ? tun_get+0x1e/0x2f0 [ 61.858952][T11670] ? tun_get+0x27d/0x2f0 [ 61.859637][T11670] tun_chr_write_iter+0x111/0x1f0 [ 61.860913][T11670] vfs_write+0xa84/0xcb0 [ 61.861578][T11670] ? __lock_acquire+0x1f60/0x1f60 [ 61.862376][T11670] ? kernel_write+0x330/0x330 [ 61.863221][T11670] ? lockdep_hardirqs_on_prepare+0x43c/0x780 [ 61.864230][T11670] ? __fget_files+0x3ea/0x460 [ 61.864955][T11670] ? seqcount_lockdep_reader_access+0x157/0x220 [ 61.866571][T11670] ? __fdget_pos+0x19e/0x320 [ 61.867414][T11670] ksys_write+0x19f/0x2c0 [ 61.868263][T11670] ? __ia32_sys_read+0x90/0x90 [ 61.868996][T11670] ? ktime_get_coarse_real_ts64+0x10b/0x120 [ 61.869896][T11670] do_syscall_64+0xec/0x210 [ 61.870592][T11670] entry_SYSCALL_64_after_hwframe+0x67/0x6f [ 61.871595][T11670] RIP: 0033:0x472a4f [ 61.873158][T11670] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 c9 d8 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 0c d9 02 00 48 [ 61.876447][T11670] RSP: 002b:00007f7a7a90f5c0 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 61.877944][T11670] RAX: ffffffffffffffda RBX: 00007f7a7a911640 RCX: 0000000000472a4f [ 61.879751][T11670] RDX: 0000000000000066 RSI: 0000000020000440 RDI: 00000000000000c8 [ 61.881100][T11670] RBP: 00007f7a7a90f620 R08: 0000000000000000 R09: 0000000100000000 [ 61.882298][T11670] R10: 0000000100000000 R11: 0000000000000293 R12: 00007f7a7a911640 [ 61.883501][T11670] R13: 000000000000006e R14: 000000000042f2f0 R15: 00007f7a7a8f1000 [ 61.885999][T11670] </TASK> Signed-off-by: Radoslaw Zielonek <[email protected]>
kernel-patches-daemon-bpf-rc bot
pushed a commit
that referenced
this pull request
Jul 31, 2024
When cpu_map has been redirected, first the pointer to the bpf_cpu_map_entry has been copied, then freed, and read from the copy. To fix it, this commit introduced the refcount cpu_map_parent during redirections to prevent use after free. syzbot reported: [ 61.581464][T11670] ================================================================== [ 61.583323][T11670] BUG: KASAN: slab-use-after-free in cpu_map_enqueue+0xba/0x370 [ 61.585419][T11670] Read of size 8 at addr ffff888122d75208 by task syzbot-repro/11670 [ 61.587541][T11670] [ 61.588237][T11670] CPU: 1 PID: 11670 Comm: syzbot-repro Not tainted 6.9.0-rc6-00053-g0106679839f7 #27 [ 61.590542][T11670] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.1 11/11/2019 [ 61.592798][T11670] Call Trace: [ 61.593885][T11670] <TASK> [ 61.594805][T11670] dump_stack_lvl+0x241/0x360 [ 61.595974][T11670] ? tcp_gro_dev_warn+0x260/0x260 [ 61.598242][T11670] ? __wake_up_klogd+0xcc/0x100 [ 61.599407][T11670] ? panic+0x850/0x850 [ 61.600516][T11670] ? __virt_addr_valid+0x182/0x510 [ 61.602073][T11670] ? __virt_addr_valid+0x182/0x510 [ 61.603496][T11670] print_address_description+0x7b/0x360 [ 61.605170][T11670] print_report+0xfd/0x210 [ 61.606370][T11670] ? __virt_addr_valid+0x182/0x510 [ 61.607925][T11670] ? __virt_addr_valid+0x182/0x510 [ 61.609577][T11670] ? __virt_addr_valid+0x43d/0x510 [ 61.610948][T11670] ? __phys_addr+0xb9/0x170 [ 61.612103][T11670] ? cpu_map_enqueue+0xba/0x370 [ 61.613448][T11670] kasan_report+0x143/0x180 [ 61.615000][T11670] ? cpu_map_enqueue+0xba/0x370 [ 61.616181][T11670] cpu_map_enqueue+0xba/0x370 [ 61.617620][T11670] xdp_do_redirect+0x685/0xbf0 [ 61.618787][T11670] tun_xdp_act+0xe7/0x9e0 [ 61.619856][T11670] ? __tun_build_skb+0x2e0/0x2e0 [ 61.621356][T11670] tun_build_skb+0xac6/0x1140 [ 61.622602][T11670] ? tun_build_skb+0xb4/0x1140 [ 61.623880][T11670] ? tun_get_user+0x2760/0x2760 [ 61.625341][T11670] tun_get_user+0x7fa/0x2760 [ 61.626532][T11670] ? rcu_read_unlock+0xa0/0xa0 [ 61.627725][T11670] ? tun_get+0x1e/0x2f0 [ 61.629147][T11670] ? tun_get+0x1e/0x2f0 [ 61.630265][T11670] ? tun_get+0x27d/0x2f0 [ 61.631486][T11670] tun_chr_write_iter+0x111/0x1f0 [ 61.632855][T11670] vfs_write+0xa84/0xcb0 [ 61.634185][T11670] ? __lock_acquire+0x1f60/0x1f60 [ 61.635501][T11670] ? kernel_write+0x330/0x330 [ 61.636757][T11670] ? lockdep_hardirqs_on_prepare+0x43c/0x780 [ 61.638445][T11670] ? __fget_files+0x3ea/0x460 [ 61.639448][T11670] ? seqcount_lockdep_reader_access+0x157/0x220 [ 61.641217][T11670] ? __fdget_pos+0x19e/0x320 [ 61.642426][T11670] ksys_write+0x19f/0x2c0 [ 61.643576][T11670] ? __ia32_sys_read+0x90/0x90 [ 61.644841][T11670] ? ktime_get_coarse_real_ts64+0x10b/0x120 [ 61.646549][T11670] do_syscall_64+0xec/0x210 [ 61.647832][T11670] entry_SYSCALL_64_after_hwframe+0x67/0x6f [ 61.649485][T11670] RIP: 0033:0x472a4f [ 61.650539][T11670] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 c9 d8 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 0c d9 02 00 48 [ 61.655476][T11670] RSP: 002b:00007f7a7a90f5c0 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 61.657675][T11670] RAX: ffffffffffffffda RBX: 00007f7a7a911640 RCX: 0000000000472a4f [ 61.659658][T11670] RDX: 0000000000000066 RSI: 0000000020000440 RDI: 00000000000000c8 [ 61.661980][T11670] RBP: 00007f7a7a90f620 R08: 0000000000000000 R09: 0000000100000000 [ 61.663982][T11670] R10: 0000000100000000 R11: 0000000000000293 R12: 00007f7a7a911640 [ 61.666425][T11670] R13: 000000000000006e R14: 000000000042f2f0 R15: 00007f7a7a8f1000 [ 61.668443][T11670] </TASK> [ 61.669233][T11670] [ 61.669754][T11670] Allocated by task 11643: [ 61.670855][T11670] kasan_save_track+0x3f/0x70 [ 61.672094][T11670] __kasan_kmalloc+0x98/0xb0 [ 61.673466][T11670] __kmalloc_node+0x259/0x4f0 [ 61.674687][T11670] bpf_map_kmalloc_node+0xd3/0x1c0 [ 61.676069][T11670] cpu_map_update_elem+0x2f0/0x1000 [ 61.677619][T11670] bpf_map_update_value+0x1b2/0x540 [ 61.679006][T11670] map_update_elem+0x52f/0x6e0 [ 61.680076][T11670] __sys_bpf+0x7a9/0x850 [ 61.681610][T11670] __x64_sys_bpf+0x7c/0x90 [ 61.682772][T11670] do_syscall_64+0xec/0x210 [ 61.683967][T11670] entry_SYSCALL_64_after_hwframe+0x67/0x6f [ 61.685648][T11670] [ 61.686282][T11670] Freed by task 1064: [ 61.687296][T11670] kasan_save_track+0x3f/0x70 [ 61.688498][T11670] kasan_save_free_info+0x40/0x50 [ 61.689786][T11670] poison_slab_object+0xa6/0xe0 [ 61.691059][T11670] __kasan_slab_free+0x37/0x60 [ 61.692336][T11670] kfree+0x136/0x2f0 [ 61.693549][T11670] __cpu_map_entry_free+0x6f3/0x770 [ 61.695004][T11670] cpu_map_free+0xc0/0x180 [ 61.696191][T11670] bpf_map_free_deferred+0xe3/0x100 [ 61.697703][T11670] process_scheduled_works+0x9cb/0x14a0 [ 61.699330][T11670] worker_thread+0x85c/0xd50 [ 61.700546][T11670] kthread+0x2ef/0x390 [ 61.701791][T11670] ret_from_fork+0x4d/0x80 [ 61.702942][T11670] ret_from_fork_asm+0x11/0x20 [ 61.704195][T11670] [ 61.704825][T11670] The buggy address belongs to the object at ffff888122d75200 [ 61.704825][T11670] which belongs to the cache kmalloc-cg-256 of size 256 [ 61.708516][T11670] The buggy address is located 8 bytes inside of [ 61.708516][T11670] freed 256-byte region [ffff888122d75200, ffff888122d75300) [ 61.712215][T11670] [ 61.712824][T11670] The buggy address belongs to the physical page: [ 61.714883][T11670] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x122d74 [ 61.717300][T11670] head: order:1 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 61.719037][T11670] memcg:ffff888120d85f01 [ 61.720006][T11670] flags: 0x17ff00000000840(slab|head|node=0|zone=2|lastcpupid=0x7ff) [ 61.722181][T11670] page_type: 0xffffffff() [ 61.723318][T11670] raw: 017ff00000000840 ffff88810004dcc0 dead000000000122 0000000000000000 [ 61.725650][T11670] raw: 0000000000000000 0000000080100010 00000001ffffffff ffff888120d85f01 [ 61.727943][T11670] head: 017ff00000000840 ffff88810004dcc0 dead000000000122 0000000000000000 [ 61.730237][T11670] head: 0000000000000000 0000000080100010 00000001ffffffff ffff888120d85f01 [ 61.732671][T11670] head: 017ff00000000001 ffffea00048b5d01 dead000000000122 00000000ffffffff [ 61.735029][T11670] head: 0000000200000000 0000000000000000 00000000ffffffff 0000000000000000 [ 61.737400][T11670] page dumped because: kasan: bad access detected [ 61.740100][T11670] page_owner tracks the page as allocated [ 61.743121][T11670] page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 8343, tgid -2092279795 (syzbot-repro), ts 8343, free_ts 43505720198 [ 61.754038][T11670] post_alloc_hook+0x1e6/0x210 [ 61.756046][T11670] get_page_from_freelist+0x7d2/0x850 [ 61.759460][T11670] __alloc_pages+0x25e/0x580 [ 61.761428][T11670] alloc_slab_page+0x6b/0x1a0 [ 61.764199][T11670] allocate_slab+0x5d/0x200 [ 61.766122][T11670] ___slab_alloc+0xac5/0xf20 [ 61.767195][T11670] __kmalloc+0x2e0/0x4b0 [ 61.769028][T11670] fib_default_rule_add+0x4a/0x350 [ 61.770394][T11670] fib6_rules_net_init+0x42/0x100 [ 61.771731][T11670] ops_init+0x39d/0x670 [ 61.773061][T11670] setup_net+0x3bc/0xae0 [ 61.774102][T11670] copy_net_ns+0x399/0x5e0 [ 61.775628][T11670] create_new_namespaces+0x4de/0x8d0 [ 61.776950][T11670] unshare_nsproxy_namespaces+0x127/0x190 [ 61.778352][T11670] ksys_unshare+0x5e6/0xbf0 [ 61.779741][T11670] __x64_sys_unshare+0x38/0x40 [ 61.781302][T11670] page last free pid 4619 tgid 4619 stack trace: [ 61.783542][T11670] free_unref_page_prepare+0x72f/0x7c0 [ 61.785018][T11670] free_unref_page+0x37/0x3f0 [ 61.786030][T11670] __slab_free+0x351/0x3f0 [ 61.786991][T11670] qlist_free_all+0x60/0xd0 [ 61.788827][T11670] kasan_quarantine_reduce+0x15a/0x170 [ 61.789951][T11670] __kasan_slab_alloc+0x23/0x70 [ 61.790999][T11670] kmem_cache_alloc_node+0x193/0x390 [ 61.792331][T11670] kmalloc_reserve+0xa7/0x2a0 [ 61.793345][T11670] __alloc_skb+0x1ec/0x430 [ 61.794435][T11670] netlink_sendmsg+0x615/0xc80 [ 61.796439][T11670] __sock_sendmsg+0x21f/0x270 [ 61.797467][T11670] ____sys_sendmsg+0x540/0x860 [ 61.798505][T11670] __sys_sendmsg+0x2b7/0x3a0 [ 61.799512][T11670] do_syscall_64+0xec/0x210 [ 61.800674][T11670] entry_SYSCALL_64_after_hwframe+0x67/0x6f [ 61.802021][T11670] [ 61.802526][T11670] Memory state around the buggy address: [ 61.803701][T11670] ffff888122d75100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 61.805694][T11670] ffff888122d75180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 61.808104][T11670] >ffff888122d75200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 61.809769][T11670] ^ [ 61.810672][T11670] ffff888122d75280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 61.812532][T11670] ffff888122d75300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 61.814846][T11670] ================================================================== [ 61.816914][T11670] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 61.818415][T11670] CPU: 1 PID: 11670 Comm: syzbot-repro Not tainted 6.9.0-rc6-00053-g0106679839f7 #27 [ 61.821191][T11670] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.1 11/11/2019 [ 61.822911][T11670] Call Trace: [ 61.823632][T11670] <TASK> [ 61.824525][T11670] dump_stack_lvl+0x241/0x360 [ 61.825545][T11670] ? tcp_gro_dev_warn+0x260/0x260 [ 61.826706][T11670] ? panic+0x850/0x850 [ 61.828594][T11670] ? lock_release+0x85/0x860 [ 61.829749][T11670] ? vscnprintf+0x5d/0x80 [ 61.830951][T11670] panic+0x335/0x850 [ 61.832316][T11670] ? check_panic_on_warn+0x21/0xa0 [ 61.834475][T11670] ? __memcpy_flushcache+0x2c0/0x2c0 [ 61.835809][T11670] ? _raw_spin_unlock_irqrestore+0xd8/0x140 [ 61.838063][T11670] ? _raw_spin_unlock_irqrestore+0xdd/0x140 [ 61.842056][T11670] ? _raw_spin_unlock+0x40/0x40 [ 61.843116][T11670] ? print_report+0x1cc/0x210 [ 61.844527][T11670] check_panic_on_warn+0x82/0xa0 [ 61.845336][T11670] ? cpu_map_enqueue+0xba/0x370 [ 61.846117][T11670] end_report+0x48/0xa0 [ 61.846790][T11670] kasan_report+0x154/0x180 [ 61.847520][T11670] ? cpu_map_enqueue+0xba/0x370 [ 61.848471][T11670] cpu_map_enqueue+0xba/0x370 [ 61.849968][T11670] xdp_do_redirect+0x685/0xbf0 [ 61.850994][T11670] tun_xdp_act+0xe7/0x9e0 [ 61.851703][T11670] ? __tun_build_skb+0x2e0/0x2e0 [ 61.852598][T11670] tun_build_skb+0xac6/0x1140 [ 61.853362][T11670] ? tun_build_skb+0xb4/0x1140 [ 61.854454][T11670] ? tun_get_user+0x2760/0x2760 [ 61.855806][T11670] tun_get_user+0x7fa/0x2760 [ 61.856734][T11670] ? rcu_read_unlock+0xa0/0xa0 [ 61.857502][T11670] ? tun_get+0x1e/0x2f0 [ 61.858171][T11670] ? tun_get+0x1e/0x2f0 [ 61.858952][T11670] ? tun_get+0x27d/0x2f0 [ 61.859637][T11670] tun_chr_write_iter+0x111/0x1f0 [ 61.860913][T11670] vfs_write+0xa84/0xcb0 [ 61.861578][T11670] ? __lock_acquire+0x1f60/0x1f60 [ 61.862376][T11670] ? kernel_write+0x330/0x330 [ 61.863221][T11670] ? lockdep_hardirqs_on_prepare+0x43c/0x780 [ 61.864230][T11670] ? __fget_files+0x3ea/0x460 [ 61.864955][T11670] ? seqcount_lockdep_reader_access+0x157/0x220 [ 61.866571][T11670] ? __fdget_pos+0x19e/0x320 [ 61.867414][T11670] ksys_write+0x19f/0x2c0 [ 61.868263][T11670] ? __ia32_sys_read+0x90/0x90 [ 61.868996][T11670] ? ktime_get_coarse_real_ts64+0x10b/0x120 [ 61.869896][T11670] do_syscall_64+0xec/0x210 [ 61.870592][T11670] entry_SYSCALL_64_after_hwframe+0x67/0x6f [ 61.871595][T11670] RIP: 0033:0x472a4f [ 61.873158][T11670] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 c9 d8 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 0c d9 02 00 48 [ 61.876447][T11670] RSP: 002b:00007f7a7a90f5c0 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 61.877944][T11670] RAX: ffffffffffffffda RBX: 00007f7a7a911640 RCX: 0000000000472a4f [ 61.879751][T11670] RDX: 0000000000000066 RSI: 0000000020000440 RDI: 00000000000000c8 [ 61.881100][T11670] RBP: 00007f7a7a90f620 R08: 0000000000000000 R09: 0000000100000000 [ 61.882298][T11670] R10: 0000000100000000 R11: 0000000000000293 R12: 00007f7a7a911640 [ 61.883501][T11670] R13: 000000000000006e R14: 000000000042f2f0 R15: 00007f7a7a8f1000 [ 61.885999][T11670] </TASK> Signed-off-by: Radoslaw Zielonek <[email protected]>
kernel-patches-daemon-bpf-rc bot
pushed a commit
that referenced
this pull request
Oct 15, 2024
Wesley reported an issue: ================================================================== EXT4-fs (dm-5): resizing filesystem from 7168 to 786432 blocks ------------[ cut here ]------------ kernel BUG at fs/ext4/resize.c:324! CPU: 9 UID: 0 PID: 3576 Comm: resize2fs Not tainted 6.11.0+ #27 RIP: 0010:ext4_resize_fs+0x1212/0x12d0 Call Trace: __ext4_ioctl+0x4e0/0x1800 ext4_ioctl+0x12/0x20 __x64_sys_ioctl+0x99/0xd0 x64_sys_call+0x1206/0x20d0 do_syscall_64+0x72/0x110 entry_SYSCALL_64_after_hwframe+0x76/0x7e ================================================================== While reviewing the patch, Honza found that when adjusting resize_bg in alloc_flex_gd(), it was possible for flex_gd->resize_bg to be bigger than flexbg_size. The reproduction of the problem requires the following: o_group = flexbg_size * 2 * n; o_size = (o_group + 1) * group_size; n_group: [o_group + flexbg_size, o_group + flexbg_size * 2) o_size = (n_group + 1) * group_size; Take n=0,flexbg_size=16 as an example: last:15 |o---------------|--------------n-| o_group:0 resize to n_group:30 The corresponding reproducer is: img=test.img rm -f $img truncate -s 600M $img mkfs.ext4 -F $img -b 1024 -G 16 8M dev=`losetup -f --show $img` mkdir -p /tmp/test mount $dev /tmp/test resize2fs $dev 248M Delete the problematic plus 1 to fix the issue, and add a WARN_ON_ONCE() to prevent the issue from happening again. [ Note: another reproucer which this commit fixes is: img=test.img rm -f $img truncate -s 25MiB $img mkfs.ext4 -b 4096 -E nodiscard,lazy_itable_init=0,lazy_journal_init=0 $img truncate -s 3GiB $img dev=`losetup -f --show $img` mkdir -p /tmp/test mount $dev /tmp/test resize2fs $dev 3G umount $dev losetup -d $dev -- TYT ] Reported-by: Wesley Hershberger <[email protected]> Closes: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2081231 Reported-by: Stéphane Graber <[email protected]> Closes: https://lore.kernel.org/all/[email protected]/ Tested-by: Alexander Mikhalitsyn <[email protected]> Tested-by: Eric Sandeen <[email protected]> Fixes: 665d3e0 ("ext4: reduce unnecessary memory allocation in alloc_flex_gd()") Cc: [email protected] Signed-off-by: Baokun Li <[email protected]> Reviewed-by: Jan Kara <[email protected]> Link: https://patch.msgid.link/[email protected] Signed-off-by: Theodore Ts'o <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Pull request for series with
subject: bpftool: Allow building statically
version: 1
url: https://patchwork.kernel.org/project/netdevbpf/list/?series=615375