From: Jakub Kicinski <kubakici@wp.pl>
To: John Fastabend <john.fastabend@gmail.com>
Cc: Cong Wang <xiyou.wangcong@gmail.com>,
Jiri Pirko <jiri@resnulli.us>,
"netdev@vger.kernel.org" <netdev@vger.kernel.org>
Subject: Re: RCU callback crashes
Date: Wed, 20 Dec 2017 16:50:55 -0800 [thread overview]
Message-ID: <20171220164419.42c63ebf@cakuba.netronome.com> (raw)
In-Reply-To: <20171220164058.2a862e27@cakuba.netronome.com>
On Wed, 20 Dec 2017 16:41:14 -0800, Jakub Kicinski wrote:
> Just as I hit send... :) but this looks unrelated, "Comm: sshd" -
> so probably from the management interface.
>
> [ 154.604041] ==================================================================
> [ 154.612245] BUG: KASAN: slab-out-of-bounds in pfifo_fast_dequeue+0x140/0x2d0
> [ 154.620219] Read of size 8 at addr ffff88086bb64040 by task sshd/983
> [ 154.627403]
> [ 154.629161] CPU: 10 PID: 983 Comm: sshd Not tainted 4.15.0-rc3-perf-00984-g82d3fc87a4aa-dirty #13
> [ 154.639190] Hardware name: Dell Inc. PowerEdge R730/072T6D, BIOS 2.3.4 11/08/2016
> [ 154.647665] Call Trace:
> [ 154.650494] dump_stack+0xa6/0x118
> [ 154.654387] ? _atomic_dec_and_lock+0xe8/0xe8
> [ 154.659355] ? trace_event_raw_event_rcu_torture_read+0x190/0x190
> [ 154.666263] ? rcu_segcblist_enqueue+0xe9/0x120
> [ 154.671422] ? _raw_spin_unlock_bh+0x91/0xc0
> [ 154.676286] ? pfifo_fast_dequeue+0x140/0x2d0
> [ 154.681251] print_address_description+0x6a/0x270
> [ 154.686601] ? pfifo_fast_dequeue+0x140/0x2d0
> [ 154.691565] kasan_report+0x23f/0x350
> [ 154.695752] pfifo_fast_dequeue+0x140/0x2d0
If we trust stack decode it's:
615 static struct sk_buff *pfifo_fast_dequeue(struct Qdisc *qdisc)
616 {
617 struct pfifo_fast_priv *priv = qdisc_priv(qdisc);
618 struct sk_buff *skb = NULL;
619 int band;
620
621 for (band = 0; band < PFIFO_FAST_BANDS && !skb; band++) {
622 struct skb_array *q = band2list(priv, band);
623
>> 624 if (__skb_array_empty(q))
625 continue;
626
627 skb = skb_array_consume_bh(q);
628 }
629 if (likely(skb)) {
630 qdisc_qstats_cpu_backlog_dec(qdisc, skb);
631 qdisc_bstats_cpu_update(qdisc, skb);
632 qdisc_qstats_cpu_qlen_dec(qdisc);
633 }
634
635 return skb;
636 }
next prev parent reply other threads:[~2017-12-21 0:51 UTC|newest]
Thread overview: 28+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-12-20 1:59 RCU callback crashes Jakub Kicinski
2017-12-20 6:11 ` Jiri Pirko
2017-12-20 6:22 ` Jakub Kicinski
2017-12-20 6:34 ` Jakub Kicinski
2017-12-20 18:04 ` John Fastabend
2017-12-20 20:17 ` Jakub Kicinski
2017-12-20 20:23 ` John Fastabend
2017-12-20 22:38 ` Cong Wang
2017-12-20 18:17 ` Cong Wang
2017-12-20 18:31 ` Cong Wang
2017-12-21 0:03 ` Cong Wang
2017-12-21 0:08 ` Jakub Kicinski
2017-12-21 0:37 ` Jakub Kicinski
2017-12-21 0:41 ` Jakub Kicinski
2017-12-21 0:50 ` Jakub Kicinski [this message]
2017-12-21 7:27 ` Cong Wang
2017-12-21 16:26 ` John Fastabend
2017-12-21 16:56 ` Jakub Kicinski
2017-12-21 20:17 ` Cong Wang
2017-12-21 21:31 ` Cong Wang
2017-12-21 21:45 ` Jakub Kicinski
2017-12-21 7:24 ` Cong Wang
2017-12-20 19:59 ` Jiri Pirko
2017-12-20 20:14 ` John Fastabend
2017-12-20 20:18 ` Jiri Pirko
2017-12-20 22:25 ` Cong Wang
2017-12-20 20:15 ` Jiri Pirko
2017-12-20 20:18 ` John Fastabend
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20171220164419.42c63ebf@cakuba.netronome.com \
--to=kubakici@wp.pl \
--cc=jiri@resnulli.us \
--cc=john.fastabend@gmail.com \
--cc=netdev@vger.kernel.org \
--cc=xiyou.wangcong@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.