From: Ido Schimmel <idosch@idosch.org>
To: Dmitry Vyukov <dvyukov@google.com>
Cc: syzbot <syzbot+9ed8f68ab30761f3678e@syzkaller.appspotmail.com>,
Jiri Pirko <jiri@mellanox.com>,
Alexei Starovoitov <ast@kernel.org>, bpf <bpf@vger.kernel.org>,
Daniel Borkmann <daniel@iogearbox.net>,
David Miller <davem@davemloft.net>,
Jakub Kicinski <jakub.kicinski@netronome.com>,
Martin KaFai Lau <kafai@fb.com>,
LKML <linux-kernel@vger.kernel.org>,
netdev <netdev@vger.kernel.org>, Song Liu <songliubraving@fb.com>,
syzkaller-bugs <syzkaller-bugs@googlegroups.com>,
Yonghong Song <yhs@fb.com>
Subject: Re: general protection fault in process_one_work
Date: Tue, 29 Oct 2019 18:54:04 +0200 [thread overview]
Message-ID: <20191029165404.GA10996@splinter> (raw)
In-Reply-To: <20191029084517.GA24289@splinter>
On Tue, Oct 29, 2019 at 10:45:19AM +0200, Ido Schimmel wrote:
> On Tue, Oct 29, 2019 at 09:43:27AM +0100, Dmitry Vyukov wrote:
> > On Tue, Oct 29, 2019 at 9:38 AM syzbot
> > <syzbot+9ed8f68ab30761f3678e@syzkaller.appspotmail.com> wrote:
> > >
> > > Hello,
> > >
> > > syzbot found the following crash on:
> > >
> > > HEAD commit: 38207291 bpf: Prepare btf_ctx_access for non raw_tp use case
> > > git tree: bpf-next
> > > console output: https://syzkaller.appspot.com/x/log.txt?x=14173c0f600000
> > > kernel config: https://syzkaller.appspot.com/x/.config?x=41648156aa09be10
> > > dashboard link: https://syzkaller.appspot.com/bug?extid=9ed8f68ab30761f3678e
> > > compiler: gcc (GCC) 9.0.0 20181231 (experimental)
> > >
> > > Unfortunately, I don't have any reproducer for this crash yet.
> > >
> > > IMPORTANT: if you fix the bug, please add the following tag to the commit:
> > > Reported-by: syzbot+9ed8f68ab30761f3678e@syzkaller.appspotmail.com
> >
> > +Jiří Pírko, this seems to be related to netdevsim.
>
> Will check it.
Didn't have a lot of time today, but I think the issue is a race
condition (note that syzbot only triggered it twice so far).
Upon reload nsim_dev_port_del_all() is called and starts deleting ports
from the ports list without holding the ports list mutex. It is possible
that during this time nsim_dev_trap_report_work() is executing from a
workqueue and accessing freed memory despite holding the ports list
mutex.
I'll try to reproduce and send a fix later this week.
>
> >
> > > kasan: CONFIG_KASAN_INLINE enabled
> > > kasan: GPF could be caused by NULL-ptr deref or user memory access
> > > general protection fault: 0000 [#1] PREEMPT SMP KASAN
> > > CPU: 1 PID: 9149 Comm: kworker/1:3 Not tainted 5.4.0-rc1+ #0
> > > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
> > > Google 01/01/2011
> > > Workqueue: events nsim_dev_trap_report_work
> > > RIP: 0010:nsim_dev_trap_report_work+0xc4/0xaf0
> > > drivers/net/netdevsim/dev.c:409
> > > Code: 89 45 d0 0f 84 8b 07 00 00 49 bc 00 00 00 00 00 fc ff df e8 3e ae ef
> > > fc 48 8b 45 d0 48 05 68 01 00 00 48 89 45 90 48 c1 e8 03 <42> 80 3c 20 00
> > > 0f 85 b1 09 00 00 48 8b 45 d0 48 8b 98 68 01 00 00
> > > RSP: 0018:ffff88806c98fc90 EFLAGS: 00010a06
> > > RAX: 1bd5a0000000004d RBX: 0000000000000000 RCX: ffffffff84836e22
> > > RDX: 0000000000000000 RSI: ffffffff84836db2 RDI: 0000000000000001
> > > RBP: ffff88806c98fd30 R08: ffff88806c9863c0 R09: ffffed100d75f3d9
> > > R10: ffffed100d75f3d8 R11: ffff88806baf9ec7 R12: dffffc0000000000
> > > R13: ffff88806baf9ec0 R14: ffff8880a9a13900 R15: ffff8880ae934500
> > > FS: 0000000000000000(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
> > > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> > > CR2: 00007efdd0c9e000 CR3: 000000009cc1b000 CR4: 00000000001406e0
> > > DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> > > DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> > > Call Trace:
> > > process_one_work+0x9af/0x1740 kernel/workqueue.c:2269
> > > worker_thread+0x98/0xe40 kernel/workqueue.c:2415
> > > kthread+0x361/0x430 kernel/kthread.c:255
> > > ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
> > > Modules linked in:
> > > ---[ end trace ba29cd1c27f63d86 ]---
> > > RIP: 0010:nsim_dev_trap_report_work+0xc4/0xaf0
> > > drivers/net/netdevsim/dev.c:409
> > > Code: 89 45 d0 0f 84 8b 07 00 00 49 bc 00 00 00 00 00 fc ff df e8 3e ae ef
> > > fc 48 8b 45 d0 48 05 68 01 00 00 48 89 45 90 48 c1 e8 03 <42> 80 3c 20 00
> > > 0f 85 b1 09 00 00 48 8b 45 d0 48 8b 98 68 01 00 00
> > > RSP: 0018:ffff88806c98fc90 EFLAGS: 00010a06
> > > RAX: 1bd5a0000000004d RBX: 0000000000000000 RCX: ffffffff84836e22
> > > RDX: 0000000000000000 RSI: ffffffff84836db2 RDI: 0000000000000001
> > > RBP: ffff88806c98fd30 R08: ffff88806c9863c0 R09: ffffed100d75f3d9
> > > R10: ffffed100d75f3d8 R11: ffff88806baf9ec7 R12: dffffc0000000000
> > > R13: ffff88806baf9ec0 R14: ffff8880a9a13900 R15: ffff8880ae934500
> > > FS: 0000000000000000(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
> > > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> > > CR2: 00007efdd0c9e000 CR3: 000000009cc1b000 CR4: 00000000001406e0
> > > DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> > > DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> > >
> > >
> > > ---
> > > This bug is generated by a bot. It may contain errors.
> > > See https://goo.gl/tpsmEJ for more information about syzbot.
> > > syzbot engineers can be reached at syzkaller@googlegroups.com.
> > >
> > > syzbot will keep track of this bug report. See:
> > > https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
> > >
> > > --
> > > You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group.
> > > To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bugs+unsubscribe@googlegroups.com.
> > > To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/0000000000001c46d5059608892f%40google.com.
next prev parent reply other threads:[~2019-10-29 16:54 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-10-29 8:38 general protection fault in process_one_work syzbot
2019-10-29 8:43 ` Dmitry Vyukov
2019-10-29 8:45 ` Ido Schimmel
2019-10-29 16:54 ` Ido Schimmel [this message]
2019-10-31 16:25 ` Ido Schimmel
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20191029165404.GA10996@splinter \
--to=idosch@idosch.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=davem@davemloft.net \
--cc=dvyukov@google.com \
--cc=jakub.kicinski@netronome.com \
--cc=jiri@mellanox.com \
--cc=kafai@fb.com \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=songliubraving@fb.com \
--cc=syzbot+9ed8f68ab30761f3678e@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
--cc=yhs@fb.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.