From: "Toke Høiland-Jørgensen" <toke@redhat.com>
To: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Cc: syzbot <syzbot+c226757eb784a9da3e8b@syzkaller.appspotmail.com>,
andrii@kernel.org, ast@kernel.org, bpf@vger.kernel.org,
daniel@iogearbox.net, davem@davemloft.net, eddyz87@gmail.com,
edumazet@google.com, haoluo@google.com, john.fastabend@gmail.com,
jolsa@kernel.org, kpsingh@kernel.org, kuba@kernel.org,
linux-kernel@vger.kernel.org, martin.lau@linux.dev,
netdev@vger.kernel.org, pabeni@redhat.com, sdf@fomichev.me,
song@kernel.org, syzkaller-bugs@googlegroups.com,
yonghong.song@linux.dev
Subject: Re: [syzbot] [bpf?] [net?] general protection fault in __cpu_map_flush
Date: Wed, 24 Jul 2024 16:43:59 +0200 [thread overview]
Message-ID: <871q3iq28g.fsf@toke.dk> (raw)
In-Reply-To: <000000000000048a4b061dfcd02a@google.com>
Hi Sebastian
The syzbot splat below shows up in recent -next kernels which
sorta-kinda wags its finger suggestively at the bpf_net_ctx_get()
changes. There's one for __dev_flush() as well:
https://lore.kernel.org/r/0000000000009d1d0a061d91b803@google.com
Care to take a look? :)
Thanks!
-Toke
syzbot <syzbot+c226757eb784a9da3e8b@syzkaller.appspotmail.com> writes:
> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: 9ec6ec93f2c1 Add linux-next specific files for 20240724
> git tree: linux-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=10e71ca1980000
> kernel config: https://syzkaller.appspot.com/x/.config?x=83e9d0906fa0e2bd
> dashboard link: https://syzkaller.appspot.com/bug?extid=c226757eb784a9da3e8b
> compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=17c0f8e3980000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=151b9919980000
>
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/c0ab2da24b1f/disk-9ec6ec93.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/da6faf16185f/vmlinux-9ec6ec93.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/1ad900571155/bzImage-9ec6ec93.xz
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+c226757eb784a9da3e8b@syzkaller.appspotmail.com
>
> Oops: general protection fault, probably for non-canonical address 0xe3fffb24002e6fe6: 0000 [#1] PREEMPT SMP KASAN PTI
> KASAN: maybe wild-memory-access in range [0x1ffff92001737f30-0x1ffff92001737f37]
> CPU: 1 UID: 0 PID: 11878 Comm: syz-executor412 Not tainted 6.10.0-next-20240724-syzkaller #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024
> RIP: 0010:__cpu_map_flush+0x42/0xd0
> Code: e8 13 8c d6 ff 4c 89 f0 48 c1 e8 03 42 80 3c 38 00 74 08 4c 89 f7 e8 4d 12 3e 00 49 8b 1e 4c 39 f3 74 77 48 89 d8 48 c1 e8 03 <42> 80 3c 38 00 74 08 48 89 df e8 2f 12 3e 00 4c 8b 23 48 8d 7b c0
> RSP: 0018:ffffc90000a18b10 EFLAGS: 00010202
> RAX: 03ffff24002e6fe6 RBX: 1ffff92001737f30 RCX: ffff888074dc8000
> RDX: 0000000080000101 RSI: 0000000000000010 RDI: ffffc9000b9bf800
> RBP: dffffc0000000000 R08: ffffffff896d3b5a R09: 1ffffffff1f5f375
> R10: dffffc0000000000 R11: fffffbfff1f5f376 R12: ffffc9000b9bf800
> R13: ffffc9000b9bf820 R14: ffffc9000b9bf800 R15: dffffc0000000000
> FS: 0000555592677380(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00007fd44da640f0 CR3: 000000001ea68000 CR4: 00000000003506f0
> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> Call Trace:
> <IRQ>
> xdp_do_check_flushed+0x136/0x240 net/core/filter.c:4304
> __napi_poll+0xe4/0x490 net/core/dev.c:6774
> napi_poll net/core/dev.c:6840 [inline]
> net_rx_action+0x89b/0x1240 net/core/dev.c:6962
> handle_softirqs+0x2c4/0x970 kernel/softirq.c:554
> __do_softirq kernel/softirq.c:588 [inline]
> invoke_softirq kernel/softirq.c:428 [inline]
> __irq_exit_rcu+0xf4/0x1c0 kernel/softirq.c:637
> irq_exit_rcu+0x9/0x30 kernel/softirq.c:649
> common_interrupt+0xaa/0xd0 arch/x86/kernel/irq.c:278
> </IRQ>
> <TASK>
> asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:693
> RIP: 0010:check_kcov_mode kernel/kcov.c:184 [inline]
> RIP: 0010:__sanitizer_cov_trace_pc+0x37/0x70 kernel/kcov.c:207
> Code: 40 d7 03 00 65 8b 15 10 0c 70 7e f7 c2 00 01 ff 00 74 11 f7 c2 00 01 00 00 74 35 83 b9 1c 16 00 00 00 74 2c 8b 91 f8 15 00 00 <83> fa 02 75 21 48 8b 91 00 16 00 00 48 8b 32 48 8d 7e 01 8b 89 fc
> RSP: 0018:ffffc9000b9bf8a0 EFLAGS: 00000246
> RAX: ffffffff81410dcc RBX: 0000000000000000 RCX: ffff888074dc8000
> RDX: 0000000000000000 RSI: ffffffff8b942412 RDI: ffffffff8b942328
> RBP: 1ffff92001737f30 R08: ffffffff81410c60 R09: ffffc9000b9bfa70
> R10: 0000000000000003 R11: ffffffff817f7030 R12: ffffffff90294810
> R13: dffffc0000000000 R14: 1ffff92001737f30 R15: ffffffff90d0fbd4
> unwind_next_frame+0x67c/0x2a00 arch/x86/kernel/unwind_orc.c:495
> arch_stack_walk+0x151/0x1b0 arch/x86/kernel/stacktrace.c:25
> stack_trace_save+0x118/0x1d0 kernel/stacktrace.c:122
> kasan_save_stack mm/kasan/common.c:47 [inline]
> kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
> kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579
> poison_slab_object+0xe0/0x150 mm/kasan/common.c:240
> __kasan_slab_free+0x37/0x60 mm/kasan/common.c:256
> kasan_slab_free include/linux/kasan.h:184 [inline]
> slab_free_hook mm/slub.c:2252 [inline]
> slab_free mm/slub.c:4473 [inline]
> kmem_cache_free+0x145/0x350 mm/slub.c:4548
> __dentry_kill+0x497/0x630 fs/dcache.c:629
> dput+0x19f/0x2b0 fs/dcache.c:852
> __fput+0x5f8/0x8a0 fs/file_table.c:430
> __do_sys_close fs/open.c:1566 [inline]
> __se_sys_close fs/open.c:1551 [inline]
> __x64_sys_close+0x7f/0x110 fs/open.c:1551
> do_syscall_x64 arch/x86/entry/common.c:52 [inline]
> do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
> RIP: 0033:0x7fd44d9ed9c0
> Code: ff f7 d8 64 89 02 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 80 3d e1 76 07 00 00 74 17 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 48 c3 0f 1f 80 00 00 00 00 48 83 ec 18 89 7c
> RSP: 002b:00007fff7a1e95b8 EFLAGS: 00000202 ORIG_RAX: 0000000000000003
> RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00007fd44d9ed9c0
> RDX: 0000000000000e80 RSI: 0000000020000100 RDI: 0000000000000004
> RBP: 00007fff7a1e9600 R08: 00007fff7a1e95e0 R09: 00007fff7a1e95e0
> R10: 00007fff7a1e95e0 R11: 0000000000000202 R12: 0000000000000000
> R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
> </TASK>
> Modules linked in:
> ---[ end trace 0000000000000000 ]---
> RIP: 0010:__cpu_map_flush+0x42/0xd0
> Code: e8 13 8c d6 ff 4c 89 f0 48 c1 e8 03 42 80 3c 38 00 74 08 4c 89 f7 e8 4d 12 3e 00 49 8b 1e 4c 39 f3 74 77 48 89 d8 48 c1 e8 03 <42> 80 3c 38 00 74 08 48 89 df e8 2f 12 3e 00 4c 8b 23 48 8d 7b c0
> RSP: 0018:ffffc90000a18b10 EFLAGS: 00010202
> RAX: 03ffff24002e6fe6 RBX: 1ffff92001737f30 RCX: ffff888074dc8000
> RDX: 0000000080000101 RSI: 0000000000000010 RDI: ffffc9000b9bf800
> RBP: dffffc0000000000 R08: ffffffff896d3b5a R09: 1ffffffff1f5f375
> R10: dffffc0000000000 R11: fffffbfff1f5f376 R12: ffffc9000b9bf800
> R13: ffffc9000b9bf820 R14: ffffc9000b9bf800 R15: dffffc0000000000
> FS: 0000555592677380(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00007fd44da640f0 CR3: 000000001ea68000 CR4: 00000000003506f0
> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> ----------------
> Code disassembly (best guess):
> 0: e8 13 8c d6 ff call 0xffd68c18
> 5: 4c 89 f0 mov %r14,%rax
> 8: 48 c1 e8 03 shr $0x3,%rax
> c: 42 80 3c 38 00 cmpb $0x0,(%rax,%r15,1)
> 11: 74 08 je 0x1b
> 13: 4c 89 f7 mov %r14,%rdi
> 16: e8 4d 12 3e 00 call 0x3e1268
> 1b: 49 8b 1e mov (%r14),%rbx
> 1e: 4c 39 f3 cmp %r14,%rbx
> 21: 74 77 je 0x9a
> 23: 48 89 d8 mov %rbx,%rax
> 26: 48 c1 e8 03 shr $0x3,%rax
> * 2a: 42 80 3c 38 00 cmpb $0x0,(%rax,%r15,1) <-- trapping instruction
> 2f: 74 08 je 0x39
> 31: 48 89 df mov %rbx,%rdi
> 34: e8 2f 12 3e 00 call 0x3e1268
> 39: 4c 8b 23 mov (%rbx),%r12
> 3c: 48 8d 7b c0 lea -0x40(%rbx),%rdi
>
>
> ---
> If you want syzbot to run the reproducer, reply with:
> #syz test: git://repo/address.git branch-or-commit-hash
> If you attach or paste a git patch, syzbot will apply it before testing.
prev parent reply other threads:[~2024-07-24 14:44 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-07-18 21:31 [syzbot] [bpf?] [net?] general protection fault in __cpu_map_flush syzbot
2024-07-24 11:45 ` syzbot
2024-07-24 14:43 ` Toke Høiland-Jørgensen [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=871q3iq28g.fsf@toke.dk \
--to=toke@redhat.com \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bigeasy@linutronix.de \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=davem@davemloft.net \
--cc=eddyz87@gmail.com \
--cc=edumazet@google.com \
--cc=haoluo@google.com \
--cc=john.fastabend@gmail.com \
--cc=jolsa@kernel.org \
--cc=kpsingh@kernel.org \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=martin.lau@linux.dev \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=sdf@fomichev.me \
--cc=song@kernel.org \
--cc=syzbot+c226757eb784a9da3e8b@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
--cc=yonghong.song@linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.