Re: [main-line]warning at arch/powerpc/net/bpf_jit_comp.c:961

[Hari Bathini <hbathini@linux.ibm.com>]

[-- Attachment #1: Type: text/plain, Size: 6341 bytes --]

Hi Venkat,

On 20/03/25 3:01 am, Hari Bathini wrote:
> 
> 
> On 19/03/25 1:06 pm, Hari Bathini wrote:
>> Hi Venkat,
>>
>> Thanks for reporting this.
>> I am having a hard time reproducing this. Please share the
>> kernel build config..
>>
> 
> Thanks for reporting this and sharing the config file offline.
> Narrowed down the potential root cause. Will post the fix...
> 
> - Hari
> 
>> On 17/03/25 6:21 pm, Venkat Rao Bagalkote wrote:
>>> Greetings!!!
>>>
>>> I am observing below warnings on linux-mainline kernel, while running 
>>> bpf-sefltests.
>>>
>>> These warnings are intermitent, reproduces roughly 6 out of 10 times.
>>>
>>>
>>> Repo: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
>>>
>>>
>>> Tests:
>>>
>>> ./test_progs
>>>
>>>
>>> Attached is the log file of summary of tests.
>>>
>>>
>>> Traces:
>>>
>>> [  978.200120] ------------[ cut here ]------------
>>> [  978.200133] WARNING: CPU: 11 PID: 45522 at arch/powerpc/net/ 
>>> bpf_jit_comp.c:961 __arch_prepare_bpf_trampoline.isra.0+0xdc8/0xfe0
>>> [  978.200144] Modules linked in: tun(E) bpf_testmod(OE) veth(E) 
>>> bonding(E) tls(E) nft_fib_inet(E) nft_fib_ipv4(E) nft_fib_ipv6(E) 
>>> nft_fib(E) nft_reject_inet(E) nf_reject_ipv4(E) nf_reject_ipv6(E) 
>>> nft_reject(E) nft_ct(E) rfkill(E) nft_chain_nat(E) sunrpc(E) 
>>> ibmveth(E) pseries_rng(E) vmx_crypto(E) drm(E) dm_multipath(E) 
>>> dm_mod(E) fuse(E) drm_panel_orientation_quirks(E) zram(E) xfs(E) 
>>> sd_mod(E) ibmvscsi(E) scsi_transport_srp(E) [last unloaded: 
>>> bpf_test_modorder_x(OE)]
>>> [  978.200194] CPU: 11 UID: 0 PID: 45522 Comm: test_progs Tainted: 
>>> G           OE      6.14.0-rc7-auto #4
>>> [  978.200202] Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
>>> [  978.200205] Hardware name: IBM,8375-42A POWER9 (architected) 
>>> 0x4e0202 0xf000005 of:IBM,FW950.A0 (VL950_144) hv:phyp pSeries
>>> [  978.200210] NIP:  c0000000001e3658 LR: c0000000001e34b0 CTR: 
>>> 0000000000000006
>>> [  978.200216] REGS: c00000001c057570 TRAP: 0700   Tainted: G OE 
>>> (6.14.0-rc7-auto)
>>> [  978.200221] MSR:  8000000000029033 <SF,EE,ME,IR,DR,RI,LE>  CR: 
>>> 44844442  XER: 20040169
>>> [  978.200234] CFAR: c0000000001e34e8 IRQMASK: 0
>>> [  978.200234] GPR00: c0000000001e34b0 c00000001c057810 
>>> c000000001d68100 0000000000000000
>>> [  978.200234] GPR04: c00800000025d640 c00000001c05786c 
>>> 0000000000000160 0000000000000164
>>> [  978.200234] GPR08: c000000157b8c164 c000000157b8c16c 
>>> 000000000000016c 0000000000004000
>>> [  978.200234] GPR12: 0000000000000001 c00000001ec82b00 
>>> 0000000000000078 0000000038210110
>>> [  978.200234] GPR16: 00000000000000a8 00000000eb210098 
>>> 0000000060638000 00000000e86100c0
>>> [  978.200234] GPR20: 00000000eb4100a0 0000000000000004 
>>> 000000002c230000 0000000060000000
>>> [  978.200234] GPR24: fffffffffffff000 c000000005834428 
>>> c00800000025d640 0000000000000001
>>> [  978.200234] GPR28: c000000157b89c00 000000000000026c 
>>> 0000000000000003 c000000157b8c000
>>> [  978.200294] NIP [c0000000001e3658] 
>>> __arch_prepare_bpf_trampoline.isra.0+0xdc8/0xfe0
>>> [  978.200301] LR [c0000000001e34b0] 
>>> __arch_prepare_bpf_trampoline.isra.0+0xc20/0xfe0
>>> [  978.200308] Call Trace:
>>> [  978.200310] [c00000001c057810] [c0000000001e34b0] 
>>> __arch_prepare_bpf_trampoline.isra.0+0xc20/0xfe0 (unreliable)
>>> [  978.200319] [c00000001c057950] [c0000000001e4974] 
>>> arch_prepare_bpf_trampoline+0x94/0x130
>>> [  978.200327] [c00000001c0579b0] [c0000000005001ac] 
>>> bpf_trampoline_update+0x23c/0x660
>>> [  978.200334] [c00000001c057a90] [c0000000005006dc] 
>>> __bpf_trampoline_link_prog+0x10c/0x360
>>> [  978.200341] [c00000001c057ad0] [c000000000500c28] 
>>> bpf_trampoline_link_cgroup_shim+0x268/0x370
>>> [  978.200348] [c00000001c057b80] [c00000000053254c] 
>>> __cgroup_bpf_attach+0x4ec/0x760
>>> [  978.200355] [c00000001c057c60] [c000000000533dd4] 
>>> cgroup_bpf_prog_attach+0xa4/0x310
>>> [  978.200362] [c00000001c057cb0] [c00000000049d1b8] 
>>> bpf_prog_attach+0x2a8/0x2e0
>>> [  978.200370] [c00000001c057d00] [c0000000004a7278] 
>>> __sys_bpf+0x428/0xd20
>>> [  978.200375] [c00000001c057df0] [c0000000004a7b9c] sys_bpf+0x2c/0x40
>>> [  978.200381] [c00000001c057e10] [c000000000033078] 
>>> system_call_exception+0x128/0x310
>>> [  978.200388] [c00000001c057e50] [c00000000000d05c] 
>>> system_call_vectored_common+0x15c/0x2ec
>>> [  978.200396] --- interrupt: 3000 at 0x7fff98ba9f40
>>> [  978.200405] NIP:  00007fff98ba9f40 LR: 00007fff98ba9f40 CTR: 
>>> 0000000000000000
>>> [  978.200410] REGS: c00000001c057e80 TRAP: 3000   Tainted: G OE 
>>> (6.14.0-rc7-auto)
>>> [  978.200415] MSR:  800000000280f033 
>>> <SF,VEC,VSX,EE,PR,FP,ME,IR,DR,RI,LE>  CR: 48002848  XER: 00000000
>>> [  978.200431] IRQMASK: 0
>>> [  978.200431] GPR00: 0000000000000169 00007fffde891b10 
>>> 00007fff98cb6d00 0000000000000008
>>> [  978.200431] GPR04: 00007fffde891bf8 0000000000000020 
>>> 0000000000000001 0000000000000008
>>> [  978.200431] GPR08: 0000000000000008 0000000000000000 
>>> 0000000000000000 0000000000000000
>>> [  978.200431] GPR12: 0000000000000000 00007fff995fe9e0 
>>> 0000000000000000 0000000000000000
>>> [  978.200431] GPR16: 0000000000000000 0000000000000000 
>>> 0000000000000000 0000000000000000
>>> [  978.200431] GPR20: 0000000000000000 0000000000000000 
>>> 0000000000000000 00007fff995ef438
>>> [  978.200431] GPR24: 00000000105ed2f4 00007fff995f0000 
>>> 00007fffde892998 0000000000000001
>>> [  978.200431] GPR28: 00007fffde892aa8 00007fffde892988 
>>> 0000000000000001 00007fffde891b40
>>> [  978.200487] NIP [00007fff98ba9f40] 0x7fff98ba9f40
>>> [  978.200491] LR [00007fff98ba9f40] 0x7fff98ba9f40
>>> [  978.200495] --- interrupt: 3000
>>> [  978.200498] Code: 7d5f412e 81210060 39290001 792a1788 3ba90040 
>>> 91210060 7d3f5214 57bd103a e9010030 3908ff00 7c294040 4081fae0 
>>> <0fe00000> 3ba0fff2 4bfffad4 8281003c
>>> [  978.200519] ---[ end trace 0000000000000000 ]---
>>>
>>> If you happen to fix this, please add below tag.
>>>
>>>
>>> Reported-by: Venkat Rao Bagalkote <venkat88@linux.ibm.com>

The attached fix is not complete but will be sufficient for this
test scenario. While I come up with the complete fix for all scenarios,
can you share your observations applying the change...

- Hari

[-- Attachment #2: 0001-powerpc-bpf-trampoline-fix.patch --]
[-- Type: text/x-patch, Size: 2179 bytes --]

diff --git a/arch/powerpc/net/bpf_jit_comp.c b/arch/powerpc/net/bpf_jit_comp.c
index 2991bb171a9b..d867ada31bd5 100644
--- a/arch/powerpc/net/bpf_jit_comp.c
+++ b/arch/powerpc/net/bpf_jit_comp.c
@@ -833,7 +833,8 @@ static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im, void *rw_im
 	EMIT(PPC_RAW_STL(_R26, _R1, nvr_off + SZL));
 
 	if (flags & BPF_TRAMP_F_CALL_ORIG) {
-		PPC_LI_ADDR(_R3, (unsigned long)im);
+		PPC_LI_ADDR(_R3, im ? (unsigned long)im :
+				(unsigned long)(~(1UL << (BITS_PER_LONG - 1))));
 		ret = bpf_jit_emit_func_call_rel(image, ro_image, ctx,
 						 (unsigned long)__bpf_tramp_enter);
 		if (ret)
@@ -889,7 +890,8 @@ static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im, void *rw_im
 			bpf_trampoline_restore_tail_call_cnt(image, ctx, func_frame_offset, r4_off);
 
 		/* Reserve space to patch branch instruction to skip fexit progs */
-		im->ip_after_call = &((u32 *)ro_image)[ctx->idx];
+		if (im)
+			im->ip_after_call = &((u32 *)ro_image)[ctx->idx];
 		EMIT(PPC_RAW_NOP());
 	}
 
@@ -912,8 +914,10 @@ static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im, void *rw_im
 		}
 
 	if (flags & BPF_TRAMP_F_CALL_ORIG) {
-		im->ip_epilogue = &((u32 *)ro_image)[ctx->idx];
-		PPC_LI_ADDR(_R3, im);
+		if (im)
+			im->ip_epilogue = &((u32 *)ro_image)[ctx->idx];
+		PPC_LI_ADDR(_R3, im ? (unsigned long)im :
+				(unsigned long)(~(1UL << (BITS_PER_LONG - 1))));
 		ret = bpf_jit_emit_func_call_rel(image, ro_image, ctx,
 						 (unsigned long)__bpf_tramp_exit);
 		if (ret)
@@ -972,7 +976,6 @@ static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im, void *rw_im
 int arch_bpf_trampoline_size(const struct btf_func_model *m, u32 flags,
 			     struct bpf_tramp_links *tlinks, void *func_addr)
 {
-	struct bpf_tramp_image im;
 	void *image;
 	int ret;
 
@@ -988,7 +991,7 @@ int arch_bpf_trampoline_size(const struct btf_func_model *m, u32 flags,
 	if (!image)
 		return -ENOMEM;
 
-	ret = __arch_prepare_bpf_trampoline(&im, image, image + PAGE_SIZE, image,
+	ret = __arch_prepare_bpf_trampoline(NULL, image, image + PAGE_SIZE, image,
 					    m, flags, tlinks, func_addr);
 	bpf_jit_free_exec(image);