* Re: [syzbot] [bpf?] [net?] general protection fault in __dev_flush
2024-07-19 3:59 [syzbot] [net?] [bpf?] general protection fault in __dev_flush syzbot
@ 2024-07-22 2:59 ` syzbot
2024-07-24 15:21 ` [PATCH net] tun: Remove nested call to bpf_net_ctx_set() in do_xdp_generic() Jeongjun Park
2024-07-22 10:31 ` [syzbot] Re: [syzbot] [net?] [bpf?] general protection fault in __dev_flush syzbot
` (10 subsequent siblings)
11 siblings, 1 reply; 24+ messages in thread
From: syzbot @ 2024-07-22 2:59 UTC (permalink / raw)
To: andrii, ast, bpf, daniel, davem, eddyz87, haoluo, hawk,
john.fastabend, jolsa, kpsingh, kuba, linux-kernel, martin.lau,
netdev, sdf, song, syzkaller-bugs, yonghong.song
syzbot has found a reproducer for the following issue on:
HEAD commit: 7846b618e0a4 Merge tag 'rtc-6.11' of git://git.kernel.org/..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=142d3eb5980000
kernel config: https://syzkaller.appspot.com/x/.config?x=be4129de17851dbe
dashboard link: https://syzkaller.appspot.com/bug?extid=44623300f057a28baf1e
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=154c40b1980000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=14f3e11d980000
Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/7bc7510fe41f/non_bootable_disk-7846b618.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/3a2831ffe61c/vmlinux-7846b618.xz
kernel image: https://storage.googleapis.com/syzbot-assets/575e23a7c452/bzImage-7846b618.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+44623300f057a28baf1e@syzkaller.appspotmail.com
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 1 PID: 5389 Comm: syz-executor357 Not tainted 6.10.0-syzkaller-11323-g7846b618e0a4 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:__dev_flush+0x49/0x1e0 kernel/bpf/devmap.c:424
Code: 00 fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 98 01 00 00 48 b8 00 00 00 00 00 fc ff df 49 8b 2f 48 8d 5d 80 48 89 ea 48 c1 ea 03 <80> 3c 02 00 0f 85 69 01 00 00 48 8b 45 00 49 39 ef 4c 8d 60 80 0f
RSP: 0018:ffffc900008b0c90 EFLAGS: 00010246
RAX: dffffc0000000000 RBX: ffffffffffffff80 RCX: ffffffff88d6a5bb
RDX: 0000000000000000 RSI: ffffffff81af9c56 RDI: ffffc9000345fa68
RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffffc9000345fa58
R13: ffff888022ec0fb0 R14: ffffc9000345fa68 R15: ffffc9000345fa68
FS: 0000555568ea6380(0000) GS:ffff88806b100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ff4743880f0 CR3: 0000000023168000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<IRQ>
xdp_do_check_flushed+0x40a/0x4e0 net/core/filter.c:4300
__napi_poll.constprop.0+0xd1/0x550 net/core/dev.c:6774
napi_poll net/core/dev.c:6840 [inline]
net_rx_action+0xa92/0x1010 net/core/dev.c:6962
handle_softirqs+0x216/0x8f0 kernel/softirq.c:554
do_softirq kernel/softirq.c:455 [inline]
do_softirq+0xb2/0xf0 kernel/softirq.c:442
</IRQ>
<TASK>
__local_bh_enable_ip+0x100/0x120 kernel/softirq.c:382
local_bh_enable include/linux/bottom_half.h:33 [inline]
tun_get_user+0x1d9b/0x3c30 drivers/net/tun.c:1936
tun_chr_write_iter+0xe8/0x210 drivers/net/tun.c:2052
new_sync_write fs/read_write.c:497 [inline]
vfs_write+0x6b6/0x1140 fs/read_write.c:590
ksys_write+0x12f/0x260 fs/read_write.c:643
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7ff47430af50
Code: 40 00 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 80 3d 51 e1 07 00 00 74 17 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 58 c3 0f 1f 80 00 00 00 00 48 83 ec 28 48 89
RSP: 002b:00007ffde0326728 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007ffde03267c0 RCX: 00007ff47430af50
RDX: 0000000000000e80 RSI: 0000000020000100 RDI: 00000000000000c8
RBP: 00007ffde0326770 R08: 00007ffde0326750 R09: 00007ffde0326750
R10: 00007ffde0326750 R11: 0000000000000202 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__dev_flush+0x49/0x1e0 kernel/bpf/devmap.c:424
Code: 00 fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 98 01 00 00 48 b8 00 00 00 00 00 fc ff df 49 8b 2f 48 8d 5d 80 48 89 ea 48 c1 ea 03 <80> 3c 02 00 0f 85 69 01 00 00 48 8b 45 00 49 39 ef 4c 8d 60 80 0f
RSP: 0018:ffffc900008b0c90 EFLAGS: 00010246
RAX: dffffc0000000000 RBX: ffffffffffffff80 RCX: ffffffff88d6a5bb
RDX: 0000000000000000 RSI: ffffffff81af9c56 RDI: ffffc9000345fa68
RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffffc9000345fa58
R13: ffff888022ec0fb0 R14: ffffc9000345fa68 R15: ffffc9000345fa68
FS: 0000555568ea6380(0000) GS:ffff88806b100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ff4743880f0 CR3: 0000000023168000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess), 4 bytes skipped:
0: 48 c1 ea 03 shr $0x3,%rdx
4: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1)
8: 0f 85 98 01 00 00 jne 0x1a6
e: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
15: fc ff df
18: 49 8b 2f mov (%r15),%rbp
1b: 48 8d 5d 80 lea -0x80(%rbp),%rbx
1f: 48 89 ea mov %rbp,%rdx
22: 48 c1 ea 03 shr $0x3,%rdx
* 26: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) <-- trapping instruction
2a: 0f 85 69 01 00 00 jne 0x199
30: 48 8b 45 00 mov 0x0(%rbp),%rax
34: 49 39 ef cmp %rbp,%r15
37: 4c 8d 60 80 lea -0x80(%rax),%r12
3b: 0f .byte 0xf
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 24+ messages in thread* [PATCH net] tun: Remove nested call to bpf_net_ctx_set() in do_xdp_generic()
2024-07-22 2:59 ` [syzbot] [bpf?] [net?] " syzbot
@ 2024-07-24 15:21 ` Jeongjun Park
2024-07-25 2:43 ` Willem de Bruijn
0 siblings, 1 reply; 24+ messages in thread
From: Jeongjun Park @ 2024-07-24 15:21 UTC (permalink / raw)
To: willemdebruijn.kernel, jasowang
Cc: syzbot+44623300f057a28baf1e, davem, edumazet, pabeni, kuba, jiri,
bigeasy, linux-kernel, netdev, bpf, syzkaller-bugs, Jeongjun Park
In the previous commit, bpf_net_context handling was added to
tun_sendmsg() and do_xdp_generic(), but if you write code like this,
bpf_net_context overlaps in the call trace below, causing various
memory corruptions.
<Call trace>
...
tun_sendmsg() // bpf_net_ctx_set()
tun_xdp_one()
do_xdp_generic() // bpf_net_ctx_set() <-- nested
...
This patch removes the bpf_net_context handling that exists in
do_xdp_generic() and modifies it to handle it in the parent function.
Reported-by: syzbot+44623300f057a28baf1e@syzkaller.appspotmail.com
Fixes: fecef4cd42c6 ("tun: Assign missing bpf_net_context.")
Signed-off-by: Jeongjun Park <aha310510@gmail.com>
---
drivers/net/tun.c | 3 +++
net/core/dev.c | 8 +++-----
2 files changed, 6 insertions(+), 5 deletions(-)
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 9b24861464bc..095ada4a525e 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -1919,10 +1919,12 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
if (skb_xdp) {
struct bpf_prog *xdp_prog;
+ struct bpf_net_context __bpf_net_ctx, *bpf_net_ctx;
int ret;
local_bh_disable();
rcu_read_lock();
+ bpf_net_ctx = bpf_net_ctx_set(&__bpf_net_ctx);
xdp_prog = rcu_dereference(tun->xdp_prog);
if (xdp_prog) {
ret = do_xdp_generic(xdp_prog, &skb);
@@ -1932,6 +1934,7 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
goto unlock_frags;
}
}
+ bpf_net_ctx_clear(bpf_net_ctx);
rcu_read_unlock();
local_bh_enable();
}
diff --git a/net/core/dev.c b/net/core/dev.c
index 6ea1d20676fb..26f9fdd66e64 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -5126,14 +5126,11 @@ static DEFINE_STATIC_KEY_FALSE(generic_xdp_needed_key);
int do_xdp_generic(struct bpf_prog *xdp_prog, struct sk_buff **pskb)
{
- struct bpf_net_context __bpf_net_ctx, *bpf_net_ctx;
-
if (xdp_prog) {
struct xdp_buff xdp;
u32 act;
int err;
- bpf_net_ctx = bpf_net_ctx_set(&__bpf_net_ctx);
act = netif_receive_generic_xdp(pskb, &xdp, xdp_prog);
if (act != XDP_PASS) {
switch (act) {
@@ -5147,13 +5144,11 @@ int do_xdp_generic(struct bpf_prog *xdp_prog, struct sk_buff **pskb)
generic_xdp_tx(*pskb, xdp_prog);
break;
}
- bpf_net_ctx_clear(bpf_net_ctx);
return XDP_DROP;
}
}
return XDP_PASS;
out_redir:
- bpf_net_ctx_clear(bpf_net_ctx);
kfree_skb_reason(*pskb, SKB_DROP_REASON_XDP);
return XDP_DROP;
}
@@ -5475,10 +5470,13 @@ static int __netif_receive_skb_core(struct sk_buff **pskb, bool pfmemalloc,
if (static_branch_unlikely(&generic_xdp_needed_key)) {
int ret2;
+ struct bpf_net_context __bpf_net_ctx, *bpf_net_ctx;
migrate_disable();
+ bpf_net_ctx = bpf_net_ctx_set(&__bpf_net_ctx);
ret2 = do_xdp_generic(rcu_dereference(skb->dev->xdp_prog),
&skb);
+ bpf_net_ctx_clear(bpf_net_ctx);
migrate_enable();
if (ret2 != XDP_PASS) {
--
^ permalink raw reply related [flat|nested] 24+ messages in thread* Re: [PATCH net] tun: Remove nested call to bpf_net_ctx_set() in do_xdp_generic()
2024-07-24 15:21 ` [PATCH net] tun: Remove nested call to bpf_net_ctx_set() in do_xdp_generic() Jeongjun Park
@ 2024-07-25 2:43 ` Willem de Bruijn
2024-07-25 4:13 ` Jeongjun Park
2024-07-25 10:44 ` Paolo Abeni
0 siblings, 2 replies; 24+ messages in thread
From: Willem de Bruijn @ 2024-07-25 2:43 UTC (permalink / raw)
To: Jeongjun Park, willemdebruijn.kernel, jasowang
Cc: syzbot+44623300f057a28baf1e, davem, edumazet, pabeni, kuba, jiri,
bigeasy, linux-kernel, netdev, bpf, syzkaller-bugs, Jeongjun Park
Jeongjun Park wrote:
> In the previous commit, bpf_net_context handling was added to
> tun_sendmsg() and do_xdp_generic(), but if you write code like this,
> bpf_net_context overlaps in the call trace below, causing various
> memory corruptions.
I'm no expert on this code, but commit 401cb7dae813 that introduced
bpf_net_ctx_set explicitly states that nested calls are allowed.
And the function does imply that:
static inline struct bpf_net_context *bpf_net_ctx_set(struct bpf_net_context *bpf_net_ctx)
{
struct task_struct *tsk = current;
if (tsk->bpf_net_context != NULL)
return NULL;
bpf_net_ctx->ri.kern_flags = 0;
tsk->bpf_net_context = bpf_net_ctx;
return bpf_net_ctx;
}
> <Call trace>
> ...
> tun_sendmsg() // bpf_net_ctx_set()
> tun_xdp_one()
> do_xdp_generic() // bpf_net_ctx_set() <-- nested
> ...
>
> This patch removes the bpf_net_context handling that exists in
> do_xdp_generic() and modifies it to handle it in the parent function.
Is tun_xdp_one missing? That also calls do_xdp_generic.
^ permalink raw reply [flat|nested] 24+ messages in thread* Re: [PATCH net] tun: Remove nested call to bpf_net_ctx_set() in do_xdp_generic()
2024-07-25 2:43 ` Willem de Bruijn
@ 2024-07-25 4:13 ` Jeongjun Park
2024-07-25 10:44 ` Paolo Abeni
1 sibling, 0 replies; 24+ messages in thread
From: Jeongjun Park @ 2024-07-25 4:13 UTC (permalink / raw)
To: willemdebruijn.kernel
Cc: aha310510, bigeasy, bpf, davem, edumazet, jasowang, jiri, kuba,
linux-kernel, netdev, pabeni, syzbot+44623300f057a28baf1e,
syzkaller-bugs
Willem de Bruijn wrote:
> I'm no expert on this code, but commit 401cb7dae813 that introduced
> bpf_net_ctx_set explicitly states that nested calls are allowed.
>
> And the function does imply that:
>
> static inline struct bpf_net_context *bpf_net_ctx_set(struct bpf_net_context *bpf_net_ctx)
> {
> struct task_struct *tsk = current;
>
> if (tsk->bpf_net_context != NULL)
> return NULL;
> bpf_net_ctx->ri.kern_flags = 0;
>
> tsk->bpf_net_context = bpf_net_ctx;
> return bpf_net_ctx;
> }
I'm not an expert on this code either. As you said, there is a
possibility that the bug is not caused by overlapping calls, but various
memory corruptions are occurring due to the handling of bpf_net_context
in do_xdp_generic. Therefore, it is appropriate to modify it to handle
it in the parent function rather than in do_xdp_generic.
> Is tun_xdp_one missing? That also calls do_xdp_generic.
This is no problem since tun_xdp_one is only called from tun_sendmsg
and tun_sendmsg already does the bpf_net_context handling.
Regards,
Jeongjun Park.
^ permalink raw reply [flat|nested] 24+ messages in thread* Re: [PATCH net] tun: Remove nested call to bpf_net_ctx_set() in do_xdp_generic()
2024-07-25 2:43 ` Willem de Bruijn
2024-07-25 4:13 ` Jeongjun Park
@ 2024-07-25 10:44 ` Paolo Abeni
2024-07-25 12:15 ` Jeongjun Park
1 sibling, 1 reply; 24+ messages in thread
From: Paolo Abeni @ 2024-07-25 10:44 UTC (permalink / raw)
To: Willem de Bruijn, Jeongjun Park, jasowang
Cc: syzbot+44623300f057a28baf1e, davem, edumazet, kuba, jiri, bigeasy,
linux-kernel, netdev, bpf, syzkaller-bugs
On 7/25/24 04:43, Willem de Bruijn wrote:
> Jeongjun Park wrote:
>> In the previous commit, bpf_net_context handling was added to
>> tun_sendmsg() and do_xdp_generic(), but if you write code like this,
>> bpf_net_context overlaps in the call trace below, causing various
>> memory corruptions.
>
> I'm no expert on this code, but commit 401cb7dae813 that introduced
> bpf_net_ctx_set explicitly states that nested calls are allowed.
>
> And the function does imply that:
>
> static inline struct bpf_net_context *bpf_net_ctx_set(struct bpf_net_context *bpf_net_ctx)
> {
> struct task_struct *tsk = current;
>
> if (tsk->bpf_net_context != NULL)
> return NULL;
> bpf_net_ctx->ri.kern_flags = 0;
>
> tsk->bpf_net_context = bpf_net_ctx;
> return bpf_net_ctx;
> }
I agree with Willem, the ctx nesting looks legit generally speaking.
@Jeongjun: you need to track down more accurately the issue root cause
and include such info into the commit message.
Skimming over the code I *think* do_xdp_generic() is not cleaning the
nested context in all the paths before return and that could cause the
reported issue.
Thanks,
Paolo
^ permalink raw reply [flat|nested] 24+ messages in thread* Re: [PATCH net] tun: Remove nested call to bpf_net_ctx_set() in do_xdp_generic()
2024-07-25 10:44 ` Paolo Abeni
@ 2024-07-25 12:15 ` Jeongjun Park
0 siblings, 0 replies; 24+ messages in thread
From: Jeongjun Park @ 2024-07-25 12:15 UTC (permalink / raw)
To: pabeni
Cc: aha310510, bigeasy, bpf, davem, edumazet, jasowang, jiri, kuba,
linux-kernel, netdev, syzbot+44623300f057a28baf1e, syzkaller-bugs,
willemdebruijn.kernel
Paolo Abeni wrote:
>
> On 7/25/24 04:43, Willem de Bruijn wrote:
> > Jeongjun Park wrote:
> >> In the previous commit, bpf_net_context handling was added to
> >> tun_sendmsg() and do_xdp_generic(), but if you write code like this,
> >> bpf_net_context overlaps in the call trace below, causing various
> >> memory corruptions.
> >
> > I'm no expert on this code, but commit 401cb7dae813 that introduced
> > bpf_net_ctx_set explicitly states that nested calls are allowed.
> >
> > And the function does imply that:
> >
> > static inline struct bpf_net_context *bpf_net_ctx_set(struct bpf_net_context *bpf_net_ctx)
> > {
> > struct task_struct *tsk = current;
> >
> > if (tsk->bpf_net_context != NULL)
> > return NULL;
> > bpf_net_ctx->ri.kern_flags = 0;
> >
> > tsk->bpf_net_context = bpf_net_ctx;
> > return bpf_net_ctx;
> > }
>
> I agree with Willem, the ctx nesting looks legit generally speaking.
> @Jeongjun: you need to track down more accurately the issue root cause
> and include such info into the commit message.
>
> Skimming over the code I *think* do_xdp_generic() is not cleaning the
> nested context in all the paths before return and that could cause the
> reported issue.
Thanks to your comment, I re-read the code and found the root cause.
I will send a patch for that bug.
Regards,
Jeongjun Park
^ permalink raw reply [flat|nested] 24+ messages in thread
* Re: [syzbot] Re: [syzbot] [net?] [bpf?] general protection fault in __dev_flush
2024-07-19 3:59 [syzbot] [net?] [bpf?] general protection fault in __dev_flush syzbot
2024-07-22 2:59 ` [syzbot] [bpf?] [net?] " syzbot
@ 2024-07-22 10:31 ` syzbot
2024-07-22 10:31 ` syzbot
` (9 subsequent siblings)
11 siblings, 0 replies; 24+ messages in thread
From: syzbot @ 2024-07-22 10:31 UTC (permalink / raw)
To: linux-kernel
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.
***
Subject: Re: [syzbot] [net?] [bpf?] general protection fault in __dev_flush
Author: aha310510@gmail.com
#syz test git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
---
include/linux/filter.h | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/include/linux/filter.h b/include/linux/filter.h
index b6672ff61407..22691015d175 100644
--- a/include/linux/filter.h
+++ b/include/linux/filter.h
@@ -842,15 +842,15 @@ static inline void bpf_net_ctx_get_all_used_flush_lists(struct list_head **lh_ma
if (!IS_ENABLED(CONFIG_BPF_SYSCALL))
return;
- lh = &bpf_net_ctx->dev_map_flush_list;
+ lh = this_cpu_ptr(&bpf_net_ctx->dev_map_flush_list);
if (kern_flags & BPF_RI_F_DEV_MAP_INIT && !list_empty(lh))
*lh_dev = lh;
- lh = &bpf_net_ctx->cpu_map_flush_list;
+ lh = this_cpu_ptr(&bpf_net_ctx->cpu_map_flush_list);
if (kern_flags & BPF_RI_F_CPU_MAP_INIT && !list_empty(lh))
*lh_map = lh;
- lh = &bpf_net_ctx->xskmap_map_flush_list;
+ lh = this_cpu_ptr(&bpf_net_ctx->xskmap_map_flush_list);
if (IS_ENABLED(CONFIG_XDP_SOCKETS) &&
kern_flags & BPF_RI_F_XSK_MAP_INIT && !list_empty(lh))
*lh_xsk = lh;
--
^ permalink raw reply related [flat|nested] 24+ messages in thread* Re: [syzbot] Re: [syzbot] [net?] [bpf?] general protection fault in __dev_flush
2024-07-19 3:59 [syzbot] [net?] [bpf?] general protection fault in __dev_flush syzbot
2024-07-22 2:59 ` [syzbot] [bpf?] [net?] " syzbot
2024-07-22 10:31 ` [syzbot] Re: [syzbot] [net?] [bpf?] general protection fault in __dev_flush syzbot
@ 2024-07-22 10:31 ` syzbot
2024-07-22 11:40 ` syzbot
` (8 subsequent siblings)
11 siblings, 0 replies; 24+ messages in thread
From: syzbot @ 2024-07-22 10:31 UTC (permalink / raw)
To: linux-kernel
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.
***
Subject: Re: [syzbot] [net?] [bpf?] general protection fault in __dev_flush
Author: aha310510@gmail.com
#syz test git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
^ permalink raw reply [flat|nested] 24+ messages in thread* Re: [syzbot] Re: [syzbot] [net?] [bpf?] general protection fault in __dev_flush
2024-07-19 3:59 [syzbot] [net?] [bpf?] general protection fault in __dev_flush syzbot
` (2 preceding siblings ...)
2024-07-22 10:31 ` syzbot
@ 2024-07-22 11:40 ` syzbot
2024-07-24 9:39 ` syzbot
` (7 subsequent siblings)
11 siblings, 0 replies; 24+ messages in thread
From: syzbot @ 2024-07-22 11:40 UTC (permalink / raw)
To: linux-kernel
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.
***
Subject: Re: [syzbot] [net?] [bpf?] general protection fault in __dev_flush
Author: aha310510@gmail.com
#syz test git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 7846b618e0a4c3e08888099d1d4512722b39ca99
---
include/linux/filter.h | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/include/linux/filter.h b/include/linux/filter.h
index b6672ff61407..22691015d175 100644
--- a/include/linux/filter.h
+++ b/include/linux/filter.h
@@ -842,15 +842,15 @@ static inline void bpf_net_ctx_get_all_used_flush_lists(struct list_head **lh_ma
if (!IS_ENABLED(CONFIG_BPF_SYSCALL))
return;
- lh = &bpf_net_ctx->dev_map_flush_list;
+ lh = this_cpu_ptr(&bpf_net_ctx->dev_map_flush_list);
if (kern_flags & BPF_RI_F_DEV_MAP_INIT && !list_empty(lh))
*lh_dev = lh;
- lh = &bpf_net_ctx->cpu_map_flush_list;
+ lh = this_cpu_ptr(&bpf_net_ctx->cpu_map_flush_list);
if (kern_flags & BPF_RI_F_CPU_MAP_INIT && !list_empty(lh))
*lh_map = lh;
- lh = &bpf_net_ctx->xskmap_map_flush_list;
+ lh = this_cpu_ptr(&bpf_net_ctx->xskmap_map_flush_list);
if (IS_ENABLED(CONFIG_XDP_SOCKETS) &&
kern_flags & BPF_RI_F_XSK_MAP_INIT && !list_empty(lh))
*lh_xsk = lh;
--
^ permalink raw reply related [flat|nested] 24+ messages in thread* Re: [syzbot] Re: [syzbot] [net?] [bpf?] general protection fault in __dev_flush
2024-07-19 3:59 [syzbot] [net?] [bpf?] general protection fault in __dev_flush syzbot
` (3 preceding siblings ...)
2024-07-22 11:40 ` syzbot
@ 2024-07-24 9:39 ` syzbot
2024-07-24 11:43 ` syzbot
` (6 subsequent siblings)
11 siblings, 0 replies; 24+ messages in thread
From: syzbot @ 2024-07-24 9:39 UTC (permalink / raw)
To: linux-kernel
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.
***
Subject: Re: [syzbot] [net?] [bpf?] general protection fault in __dev_flush
Author: aha310510@gmail.com
#syz test git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
---
drivers/net/tun.c | 4 ----
1 file changed, 4 deletions(-)
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 9b24861464bc..022ffadae2af 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -1661,7 +1661,6 @@ static struct sk_buff *tun_build_skb(struct tun_struct *tun,
int len, int *skb_xdp)
{
struct page_frag *alloc_frag = ¤t->task_frag;
- struct bpf_net_context __bpf_net_ctx, *bpf_net_ctx;
struct bpf_prog *xdp_prog;
int buflen = SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
char *buf;
@@ -1701,7 +1700,6 @@ static struct sk_buff *tun_build_skb(struct tun_struct *tun,
local_bh_disable();
rcu_read_lock();
- bpf_net_ctx = bpf_net_ctx_set(&__bpf_net_ctx);
xdp_prog = rcu_dereference(tun->xdp_prog);
if (xdp_prog) {
struct xdp_buff xdp;
@@ -1730,14 +1728,12 @@ static struct sk_buff *tun_build_skb(struct tun_struct *tun,
pad = xdp.data - xdp.data_hard_start;
len = xdp.data_end - xdp.data;
}
- bpf_net_ctx_clear(bpf_net_ctx);
rcu_read_unlock();
local_bh_enable();
return __tun_build_skb(tfile, alloc_frag, buf, buflen, len, pad);
out:
- bpf_net_ctx_clear(bpf_net_ctx);
rcu_read_unlock();
local_bh_enable();
return NULL;
--
^ permalink raw reply related [flat|nested] 24+ messages in thread* Re: [syzbot] Re: [syzbot] [net?] [bpf?] general protection fault in __dev_flush
2024-07-19 3:59 [syzbot] [net?] [bpf?] general protection fault in __dev_flush syzbot
` (4 preceding siblings ...)
2024-07-24 9:39 ` syzbot
@ 2024-07-24 11:43 ` syzbot
2024-07-24 12:28 ` syzbot
` (5 subsequent siblings)
11 siblings, 0 replies; 24+ messages in thread
From: syzbot @ 2024-07-24 11:43 UTC (permalink / raw)
To: linux-kernel
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.
***
Subject: Re: [syzbot] [net?] [bpf?] general protection fault in __dev_flush
Author: aha310510@gmail.com
#syz test git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
---
drivers/net/tun.c | 7 -------
1 file changed, 7 deletions(-)
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 9b24861464bc..9254bca2813d 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -1661,7 +1661,6 @@ static struct sk_buff *tun_build_skb(struct tun_struct *tun,
int len, int *skb_xdp)
{
struct page_frag *alloc_frag = ¤t->task_frag;
- struct bpf_net_context __bpf_net_ctx, *bpf_net_ctx;
struct bpf_prog *xdp_prog;
int buflen = SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
char *buf;
@@ -1701,7 +1700,6 @@ static struct sk_buff *tun_build_skb(struct tun_struct *tun,
local_bh_disable();
rcu_read_lock();
- bpf_net_ctx = bpf_net_ctx_set(&__bpf_net_ctx);
xdp_prog = rcu_dereference(tun->xdp_prog);
if (xdp_prog) {
struct xdp_buff xdp;
@@ -1730,14 +1728,12 @@ static struct sk_buff *tun_build_skb(struct tun_struct *tun,
pad = xdp.data - xdp.data_hard_start;
len = xdp.data_end - xdp.data;
}
- bpf_net_ctx_clear(bpf_net_ctx);
rcu_read_unlock();
local_bh_enable();
return __tun_build_skb(tfile, alloc_frag, buf, buflen, len, pad);
out:
- bpf_net_ctx_clear(bpf_net_ctx);
rcu_read_unlock();
local_bh_enable();
return NULL;
@@ -2570,7 +2566,6 @@ static int tun_sendmsg(struct socket *sock, struct msghdr *m, size_t total_len)
if (m->msg_controllen == sizeof(struct tun_msg_ctl) &&
ctl && ctl->type == TUN_MSG_PTR) {
- struct bpf_net_context __bpf_net_ctx, *bpf_net_ctx;
struct tun_page tpage;
int n = ctl->num;
int flush = 0, queued = 0;
@@ -2579,7 +2574,6 @@ static int tun_sendmsg(struct socket *sock, struct msghdr *m, size_t total_len)
local_bh_disable();
rcu_read_lock();
- bpf_net_ctx = bpf_net_ctx_set(&__bpf_net_ctx);
for (i = 0; i < n; i++) {
xdp = &((struct xdp_buff *)ctl->ptr)[i];
@@ -2594,7 +2588,6 @@ static int tun_sendmsg(struct socket *sock, struct msghdr *m, size_t total_len)
if (tfile->napi_enabled && queued > 0)
napi_schedule(&tfile->napi);
- bpf_net_ctx_clear(bpf_net_ctx);
rcu_read_unlock();
local_bh_enable();
--
^ permalink raw reply related [flat|nested] 24+ messages in thread* Re: [syzbot] Re: [syzbot] [net?] [bpf?] general protection fault in __dev_flush
2024-07-19 3:59 [syzbot] [net?] [bpf?] general protection fault in __dev_flush syzbot
` (5 preceding siblings ...)
2024-07-24 11:43 ` syzbot
@ 2024-07-24 12:28 ` syzbot
2024-07-24 13:40 ` syzbot
` (4 subsequent siblings)
11 siblings, 0 replies; 24+ messages in thread
From: syzbot @ 2024-07-24 12:28 UTC (permalink / raw)
To: linux-kernel
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.
***
Subject: Re: [syzbot] [net?] [bpf?] general protection fault in __dev_flush
Author: aha310510@gmail.com
#syz test git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
---
net/core/dev.c | 5 -----
1 file changed, 5 deletions(-)
diff --git a/net/core/dev.c b/net/core/dev.c
index 6ea1d20676fb..ca1d470bc48a 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -5126,14 +5126,11 @@ static DEFINE_STATIC_KEY_FALSE(generic_xdp_needed_key);
int do_xdp_generic(struct bpf_prog *xdp_prog, struct sk_buff **pskb)
{
- struct bpf_net_context __bpf_net_ctx, *bpf_net_ctx;
-
if (xdp_prog) {
struct xdp_buff xdp;
u32 act;
int err;
- bpf_net_ctx = bpf_net_ctx_set(&__bpf_net_ctx);
act = netif_receive_generic_xdp(pskb, &xdp, xdp_prog);
if (act != XDP_PASS) {
switch (act) {
@@ -5147,13 +5144,11 @@ int do_xdp_generic(struct bpf_prog *xdp_prog, struct sk_buff **pskb)
generic_xdp_tx(*pskb, xdp_prog);
break;
}
- bpf_net_ctx_clear(bpf_net_ctx);
return XDP_DROP;
}
}
return XDP_PASS;
out_redir:
- bpf_net_ctx_clear(bpf_net_ctx);
kfree_skb_reason(*pskb, SKB_DROP_REASON_XDP);
return XDP_DROP;
}
--
^ permalink raw reply related [flat|nested] 24+ messages in thread* Re: [syzbot] Re: [syzbot] [net?] [bpf?] general protection fault in __dev_flush
2024-07-19 3:59 [syzbot] [net?] [bpf?] general protection fault in __dev_flush syzbot
` (6 preceding siblings ...)
2024-07-24 12:28 ` syzbot
@ 2024-07-24 13:40 ` syzbot
2024-07-24 14:13 ` syzbot
` (3 subsequent siblings)
11 siblings, 0 replies; 24+ messages in thread
From: syzbot @ 2024-07-24 13:40 UTC (permalink / raw)
To: linux-kernel
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.
***
Subject: Re: [syzbot] [net?] [bpf?] general protection fault in __dev_flush
Author: aha310510@gmail.com
#syz test git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
---
drivers/net/tun.c | 3 +++
net/core/dev.c | 8 +++-----
2 files changed, 6 insertions(+), 5 deletions(-)
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 9b24861464bc..095ada4a525e 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -1919,10 +1919,12 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
if (skb_xdp) {
struct bpf_prog *xdp_prog;
+ struct bpf_net_context __bpf_net_ctx, *bpf_net_ctx;
int ret;
local_bh_disable();
rcu_read_lock();
+ bpf_net_ctx = bpf_net_ctx_set(&__bpf_net_ctx);
xdp_prog = rcu_dereference(tun->xdp_prog);
if (xdp_prog) {
ret = do_xdp_generic(xdp_prog, &skb);
@@ -1932,6 +1934,7 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
goto unlock_frags;
}
}
+ bpf_net_ctx_clear(bpf_net_ctx);
rcu_read_unlock();
local_bh_enable();
}
diff --git a/net/core/dev.c b/net/core/dev.c
index 6ea1d20676fb..26f9fdd66e64 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -5126,14 +5126,11 @@ static DEFINE_STATIC_KEY_FALSE(generic_xdp_needed_key);
int do_xdp_generic(struct bpf_prog *xdp_prog, struct sk_buff **pskb)
{
- struct bpf_net_context __bpf_net_ctx, *bpf_net_ctx;
-
if (xdp_prog) {
struct xdp_buff xdp;
u32 act;
int err;
- bpf_net_ctx = bpf_net_ctx_set(&__bpf_net_ctx);
act = netif_receive_generic_xdp(pskb, &xdp, xdp_prog);
if (act != XDP_PASS) {
switch (act) {
@@ -5147,13 +5144,11 @@ int do_xdp_generic(struct bpf_prog *xdp_prog, struct sk_buff **pskb)
generic_xdp_tx(*pskb, xdp_prog);
break;
}
- bpf_net_ctx_clear(bpf_net_ctx);
return XDP_DROP;
}
}
return XDP_PASS;
out_redir:
- bpf_net_ctx_clear(bpf_net_ctx);
kfree_skb_reason(*pskb, SKB_DROP_REASON_XDP);
return XDP_DROP;
}
@@ -5475,10 +5470,13 @@ static int __netif_receive_skb_core(struct sk_buff **pskb, bool pfmemalloc,
if (static_branch_unlikely(&generic_xdp_needed_key)) {
int ret2;
+ struct bpf_net_context __bpf_net_ctx, *bpf_net_ctx;
migrate_disable();
+ bpf_net_context = bpf_net_ctx_set(&__bpf_net_ctx);
ret2 = do_xdp_generic(rcu_dereference(skb->dev->xdp_prog),
&skb);
+ bpf_net_ctx_clear(bpf_net_ctx);
migrate_enable();
if (ret2 != XDP_PASS) {
--
^ permalink raw reply related [flat|nested] 24+ messages in thread* Re: [syzbot] Re: [syzbot] [net?] [bpf?] general protection fault in __dev_flush
2024-07-19 3:59 [syzbot] [net?] [bpf?] general protection fault in __dev_flush syzbot
` (7 preceding siblings ...)
2024-07-24 13:40 ` syzbot
@ 2024-07-24 14:13 ` syzbot
2024-07-25 11:27 ` [syzbot] Re: [PATCH net] tun: Remove nested call to bpf_net_ctx_set() in do_xdp_generic() syzbot
` (2 subsequent siblings)
11 siblings, 0 replies; 24+ messages in thread
From: syzbot @ 2024-07-24 14:13 UTC (permalink / raw)
To: linux-kernel
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.
***
Subject: Re: [syzbot] [net?] [bpf?] general protection fault in __dev_flush
Author: aha310510@gmail.com
#syz test git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
---
drivers/net/tun.c | 3 +++
net/core/dev.c | 8 +++-----
2 files changed, 6 insertions(+), 5 deletions(-)
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 9b24861464bc..095ada4a525e 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -1919,10 +1919,12 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
if (skb_xdp) {
struct bpf_prog *xdp_prog;
+ struct bpf_net_context __bpf_net_ctx, *bpf_net_ctx;
int ret;
local_bh_disable();
rcu_read_lock();
+ bpf_net_ctx = bpf_net_ctx_set(&__bpf_net_ctx);
xdp_prog = rcu_dereference(tun->xdp_prog);
if (xdp_prog) {
ret = do_xdp_generic(xdp_prog, &skb);
@@ -1932,6 +1934,7 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
goto unlock_frags;
}
}
+ bpf_net_ctx_clear(bpf_net_ctx);
rcu_read_unlock();
local_bh_enable();
}
diff --git a/net/core/dev.c b/net/core/dev.c
index 6ea1d20676fb..26f9fdd66e64 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -5126,14 +5126,11 @@ static DEFINE_STATIC_KEY_FALSE(generic_xdp_needed_key);
int do_xdp_generic(struct bpf_prog *xdp_prog, struct sk_buff **pskb)
{
- struct bpf_net_context __bpf_net_ctx, *bpf_net_ctx;
-
if (xdp_prog) {
struct xdp_buff xdp;
u32 act;
int err;
- bpf_net_ctx = bpf_net_ctx_set(&__bpf_net_ctx);
act = netif_receive_generic_xdp(pskb, &xdp, xdp_prog);
if (act != XDP_PASS) {
switch (act) {
@@ -5147,13 +5144,11 @@ int do_xdp_generic(struct bpf_prog *xdp_prog, struct sk_buff **pskb)
generic_xdp_tx(*pskb, xdp_prog);
break;
}
- bpf_net_ctx_clear(bpf_net_ctx);
return XDP_DROP;
}
}
return XDP_PASS;
out_redir:
- bpf_net_ctx_clear(bpf_net_ctx);
kfree_skb_reason(*pskb, SKB_DROP_REASON_XDP);
return XDP_DROP;
}
@@ -5475,10 +5470,13 @@ static int __netif_receive_skb_core(struct sk_buff **pskb, bool pfmemalloc,
if (static_branch_unlikely(&generic_xdp_needed_key)) {
int ret2;
+ struct bpf_net_context __bpf_net_ctx, *bpf_net_ctx;
migrate_disable();
+ bpf_net_ctx = bpf_net_ctx_set(&__bpf_net_ctx);
ret2 = do_xdp_generic(rcu_dereference(skb->dev->xdp_prog),
&skb);
+ bpf_net_ctx_clear(bpf_net_ctx);
migrate_enable();
if (ret2 != XDP_PASS) {
--
^ permalink raw reply related [flat|nested] 24+ messages in thread* Re: [syzbot] Re: [PATCH net] tun: Remove nested call to bpf_net_ctx_set() in do_xdp_generic()
2024-07-19 3:59 [syzbot] [net?] [bpf?] general protection fault in __dev_flush syzbot
` (8 preceding siblings ...)
2024-07-24 14:13 ` syzbot
@ 2024-07-25 11:27 ` syzbot
2024-07-25 11:28 ` [syzbot] Re: [syzbot] [net?] [bpf?] general protection fault in __dev_flush syzbot
2024-07-25 21:40 ` [PATCH net] tun: Add missing bpf_net_ctx_clear() in do_xdp_generic() Jeongjun Park
11 siblings, 0 replies; 24+ messages in thread
From: syzbot @ 2024-07-25 11:27 UTC (permalink / raw)
To: linux-kernel
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.
***
Subject: Re: [PATCH net] tun: Remove nested call to bpf_net_ctx_set() in do_xdp_generic()
Author: aha310510@gmail.com
#syz test git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
---
net/core/dev.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/core/dev.c b/net/core/dev.c
index 6ea1d20676fb..a741000c81d8 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -5150,6 +5150,8 @@ int do_xdp_generic(struct bpf_prog *xdp_prog, struct sk_buff **pskb)
bpf_net_ctx_clear(bpf_net_ctx);
return XDP_DROP;
}
+
+ bpf_net_ctx_clear(bpf_net_ctx);
}
return XDP_PASS;
out_redir:
--
^ permalink raw reply related [flat|nested] 24+ messages in thread* Re: [syzbot] Re: [syzbot] [net?] [bpf?] general protection fault in __dev_flush
2024-07-19 3:59 [syzbot] [net?] [bpf?] general protection fault in __dev_flush syzbot
` (9 preceding siblings ...)
2024-07-25 11:27 ` [syzbot] Re: [PATCH net] tun: Remove nested call to bpf_net_ctx_set() in do_xdp_generic() syzbot
@ 2024-07-25 11:28 ` syzbot
2024-07-25 21:40 ` [PATCH net] tun: Add missing bpf_net_ctx_clear() in do_xdp_generic() Jeongjun Park
11 siblings, 0 replies; 24+ messages in thread
From: syzbot @ 2024-07-25 11:28 UTC (permalink / raw)
To: linux-kernel
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.
***
Subject: Re: [syzbot] [net?] [bpf?] general protection fault in __dev_flush
Author: aha310510@gmail.com
#syz test git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
---
net/core/dev.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/core/dev.c b/net/core/dev.c
index 6ea1d20676fb..a741000c81d8 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -5150,6 +5150,8 @@ int do_xdp_generic(struct bpf_prog *xdp_prog, struct sk_buff **pskb)
bpf_net_ctx_clear(bpf_net_ctx);
return XDP_DROP;
}
+
+ bpf_net_ctx_clear(bpf_net_ctx);
}
return XDP_PASS;
out_redir:
--
^ permalink raw reply related [flat|nested] 24+ messages in thread* [PATCH net] tun: Add missing bpf_net_ctx_clear() in do_xdp_generic()
2024-07-19 3:59 [syzbot] [net?] [bpf?] general protection fault in __dev_flush syzbot
` (10 preceding siblings ...)
2024-07-25 11:28 ` [syzbot] Re: [syzbot] [net?] [bpf?] general protection fault in __dev_flush syzbot
@ 2024-07-25 21:40 ` Jeongjun Park
2024-07-26 2:21 ` Jason Wang
` (3 more replies)
11 siblings, 4 replies; 24+ messages in thread
From: Jeongjun Park @ 2024-07-25 21:40 UTC (permalink / raw)
To: syzbot+44623300f057a28baf1e, davem, edumazet, kuba, pabeni
Cc: ast, daniel, hawk, john.fastabend, willemdebruijn.kernel,
jasowang, bigeasy, bpf, linux-kernel, netdev, syzkaller-bugs,
Jeongjun Park
There are cases where do_xdp_generic returns bpf_net_context without
clearing it. This causes various memory corruptions, so the missing
bpf_net_ctx_clear must be added.
Reported-by: syzbot+44623300f057a28baf1e@syzkaller.appspotmail.com
Fixes: fecef4cd42c6 ("tun: Assign missing bpf_net_context.")
Signed-off-by: Jeongjun Park <aha310510@gmail.com>
---
net/core/dev.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/core/dev.c b/net/core/dev.c
index 6ea1d20676fb..751d9b70e6ad 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -5150,6 +5150,7 @@ int do_xdp_generic(struct bpf_prog *xdp_prog, struct sk_buff **pskb)
bpf_net_ctx_clear(bpf_net_ctx);
return XDP_DROP;
}
+ bpf_net_ctx_clear(bpf_net_ctx);
}
return XDP_PASS;
out_redir:
--
^ permalink raw reply related [flat|nested] 24+ messages in thread* Re: [PATCH net] tun: Add missing bpf_net_ctx_clear() in do_xdp_generic()
2024-07-25 21:40 ` [PATCH net] tun: Add missing bpf_net_ctx_clear() in do_xdp_generic() Jeongjun Park
@ 2024-07-26 2:21 ` Jason Wang
2024-07-26 3:03 ` Willem de Bruijn
2024-07-26 14:41 ` Jakub Kicinski
` (2 subsequent siblings)
3 siblings, 1 reply; 24+ messages in thread
From: Jason Wang @ 2024-07-26 2:21 UTC (permalink / raw)
To: Jeongjun Park
Cc: syzbot+44623300f057a28baf1e, davem, edumazet, kuba, pabeni, ast,
daniel, hawk, john.fastabend, willemdebruijn.kernel, bigeasy, bpf,
linux-kernel, netdev, syzkaller-bugs
On Fri, Jul 26, 2024 at 5:41 AM Jeongjun Park <aha310510@gmail.com> wrote:
>
> There are cases where do_xdp_generic returns bpf_net_context without
> clearing it. This causes various memory corruptions, so the missing
> bpf_net_ctx_clear must be added.
>
> Reported-by: syzbot+44623300f057a28baf1e@syzkaller.appspotmail.com
> Fixes: fecef4cd42c6 ("tun: Assign missing bpf_net_context.")
> Signed-off-by: Jeongjun Park <aha310510@gmail.com>
Acked-by: Jason Wang <jasowang@redhat.com>
(Looks like the do_xdp_generic() needs some tweak for example we can
merge the two paths for XDP_DROP at least).
Thanks
> ---
> net/core/dev.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/net/core/dev.c b/net/core/dev.c
> index 6ea1d20676fb..751d9b70e6ad 100644
> --- a/net/core/dev.c
> +++ b/net/core/dev.c
> @@ -5150,6 +5150,7 @@ int do_xdp_generic(struct bpf_prog *xdp_prog, struct sk_buff **pskb)
> bpf_net_ctx_clear(bpf_net_ctx);
> return XDP_DROP;
> }
> + bpf_net_ctx_clear(bpf_net_ctx);
> }
> return XDP_PASS;
> out_redir:
> --
>
^ permalink raw reply [flat|nested] 24+ messages in thread* Re: [PATCH net] tun: Add missing bpf_net_ctx_clear() in do_xdp_generic()
2024-07-26 2:21 ` Jason Wang
@ 2024-07-26 3:03 ` Willem de Bruijn
0 siblings, 0 replies; 24+ messages in thread
From: Willem de Bruijn @ 2024-07-26 3:03 UTC (permalink / raw)
To: Jason Wang
Cc: Jeongjun Park, syzbot+44623300f057a28baf1e, davem, edumazet, kuba,
pabeni, ast, daniel, hawk, john.fastabend, bigeasy, bpf,
linux-kernel, netdev, syzkaller-bugs
On Thu, Jul 25, 2024 at 10:21 PM Jason Wang <jasowang@redhat.com> wrote:
>
> On Fri, Jul 26, 2024 at 5:41 AM Jeongjun Park <aha310510@gmail.com> wrote:
> >
> > There are cases where do_xdp_generic returns bpf_net_context without
> > clearing it. This causes various memory corruptions, so the missing
> > bpf_net_ctx_clear must be added.
> >
> > Reported-by: syzbot+44623300f057a28baf1e@syzkaller.appspotmail.com
> > Fixes: fecef4cd42c6 ("tun: Assign missing bpf_net_context.")
> > Signed-off-by: Jeongjun Park <aha310510@gmail.com>
>
> Acked-by: Jason Wang <jasowang@redhat.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
^ permalink raw reply [flat|nested] 24+ messages in thread
* Re: [PATCH net] tun: Add missing bpf_net_ctx_clear() in do_xdp_generic()
2024-07-25 21:40 ` [PATCH net] tun: Add missing bpf_net_ctx_clear() in do_xdp_generic() Jeongjun Park
2024-07-26 2:21 ` Jason Wang
@ 2024-07-26 14:41 ` Jakub Kicinski
2024-07-27 2:16 ` Jeongjun Park
2024-07-27 2:28 ` Jeongjun Park
2024-07-29 10:08 ` patchwork-bot+netdevbpf
3 siblings, 1 reply; 24+ messages in thread
From: Jakub Kicinski @ 2024-07-26 14:41 UTC (permalink / raw)
To: Jeongjun Park
Cc: syzbot+44623300f057a28baf1e, davem, edumazet, pabeni, ast, daniel,
hawk, john.fastabend, willemdebruijn.kernel, jasowang, bigeasy,
bpf, linux-kernel, netdev, syzkaller-bugs
On Fri, 26 Jul 2024 06:40:49 +0900 Jeongjun Park wrote:
> There are cases where do_xdp_generic returns bpf_net_context without
> clearing it. This causes various memory corruptions, so the missing
> bpf_net_ctx_clear must be added.
>
> Reported-by: syzbot+44623300f057a28baf1e@syzkaller.appspotmail.com
> Fixes: fecef4cd42c6 ("tun: Assign missing bpf_net_context.")
> Signed-off-by: Jeongjun Park <aha310510@gmail.com>
Also likely:
Reported-by: syzbot+3c2b6d5d4bec3b904933@syzkaller.appspotmail.com
Reported-by: syzbot+707d98c8649695eaf329@syzkaller.appspotmail.com
Right?
^ permalink raw reply [flat|nested] 24+ messages in thread* [PATCH net] tun: Add missing bpf_net_ctx_clear() in do_xdp_generic()
2024-07-26 14:41 ` Jakub Kicinski
@ 2024-07-27 2:16 ` Jeongjun Park
0 siblings, 0 replies; 24+ messages in thread
From: Jeongjun Park @ 2024-07-27 2:16 UTC (permalink / raw)
To: kuba
Cc: aha310510, ast, bigeasy, bpf, daniel, davem, edumazet, hawk,
jasowang, john.fastabend, linux-kernel, netdev, pabeni,
syzbot+44623300f057a28baf1e, syzkaller-bugs,
willemdebruijn.kernel
Jakub Kicinski wrote:
>
> On Fri, 26 Jul 2024 06:40:49 +0900 Jeongjun Park wrote:
> > There are cases where do_xdp_generic returns bpf_net_context without
> > clearing it. This causes various memory corruptions, so the missing
> > bpf_net_ctx_clear must be added.
> >
> > Reported-by: syzbot+44623300f057a28baf1e@syzkaller.appspotmail.com
> > Fixes: fecef4cd42c6 ("tun: Assign missing bpf_net_context.")
> > Signed-off-by: Jeongjun Park <aha310510@gmail.com>
>
> Also likely:
>
> Reported-by: syzbot+3c2b6d5d4bec3b904933@syzkaller.appspotmail.com
> Reported-by: syzbot+707d98c8649695eaf329@syzkaller.appspotmail.com
>
> Right?
Yes, both appear to be bugs with the same root cause.
Regards,
Jeongjun Park
^ permalink raw reply [flat|nested] 24+ messages in thread
* Re: [PATCH net] tun: Add missing bpf_net_ctx_clear() in do_xdp_generic()
2024-07-25 21:40 ` [PATCH net] tun: Add missing bpf_net_ctx_clear() in do_xdp_generic() Jeongjun Park
2024-07-26 2:21 ` Jason Wang
2024-07-26 14:41 ` Jakub Kicinski
@ 2024-07-27 2:28 ` Jeongjun Park
2024-07-29 10:08 ` patchwork-bot+netdevbpf
3 siblings, 0 replies; 24+ messages in thread
From: Jeongjun Park @ 2024-07-27 2:28 UTC (permalink / raw)
To: aha310510
Cc: ast, bigeasy, bpf, daniel, davem, edumazet, hawk, jasowang,
john.fastabend, kuba, linux-kernel, netdev, pabeni,
syzbot+44623300f057a28baf1e, syzkaller-bugs,
willemdebruijn.kernel, syzbot+c226757eb784a9da3e8b,
syzbot+61a1cfc2b6632363d319, syzbot+709e4c85c904bcd62735
On Fri, 26 Jul 2024 06:40:49 +0900 Jeongjun Park wrote:
> There are cases where do_xdp_generic returns bpf_net_context without
> clearing it. This causes various memory corruptions, so the missing
> bpf_net_ctx_clear must be added.
>
> Reported-by: syzbot+44623300f057a28baf1e@syzkaller.appspotmail.com
> Fixes: fecef4cd42c6 ("tun: Assign missing bpf_net_context.")
> Signed-off-by: Jeongjun Park <aha310510@gmail.com>
Reported-by: syzbot+c226757eb784a9da3e8b@syzkaller.appspotmail.com
Reported-by: syzbot+61a1cfc2b6632363d319@syzkaller.appspotmail.com
Reported-by: syzbot+709e4c85c904bcd62735@syzkaller.appspotmail.com
After searching, I found reports with the same root cause, so I added
them.
^ permalink raw reply [flat|nested] 24+ messages in thread* Re: [PATCH net] tun: Add missing bpf_net_ctx_clear() in do_xdp_generic()
2024-07-25 21:40 ` [PATCH net] tun: Add missing bpf_net_ctx_clear() in do_xdp_generic() Jeongjun Park
` (2 preceding siblings ...)
2024-07-27 2:28 ` Jeongjun Park
@ 2024-07-29 10:08 ` patchwork-bot+netdevbpf
3 siblings, 0 replies; 24+ messages in thread
From: patchwork-bot+netdevbpf @ 2024-07-29 10:08 UTC (permalink / raw)
To: Jeongjun Park
Cc: syzbot+44623300f057a28baf1e, davem, edumazet, kuba, pabeni, ast,
daniel, hawk, john.fastabend, willemdebruijn.kernel, jasowang,
bigeasy, bpf, linux-kernel, netdev, syzkaller-bugs
Hello:
This patch was applied to netdev/net.git (main)
by David S. Miller <davem@davemloft.net>:
On Fri, 26 Jul 2024 06:40:49 +0900 you wrote:
> There are cases where do_xdp_generic returns bpf_net_context without
> clearing it. This causes various memory corruptions, so the missing
> bpf_net_ctx_clear must be added.
>
> Reported-by: syzbot+44623300f057a28baf1e@syzkaller.appspotmail.com
> Fixes: fecef4cd42c6 ("tun: Assign missing bpf_net_context.")
> Signed-off-by: Jeongjun Park <aha310510@gmail.com>
>
> [...]
Here is the summary with links:
- [net] tun: Add missing bpf_net_ctx_clear() in do_xdp_generic()
https://git.kernel.org/netdev/net/c/9da49aa80d68
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 24+ messages in thread