Re: [syzbot] [rdma?] INFO: trying to register non-static key in skb

netdev.vger.kernel.org archive mirror
 help / color / mirror / Atom feed

* Re: [syzbot] [rdma?] INFO: trying to register non-static key in skb_dequeue (2)
       [not found] <000000000000235bce05fac5f850@google.com>
@ 2023-05-18  9:20 ` syzbot
  2023-05-23  2:07   ` Guoqing Jiang
  0 siblings, 1 reply; 22+ messages in thread
From: syzbot @ 2023-05-18  9:20 UTC (permalink / raw)
  To: jgg, leon, linux-kernel, linux-rdma, netdev, syzkaller-bugs,
	zyjzyj2000

syzbot has found a reproducer for the following issue on:

HEAD commit:    ab87603b2511 net: wwan: t7xx: Ensure init is completed bef..
git tree:       net
console output: https://syzkaller.appspot.com/x/log.txt?x=1157266a280000
kernel config:  https://syzkaller.appspot.com/x/.config?x=eb92acf166a5d2cd
dashboard link: https://syzkaller.appspot.com/bug?extid=eba589d8f49c73d356da
compiler:       gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=124d5da6280000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/ac3ed2228400/disk-ab87603b.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/c51b74034116/vmlinux-ab87603b.xz
kernel image: https://storage.googleapis.com/syzbot-assets/98ab9d7ee1ee/bzImage-ab87603b.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+eba589d8f49c73d356da@syzkaller.appspotmail.com

infiniband syz2: set active
infiniband syz2: added team0
INFO: trying to register non-static key.
The code is fine but needs lockdep annotation, or maybe
you didn't initialize this object before use?
turning off the locking correctness validator.
CPU: 0 PID: 5133 Comm: syz-executor.3 Not tainted 6.4.0-rc1-syzkaller-00136-gab87603b2511 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xd9/0x150 lib/dump_stack.c:106
 assign_lock_key kernel/locking/lockdep.c:982 [inline]
 register_lock_class+0xdb6/0x1120 kernel/locking/lockdep.c:1295
 __lock_acquire+0x10a/0x5df0 kernel/locking/lockdep.c:4951
 lock_acquire kernel/locking/lockdep.c:5691 [inline]
 lock_acquire+0x1b1/0x520 kernel/locking/lockdep.c:5656
 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
 _raw_spin_lock_irqsave+0x3d/0x60 kernel/locking/spinlock.c:162
 skb_dequeue+0x20/0x180 net/core/skbuff.c:3639
 drain_resp_pkts drivers/infiniband/sw/rxe/rxe_comp.c:555 [inline]
 rxe_completer+0x250d/0x3cc0 drivers/infiniband/sw/rxe/rxe_comp.c:652
 rxe_qp_do_cleanup+0x1be/0x820 drivers/infiniband/sw/rxe/rxe_qp.c:761
 execute_in_process_context+0x3b/0x150 kernel/workqueue.c:3473
 __rxe_cleanup+0x21e/0x370 drivers/infiniband/sw/rxe/rxe_pool.c:233
 rxe_create_qp+0x3f6/0x5f0 drivers/infiniband/sw/rxe/rxe_verbs.c:583
 create_qp+0x5ac/0x970 drivers/infiniband/core/verbs.c:1235
 ib_create_qp_kernel+0xa1/0x310 drivers/infiniband/core/verbs.c:1346
 ib_create_qp include/rdma/ib_verbs.h:3743 [inline]
 create_mad_qp+0x177/0x380 drivers/infiniband/core/mad.c:2905
 ib_mad_port_open drivers/infiniband/core/mad.c:2986 [inline]
 ib_mad_init_device+0xf40/0x1a90 drivers/infiniband/core/mad.c:3077
 add_client_context+0x405/0x5e0 drivers/infiniband/core/device.c:721
 enable_device_and_get+0x1cd/0x3b0 drivers/infiniband/core/device.c:1332
 ib_register_device drivers/infiniband/core/device.c:1420 [inline]
 ib_register_device+0x8b1/0xbc0 drivers/infiniband/core/device.c:1366
 rxe_register_device+0x302/0x3e0 drivers/infiniband/sw/rxe/rxe_verbs.c:1485
 rxe_net_add+0x90/0xf0 drivers/infiniband/sw/rxe/rxe_net.c:527
 rxe_newlink+0xf0/0x1b0 drivers/infiniband/sw/rxe/rxe.c:197
 nldev_newlink+0x332/0x5e0 drivers/infiniband/core/nldev.c:1731
 rdma_nl_rcv_msg+0x371/0x6a0 drivers/infiniband/core/netlink.c:195
 rdma_nl_rcv_skb.constprop.0.isra.0+0x2fc/0x440 drivers/infiniband/core/netlink.c:239
 netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline]
 netlink_unicast+0x547/0x7f0 net/netlink/af_netlink.c:1365
 netlink_sendmsg+0x925/0xe30 net/netlink/af_netlink.c:1913
 sock_sendmsg_nosec net/socket.c:724 [inline]
 sock_sendmsg+0xde/0x190 net/socket.c:747
 ____sys_sendmsg+0x71c/0x900 net/socket.c:2503
 ___sys_sendmsg+0x110/0x1b0 net/socket.c:2557
 __sys_sendmsg+0xf7/0x1c0 net/socket.c:2586
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f7a1ee8c169
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f7a1fc76168 EFLAGS: 00000246
 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f7a1efabf80 RCX: 00007f7a1ee8c169
RDX: 0000000000000040 RSI: 0000000020000200 RDI: 0000000000000003
RBP: 00007f7a1eee7ca1 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fffc46ccb6f R14: 00007f7a1fc76300 R15: 0000000000022000
 </TASK>
general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037]
CPU: 0 PID: 5133 Comm: syz-executor.3 Not tainted 6.4.0-rc1-syzkaller-00136-gab87603b2511 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023
RIP: 0010:flush_send_queue drivers/infiniband/sw/rxe/rxe_comp.c:597 [inline]
RIP: 0010:rxe_completer+0x255c/0x3cc0 drivers/infiniband/sw/rxe/rxe_comp.c:653
Code: 80 3c 02 00 0f 85 81 10 00 00 49 8b af 88 03 00 00 48 8d 45 30 48 89 c2 48 89 04 24 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 83 11 00 00 48 8d 45 2c 44 8b
RSP: 0018:ffffc9000419e938 EFLAGS: 00010206
RAX: dffffc0000000000 RBX: ffffed100f5fb800 RCX: 0000000000000000
RDX: 0000000000000006 RSI: ffffffff877f3bea RDI: ffff88807afdc388
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: fffffbfff1cf4e42 R11: 205d313330355420 R12: ffff88807afdc1a0
R13: 0000000000000000 R14: 0000000000000000 R15: ffff88807afdc000
FS:  00007f7a1fc76700(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000c001136000 CR3: 00000000206d3000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 rxe_qp_do_cleanup+0x1be/0x820 drivers/infiniband/sw/rxe/rxe_qp.c:761
 execute_in_process_context+0x3b/0x150 kernel/workqueue.c:3473
 __rxe_cleanup+0x21e/0x370 drivers/infiniband/sw/rxe/rxe_pool.c:233
 rxe_create_qp+0x3f6/0x5f0 drivers/infiniband/sw/rxe/rxe_verbs.c:583
 create_qp+0x5ac/0x970 drivers/infiniband/core/verbs.c:1235
 ib_create_qp_kernel+0xa1/0x310 drivers/infiniband/core/verbs.c:1346
 ib_create_qp include/rdma/ib_verbs.h:3743 [inline]
 create_mad_qp+0x177/0x380 drivers/infiniband/core/mad.c:2905
 ib_mad_port_open drivers/infiniband/core/mad.c:2986 [inline]
 ib_mad_init_device+0xf40/0x1a90 drivers/infiniband/core/mad.c:3077
 add_client_context+0x405/0x5e0 drivers/infiniband/core/device.c:721
 enable_device_and_get+0x1cd/0x3b0 drivers/infiniband/core/device.c:1332
 ib_register_device drivers/infiniband/core/device.c:1420 [inline]
 ib_register_device+0x8b1/0xbc0 drivers/infiniband/core/device.c:1366
 rxe_register_device+0x302/0x3e0 drivers/infiniband/sw/rxe/rxe_verbs.c:1485
 rxe_net_add+0x90/0xf0 drivers/infiniband/sw/rxe/rxe_net.c:527
 rxe_newlink+0xf0/0x1b0 drivers/infiniband/sw/rxe/rxe.c:197
 nldev_newlink+0x332/0x5e0 drivers/infiniband/core/nldev.c:1731
 rdma_nl_rcv_msg+0x371/0x6a0 drivers/infiniband/core/netlink.c:195
 rdma_nl_rcv_skb.constprop.0.isra.0+0x2fc/0x440 drivers/infiniband/core/netlink.c:239
 netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline]
 netlink_unicast+0x547/0x7f0 net/netlink/af_netlink.c:1365
 netlink_sendmsg+0x925/0xe30 net/netlink/af_netlink.c:1913
 sock_sendmsg_nosec net/socket.c:724 [inline]
 sock_sendmsg+0xde/0x190 net/socket.c:747
 ____sys_sendmsg+0x71c/0x900 net/socket.c:2503
 ___sys_sendmsg+0x110/0x1b0 net/socket.c:2557
 __sys_sendmsg+0xf7/0x1c0 net/socket.c:2586
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f7a1ee8c169
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f7a1fc76168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f7a1efabf80 RCX: 00007f7a1ee8c169
RDX: 0000000000000040 RSI: 0000000020000200 RDI: 0000000000000003
RBP: 00007f7a1eee7ca1 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fffc46ccb6f R14: 00007f7a1fc76300 R15: 0000000000022000
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:flush_send_queue drivers/infiniband/sw/rxe/rxe_comp.c:597 [inline]
RIP: 0010:rxe_completer+0x255c/0x3cc0 drivers/infiniband/sw/rxe/rxe_comp.c:653
Code: 80 3c 02 00 0f 85 81 10 00 00 49 8b af 88 03 00 00 48 8d 45 30 48 89 c2 48 89 04 24 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 83 11 00 00 48 8d 45 2c 44 8b
RSP: 0018:ffffc9000419e938 EFLAGS: 00010206
RAX: dffffc0000000000 RBX: ffffed100f5fb800 RCX: 0000000000000000
RDX: 0000000000000006 RSI: ffffffff877f3bea RDI: ffff88807afdc388
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: fffffbfff1cf4e42 R11: 205d313330355420 R12: ffff88807afdc1a0
R13: 0000000000000000 R14: 0000000000000000 R15: ffff88807afdc000
FS:  00007f7a1fc76700(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000c001136000 CR3: 00000000206d3000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	80 3c 02 00          	cmpb   $0x0,(%rdx,%rax,1)
   4:	0f 85 81 10 00 00    	jne    0x108b
   a:	49 8b af 88 03 00 00 	mov    0x388(%r15),%rbp
  11:	48 8d 45 30          	lea    0x30(%rbp),%rax
  15:	48 89 c2             	mov    %rax,%rdx
  18:	48 89 04 24          	mov    %rax,(%rsp)
  1c:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  23:	fc ff df
  26:	48 c1 ea 03          	shr    $0x3,%rdx
* 2a:	0f b6 04 02          	movzbl (%rdx,%rax,1),%eax <-- trapping instruction
  2e:	84 c0                	test   %al,%al
  30:	74 08                	je     0x3a
  32:	3c 03                	cmp    $0x3,%al
  34:	0f 8e 83 11 00 00    	jle    0x11bd
  3a:	48 8d 45 2c          	lea    0x2c(%rbp),%rax
  3e:	44                   	rex.R
  3f:	8b                   	.byte 0x8b


---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

^ permalink raw reply	[flat|nested] 22+ messages in thread

* Re: [syzbot] [rdma?] INFO: trying to register non-static key in skb_dequeue (2)
  2023-05-18  9:20 ` [syzbot] [rdma?] INFO: trying to register non-static key in skb_dequeue (2) syzbot
@ 2023-05-23  2:07   ` Guoqing Jiang
  2023-05-23  2:13     ` syzbot
  0 siblings, 1 reply; 22+ messages in thread
From: Guoqing Jiang @ 2023-05-23  2:07 UTC (permalink / raw)
  To: syzbot, jgg, leon, linux-kernel, linux-rdma, netdev,
	syzkaller-bugs, zyjzyj2000



On 5/18/23 17:20, syzbot wrote:
> syzbot has found a reproducer for the following issue on:
>
> HEAD commit:    ab87603b2511 net: wwan: t7xx: Ensure init is completed bef..
> git tree:       net
> console output: https://syzkaller.appspot.com/x/log.txt?x=1157266a280000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=eb92acf166a5d2cd
> dashboard link: https://syzkaller.appspot.com/bug?extid=eba589d8f49c73d356da
> compiler:       gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=124d5da6280000
>
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/ac3ed2228400/disk-ab87603b.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/c51b74034116/vmlinux-ab87603b.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/98ab9d7ee1ee/bzImage-ab87603b.xz
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+eba589d8f49c73d356da@syzkaller.appspotmail.com
>
> infiniband syz2: set active
> infiniband syz2: added team0
> INFO: trying to register non-static key.
> The code is fine but needs lockdep annotation, or maybe
> you didn't initialize this object before use?
> turning off the locking correctness validator.
> CPU: 0 PID: 5133 Comm: syz-executor.3 Not tainted 6.4.0-rc1-syzkaller-00136-gab87603b2511 #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023
> Call Trace:
>   <TASK>
>   __dump_stack lib/dump_stack.c:88 [inline]
>   dump_stack_lvl+0xd9/0x150 lib/dump_stack.c:106
>   assign_lock_key kernel/locking/lockdep.c:982 [inline]
>   register_lock_class+0xdb6/0x1120 kernel/locking/lockdep.c:1295
>   __lock_acquire+0x10a/0x5df0 kernel/locking/lockdep.c:4951
>   lock_acquire kernel/locking/lockdep.c:5691 [inline]
>   lock_acquire+0x1b1/0x520 kernel/locking/lockdep.c:5656
>   __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
>   _raw_spin_lock_irqsave+0x3d/0x60 kernel/locking/spinlock.c:162
>   skb_dequeue+0x20/0x180 net/core/skbuff.c:3639
>   drain_resp_pkts drivers/infiniband/sw/rxe/rxe_comp.c:555 [inline]
>   rxe_completer+0x250d/0x3cc0 drivers/infiniband/sw/rxe/rxe_comp.c:652
>   rxe_qp_do_cleanup+0x1be/0x820 drivers/infiniband/sw/rxe/rxe_qp.c:761
>   execute_in_process_context+0x3b/0x150 kernel/workqueue.c:3473
>   __rxe_cleanup+0x21e/0x370 drivers/infiniband/sw/rxe/rxe_pool.c:233
>   rxe_create_qp+0x3f6/0x5f0 drivers/infiniband/sw/rxe/rxe_verbs.c:583
>   create_qp+0x5ac/0x970 drivers/infiniband/core/verbs.c:1235
>   ib_create_qp_kernel+0xa1/0x310 drivers/infiniband/core/verbs.c:1346
>   ib_create_qp include/rdma/ib_verbs.h:3743 [inline]
>   create_mad_qp+0x177/0x380 drivers/infiniband/core/mad.c:2905
>   ib_mad_port_open drivers/infiniband/core/mad.c:2986 [inline]
>   ib_mad_init_device+0xf40/0x1a90 drivers/infiniband/core/mad.c:3077
>   add_client_context+0x405/0x5e0 drivers/infiniband/core/device.c:721
>   enable_device_and_get+0x1cd/0x3b0 drivers/infiniband/core/device.c:1332
>   ib_register_device drivers/infiniband/core/device.c:1420 [inline]
>   ib_register_device+0x8b1/0xbc0 drivers/infiniband/core/device.c:1366
>   rxe_register_device+0x302/0x3e0 drivers/infiniband/sw/rxe/rxe_verbs.c:1485
>   rxe_net_add+0x90/0xf0 drivers/infiniband/sw/rxe/rxe_net.c:527
>   rxe_newlink+0xf0/0x1b0 drivers/infiniband/sw/rxe/rxe.c:197
>   nldev_newlink+0x332/0x5e0 drivers/infiniband/core/nldev.c:1731
>   rdma_nl_rcv_msg+0x371/0x6a0 drivers/infiniband/core/netlink.c:195
>   rdma_nl_rcv_skb.constprop.0.isra.0+0x2fc/0x440 drivers/infiniband/core/netlink.c:239
>   netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline]
>   netlink_unicast+0x547/0x7f0 net/netlink/af_netlink.c:1365
>   netlink_sendmsg+0x925/0xe30 net/netlink/af_netlink.c:1913
>   sock_sendmsg_nosec net/socket.c:724 [inline]
>   sock_sendmsg+0xde/0x190 net/socket.c:747
>   ____sys_sendmsg+0x71c/0x900 net/socket.c:2503
>   ___sys_sendmsg+0x110/0x1b0 net/socket.c:2557
>   __sys_sendmsg+0xf7/0x1c0 net/socket.c:2586
>   do_syscall_x64 arch/x86/entry/common.c:50 [inline]
>   do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
>   entry_SYSCALL_64_after_hwframe+0x63/0xcd
> RIP: 0033:0x7f7a1ee8c169
> Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
> RSP: 002b:00007f7a1fc76168 EFLAGS: 00000246
>   ORIG_RAX: 000000000000002e
> RAX: ffffffffffffffda RBX: 00007f7a1efabf80 RCX: 00007f7a1ee8c169
> RDX: 0000000000000040 RSI: 0000000020000200 RDI: 0000000000000003
> RBP: 00007f7a1eee7ca1 R08: 0000000000000000 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
> R13: 00007fffc46ccb6f R14: 00007f7a1fc76300 R15: 0000000000022000
>   </TASK>
> general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN
> KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037]
> CPU: 0 PID: 5133 Comm: syz-executor.3 Not tainted 6.4.0-rc1-syzkaller-00136-gab87603b2511 #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023
> RIP: 0010:flush_send_queue drivers/infiniband/sw/rxe/rxe_comp.c:597 [inline]
> RIP: 0010:rxe_completer+0x255c/0x3cc0 drivers/infiniband/sw/rxe/rxe_comp.c:653
> Code: 80 3c 02 00 0f 85 81 10 00 00 49 8b af 88 03 00 00 48 8d 45 30 48 89 c2 48 89 04 24 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 83 11 00 00 48 8d 45 2c 44 8b
> RSP: 0018:ffffc9000419e938 EFLAGS: 00010206
> RAX: dffffc0000000000 RBX: ffffed100f5fb800 RCX: 0000000000000000
> RDX: 0000000000000006 RSI: ffffffff877f3bea RDI: ffff88807afdc388
> RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
> R10: fffffbfff1cf4e42 R11: 205d313330355420 R12: ffff88807afdc1a0
> R13: 0000000000000000 R14: 0000000000000000 R15: ffff88807afdc000
> FS:  00007f7a1fc76700(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 000000c001136000 CR3: 00000000206d3000 CR4: 00000000003506f0
> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> Call Trace:
>   <TASK>
>   rxe_qp_do_cleanup+0x1be/0x820 drivers/infiniband/sw/rxe/rxe_qp.c:761
>   execute_in_process_context+0x3b/0x150 kernel/workqueue.c:3473
>   __rxe_cleanup+0x21e/0x370 drivers/infiniband/sw/rxe/rxe_pool.c:233
>   rxe_create_qp+0x3f6/0x5f0 drivers/infiniband/sw/rxe/rxe_verbs.c:583
>   create_qp+0x5ac/0x970 drivers/infiniband/core/verbs.c:1235
>   ib_create_qp_kernel+0xa1/0x310 drivers/infiniband/core/verbs.c:1346
>   ib_create_qp include/rdma/ib_verbs.h:3743 [inline]
>   create_mad_qp+0x177/0x380 drivers/infiniband/core/mad.c:2905
>   ib_mad_port_open drivers/infiniband/core/mad.c:2986 [inline]
>   ib_mad_init_device+0xf40/0x1a90 drivers/infiniband/core/mad.c:3077
>   add_client_context+0x405/0x5e0 drivers/infiniband/core/device.c:721
>   enable_device_and_get+0x1cd/0x3b0 drivers/infiniband/core/device.c:1332
>   ib_register_device drivers/infiniband/core/device.c:1420 [inline]
>   ib_register_device+0x8b1/0xbc0 drivers/infiniband/core/device.c:1366
>   rxe_register_device+0x302/0x3e0 drivers/infiniband/sw/rxe/rxe_verbs.c:1485
>   rxe_net_add+0x90/0xf0 drivers/infiniband/sw/rxe/rxe_net.c:527
>   rxe_newlink+0xf0/0x1b0 drivers/infiniband/sw/rxe/rxe.c:197
>   nldev_newlink+0x332/0x5e0 drivers/infiniband/core/nldev.c:1731
>   rdma_nl_rcv_msg+0x371/0x6a0 drivers/infiniband/core/netlink.c:195
>   rdma_nl_rcv_skb.constprop.0.isra.0+0x2fc/0x440 drivers/infiniband/core/netlink.c:239
>   netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline]
>   netlink_unicast+0x547/0x7f0 net/netlink/af_netlink.c:1365
>   netlink_sendmsg+0x925/0xe30 net/netlink/af_netlink.c:1913
>   sock_sendmsg_nosec net/socket.c:724 [inline]
>   sock_sendmsg+0xde/0x190 net/socket.c:747
>   ____sys_sendmsg+0x71c/0x900 net/socket.c:2503
>   ___sys_sendmsg+0x110/0x1b0 net/socket.c:2557
>   __sys_sendmsg+0xf7/0x1c0 net/socket.c:2586
>   do_syscall_x64 arch/x86/entry/common.c:50 [inline]
>   do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
>   entry_SYSCALL_64_after_hwframe+0x63/0xcd
> RIP: 0033:0x7f7a1ee8c169
> Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
> RSP: 002b:00007f7a1fc76168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
> RAX: ffffffffffffffda RBX: 00007f7a1efabf80 RCX: 00007f7a1ee8c169
> RDX: 0000000000000040 RSI: 0000000020000200 RDI: 0000000000000003
> RBP: 00007f7a1eee7ca1 R08: 0000000000000000 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
> R13: 00007fffc46ccb6f R14: 00007f7a1fc76300 R15: 0000000000022000
>   </TASK>
> Modules linked in:
> ---[ end trace 0000000000000000 ]---
> RIP: 0010:flush_send_queue drivers/infiniband/sw/rxe/rxe_comp.c:597 [inline]
> RIP: 0010:rxe_completer+0x255c/0x3cc0 drivers/infiniband/sw/rxe/rxe_comp.c:653

Looks if rxe_qp_from_init returns failure, qp->sq.queue is NULL but rxe
still de-reference it during cleanup. And it is the same for sk_buff_head.

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma.git 
for-rc

diff --git a/drivers/infiniband/sw/rxe/rxe_qp.c 
b/drivers/infiniband/sw/rxe/rxe_qp.c
index 61a2eb77d999..17ed41309756 100644
--- a/drivers/infiniband/sw/rxe/rxe_qp.c
+++ b/drivers/infiniband/sw/rxe/rxe_qp.c
@@ -758,19 +758,21 @@ static void rxe_qp_do_cleanup(struct work_struct 
*work)
                 del_timer_sync(&qp->rnr_nak_timer);
         }

-       if (qp->resp.task.func)
+       /* flush out any receive wr's or pending requests */
+       if (qp->resp.task.func) {
                 rxe_cleanup_task(&qp->resp.task);
+               rxe_responder(qp);
+       }

-       if (qp->req.task.func)
+       if (qp->req.task.func) {
                 rxe_cleanup_task(&qp->req.task);
+               rxe_requester(qp);
+       }

-       if (qp->comp.task.func)
+       if (qp->comp.task.func) {
                 rxe_cleanup_task(&qp->comp.task);
-
-       /* flush out any receive wr's or pending requests */
-       rxe_requester(qp);
-       rxe_completer(qp);
-       rxe_responder(qp);
+               rxe_completer(qp);
+       }

         if (qp->sq.queue)
                 rxe_queue_cleanup(qp->sq.queue);

^ permalink raw reply related	[flat|nested] 22+ messages in thread

* Re: [syzbot] [rdma?] INFO: trying to register non-static key in skb_dequeue (2)
  2023-05-23  2:07   ` Guoqing Jiang
@ 2023-05-23  2:13     ` syzbot
  2023-05-23  2:25       ` Guoqing Jiang
  0 siblings, 1 reply; 22+ messages in thread
From: syzbot @ 2023-05-23  2:13 UTC (permalink / raw)
  To: guoqing.jiang, jgg, leon, linux-kernel, linux-rdma, netdev,
	syzkaller-bugs, zyjzyj2000

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

failed to apply patch:
checking file drivers/infiniband/sw/rxe/rxe_qp.c
patch: **** unexpected end of file in patch

Tested on:

commit:         56518a60 RDMA/hns: Modify the value of long message lo..
git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma.git for-rc
dashboard link: https://syzkaller.appspot.com/bug?extid=eba589d8f49c73d356da
compiler:       
patch:          https://syzkaller.appspot.com/x/patch.diff?x=132bea5a280000

^ permalink raw reply	[flat|nested] 22+ messages in thread

* Re: [syzbot] [rdma?] INFO: trying to register non-static key in skb_dequeue (2)
  2023-05-23  2:13     ` syzbot
@ 2023-05-23  2:25       ` Guoqing Jiang
  2023-05-23  2:55         ` syzbot
  2023-05-23  3:47         ` Zhu Yanjun
  0 siblings, 2 replies; 22+ messages in thread
From: Guoqing Jiang @ 2023-05-23  2:25 UTC (permalink / raw)
  To: syzbot, jgg, leon, linux-kernel, linux-rdma, netdev,
	syzkaller-bugs, zyjzyj2000

[-- Attachment #1: Type: text/plain, Size: 707 bytes --]



On 5/23/23 10:13, syzbot wrote:
> Hello,
>
> syzbot tried to test the proposed patch but the build/boot failed:
>
> failed to apply patch:
> checking file drivers/infiniband/sw/rxe/rxe_qp.c
> patch: **** unexpected end of file in patch
>
>
>
> Tested on:
>
> commit:         56518a60 RDMA/hns: Modify the value of long message lo..
> git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma.git for-rc
> dashboard link: https://syzkaller.appspot.com/bug?extid=eba589d8f49c73d356da
> compiler:
> patch:          https://syzkaller.appspot.com/x/patch.diff?x=132bea5a280000
>

Sorry, let me attach the temp patch.

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma.git 
for-rc

[-- Attachment #2: temp-rxe.patch --]
[-- Type: text/x-patch, Size: 915 bytes --]

diff --git a/drivers/infiniband/sw/rxe/rxe_qp.c b/drivers/infiniband/sw/rxe/rxe_qp.c
index 61a2eb77d999..17ed41309756 100644
--- a/drivers/infiniband/sw/rxe/rxe_qp.c
+++ b/drivers/infiniband/sw/rxe/rxe_qp.c
@@ -758,19 +758,21 @@ static void rxe_qp_do_cleanup(struct work_struct *work)
 		del_timer_sync(&qp->rnr_nak_timer);
 	}
 
-	if (qp->resp.task.func)
+	/* flush out any receive wr's or pending requests */
+	if (qp->resp.task.func) {
 		rxe_cleanup_task(&qp->resp.task);
+		rxe_responder(qp);
+	}
 
-	if (qp->req.task.func)
+	if (qp->req.task.func) {
 		rxe_cleanup_task(&qp->req.task);
+		rxe_requester(qp);
+	}
 
-	if (qp->comp.task.func)
+	if (qp->comp.task.func) {
 		rxe_cleanup_task(&qp->comp.task);
-
-	/* flush out any receive wr's or pending requests */
-	rxe_requester(qp);
-	rxe_completer(qp);
-	rxe_responder(qp);
+		rxe_completer(qp);
+	}
 
 	if (qp->sq.queue)
 		rxe_queue_cleanup(qp->sq.queue);

^ permalink raw reply related	[flat|nested] 22+ messages in thread

* Re: [syzbot] [rdma?] INFO: trying to register non-static key in skb_dequeue (2)
  2023-05-23  2:25       ` Guoqing Jiang
@ 2023-05-23  2:55         ` syzbot
  2023-05-23  3:47         ` Zhu Yanjun
  1 sibling, 0 replies; 22+ messages in thread
From: syzbot @ 2023-05-23  2:55 UTC (permalink / raw)
  To: guoqing.jiang, jgg, leon, linux-kernel, linux-rdma, netdev,
	syzkaller-bugs, zyjzyj2000

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-and-tested-by: syzbot+eba589d8f49c73d356da@syzkaller.appspotmail.com

Tested on:

commit:         56518a60 RDMA/hns: Modify the value of long message lo..
git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma.git for-rc
console output: https://syzkaller.appspot.com/x/log.txt?x=1100bb5e280000
kernel config:  https://syzkaller.appspot.com/x/.config?x=8bc832f563d8bf38
dashboard link: https://syzkaller.appspot.com/bug?extid=eba589d8f49c73d356da
compiler:       gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
patch:          https://syzkaller.appspot.com/x/patch.diff?x=10847e2e280000

Note: testing is done by a robot and is best-effort only.

^ permalink raw reply	[flat|nested] 22+ messages in thread

* Re: [syzbot] [rdma?] INFO: trying to register non-static key in skb_dequeue (2)
  2023-05-23  2:25       ` Guoqing Jiang
  2023-05-23  2:55         ` syzbot
@ 2023-05-23  3:47         ` Zhu Yanjun
  2023-05-23  3:58           ` Guoqing Jiang
  2023-05-23  4:02           ` Zhu Yanjun
  1 sibling, 2 replies; 22+ messages in thread
From: Zhu Yanjun @ 2023-05-23  3:47 UTC (permalink / raw)
  To: Guoqing Jiang
  Cc: syzbot, jgg, leon, linux-kernel, linux-rdma, netdev,
	syzkaller-bugs

On Tue, May 23, 2023 at 10:26 AM Guoqing Jiang <guoqing.jiang@linux.dev> wrote:
>
>
>
> On 5/23/23 10:13, syzbot wrote:
> > Hello,
> >
> > syzbot tried to test the proposed patch but the build/boot failed:
> >
> > failed to apply patch:
> > checking file drivers/infiniband/sw/rxe/rxe_qp.c
> > patch: **** unexpected end of file in patch

This is not the root cause. The fix is not good.

Zhu Yanjun

> >
> >
> >
> > Tested on:
> >
> > commit:         56518a60 RDMA/hns: Modify the value of long message lo..
> > git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma.git for-rc
> > dashboard link: https://syzkaller.appspot.com/bug?extid=eba589d8f49c73d356da
> > compiler:
> > patch:          https://syzkaller.appspot.com/x/patch.diff?x=132bea5a280000
> >
>
> Sorry, let me attach the temp patch.
>
> #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma.git
> for-rc

^ permalink raw reply	[flat|nested] 22+ messages in thread

* Re: [syzbot] [rdma?] INFO: trying to register non-static key in skb_dequeue (2)
  2023-05-23  3:47         ` Zhu Yanjun
@ 2023-05-23  3:58           ` Guoqing Jiang
  2023-05-23  4:02           ` Zhu Yanjun
  1 sibling, 0 replies; 22+ messages in thread
From: Guoqing Jiang @ 2023-05-23  3:58 UTC (permalink / raw)
  To: Zhu Yanjun
  Cc: syzbot, jgg, leon, linux-kernel, linux-rdma, netdev,
	syzkaller-bugs



On 5/23/23 11:47, Zhu Yanjun wrote:
> On Tue, May 23, 2023 at 10:26 AM Guoqing Jiang <guoqing.jiang@linux.dev> wrote:
>>
>>
>> On 5/23/23 10:13, syzbot wrote:
>>> Hello,
>>>
>>> syzbot tried to test the proposed patch but the build/boot failed:
>>>
>>> failed to apply patch:
>>> checking file drivers/infiniband/sw/rxe/rxe_qp.c
>>> patch: **** unexpected end of file in patch
> This is not the root cause. The fix is not good.

Could you explain about the root cause?

Thanks,
Guoqing

^ permalink raw reply	[flat|nested] 22+ messages in thread

* Re: [syzbot] [rdma?] INFO: trying to register non-static key in skb_dequeue (2)
  2023-05-23  3:47         ` Zhu Yanjun
  2023-05-23  3:58           ` Guoqing Jiang
@ 2023-05-23  4:02           ` Zhu Yanjun
  2023-05-23  4:10             ` Guoqing Jiang
  1 sibling, 1 reply; 22+ messages in thread
From: Zhu Yanjun @ 2023-05-23  4:02 UTC (permalink / raw)
  To: Guoqing Jiang
  Cc: syzbot, jgg, leon, linux-kernel, linux-rdma, netdev,
	syzkaller-bugs

On Tue, May 23, 2023 at 11:47 AM Zhu Yanjun <zyjzyj2000@gmail.com> wrote:
>
> On Tue, May 23, 2023 at 10:26 AM Guoqing Jiang <guoqing.jiang@linux.dev> wrote:
> >
> >
> >
> > On 5/23/23 10:13, syzbot wrote:
> > > Hello,
> > >
> > > syzbot tried to test the proposed patch but the build/boot failed:
> > >
> > > failed to apply patch:
> > > checking file drivers/infiniband/sw/rxe/rxe_qp.c
> > > patch: **** unexpected end of file in patch
>
> This is not the root cause. The fix is not good.

This problem is about "INFO: trying to register non-static key. The
code is fine but needs lockdep annotation, or maybe"

Zhu Yanjun

>
> Zhu Yanjun
>
> > >
> > >
> > >
> > > Tested on:
> > >
> > > commit:         56518a60 RDMA/hns: Modify the value of long message lo..
> > > git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma.git for-rc
> > > dashboard link: https://syzkaller.appspot.com/bug?extid=eba589d8f49c73d356da
> > > compiler:
> > > patch:          https://syzkaller.appspot.com/x/patch.diff?x=132bea5a280000
> > >
> >
> > Sorry, let me attach the temp patch.
> >
> > #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma.git
> > for-rc

^ permalink raw reply	[flat|nested] 22+ messages in thread

* Re: [syzbot] [rdma?] INFO: trying to register non-static key in skb_dequeue (2)
  2023-05-23  4:02           ` Zhu Yanjun
@ 2023-05-23  4:10             ` Guoqing Jiang
  2023-05-23  4:29               ` Zhu Yanjun
  0 siblings, 1 reply; 22+ messages in thread
From: Guoqing Jiang @ 2023-05-23  4:10 UTC (permalink / raw)
  To: Zhu Yanjun
  Cc: syzbot, jgg, leon, linux-kernel, linux-rdma, netdev,
	syzkaller-bugs



On 5/23/23 12:02, Zhu Yanjun wrote:
> On Tue, May 23, 2023 at 11:47 AM Zhu Yanjun <zyjzyj2000@gmail.com> wrote:
>> On Tue, May 23, 2023 at 10:26 AM Guoqing Jiang <guoqing.jiang@linux.dev> wrote:
>>>
>>>
>>> On 5/23/23 10:13, syzbot wrote:
>>>> Hello,
>>>>
>>>> syzbot tried to test the proposed patch but the build/boot failed:
>>>>
>>>> failed to apply patch:
>>>> checking file drivers/infiniband/sw/rxe/rxe_qp.c
>>>> patch: **** unexpected end of file in patch
>> This is not the root cause. The fix is not good.
> This problem is about "INFO: trying to register non-static key. The
> code is fine but needs lockdep annotation, or maybe"

Which is caused by  "skb_queue_head_init(&qp->resp_pkts)" is not called
given rxe_qp_init_resp returns error, but the cleanup still trigger the 
chain.

rxe_qp_do_cleanup -> rxe_completer -> drain_resp_pkts -> 
skb_dequeue(&qp->resp_pkts)

But I might misunderstood it ...

Thanks,
Guoqing

^ permalink raw reply	[flat|nested] 22+ messages in thread

* Re: [syzbot] [rdma?] INFO: trying to register non-static key in skb_dequeue (2)
  2023-05-23  4:10             ` Guoqing Jiang
@ 2023-05-23  4:29               ` Zhu Yanjun
  2023-05-23  5:08                 ` Zhu Yanjun
  2023-05-23  5:50                 ` Guoqing Jiang
  0 siblings, 2 replies; 22+ messages in thread
From: Zhu Yanjun @ 2023-05-23  4:29 UTC (permalink / raw)
  To: Guoqing Jiang
  Cc: syzbot, jgg, leon, linux-kernel, linux-rdma, netdev,
	syzkaller-bugs

On Tue, May 23, 2023 at 12:10 PM Guoqing Jiang <guoqing.jiang@linux.dev> wrote:
>
>
>
> On 5/23/23 12:02, Zhu Yanjun wrote:
> > On Tue, May 23, 2023 at 11:47 AM Zhu Yanjun <zyjzyj2000@gmail.com> wrote:
> >> On Tue, May 23, 2023 at 10:26 AM Guoqing Jiang <guoqing.jiang@linux.dev> wrote:
> >>>
> >>>
> >>> On 5/23/23 10:13, syzbot wrote:
> >>>> Hello,
> >>>>
> >>>> syzbot tried to test the proposed patch but the build/boot failed:
> >>>>
> >>>> failed to apply patch:
> >>>> checking file drivers/infiniband/sw/rxe/rxe_qp.c
> >>>> patch: **** unexpected end of file in patch
> >> This is not the root cause. The fix is not good.
> > This problem is about "INFO: trying to register non-static key. The
> > code is fine but needs lockdep annotation, or maybe"

This warning is from "lock is not initialized". This is a
use-before-initialized problem.
The correct fix is to initialize the lock that is complained before it is used.

Zhu Yanjun
>
> Which is caused by  "skb_queue_head_init(&qp->resp_pkts)" is not called
> given rxe_qp_init_resp returns error, but the cleanup still trigger the
> chain.
>
> rxe_qp_do_cleanup -> rxe_completer -> drain_resp_pkts ->
> skb_dequeue(&qp->resp_pkts)
>
> But I might misunderstood it ...
>
> Thanks,
> Guoqing

^ permalink raw reply	[flat|nested] 22+ messages in thread

* Re: [syzbot] [rdma?] INFO: trying to register non-static key in skb_dequeue (2)
  2023-05-23  4:29               ` Zhu Yanjun
@ 2023-05-23  5:08                 ` Zhu Yanjun
  2023-05-23  5:18                   ` Zhu Yanjun
  2023-05-23  5:50                 ` Guoqing Jiang
  1 sibling, 1 reply; 22+ messages in thread
From: Zhu Yanjun @ 2023-05-23  5:08 UTC (permalink / raw)
  To: Guoqing Jiang
  Cc: syzbot, jgg, leon, linux-kernel, linux-rdma, netdev,
	syzkaller-bugs

On Tue, May 23, 2023 at 12:29 PM Zhu Yanjun <zyjzyj2000@gmail.com> wrote:
>
> On Tue, May 23, 2023 at 12:10 PM Guoqing Jiang <guoqing.jiang@linux.dev> wrote:
> >
> >
> >
> > On 5/23/23 12:02, Zhu Yanjun wrote:
> > > On Tue, May 23, 2023 at 11:47 AM Zhu Yanjun <zyjzyj2000@gmail.com> wrote:
> > >> On Tue, May 23, 2023 at 10:26 AM Guoqing Jiang <guoqing.jiang@linux.dev> wrote:
> > >>>
> > >>>
> > >>> On 5/23/23 10:13, syzbot wrote:
> > >>>> Hello,
> > >>>>
> > >>>> syzbot tried to test the proposed patch but the build/boot failed:
> > >>>>
> > >>>> failed to apply patch:
> > >>>> checking file drivers/infiniband/sw/rxe/rxe_qp.c
> > >>>> patch: **** unexpected end of file in patch
> > >> This is not the root cause. The fix is not good.
> > > This problem is about "INFO: trying to register non-static key. The
> > > code is fine but needs lockdep annotation, or maybe"
>
> This warning is from "lock is not initialized". This is a
> use-before-initialized problem.
> The correct fix is to initialize the lock that is complained before it is used.
>
> Zhu Yanjun

Based on the call trace, the followings are the order of this call trace.

291 /* called by the create qp verb */
292 int rxe_qp_from_init(struct rxe_dev *rxe, struct rxe_qp *qp,
struct rxe_pd *pd,
297 {
            ...
317         rxe_qp_init_misc(rxe, qp, init);
            ...
322
323         err = rxe_qp_init_resp(rxe, qp, init, udata, uresp);
324         if (err)
325                 goto err2;   <--- error

            ...

334 err2:
335         rxe_queue_cleanup(qp->sq.queue); <--- Goto here
336         qp->sq.queue = NULL;

In rxe_qp_init_resp, the error occurs before skb_queue_head_init.
So this call trace appeared.

Zhu Yanjun

> >
> > Which is caused by  "skb_queue_head_init(&qp->resp_pkts)" is not called
> > given rxe_qp_init_resp returns error, but the cleanup still trigger the
> > chain.
> >
> > rxe_qp_do_cleanup -> rxe_completer -> drain_resp_pkts ->
> > skb_dequeue(&qp->resp_pkts)
> >
> > But I might misunderstood it ...
> >
> > Thanks,
> > Guoqing

^ permalink raw reply	[flat|nested] 22+ messages in thread

* Re: [syzbot] [rdma?] INFO: trying to register non-static key in skb_dequeue (2)
  2023-05-23  5:08                 ` Zhu Yanjun
@ 2023-05-23  5:18                   ` Zhu Yanjun
  2023-05-23  5:44                     ` Guoqing Jiang
  0 siblings, 1 reply; 22+ messages in thread
From: Zhu Yanjun @ 2023-05-23  5:18 UTC (permalink / raw)
  To: Guoqing Jiang
  Cc: syzbot, jgg, leon, linux-kernel, linux-rdma, netdev,
	syzkaller-bugs

On Tue, May 23, 2023 at 1:08 PM Zhu Yanjun <zyjzyj2000@gmail.com> wrote:
>
> On Tue, May 23, 2023 at 12:29 PM Zhu Yanjun <zyjzyj2000@gmail.com> wrote:
> >
> > On Tue, May 23, 2023 at 12:10 PM Guoqing Jiang <guoqing.jiang@linux.dev> wrote:
> > >
> > >
> > >
> > > On 5/23/23 12:02, Zhu Yanjun wrote:
> > > > On Tue, May 23, 2023 at 11:47 AM Zhu Yanjun <zyjzyj2000@gmail.com> wrote:
> > > >> On Tue, May 23, 2023 at 10:26 AM Guoqing Jiang <guoqing.jiang@linux.dev> wrote:
> > > >>>
> > > >>>
> > > >>> On 5/23/23 10:13, syzbot wrote:
> > > >>>> Hello,
> > > >>>>
> > > >>>> syzbot tried to test the proposed patch but the build/boot failed:
> > > >>>>
> > > >>>> failed to apply patch:
> > > >>>> checking file drivers/infiniband/sw/rxe/rxe_qp.c
> > > >>>> patch: **** unexpected end of file in patch
> > > >> This is not the root cause. The fix is not good.
> > > > This problem is about "INFO: trying to register non-static key. The
> > > > code is fine but needs lockdep annotation, or maybe"
> >
> > This warning is from "lock is not initialized". This is a
> > use-before-initialized problem.
> > The correct fix is to initialize the lock that is complained before it is used.
> >
> > Zhu Yanjun
>
> Based on the call trace, the followings are the order of this call trace.
>
> 291 /* called by the create qp verb */
> 292 int rxe_qp_from_init(struct rxe_dev *rxe, struct rxe_qp *qp,
> struct rxe_pd *pd,
> 297 {
>             ...
> 317         rxe_qp_init_misc(rxe, qp, init);
>             ...
> 322
> 323         err = rxe_qp_init_resp(rxe, qp, init, udata, uresp);
> 324         if (err)
> 325                 goto err2;   <--- error
>
>             ...
>
> 334 err2:
> 335         rxe_queue_cleanup(qp->sq.queue); <--- Goto here
> 336         qp->sq.queue = NULL;
>
> In rxe_qp_init_resp, the error occurs before skb_queue_head_init.
> So this call trace appeared.

250 static int rxe_qp_init_resp(struct rxe_dev *rxe, struct rxe_qp *qp,
254 {
                        ...
264
265                 type = QUEUE_TYPE_FROM_CLIENT;
266                 qp->rq.queue = rxe_queue_init(rxe, &qp->rq.max_wr,
267                                         wqe_size, type);
268                 if (!qp->rq.queue)
269                         return -ENOMEM;    <---Error here
270

...

282         skb_queue_head_init(&qp->resp_pkts); <-this is not called.
...
This will make spin_lock of resp_pkts is used before initialized.

Zhu Yanjun
>
> Zhu Yanjun
>
> > >
> > > Which is caused by  "skb_queue_head_init(&qp->resp_pkts)" is not called
> > > given rxe_qp_init_resp returns error, but the cleanup still trigger the
> > > chain.
> > >
> > > rxe_qp_do_cleanup -> rxe_completer -> drain_resp_pkts ->
> > > skb_dequeue(&qp->resp_pkts)
> > >
> > > But I might misunderstood it ...
> > >
> > > Thanks,
> > > Guoqing

^ permalink raw reply	[flat|nested] 22+ messages in thread

* Re: [syzbot] [rdma?] INFO: trying to register non-static key in skb_dequeue (2)
  2023-05-23  5:18                   ` Zhu Yanjun
@ 2023-05-23  5:44                     ` Guoqing Jiang
  2023-05-23  5:52                       ` Zhu Yanjun
  0 siblings, 1 reply; 22+ messages in thread
From: Guoqing Jiang @ 2023-05-23  5:44 UTC (permalink / raw)
  To: Zhu Yanjun
  Cc: syzbot, jgg, leon, linux-kernel, linux-rdma, netdev,
	syzkaller-bugs



On 5/23/23 13:18, Zhu Yanjun wrote:
> On Tue, May 23, 2023 at 1:08 PM Zhu Yanjun <zyjzyj2000@gmail.com> wrote:
>> On Tue, May 23, 2023 at 12:29 PM Zhu Yanjun <zyjzyj2000@gmail.com> wrote:
>>> On Tue, May 23, 2023 at 12:10 PM Guoqing Jiang <guoqing.jiang@linux.dev> wrote:
>>>>
>>>>
>>>> On 5/23/23 12:02, Zhu Yanjun wrote:
>>>>> On Tue, May 23, 2023 at 11:47 AM Zhu Yanjun <zyjzyj2000@gmail.com> wrote:
>>>>>> On Tue, May 23, 2023 at 10:26 AM Guoqing Jiang <guoqing.jiang@linux.dev> wrote:
>>>>>>>
>>>>>>> On 5/23/23 10:13, syzbot wrote:
>>>>>>>> Hello,
>>>>>>>>
>>>>>>>> syzbot tried to test the proposed patch but the build/boot failed:
>>>>>>>>
>>>>>>>> failed to apply patch:
>>>>>>>> checking file drivers/infiniband/sw/rxe/rxe_qp.c
>>>>>>>> patch: **** unexpected end of file in patch
>>>>>> This is not the root cause. The fix is not good.
>>>>> This problem is about "INFO: trying to register non-static key. The
>>>>> code is fine but needs lockdep annotation, or maybe"
>>> This warning is from "lock is not initialized". This is a
>>> use-before-initialized problem.
>>> The correct fix is to initialize the lock that is complained before it is used.
>>>
>>> Zhu Yanjun
>> Based on the call trace, the followings are the order of this call trace.
>>
>> 291 /* called by the create qp verb */
>> 292 int rxe_qp_from_init(struct rxe_dev *rxe, struct rxe_qp *qp,
>> struct rxe_pd *pd,
>> 297 {
>>              ...
>> 317         rxe_qp_init_misc(rxe, qp, init);
>>              ...
>> 322
>> 323         err = rxe_qp_init_resp(rxe, qp, init, udata, uresp);
>> 324         if (err)
>> 325                 goto err2;   <--- error
>>
>>              ...
>>
>> 334 err2:
>> 335         rxe_queue_cleanup(qp->sq.queue); <--- Goto here
>> 336         qp->sq.queue = NULL;
>>
>> In rxe_qp_init_resp, the error occurs before skb_queue_head_init.
>> So this call trace appeared.
> 250 static int rxe_qp_init_resp(struct rxe_dev *rxe, struct rxe_qp *qp,
> 254 {
>                          ...
> 264
> 265                 type = QUEUE_TYPE_FROM_CLIENT;
> 266                 qp->rq.queue = rxe_queue_init(rxe, &qp->rq.max_wr,
> 267                                         wqe_size, type);
> 268                 if (!qp->rq.queue)
> 269                         return -ENOMEM;    <---Error here
> 270
>
> ...
>
> 282         skb_queue_head_init(&qp->resp_pkts); <-this is not called.
> ...
> This will make spin_lock of resp_pkts is used before initialized.

IMHO, the above is same as

> Which is caused by  "skb_queue_head_init(&qp->resp_pkts)" is not called
> given rxe_qp_init_resp returns error, but the cleanup still trigger the
> chain.
>
> rxe_qp_do_cleanup -> rxe_completer -> drain_resp_pkts ->
> skb_dequeue(&qp->resp_pkts)

my previous analysis. If not, could you provide another better way to 
fix it?

Guoqing

^ permalink raw reply	[flat|nested] 22+ messages in thread

* Re: [syzbot] [rdma?] INFO: trying to register non-static key in skb_dequeue (2)
  2023-05-23  5:44                     ` Guoqing Jiang
@ 2023-05-23  5:52                       ` Zhu Yanjun
  2023-05-23  5:56                         ` Guoqing Jiang
  0 siblings, 1 reply; 22+ messages in thread
From: Zhu Yanjun @ 2023-05-23  5:52 UTC (permalink / raw)
  To: Guoqing Jiang
  Cc: syzbot, jgg, leon, linux-kernel, linux-rdma, netdev,
	syzkaller-bugs

On Tue, May 23, 2023 at 1:44 PM Guoqing Jiang <guoqing.jiang@linux.dev> wrote:
>
>
>
> On 5/23/23 13:18, Zhu Yanjun wrote:
> > On Tue, May 23, 2023 at 1:08 PM Zhu Yanjun <zyjzyj2000@gmail.com> wrote:
> >> On Tue, May 23, 2023 at 12:29 PM Zhu Yanjun <zyjzyj2000@gmail.com> wrote:
> >>> On Tue, May 23, 2023 at 12:10 PM Guoqing Jiang <guoqing.jiang@linux.dev> wrote:
> >>>>
> >>>>
> >>>> On 5/23/23 12:02, Zhu Yanjun wrote:
> >>>>> On Tue, May 23, 2023 at 11:47 AM Zhu Yanjun <zyjzyj2000@gmail.com> wrote:
> >>>>>> On Tue, May 23, 2023 at 10:26 AM Guoqing Jiang <guoqing.jiang@linux.dev> wrote:
> >>>>>>>
> >>>>>>> On 5/23/23 10:13, syzbot wrote:
> >>>>>>>> Hello,
> >>>>>>>>
> >>>>>>>> syzbot tried to test the proposed patch but the build/boot failed:
> >>>>>>>>
> >>>>>>>> failed to apply patch:
> >>>>>>>> checking file drivers/infiniband/sw/rxe/rxe_qp.c
> >>>>>>>> patch: **** unexpected end of file in patch
> >>>>>> This is not the root cause. The fix is not good.
> >>>>> This problem is about "INFO: trying to register non-static key. The
> >>>>> code is fine but needs lockdep annotation, or maybe"
> >>> This warning is from "lock is not initialized". This is a
> >>> use-before-initialized problem.
> >>> The correct fix is to initialize the lock that is complained before it is used.
> >>>
> >>> Zhu Yanjun
> >> Based on the call trace, the followings are the order of this call trace.
> >>
> >> 291 /* called by the create qp verb */
> >> 292 int rxe_qp_from_init(struct rxe_dev *rxe, struct rxe_qp *qp,
> >> struct rxe_pd *pd,
> >> 297 {
> >>              ...
> >> 317         rxe_qp_init_misc(rxe, qp, init);
> >>              ...
> >> 322
> >> 323         err = rxe_qp_init_resp(rxe, qp, init, udata, uresp);
> >> 324         if (err)
> >> 325                 goto err2;   <--- error
> >>
> >>              ...
> >>
> >> 334 err2:
> >> 335         rxe_queue_cleanup(qp->sq.queue); <--- Goto here
> >> 336         qp->sq.queue = NULL;
> >>
> >> In rxe_qp_init_resp, the error occurs before skb_queue_head_init.
> >> So this call trace appeared.
> > 250 static int rxe_qp_init_resp(struct rxe_dev *rxe, struct rxe_qp *qp,
> > 254 {
> >                          ...
> > 264
> > 265                 type = QUEUE_TYPE_FROM_CLIENT;
> > 266                 qp->rq.queue = rxe_queue_init(rxe, &qp->rq.max_wr,
> > 267                                         wqe_size, type);
> > 268                 if (!qp->rq.queue)
> > 269                         return -ENOMEM;    <---Error here
> > 270
> >
> > ...
> >
> > 282         skb_queue_head_init(&qp->resp_pkts); <-this is not called.
> > ...
> > This will make spin_lock of resp_pkts is used before initialized.
>
> IMHO, the above is same as
>
> > Which is caused by  "skb_queue_head_init(&qp->resp_pkts)" is not called
> > given rxe_qp_init_resp returns error, but the cleanup still trigger the
> > chain.
> >
> > rxe_qp_do_cleanup -> rxe_completer -> drain_resp_pkts ->
> > skb_dequeue(&qp->resp_pkts)
>
> my previous analysis. If not, could you provide another better way to
> fix it?

Move the initialization to the beginning. This can fix this problem.
See below:

"
diff --git a/drivers/infiniband/sw/rxe/rxe_qp.c
b/drivers/infiniband/sw/rxe/rxe_qp.c
index c5451a4488ca..22ef6188d7b1 100644
--- a/drivers/infiniband/sw/rxe/rxe_qp.c
+++ b/drivers/infiniband/sw/rxe/rxe_qp.c
@@ -176,6 +176,9 @@ static void rxe_qp_init_misc(struct rxe_dev *rxe,
struct rxe_qp *qp,
        spin_lock_init(&qp->rq.producer_lock);
        spin_lock_init(&qp->rq.consumer_lock);

+       skb_queue_head_init(&qp->req_pkts);
+       skb_queue_head_init(&qp->resp_pkts);
+
        atomic_set(&qp->ssn, 0);
        atomic_set(&qp->skb_out, 0);
 }
@@ -234,8 +237,6 @@ static int rxe_qp_init_req(struct rxe_dev *rxe,
struct rxe_qp *qp,
        qp->req.opcode          = -1;
        qp->comp.opcode         = -1;

-       skb_queue_head_init(&qp->req_pkts);
-
        rxe_init_task(&qp->req.task, qp, rxe_requester);
        rxe_init_task(&qp->comp.task, qp, rxe_completer);

@@ -279,8 +280,6 @@ static int rxe_qp_init_resp(struct rxe_dev *rxe,
struct rxe_qp *qp,
                }
        }

-       skb_queue_head_init(&qp->resp_pkts);
-
        rxe_init_task(&qp->resp.task, qp, rxe_responder);

        qp->resp.opcode         = OPCODE_NONE;
"

>
> Guoqing

^ permalink raw reply related	[flat|nested] 22+ messages in thread

* Re: [syzbot] [rdma?] INFO: trying to register non-static key in skb_dequeue (2)
  2023-05-23  5:52                       ` Zhu Yanjun
@ 2023-05-23  5:56                         ` Guoqing Jiang
  2023-05-23  6:04                           ` Zhu Yanjun
  0 siblings, 1 reply; 22+ messages in thread
From: Guoqing Jiang @ 2023-05-23  5:56 UTC (permalink / raw)
  To: Zhu Yanjun
  Cc: syzbot, jgg, leon, linux-kernel, linux-rdma, netdev,
	syzkaller-bugs



On 5/23/23 13:52, Zhu Yanjun wrote:
> On Tue, May 23, 2023 at 1:44 PM Guoqing Jiang <guoqing.jiang@linux.dev> wrote:
>>
>>
>> On 5/23/23 13:18, Zhu Yanjun wrote:
>>> On Tue, May 23, 2023 at 1:08 PM Zhu Yanjun <zyjzyj2000@gmail.com> wrote:
>>>> On Tue, May 23, 2023 at 12:29 PM Zhu Yanjun <zyjzyj2000@gmail.com> wrote:
>>>>> On Tue, May 23, 2023 at 12:10 PM Guoqing Jiang <guoqing.jiang@linux.dev> wrote:
>>>>>>
>>>>>> On 5/23/23 12:02, Zhu Yanjun wrote:
>>>>>>> On Tue, May 23, 2023 at 11:47 AM Zhu Yanjun <zyjzyj2000@gmail.com> wrote:
>>>>>>>> On Tue, May 23, 2023 at 10:26 AM Guoqing Jiang <guoqing.jiang@linux.dev> wrote:
>>>>>>>>> On 5/23/23 10:13, syzbot wrote:
>>>>>>>>>> Hello,
>>>>>>>>>>
>>>>>>>>>> syzbot tried to test the proposed patch but the build/boot failed:
>>>>>>>>>>
>>>>>>>>>> failed to apply patch:
>>>>>>>>>> checking file drivers/infiniband/sw/rxe/rxe_qp.c
>>>>>>>>>> patch: **** unexpected end of file in patch
>>>>>>>> This is not the root cause. The fix is not good.
>>>>>>> This problem is about "INFO: trying to register non-static key. The
>>>>>>> code is fine but needs lockdep annotation, or maybe"
>>>>> This warning is from "lock is not initialized". This is a
>>>>> use-before-initialized problem.
>>>>> The correct fix is to initialize the lock that is complained before it is used.
>>>>>
>>>>> Zhu Yanjun
>>>> Based on the call trace, the followings are the order of this call trace.
>>>>
>>>> 291 /* called by the create qp verb */
>>>> 292 int rxe_qp_from_init(struct rxe_dev *rxe, struct rxe_qp *qp,
>>>> struct rxe_pd *pd,
>>>> 297 {
>>>>               ...
>>>> 317         rxe_qp_init_misc(rxe, qp, init);
>>>>               ...
>>>> 322
>>>> 323         err = rxe_qp_init_resp(rxe, qp, init, udata, uresp);
>>>> 324         if (err)
>>>> 325                 goto err2;   <--- error
>>>>
>>>>               ...
>>>>
>>>> 334 err2:
>>>> 335         rxe_queue_cleanup(qp->sq.queue); <--- Goto here
>>>> 336         qp->sq.queue = NULL;
>>>>
>>>> In rxe_qp_init_resp, the error occurs before skb_queue_head_init.
>>>> So this call trace appeared.
>>> 250 static int rxe_qp_init_resp(struct rxe_dev *rxe, struct rxe_qp *qp,
>>> 254 {
>>>                           ...
>>> 264
>>> 265                 type = QUEUE_TYPE_FROM_CLIENT;
>>> 266                 qp->rq.queue = rxe_queue_init(rxe, &qp->rq.max_wr,
>>> 267                                         wqe_size, type);
>>> 268                 if (!qp->rq.queue)
>>> 269                         return -ENOMEM;    <---Error here
>>> 270
>>>
>>> ...
>>>
>>> 282         skb_queue_head_init(&qp->resp_pkts); <-this is not called.
>>> ...
>>> This will make spin_lock of resp_pkts is used before initialized.
>> IMHO, the above is same as
>>
>>> Which is caused by  "skb_queue_head_init(&qp->resp_pkts)" is not called
>>> given rxe_qp_init_resp returns error, but the cleanup still trigger the
>>> chain.
>>>
>>> rxe_qp_do_cleanup -> rxe_completer -> drain_resp_pkts ->
>>> skb_dequeue(&qp->resp_pkts)
>> my previous analysis. If not, could you provide another better way to
>> fix it?
> Move the initialization to the beginning. This can fix this problem.
> See below:
>
> "
> diff --git a/drivers/infiniband/sw/rxe/rxe_qp.c
> b/drivers/infiniband/sw/rxe/rxe_qp.c
> index c5451a4488ca..22ef6188d7b1 100644
> --- a/drivers/infiniband/sw/rxe/rxe_qp.c
> +++ b/drivers/infiniband/sw/rxe/rxe_qp.c
> @@ -176,6 +176,9 @@ static void rxe_qp_init_misc(struct rxe_dev *rxe,
> struct rxe_qp *qp,
>          spin_lock_init(&qp->rq.producer_lock);
>          spin_lock_init(&qp->rq.consumer_lock);
>
> +       skb_queue_head_init(&qp->req_pkts);
> +       skb_queue_head_init(&qp->resp_pkts);
> +
>          atomic_set(&qp->ssn, 0);
>          atomic_set(&qp->skb_out, 0);
>   }
> @@ -234,8 +237,6 @@ static int rxe_qp_init_req(struct rxe_dev *rxe,
> struct rxe_qp *qp,
>          qp->req.opcode          = -1;
>          qp->comp.opcode         = -1;
>
> -       skb_queue_head_init(&qp->req_pkts);
> -
>          rxe_init_task(&qp->req.task, qp, rxe_requester);
>          rxe_init_task(&qp->comp.task, qp, rxe_completer);
>
> @@ -279,8 +280,6 @@ static int rxe_qp_init_resp(struct rxe_dev *rxe,
> struct rxe_qp *qp,
>                  }
>          }
>
> -       skb_queue_head_init(&qp->resp_pkts);
> -
>          rxe_init_task(&qp->resp.task, qp, rxe_responder);
>
>          qp->resp.opcode         = OPCODE_NONE;
> "

It is weird to me that init them in init_misc instead of init_req/resp, 
given they
are dedicated/used for the different purpose. But just my 0.02$.

Guoqing

^ permalink raw reply	[flat|nested] 22+ messages in thread

* Re: [syzbot] [rdma?] INFO: trying to register non-static key in skb_dequeue (2)
  2023-05-23  5:56                         ` Guoqing Jiang
@ 2023-05-23  6:04                           ` Zhu Yanjun
  0 siblings, 0 replies; 22+ messages in thread
From: Zhu Yanjun @ 2023-05-23  6:04 UTC (permalink / raw)
  To: Guoqing Jiang
  Cc: syzbot, jgg, leon, linux-kernel, linux-rdma, netdev,
	syzkaller-bugs

On Tue, May 23, 2023 at 1:56 PM Guoqing Jiang <guoqing.jiang@linux.dev> wrote:
>
>
>
> On 5/23/23 13:52, Zhu Yanjun wrote:
> > On Tue, May 23, 2023 at 1:44 PM Guoqing Jiang <guoqing.jiang@linux.dev> wrote:
> >>
> >>
> >> On 5/23/23 13:18, Zhu Yanjun wrote:
> >>> On Tue, May 23, 2023 at 1:08 PM Zhu Yanjun <zyjzyj2000@gmail.com> wrote:
> >>>> On Tue, May 23, 2023 at 12:29 PM Zhu Yanjun <zyjzyj2000@gmail.com> wrote:
> >>>>> On Tue, May 23, 2023 at 12:10 PM Guoqing Jiang <guoqing.jiang@linux.dev> wrote:
> >>>>>>
> >>>>>> On 5/23/23 12:02, Zhu Yanjun wrote:
> >>>>>>> On Tue, May 23, 2023 at 11:47 AM Zhu Yanjun <zyjzyj2000@gmail.com> wrote:
> >>>>>>>> On Tue, May 23, 2023 at 10:26 AM Guoqing Jiang <guoqing.jiang@linux.dev> wrote:
> >>>>>>>>> On 5/23/23 10:13, syzbot wrote:
> >>>>>>>>>> Hello,
> >>>>>>>>>>
> >>>>>>>>>> syzbot tried to test the proposed patch but the build/boot failed:
> >>>>>>>>>>
> >>>>>>>>>> failed to apply patch:
> >>>>>>>>>> checking file drivers/infiniband/sw/rxe/rxe_qp.c
> >>>>>>>>>> patch: **** unexpected end of file in patch
> >>>>>>>> This is not the root cause. The fix is not good.
> >>>>>>> This problem is about "INFO: trying to register non-static key. The
> >>>>>>> code is fine but needs lockdep annotation, or maybe"
> >>>>> This warning is from "lock is not initialized". This is a
> >>>>> use-before-initialized problem.
> >>>>> The correct fix is to initialize the lock that is complained before it is used.
> >>>>>
> >>>>> Zhu Yanjun
> >>>> Based on the call trace, the followings are the order of this call trace.
> >>>>
> >>>> 291 /* called by the create qp verb */
> >>>> 292 int rxe_qp_from_init(struct rxe_dev *rxe, struct rxe_qp *qp,
> >>>> struct rxe_pd *pd,
> >>>> 297 {
> >>>>               ...
> >>>> 317         rxe_qp_init_misc(rxe, qp, init);
> >>>>               ...
> >>>> 322
> >>>> 323         err = rxe_qp_init_resp(rxe, qp, init, udata, uresp);
> >>>> 324         if (err)
> >>>> 325                 goto err2;   <--- error
> >>>>
> >>>>               ...
> >>>>
> >>>> 334 err2:
> >>>> 335         rxe_queue_cleanup(qp->sq.queue); <--- Goto here
> >>>> 336         qp->sq.queue = NULL;
> >>>>
> >>>> In rxe_qp_init_resp, the error occurs before skb_queue_head_init.
> >>>> So this call trace appeared.
> >>> 250 static int rxe_qp_init_resp(struct rxe_dev *rxe, struct rxe_qp *qp,
> >>> 254 {
> >>>                           ...
> >>> 264
> >>> 265                 type = QUEUE_TYPE_FROM_CLIENT;
> >>> 266                 qp->rq.queue = rxe_queue_init(rxe, &qp->rq.max_wr,
> >>> 267                                         wqe_size, type);
> >>> 268                 if (!qp->rq.queue)
> >>> 269                         return -ENOMEM;    <---Error here
> >>> 270
> >>>
> >>> ...
> >>>
> >>> 282         skb_queue_head_init(&qp->resp_pkts); <-this is not called.
> >>> ...
> >>> This will make spin_lock of resp_pkts is used before initialized.
> >> IMHO, the above is same as
> >>
> >>> Which is caused by  "skb_queue_head_init(&qp->resp_pkts)" is not called
> >>> given rxe_qp_init_resp returns error, but the cleanup still trigger the
> >>> chain.
> >>>
> >>> rxe_qp_do_cleanup -> rxe_completer -> drain_resp_pkts ->
> >>> skb_dequeue(&qp->resp_pkts)
> >> my previous analysis. If not, could you provide another better way to
> >> fix it?
> > Move the initialization to the beginning. This can fix this problem.
> > See below:
> >
> > "
> > diff --git a/drivers/infiniband/sw/rxe/rxe_qp.c
> > b/drivers/infiniband/sw/rxe/rxe_qp.c
> > index c5451a4488ca..22ef6188d7b1 100644
> > --- a/drivers/infiniband/sw/rxe/rxe_qp.c
> > +++ b/drivers/infiniband/sw/rxe/rxe_qp.c
> > @@ -176,6 +176,9 @@ static void rxe_qp_init_misc(struct rxe_dev *rxe,
> > struct rxe_qp *qp,
> >          spin_lock_init(&qp->rq.producer_lock);
> >          spin_lock_init(&qp->rq.consumer_lock);
> >
> > +       skb_queue_head_init(&qp->req_pkts);
> > +       skb_queue_head_init(&qp->resp_pkts);
> > +
> >          atomic_set(&qp->ssn, 0);
> >          atomic_set(&qp->skb_out, 0);
> >   }
> > @@ -234,8 +237,6 @@ static int rxe_qp_init_req(struct rxe_dev *rxe,
> > struct rxe_qp *qp,
> >          qp->req.opcode          = -1;
> >          qp->comp.opcode         = -1;
> >
> > -       skb_queue_head_init(&qp->req_pkts);
> > -
> >          rxe_init_task(&qp->req.task, qp, rxe_requester);
> >          rxe_init_task(&qp->comp.task, qp, rxe_completer);
> >
> > @@ -279,8 +280,6 @@ static int rxe_qp_init_resp(struct rxe_dev *rxe,
> > struct rxe_qp *qp,
> >                  }
> >          }
> >
> > -       skb_queue_head_init(&qp->resp_pkts);
> > -
> >          rxe_init_task(&qp->resp.task, qp, rxe_responder);
> >
> >          qp->resp.opcode         = OPCODE_NONE;
> > "
>
> It is weird to me that init them in init_misc instead of init_req/resp,
> given they
> are dedicated/used for the different purpose. But just my 0.02$.

There are some initialization problems in qp init. This needs
refactoring the related functions to fix all the problems.
Currently I am working on this. You know, this is not an easy task.
It will take me a lot of time and effort.
Now I use init_misc to initialize the related variables just as I did
in the past.
This is because init_misc is designed to initialize some variables.
And it will not cause the similar use-before-initialization problems.

Zhu Yanjun
>
> Guoqing

^ permalink raw reply	[flat|nested] 22+ messages in thread

* Re: [syzbot] [rdma?] INFO: trying to register non-static key in skb_dequeue (2)
  2023-05-23  4:29               ` Zhu Yanjun
  2023-05-23  5:08                 ` Zhu Yanjun
@ 2023-05-23  5:50                 ` Guoqing Jiang
  2023-05-23  5:55                   ` Zhu Yanjun
  1 sibling, 1 reply; 22+ messages in thread
From: Guoqing Jiang @ 2023-05-23  5:50 UTC (permalink / raw)
  To: Zhu Yanjun
  Cc: syzbot, jgg, leon, linux-kernel, linux-rdma, netdev,
	syzkaller-bugs



On 5/23/23 12:29, Zhu Yanjun wrote:
> On Tue, May 23, 2023 at 12:10 PM Guoqing Jiang <guoqing.jiang@linux.dev> wrote:
>>
>>
>> On 5/23/23 12:02, Zhu Yanjun wrote:
>>> On Tue, May 23, 2023 at 11:47 AM Zhu Yanjun <zyjzyj2000@gmail.com> wrote:
>>>> On Tue, May 23, 2023 at 10:26 AM Guoqing Jiang <guoqing.jiang@linux.dev> wrote:
>>>>>
>>>>> On 5/23/23 10:13, syzbot wrote:
>>>>>> Hello,
>>>>>>
>>>>>> syzbot tried to test the proposed patch but the build/boot failed:
>>>>>>
>>>>>> failed to apply patch:
>>>>>> checking file drivers/infiniband/sw/rxe/rxe_qp.c
>>>>>> patch: **** unexpected end of file in patch
>>>> This is not the root cause. The fix is not good.
>>> This problem is about "INFO: trying to register non-static key. The
>>> code is fine but needs lockdep annotation, or maybe"
> This warning is from "lock is not initialized". This is a
> use-before-initialized problem.

Right, and it also applies to qp->sq.queue which is set to NULL while do 
cleanup
still de-reference it.

> The correct fix is to initialize the lock that is complained before it is used.

The thing is it can't be initialized due to error, so I guess you want 
to always init them
even for error cases.

Guoqing

^ permalink raw reply	[flat|nested] 22+ messages in thread

* Re: [syzbot] [rdma?] INFO: trying to register non-static key in skb_dequeue (2)
  2023-05-23  5:50                 ` Guoqing Jiang
@ 2023-05-23  5:55                   ` Zhu Yanjun
  2023-05-23  6:00                     ` Guoqing Jiang
  0 siblings, 1 reply; 22+ messages in thread
From: Zhu Yanjun @ 2023-05-23  5:55 UTC (permalink / raw)
  To: Guoqing Jiang
  Cc: syzbot, jgg, leon, linux-kernel, linux-rdma, netdev,
	syzkaller-bugs

On Tue, May 23, 2023 at 1:50 PM Guoqing Jiang <guoqing.jiang@linux.dev> wrote:
>
>
>
> On 5/23/23 12:29, Zhu Yanjun wrote:
> > On Tue, May 23, 2023 at 12:10 PM Guoqing Jiang <guoqing.jiang@linux.dev> wrote:
> >>
> >>
> >> On 5/23/23 12:02, Zhu Yanjun wrote:
> >>> On Tue, May 23, 2023 at 11:47 AM Zhu Yanjun <zyjzyj2000@gmail.com> wrote:
> >>>> On Tue, May 23, 2023 at 10:26 AM Guoqing Jiang <guoqing.jiang@linux.dev> wrote:
> >>>>>
> >>>>> On 5/23/23 10:13, syzbot wrote:
> >>>>>> Hello,
> >>>>>>
> >>>>>> syzbot tried to test the proposed patch but the build/boot failed:
> >>>>>>
> >>>>>> failed to apply patch:
> >>>>>> checking file drivers/infiniband/sw/rxe/rxe_qp.c
> >>>>>> patch: **** unexpected end of file in patch
> >>>> This is not the root cause. The fix is not good.
> >>> This problem is about "INFO: trying to register non-static key. The
> >>> code is fine but needs lockdep annotation, or maybe"
> > This warning is from "lock is not initialized". This is a
> > use-before-initialized problem.
>
> Right, and it also applies to qp->sq.queue which is set to NULL while do
> cleanup
> still de-reference it.
>
> > The correct fix is to initialize the lock that is complained before it is used.
>
> The thing is it can't be initialized due to error, so I guess you want
> to always init them
> even for error cases.

The complaining is about "spinlock is not initialized".

Zhu Yanjun

>
> Guoqing

^ permalink raw reply	[flat|nested] 22+ messages in thread

* Re: [syzbot] [rdma?] INFO: trying to register non-static key in skb_dequeue (2)
  2023-05-23  5:55                   ` Zhu Yanjun
@ 2023-05-23  6:00                     ` Guoqing Jiang
  2023-05-23  6:07                       ` Zhu Yanjun
  0 siblings, 1 reply; 22+ messages in thread
From: Guoqing Jiang @ 2023-05-23  6:00 UTC (permalink / raw)
  To: Zhu Yanjun
  Cc: syzbot, jgg, leon, linux-kernel, linux-rdma, netdev,
	syzkaller-bugs



On 5/23/23 13:55, Zhu Yanjun wrote:
> On Tue, May 23, 2023 at 1:50 PM Guoqing Jiang <guoqing.jiang@linux.dev> wrote:
>>
>>
>> On 5/23/23 12:29, Zhu Yanjun wrote:
>>> On Tue, May 23, 2023 at 12:10 PM Guoqing Jiang <guoqing.jiang@linux.dev> wrote:
>>>>
>>>> On 5/23/23 12:02, Zhu Yanjun wrote:
>>>>> On Tue, May 23, 2023 at 11:47 AM Zhu Yanjun <zyjzyj2000@gmail.com> wrote:
>>>>>> On Tue, May 23, 2023 at 10:26 AM Guoqing Jiang <guoqing.jiang@linux.dev> wrote:
>>>>>>> On 5/23/23 10:13, syzbot wrote:
>>>>>>>> Hello,
>>>>>>>>
>>>>>>>> syzbot tried to test the proposed patch but the build/boot failed:
>>>>>>>>
>>>>>>>> failed to apply patch:
>>>>>>>> checking file drivers/infiniband/sw/rxe/rxe_qp.c
>>>>>>>> patch: **** unexpected end of file in patch
>>>>>> This is not the root cause. The fix is not good.
>>>>> This problem is about "INFO: trying to register non-static key. The
>>>>> code is fine but needs lockdep annotation, or maybe"
>>> This warning is from "lock is not initialized". This is a
>>> use-before-initialized problem.
>> Right, and it also applies to qp->sq.queue which is set to NULL while do
>> cleanup
>> still de-reference it.
>>
>>> The correct fix is to initialize the lock that is complained before it is used.
>> The thing is it can't be initialized due to error, so I guess you want
>> to always init them
>> even for error cases.
> The complaining is about "spinlock is not initialized".

There was another null-ptr-deref, no?

general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037]
CPU: 1 PID: 31038 Comm: syz-executor.3 Not tainted 6.3.0-syzkaller-12728-g348551ddaf31 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023
RIP: 0010:flush_send_queue drivers/infiniband/sw/rxe/rxe_comp.c:597 [inline]
RIP: 0010:rxe_completer+0x255c/0x3cc0 drivers/infiniband/sw/rxe/rxe_comp.c:653
Code: 80 3c 02 00 0f 85 81 10 00 00 49 8b af 88 03 00 00 48 8d 45 30 48 89 c2 48 89 04 24 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 83 11 00 00 48 8d 45 2c 44 8b
RSP: 0018:ffffc90003526938 EFLAGS: 00010206
RAX: dffffc0000000000 RBX: ffffed100e3fe800 RCX: ffffc9000b403000
RDX: 0000000000000006 RSI: ffffffff877e467a RDI: ffff888071ff4388
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: fffffbfff1cf3682 R11: fffffffffffda5b0 R12: ffff888071ff41a0
R13: 0000000000000000 R14: 0000000000000000 R15: ffff888071ff4000
FS:  00007fede029f700(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2d822000 CR3: 000000002c7e6000 CR4: 00000000003506e0
Call Trace:
  <TASK>
  rxe_qp_do_cleanup+0x1be/0x820 drivers/infiniband/sw/rxe/rxe_qp.c:761
  execute_in_process_context+0x3b/0x150 kernel/workqueue.c:3473
  __rxe_cleanup+0x21e/0x370 drivers/infiniband/sw/rxe/rxe_pool.c:233
  rxe_create_qp+0x3f6/0x5f0 drivers/infiniband/sw/rxe/rxe_verbs.c:583
  create_qp+0x5ac/0x970 drivers/infiniband/core/verbs.c:1235
  ib_create_qp_kernel+0xa1/0x310 drivers/infiniband/core/verbs.c:1346
  ib_create_qp include/rdma/ib_verbs.h:3743 [inline]
  create_mad_qp+0x177/0x380 drivers/infiniband/core/mad.c:2905
  ib_mad_port_open drivers/infiniband/core/mad.c:2986 [inline]
  ib_mad_init_device+0xf40/0x1a90 drivers/infiniband/core/mad.c:3077
  add_client_context+0x405/0x5e0 drivers/infiniband/core/device.c:721
  enable_device_and_get+0x1cd/0x3b0 drivers/infiniband/core/device.c:1332
  ib_register_device drivers/infiniband/core/device.c:1420 [inline]
  ib_register_device+0x8b1/0xbc0 drivers/infiniband/core/device.c:1366
  rxe_register_device+0x302/0x3e0 drivers/infiniband/sw/rxe/rxe_verbs.c:1485
  rxe_net_add+0x90/0xf0 drivers/infiniband/sw/rxe/rxe_net.c:527
  rxe_newlink+0xf0/0x1b0 drivers/infiniband/sw/rxe/rxe.c:197
  nldev_newlink+0x332/0x5e0 drivers/infiniband/core/nldev.c:1731
  rdma_nl_rcv_msg+0x371/0x6a0 drivers/infiniband/core/netlink.c:195
  rdma_nl_rcv_skb.constprop.0.isra.0+0x2fc/0x440 drivers/infiniband/core/netlink.c:239
  netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline]
  netlink_unicast+0x547/0x7f0 net/netlink/af_netlink.c:1365
  netlink_sendmsg+0x925/0xe30 net/netlink/af_netlink.c:1913
  sock_sendmsg_nosec net/socket.c:724 [inline]
  sock_sendmsg+0xde/0x190 net/socket.c:747
  ____sys_sendmsg+0x71c/0x900 net/socket.c:2503
  ___sys_sendmsg+0x110/0x1b0 net/socket.c:2557
  __sys_sendmsg+0xf7/0x1c0 net/socket.c:2586
  do_syscall_x64 arch/x86/entry/common.c:50 [inline]
  do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
  entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7feddf48c169
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fede029f168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007feddf5abf80 RCX: 00007feddf48c169
RDX: 0000000000000000 RSI: 0000000020000240 RDI: 0000000000000003
RBP: 00007feddf4e7ca1 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffe1bb3e01f R14: 00007fede029f300 R15: 0000000000022000
  </TASK>
Modules linked in:


Guoqing


^ permalink raw reply	[flat|nested] 22+ messages in thread

* Re: [syzbot] [rdma?] INFO: trying to register non-static key in skb_dequeue (2)
  2023-05-23  6:00                     ` Guoqing Jiang
@ 2023-05-23  6:07                       ` Zhu Yanjun
  2023-05-23  6:11                         ` Guoqing Jiang
  0 siblings, 1 reply; 22+ messages in thread
From: Zhu Yanjun @ 2023-05-23  6:07 UTC (permalink / raw)
  To: Guoqing Jiang
  Cc: syzbot, jgg, leon, linux-kernel, linux-rdma, netdev,
	syzkaller-bugs

On Tue, May 23, 2023 at 2:00 PM Guoqing Jiang <guoqing.jiang@linux.dev> wrote:
>
>
>
> On 5/23/23 13:55, Zhu Yanjun wrote:
> > On Tue, May 23, 2023 at 1:50 PM Guoqing Jiang <guoqing.jiang@linux.dev> wrote:
> >>
> >>
> >> On 5/23/23 12:29, Zhu Yanjun wrote:
> >>> On Tue, May 23, 2023 at 12:10 PM Guoqing Jiang <guoqing.jiang@linux.dev> wrote:
> >>>>
> >>>> On 5/23/23 12:02, Zhu Yanjun wrote:
> >>>>> On Tue, May 23, 2023 at 11:47 AM Zhu Yanjun <zyjzyj2000@gmail.com> wrote:
> >>>>>> On Tue, May 23, 2023 at 10:26 AM Guoqing Jiang <guoqing.jiang@linux.dev> wrote:
> >>>>>>> On 5/23/23 10:13, syzbot wrote:
> >>>>>>>> Hello,
> >>>>>>>>
> >>>>>>>> syzbot tried to test the proposed patch but the build/boot failed:
> >>>>>>>>
> >>>>>>>> failed to apply patch:
> >>>>>>>> checking file drivers/infiniband/sw/rxe/rxe_qp.c
> >>>>>>>> patch: **** unexpected end of file in patch
> >>>>>> This is not the root cause. The fix is not good.
> >>>>> This problem is about "INFO: trying to register non-static key. The
> >>>>> code is fine but needs lockdep annotation, or maybe"
> >>> This warning is from "lock is not initialized". This is a
> >>> use-before-initialized problem.
> >> Right, and it also applies to qp->sq.queue which is set to NULL while do
> >> cleanup
> >> still de-reference it.
> >>
> >>> The correct fix is to initialize the lock that is complained before it is used.
> >> The thing is it can't be initialized due to error, so I guess you want
> >> to always init them
> >> even for error cases.
> > The complaining is about "spinlock is not initialized".
>
> There was another null-ptr-deref, no?

Please show me the link. So I can delve into it.

Zhu Yanjun

>
> general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN
> KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037]
> CPU: 1 PID: 31038 Comm: syz-executor.3 Not tainted 6.3.0-syzkaller-12728-g348551ddaf31 #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023
> RIP: 0010:flush_send_queue drivers/infiniband/sw/rxe/rxe_comp.c:597 [inline]
> RIP: 0010:rxe_completer+0x255c/0x3cc0 drivers/infiniband/sw/rxe/rxe_comp.c:653
> Code: 80 3c 02 00 0f 85 81 10 00 00 49 8b af 88 03 00 00 48 8d 45 30 48 89 c2 48 89 04 24 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 83 11 00 00 48 8d 45 2c 44 8b
> RSP: 0018:ffffc90003526938 EFLAGS: 00010206
> RAX: dffffc0000000000 RBX: ffffed100e3fe800 RCX: ffffc9000b403000
> RDX: 0000000000000006 RSI: ffffffff877e467a RDI: ffff888071ff4388
> RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
> R10: fffffbfff1cf3682 R11: fffffffffffda5b0 R12: ffff888071ff41a0
> R13: 0000000000000000 R14: 0000000000000000 R15: ffff888071ff4000
> FS:  00007fede029f700(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000
> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 0000001b2d822000 CR3: 000000002c7e6000 CR4: 00000000003506e0
> Call Trace:
>   <TASK>
>   rxe_qp_do_cleanup+0x1be/0x820 drivers/infiniband/sw/rxe/rxe_qp.c:761
>   execute_in_process_context+0x3b/0x150 kernel/workqueue.c:3473
>   __rxe_cleanup+0x21e/0x370 drivers/infiniband/sw/rxe/rxe_pool.c:233
>   rxe_create_qp+0x3f6/0x5f0 drivers/infiniband/sw/rxe/rxe_verbs.c:583
>   create_qp+0x5ac/0x970 drivers/infiniband/core/verbs.c:1235
>   ib_create_qp_kernel+0xa1/0x310 drivers/infiniband/core/verbs.c:1346
>   ib_create_qp include/rdma/ib_verbs.h:3743 [inline]
>   create_mad_qp+0x177/0x380 drivers/infiniband/core/mad.c:2905
>   ib_mad_port_open drivers/infiniband/core/mad.c:2986 [inline]
>   ib_mad_init_device+0xf40/0x1a90 drivers/infiniband/core/mad.c:3077
>   add_client_context+0x405/0x5e0 drivers/infiniband/core/device.c:721
>   enable_device_and_get+0x1cd/0x3b0 drivers/infiniband/core/device.c:1332
>   ib_register_device drivers/infiniband/core/device.c:1420 [inline]
>   ib_register_device+0x8b1/0xbc0 drivers/infiniband/core/device.c:1366
>   rxe_register_device+0x302/0x3e0 drivers/infiniband/sw/rxe/rxe_verbs.c:1485
>   rxe_net_add+0x90/0xf0 drivers/infiniband/sw/rxe/rxe_net.c:527
>   rxe_newlink+0xf0/0x1b0 drivers/infiniband/sw/rxe/rxe.c:197
>   nldev_newlink+0x332/0x5e0 drivers/infiniband/core/nldev.c:1731
>   rdma_nl_rcv_msg+0x371/0x6a0 drivers/infiniband/core/netlink.c:195
>   rdma_nl_rcv_skb.constprop.0.isra.0+0x2fc/0x440 drivers/infiniband/core/netlink.c:239
>   netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline]
>   netlink_unicast+0x547/0x7f0 net/netlink/af_netlink.c:1365
>   netlink_sendmsg+0x925/0xe30 net/netlink/af_netlink.c:1913
>   sock_sendmsg_nosec net/socket.c:724 [inline]
>   sock_sendmsg+0xde/0x190 net/socket.c:747
>   ____sys_sendmsg+0x71c/0x900 net/socket.c:2503
>   ___sys_sendmsg+0x110/0x1b0 net/socket.c:2557
>   __sys_sendmsg+0xf7/0x1c0 net/socket.c:2586
>   do_syscall_x64 arch/x86/entry/common.c:50 [inline]
>   do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
>   entry_SYSCALL_64_after_hwframe+0x63/0xcd
> RIP: 0033:0x7feddf48c169
> Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
> RSP: 002b:00007fede029f168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
> RAX: ffffffffffffffda RBX: 00007feddf5abf80 RCX: 00007feddf48c169
> RDX: 0000000000000000 RSI: 0000000020000240 RDI: 0000000000000003
> RBP: 00007feddf4e7ca1 R08: 0000000000000000 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
> R13: 00007ffe1bb3e01f R14: 00007fede029f300 R15: 0000000000022000
>   </TASK>
> Modules linked in:
>
>
> Guoqing
>

^ permalink raw reply	[flat|nested] 22+ messages in thread

* Re: [syzbot] [rdma?] INFO: trying to register non-static key in skb_dequeue (2)
  2023-05-23  6:07                       ` Zhu Yanjun
@ 2023-05-23  6:11                         ` Guoqing Jiang
  2023-05-23  6:40                           ` Zhu Yanjun
  0 siblings, 1 reply; 22+ messages in thread
From: Guoqing Jiang @ 2023-05-23  6:11 UTC (permalink / raw)
  To: Zhu Yanjun
  Cc: syzbot, jgg, leon, linux-kernel, linux-rdma, netdev,
	syzkaller-bugs



On 5/23/23 14:07, Zhu Yanjun wrote:

>> There was another null-ptr-deref, no?
> Please show me the link. So I can delve into it.

Just the first mail of the thread ...

>> general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN
>> KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037]
>> CPU: 1 PID: 31038 Comm: syz-executor.3 Not tainted 6.3.0-syzkaller-12728-g348551ddaf31 #0
>> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023
>> RIP: 0010:flush_send_queue drivers/infiniband/sw/rxe/rxe_comp.c:597 [inline]
>> RIP: 0010:rxe_completer+0x255c/0x3cc0 drivers/infiniband/sw/rxe/rxe_comp.c:653
>> Code: 80 3c 02 00 0f 85 81 10 00 00 49 8b af 88 03 00 00 48 8d 45 30 48 89 c2 48 89 04 24 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 83 11 00 00 48 8d 45 2c 44 8b
>> RSP: 0018:ffffc90003526938 EFLAGS: 00010206
>> RAX: dffffc0000000000 RBX: ffffed100e3fe800 RCX: ffffc9000b403000
>> RDX: 0000000000000006 RSI: ffffffff877e467a RDI: ffff888071ff4388
>> RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
>> R10: fffffbfff1cf3682 R11: fffffffffffda5b0 R12: ffff888071ff41a0
>> R13: 0000000000000000 R14: 0000000000000000 R15: ffff888071ff4000
>> FS:  00007fede029f700(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000
>> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>> CR2: 0000001b2d822000 CR3: 000000002c7e6000 CR4: 00000000003506e0
>> Call Trace:
>>    <TASK>
>>    rxe_qp_do_cleanup+0x1be/0x820 drivers/infiniband/sw/rxe/rxe_qp.c:761
>>    execute_in_process_context+0x3b/0x150 kernel/workqueue.c:3473
>>    __rxe_cleanup+0x21e/0x370 drivers/infiniband/sw/rxe/rxe_pool.c:233
>>    rxe_create_qp+0x3f6/0x5f0 drivers/infiniband/sw/rxe/rxe_verbs.c:583
>>    create_qp+0x5ac/0x970 drivers/infiniband/core/verbs.c:1235
>>    ib_create_qp_kernel+0xa1/0x310 drivers/infiniband/core/verbs.c:1346
>>    ib_create_qp include/rdma/ib_verbs.h:3743 [inline]
>>    create_mad_qp+0x177/0x380 drivers/infiniband/core/mad.c:2905
>>    ib_mad_port_open drivers/infiniband/core/mad.c:2986 [inline]
>>    ib_mad_init_device+0xf40/0x1a90 drivers/infiniband/core/mad.c:3077
>>    add_client_context+0x405/0x5e0 drivers/infiniband/core/device.c:721
>>    enable_device_and_get+0x1cd/0x3b0 drivers/infiniband/core/device.c:1332
>>    ib_register_device drivers/infiniband/core/device.c:1420 [inline]
>>    ib_register_device+0x8b1/0xbc0 drivers/infiniband/core/device.c:1366
>>    rxe_register_device+0x302/0x3e0 drivers/infiniband/sw/rxe/rxe_verbs.c:1485
>>    rxe_net_add+0x90/0xf0 drivers/infiniband/sw/rxe/rxe_net.c:527
>>    rxe_newlink+0xf0/0x1b0 drivers/infiniband/sw/rxe/rxe.c:197
>>    nldev_newlink+0x332/0x5e0 drivers/infiniband/core/nldev.c:1731
>>    rdma_nl_rcv_msg+0x371/0x6a0 drivers/infiniband/core/netlink.c:195
>>    rdma_nl_rcv_skb.constprop.0.isra.0+0x2fc/0x440 drivers/infiniband/core/netlink.c:239
>>    netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline]
>>    netlink_unicast+0x547/0x7f0 net/netlink/af_netlink.c:1365
>>    netlink_sendmsg+0x925/0xe30 net/netlink/af_netlink.c:1913
>>    sock_sendmsg_nosec net/socket.c:724 [inline]
>>    sock_sendmsg+0xde/0x190 net/socket.c:747
>>    ____sys_sendmsg+0x71c/0x900 net/socket.c:2503
>>    ___sys_sendmsg+0x110/0x1b0 net/socket.c:2557
>>    __sys_sendmsg+0xf7/0x1c0 net/socket.c:2586
>>    do_syscall_x64 arch/x86/entry/common.c:50 [inline]
>>    do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
>>    entry_SYSCALL_64_after_hwframe+0x63/0xcd
>> RIP: 0033:0x7feddf48c169
>> Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
>> RSP: 002b:00007fede029f168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
>> RAX: ffffffffffffffda RBX: 00007feddf5abf80 RCX: 00007feddf48c169
>> RDX: 0000000000000000 RSI: 0000000020000240 RDI: 0000000000000003
>> RBP: 00007feddf4e7ca1 R08: 0000000000000000 R09: 0000000000000000
>> R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
>> R13: 00007ffe1bb3e01f R14: 00007fede029f300 R15: 0000000000022000
>>    </TASK>
>> Modules linked in:
>>

Anyway, pls check above in the link.

https://lore.kernel.org/linux-rdma/3cc9f12a-d680-e05c-72c6-d4cb559fe5ee@linux.dev/T/#m2d374949d62b017074545c2f2a1df9251e0bde32

Guoqing

^ permalink raw reply	[flat|nested] 22+ messages in thread

* Re: [syzbot] [rdma?] INFO: trying to register non-static key in skb_dequeue (2)
  2023-05-23  6:11                         ` Guoqing Jiang
@ 2023-05-23  6:40                           ` Zhu Yanjun
  0 siblings, 0 replies; 22+ messages in thread
From: Zhu Yanjun @ 2023-05-23  6:40 UTC (permalink / raw)
  To: Guoqing Jiang
  Cc: syzbot, jgg, leon, linux-kernel, linux-rdma, netdev,
	syzkaller-bugs

On Tue, May 23, 2023 at 2:11 PM Guoqing Jiang <guoqing.jiang@linux.dev> wrote:
>
>
>
> On 5/23/23 14:07, Zhu Yanjun wrote:
>
> >> There was another null-ptr-deref, no?
> > Please show me the link. So I can delve into it.
>
> Just the first mail of the thread ...
>
> >> general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN
> >> KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037]
> >> CPU: 1 PID: 31038 Comm: syz-executor.3 Not tainted 6.3.0-syzkaller-12728-g348551ddaf31 #0
> >> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023
> >> RIP: 0010:flush_send_queue drivers/infiniband/sw/rxe/rxe_comp.c:597 [inline]
> >> RIP: 0010:rxe_completer+0x255c/0x3cc0 drivers/infiniband/sw/rxe/rxe_comp.c:653
> >> Code: 80 3c 02 00 0f 85 81 10 00 00 49 8b af 88 03 00 00 48 8d 45 30 48 89 c2 48 89 04 24 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 83 11 00 00 48 8d 45 2c 44 8b
> >> RSP: 0018:ffffc90003526938 EFLAGS: 00010206
> >> RAX: dffffc0000000000 RBX: ffffed100e3fe800 RCX: ffffc9000b403000
> >> RDX: 0000000000000006 RSI: ffffffff877e467a RDI: ffff888071ff4388
> >> RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
> >> R10: fffffbfff1cf3682 R11: fffffffffffda5b0 R12: ffff888071ff41a0
> >> R13: 0000000000000000 R14: 0000000000000000 R15: ffff888071ff4000
> >> FS:  00007fede029f700(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000
> >> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> >> CR2: 0000001b2d822000 CR3: 000000002c7e6000 CR4: 00000000003506e0
> >> Call Trace:
> >>    <TASK>
> >>    rxe_qp_do_cleanup+0x1be/0x820 drivers/infiniband/sw/rxe/rxe_qp.c:761
> >>    execute_in_process_context+0x3b/0x150 kernel/workqueue.c:3473
> >>    __rxe_cleanup+0x21e/0x370 drivers/infiniband/sw/rxe/rxe_pool.c:233
> >>    rxe_create_qp+0x3f6/0x5f0 drivers/infiniband/sw/rxe/rxe_verbs.c:583
> >>    create_qp+0x5ac/0x970 drivers/infiniband/core/verbs.c:1235
> >>    ib_create_qp_kernel+0xa1/0x310 drivers/infiniband/core/verbs.c:1346
> >>    ib_create_qp include/rdma/ib_verbs.h:3743 [inline]
> >>    create_mad_qp+0x177/0x380 drivers/infiniband/core/mad.c:2905
> >>    ib_mad_port_open drivers/infiniband/core/mad.c:2986 [inline]
> >>    ib_mad_init_device+0xf40/0x1a90 drivers/infiniband/core/mad.c:3077
> >>    add_client_context+0x405/0x5e0 drivers/infiniband/core/device.c:721
> >>    enable_device_and_get+0x1cd/0x3b0 drivers/infiniband/core/device.c:1332
> >>    ib_register_device drivers/infiniband/core/device.c:1420 [inline]
> >>    ib_register_device+0x8b1/0xbc0 drivers/infiniband/core/device.c:1366
> >>    rxe_register_device+0x302/0x3e0 drivers/infiniband/sw/rxe/rxe_verbs.c:1485
> >>    rxe_net_add+0x90/0xf0 drivers/infiniband/sw/rxe/rxe_net.c:527
> >>    rxe_newlink+0xf0/0x1b0 drivers/infiniband/sw/rxe/rxe.c:197
> >>    nldev_newlink+0x332/0x5e0 drivers/infiniband/core/nldev.c:1731
> >>    rdma_nl_rcv_msg+0x371/0x6a0 drivers/infiniband/core/netlink.c:195
> >>    rdma_nl_rcv_skb.constprop.0.isra.0+0x2fc/0x440 drivers/infiniband/core/netlink.c:239
> >>    netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline]
> >>    netlink_unicast+0x547/0x7f0 net/netlink/af_netlink.c:1365
> >>    netlink_sendmsg+0x925/0xe30 net/netlink/af_netlink.c:1913
> >>    sock_sendmsg_nosec net/socket.c:724 [inline]
> >>    sock_sendmsg+0xde/0x190 net/socket.c:747
> >>    ____sys_sendmsg+0x71c/0x900 net/socket.c:2503
> >>    ___sys_sendmsg+0x110/0x1b0 net/socket.c:2557
> >>    __sys_sendmsg+0xf7/0x1c0 net/socket.c:2586
> >>    do_syscall_x64 arch/x86/entry/common.c:50 [inline]
> >>    do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
> >>    entry_SYSCALL_64_after_hwframe+0x63/0xcd
> >> RIP: 0033:0x7feddf48c169
> >> Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
> >> RSP: 002b:00007fede029f168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
> >> RAX: ffffffffffffffda RBX: 00007feddf5abf80 RCX: 00007feddf48c169
> >> RDX: 0000000000000000 RSI: 0000000020000240 RDI: 0000000000000003
> >> RBP: 00007feddf4e7ca1 R08: 0000000000000000 R09: 0000000000000000
> >> R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
> >> R13: 00007ffe1bb3e01f R14: 00007fede029f300 R15: 0000000000022000
> >>    </TASK>
> >> Modules linked in:
> >>
>
> Anyway, pls check above in the link.
>
> https://lore.kernel.org/linux-rdma/3cc9f12a-d680-e05c-72c6-d4cb559fe5ee@linux.dev/T/#m2d374949d62b017074545c2f2a1df9251e0bde32
>

Based on the following analysis, the problem in the link is the same
with this problem.

infiniband syz2: set active
infiniband syz2: added bond_slave_1
INFO: trying to register non-static key.
The code is fine but needs lockdep annotation, or maybe
you didn't initialize this object before use?
         <----This means that this is a use-before-initialization
problem
turning off the locking correctness validator.
CPU: 1 PID: 31038 Comm: syz-executor.3 Not tainted
6.3.0-syzkaller-12728-g348551ddaf31 #0
Hardware name: Google Google Compute Engine/Google Compute Engine,
BIOS Google 04/14/2023
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xd9/0x150 lib/dump_stack.c:106
 assign_lock_key kernel/locking/lockdep.c:982 [inline]
 register_lock_class+0xdb6/0x1120 kernel/locking/lockdep.c:1295
 __lock_acquire+0x10a/0x5df0 kernel/locking/lockdep.c:4951
 lock_acquire kernel/locking/lockdep.c:5691 [inline]
 lock_acquire+0x1b1/0x520 kernel/locking/lockdep.c:5656
 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
 _raw_spin_lock_irqsave+0x3d/0x60 kernel/locking/spinlock.c:162
 skb_dequeue+0x20/0x180 net/core/skbuff.c:3631
 drain_resp_pkts drivers/infiniband/sw/rxe/rxe_comp.c:555 [inline]
                    <----- when skb_dequeue is called, spin lock of
resp_pkts is not initialized.
 rxe_completer+0x250d/0x3cc0 drivers/infiniband/sw/rxe/rxe_comp.c:652
 rxe_qp_do_cleanup+0x1be/0x820 drivers/infiniband/sw/rxe/rxe_qp.c:761
 execute_in_process_context+0x3b/0x150 kernel/workqueue.c:3473
 __rxe_cleanup+0x21e/0x370 drivers/infiniband/sw/rxe/rxe_pool.c:233

 rxe_create_qp+0x3f6/0x5f0 drivers/infiniband/sw/rxe/rxe_verbs.c:583 <---- Here.

 "
 573         err = rxe_qp_from_init(rxe, qp, pd, init, uresp, ibqp->pd, udata);
 574         if (err) {
 575                 rxe_dbg_qp(qp, "create qp failed, err = %d", err);
 576                 goto err_cleanup;
 577         }
 578
 579         rxe_finalize(qp);
 580         return 0;
 581
 582 err_cleanup:
 583         cleanup_err = rxe_cleanup(qp);    <--- this is error handler.

 "
  create_qp+0x5ac/0x970 drivers/infiniband/core/verbs.c:1235
  ib_create_qp_kernel+0xa1/0x310 drivers/infiniband/core/verbs.c:1346

Zhu Yanjun
> Guoqing

^ permalink raw reply	[flat|nested] 22+ messages in thread

end of thread, other threads:[~2023-05-23  6:40 UTC | newest]

Thread overview: 22+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
     [not found] <000000000000235bce05fac5f850@google.com>
2023-05-18  9:20 ` [syzbot] [rdma?] INFO: trying to register non-static key in skb_dequeue (2) syzbot
2023-05-23  2:07   ` Guoqing Jiang
2023-05-23  2:13     ` syzbot
2023-05-23  2:25       ` Guoqing Jiang
2023-05-23  2:55         ` syzbot
2023-05-23  3:47         ` Zhu Yanjun
2023-05-23  3:58           ` Guoqing Jiang
2023-05-23  4:02           ` Zhu Yanjun
2023-05-23  4:10             ` Guoqing Jiang
2023-05-23  4:29               ` Zhu Yanjun
2023-05-23  5:08                 ` Zhu Yanjun
2023-05-23  5:18                   ` Zhu Yanjun
2023-05-23  5:44                     ` Guoqing Jiang
2023-05-23  5:52                       ` Zhu Yanjun
2023-05-23  5:56                         ` Guoqing Jiang
2023-05-23  6:04                           ` Zhu Yanjun
2023-05-23  5:50                 ` Guoqing Jiang
2023-05-23  5:55                   ` Zhu Yanjun
2023-05-23  6:00                     ` Guoqing Jiang
2023-05-23  6:07                       ` Zhu Yanjun
2023-05-23  6:11                         ` Guoqing Jiang
2023-05-23  6:40                           ` Zhu Yanjun

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).