[syzbot] Monthly rdma report (Nov 2024)

[syzbot] Monthly rdma report (Nov 2024)

[syzbot]

Hello rdma maintainers/developers,

This is a 31-day syzbot report for the rdma subsystem.
All related reports/information can be found at:
https://syzkaller.appspot.com/upstream/s/rdma

During the period, 2 new issues were detected and 0 were fixed.
In total, 8 issues are still open and 61 have already been fixed.

Some of the still happening issues:

Ref Crashes Repro Title
<1> 350     No    INFO: task hung in disable_device
                  https://syzkaller.appspot.com/bug?extid=4d0c396361b5dc5d610f
<2> 231     No    INFO: task hung in rdma_dev_change_netns
                  https://syzkaller.appspot.com/bug?extid=73c5eab674c7e1e7012e
<3> 51      No    WARNING in rxe_pool_cleanup
                  https://syzkaller.appspot.com/bug?extid=221e213bf17f17e0d6cd
<4> 46      No    INFO: task hung in add_one_compat_dev (3)
                  https://syzkaller.appspot.com/bug?extid=6dee15fdb0606ef7b6ba
<5> 12      Yes   possible deadlock in sock_set_reuseaddr
                  https://syzkaller.appspot.com/bug?extid=af5682e4f50cd6bce838

---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

To disable reminders for individual bugs, reply with the following command:
#syz set <Ref> no-reminders

To change bug's subsystems, reply with:
#syz set <Ref> subsystems: new-subsystem

You may send multiple commands in a single email message.

Re: [syzbot] Monthly rdma report (Nov 2024)

[Zhu Yanjun]

On 29.11.24 09:55, syzbot wrote:
> Hello rdma maintainers/developers,
> 
> This is a 31-day syzbot report for the rdma subsystem.
> All related reports/information can be found at:
> https://syzkaller.appspot.com/upstream/s/rdma
> 
> During the period, 2 new issues were detected and 0 were fixed.
> In total, 8 issues are still open and 61 have already been fixed.
> 
> Some of the still happening issues:
> 
> Ref Crashes Repro Title
> <1> 350     No    INFO: task hung in disable_device
>                    https://syzkaller.appspot.com/bug?extid=4d0c396361b5dc5d610f
> <2> 231     No    INFO: task hung in rdma_dev_change_netns
>                    https://syzkaller.appspot.com/bug?extid=73c5eab674c7e1e7012e
> <3> 51      No    WARNING in rxe_pool_cleanup
>                    https://syzkaller.appspot.com/bug?extid=221e213bf17f17e0d6cd

To this rxe problem, I found the following bug reports.
"
[syzbot] Monthly rdma report (Nov 2024)	0 (1)	2024/11/29 08:55
[syzbot] Monthly rdma report (Oct 2024)	0 (1)	2024/10/28 20:45
[syzbot] Monthly rdma report (Sep 2024)	0 (1)	2024/09/27 13:28
[syzbot] Monthly rdma report (Aug 2024)	1 (2)	2024/08/31 04:02
[syzbot] [rdma?] WARNING in rxe_pool_cleanup	0 (1)	2024/05/13 02:22
"
It means that pd_pool is not empty when rxe link is removed in many 
testcases.

But to the pd, the caller should call the following to allocate a pd and 
destroy a pd.

"
.alloc_pd = rxe_alloc_pd,
...
.dealloc_pd = rxe_dealloc_pd,
"

That is, the caller should create a pd when rdma link is created. And 
the caller should destroy a pd when rdma link is removed.

When pd pool is not empty, it seems that at least one pd is not removed 
when rdma link is removed. The caller should check the application to 
remove this pd before a rdma link is removed.

It is the caller to create and destroy pd, not rxe.

I am not sure whether we should add logs into rxe_alloc_pd and 
rxe_dealloc_pd to notify the caller or not.

Zhu Yanjun

> <4> 46      No    INFO: task hung in add_one_compat_dev (3)
>                    https://syzkaller.appspot.com/bug?extid=6dee15fdb0606ef7b6ba
> <5> 12      Yes   possible deadlock in sock_set_reuseaddr
>                    https://syzkaller.appspot.com/bug?extid=af5682e4f50cd6bce838
> 
> ---
> This report is generated by a bot. It may contain errors.
> See https://goo.gl/tpsmEJ for more information about syzbot.
> syzbot engineers can be reached at syzkaller@googlegroups.com.
> 
> To disable reminders for individual bugs, reply with the following command:
> #syz set <Ref> no-reminders
> 
> To change bug's subsystems, reply with:
> #syz set <Ref> subsystems: new-subsystem
> 
> You may send multiple commands in a single email message.

Re: [syzbot] Monthly rdma report (Nov 2024)

[Jason Gunthorpe]

On Fri, Nov 29, 2024 at 12:30:37PM +0100, Zhu Yanjun wrote:

> When pd pool is not empty, it seems that at least one pd is not removed when
> rdma link is removed. The caller should check the application to remove this
> pd before a rdma link is removed.

The bug is that this somehow happened, I think. There should be
refcounts preventing removal of an ib device while a client is
attached

Or, perhaps more likely, it is a pd leak on an error path.

Jason