From: "Toke Høiland-Jørgensen" <toke@redhat.com>
To: Hillf Danton <hdanton@sina.com>,
syzbot <syzbot+4e7a85b1432052e8d6f8@syzkaller.appspotmail.com>
Cc: alexei.starovoitov@gmail.com, ast@kernel.org,
bpf@vger.kernel.org, daniel@iogearbox.net, davem@davemloft.net,
hawk@kernel.org, jakub.kicinski@netronome.com,
jbrouer@redhat.com, john.fastabend@gmail.com, kafai@fb.com,
linux-kernel@vger.kernel.org, netdev@vger.kernel.org,
songliubraving@fb.com, syzkaller-bugs@googlegroups.com,
yhs@fb.com
Subject: Re: general protection fault in dev_map_hash_update_elem
Date: Sun, 08 Sep 2019 09:09:36 +0100 [thread overview]
Message-ID: <87v9u3w6nz.fsf@toke.dk> (raw)
In-Reply-To: <20190908030726.7520-1-hdanton@sina.com>
Hillf Danton <hdanton@sina.com> writes:
>> syzbot has found a reproducer for the following crash on Sat, 07 Sep 2019 18:59:06 -0700
>>
>> HEAD commit: a2c11b03 kcm: use BPF_PROG_RUN
>> git tree: bpf-next
>> console output: https://syzkaller.appspot.com/x/log.txt?x=13d46ec1600000
>> kernel config: https://syzkaller.appspot.com/x/.config?x=cf0c85d15c20ade3
>> dashboard link: https://syzkaller.appspot.com/bug?extid=4e7a85b1432052e8d6f8
>> compiler: gcc (GCC) 9.0.0 20181231 (experimental)
>> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1220b2d1600000
>> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1360b26e600000
>>
>> general protection fault: 0000 [#1] PREEMPT SMP KASAN
>> CPU: 1 PID: 10210 Comm: syz-executor910 Not tainted 5.3.0-rc7+ #0
>> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
>> Google 01/01/2011
>> RIP: 0010:__write_once_size include/linux/compiler.h:226 [inline]
>> RIP: 0010:__hlist_del include/linux/list.h:762 [inline]
>> RIP: 0010:hlist_del_rcu include/linux/rculist.h:455 [inline]
>> RIP: 0010:__dev_map_hash_update_elem kernel/bpf/devmap.c:668 [inline]
>> RIP: 0010:dev_map_hash_update_elem+0x3c8/0x6e0 kernel/bpf/devmap.c:691
>
> Fix commit 6f9d451ab1a3 ("xdp: Add devmap_hash map type for looking
> up devices by hashed index")
While this minimal patch does fix the bug (as Jesper already noted), I
prefer to rework the logic instead of just repeating the lookup; a patch
is on its way :)
-Toke
next parent reply other threads:[~2019-09-08 8:09 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20190908030726.7520-1-hdanton@sina.com>
2019-09-08 8:09 ` Toke Høiland-Jørgensen [this message]
2019-09-05 20:08 general protection fault in dev_map_hash_update_elem syzbot
2019-09-05 21:44 ` Alexei Starovoitov
2019-09-06 12:54 ` Jesper Dangaard Brouer
2019-09-06 23:04 ` Toke Høiland-Jørgensen
2019-09-08 1:59 ` syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87v9u3w6nz.fsf@toke.dk \
--to=toke@redhat.com \
--cc=alexei.starovoitov@gmail.com \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=davem@davemloft.net \
--cc=hawk@kernel.org \
--cc=hdanton@sina.com \
--cc=jakub.kicinski@netronome.com \
--cc=jbrouer@redhat.com \
--cc=john.fastabend@gmail.com \
--cc=kafai@fb.com \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=songliubraving@fb.com \
--cc=syzbot+4e7a85b1432052e8d6f8@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
--cc=yhs@fb.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).