From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0151DC4332F for ; Thu, 8 Dec 2022 18:07:08 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229619AbiLHSHH (ORCPT ); Thu, 8 Dec 2022 13:07:07 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34316 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229521AbiLHSHF (ORCPT ); Thu, 8 Dec 2022 13:07:05 -0500 Received: from mail-ed1-x536.google.com (mail-ed1-x536.google.com [IPv6:2a00:1450:4864:20::536]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7DBAC2FBCE; Thu, 8 Dec 2022 10:07:04 -0800 (PST) Received: by mail-ed1-x536.google.com with SMTP id a16so2876382edb.9; Thu, 08 Dec 2022 10:07:04 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=in-reply-to:content-transfer-encoding:content-disposition :mime-version:references:message-id:subject:cc:to:date:from:from:to :cc:subject:date:message-id:reply-to; bh=zlZ5JYrfoxlWWhYLoRlXAX2lb7aDsHfABVN0GPpBHNM=; b=lruSRpX2iU7Qy3Bybc+bFJcYPzpZBUHVHjfOKiYhVqC9kGN7RQfw/4mQ26JOMqEjdU gfY+acMolufoIoWyhLrYmzpzzNRx+B6o7rsP9hBsHfMyfTI4g71ZEiGSWASeGtr3FR9g AuF3W5S3rXfqbBHme3vWhMwKoiDPGaAPY1M0GsEPxqmORDknDR9YMWDRGsc78SLblTPB HrviXQ/jWJdPMqerf/ZNft1pgViT2wWbhAh7QYcDGJDDijO2JzlnFDuVDc8utzEPw+Zq PU1Ze8C5lLNq6gAsUoOlqxFZxf9NMXOzv1bKx3JxFWRjviEeWoKiufovPrvV/JaNut1k yZCw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=in-reply-to:content-transfer-encoding:content-disposition :mime-version:references:message-id:subject:cc:to:date:from :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=zlZ5JYrfoxlWWhYLoRlXAX2lb7aDsHfABVN0GPpBHNM=; b=u1/v1H+tyYMqdz/J0V4tgHWAN8CGYqTECu4RlGNXvjoMLFpw+b8m+0Csxijuk98UDJ TT+cfVPOAXfW/eMxCb6HCUVulk3lIkR1hmESrk/4Qd+pM6q0knxfVexartviUwg0HuKa 8p8fvzxUFTHwQkTGSu0+eB8IeHoNtb2SKmINrpDySnJw0D1psk0Mxz6Fx+uHmnE0W2zL Fq70wp6Sb1xMXfgvacgY00i0rvukRN4/RCPfRNQT5seYWuC9SjNaWCZIK3eDTXxmAmGC 846vl5Mq+47jFiADWpYrxc+m7ejsYnpwJN7DP/xLg0dx5dkVNmb8gJmatakbgmGbLVtr vXQQ== X-Gm-Message-State: ANoB5pklgLJhyZoxCCUz1mooR/Zke+qezTmDLbZmlWEEufV2pCcga/n+ fu5WABu0tnJ7JnVoOXteMOs= X-Google-Smtp-Source: AA0mqf7DiOruFzawmpbEDX8sSceVWIPq+u8dLVRJ5tc0JilGkZFIMKpo9H0anA7MpyB5lchyygmvBg== X-Received: by 2002:a05:6402:370e:b0:463:398a:9fe7 with SMTP id ek14-20020a056402370e00b00463398a9fe7mr2413340edb.34.1670522822943; Thu, 08 Dec 2022 10:07:02 -0800 (PST) Received: from krava (ip-78-102-146-30.bb.vodafone.cz. [78.102.146.30]) by smtp.gmail.com with ESMTPSA id x14-20020aa7cd8e000000b0046b00a9eeb5sm3634944edv.49.2022.12.08.10.07.01 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 08 Dec 2022 10:07:02 -0800 (PST) From: Jiri Olsa X-Google-Original-From: Jiri Olsa Date: Thu, 8 Dec 2022 19:06:59 +0100 To: Alexei Starovoitov Cc: Jiri Olsa , Hao Sun , Peter Zijlstra , bpf , Alexei Starovoitov , Daniel Borkmann , John Fastabend , Andrii Nakryiko , Martin KaFai Lau , Song Liu , Yonghong Song , KP Singh , Stanislav Fomichev , Hao Luo , David Miller , Jakub Kicinski , Jesper Dangaard Brouer , Linux Kernel Mailing List , netdev , Thorsten Leemhuis Subject: Re: BUG: unable to handle kernel paging request in bpf_dispatcher_xdp Message-ID: References: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org On Thu, Dec 08, 2022 at 09:48:52AM -0800, Alexei Starovoitov wrote: > On Wed, Dec 7, 2022 at 11:57 AM Alexei Starovoitov > wrote: > > > > On Tue, Dec 6, 2022 at 7:18 AM Jiri Olsa wrote: > > > > > > On Tue, Dec 06, 2022 at 02:46:43PM +0800, Hao Sun wrote: > > > > Hao Sun 于2022年12月6日周二 11:28写道： > > > > > > > > > > Hi, > > > > > > > > > > The following crash can be triggered with the BPF prog provided. > > > > > It seems the verifier passed some invalid progs. I will try to simplify > > > > > the C reproducer, for now, the following can reproduce this: > > > > > > > > > > HEAD commit: ab0350c743d5 selftests/bpf: Fix conflicts with built-in > > > > > functions in bpf_iter_ksym > > > > > git tree: bpf-next > > > > > console log: https://pastebin.com/raw/87RCSnCs > > > > > kernel config: https://pastebin.com/raw/rZdWLcgK > > > > > Syz reproducer: https://pastebin.com/raw/4kbwhdEv > > > > > C reproducer: https://pastebin.com/raw/GFfDn2Gk > > > > > > > > > > > > > Simplified C reproducer: https://pastebin.com/raw/aZgLcPvW > > > > > > > > Only two syscalls are required to reproduce this, seems it's an issue > > > > in XDP test run. Essentially, the reproducer just loads a very simple > > > > prog and tests run repeatedly and concurrently: > > > > > > > > r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000640)=@base={0x6, 0xb, > > > > &(0x7f0000000500)}, 0x80) > > > > bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000140)={r0, 0x0, 0x0, 0x0, 0x0, > > > > 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) > > > > > > > > Loaded prog: > > > > 0: (18) r0 = 0x0 > > > > 2: (18) r6 = 0x0 > > > > 4: (18) r7 = 0x0 > > > > 6: (18) r8 = 0x0 > > > > 8: (18) r9 = 0x0 > > > > 10: (95) exit > > > > > > hi, > > > I can reproduce with your config.. it seems related to the > > > recent static call change: > > > c86df29d11df bpf: Convert BPF_DISPATCHER to use static_call() (not ftrace) > > > > > > I can't reproduce when I revert that commit.. Peter, any idea? > > > > Jiri, > > > > I see your tested-by tag on Peter's commit c86df29d11df. > > I assume you're actually tested it, but > > this syzbot oops shows that even empty bpf prog crashes, > > so there is something wrong with that commit. > > > > What is the difference between this new kconfig and old one that > > you've tested? > > > > I'm trying to understand the severity of the issues and > > whether we need to revert that commit asap since the merge window > > is about to start. > > Jiri, Peter, > > ping. > > cc-ing Thorsten, since he's tracking it now. > > The config has CONFIG_X86_KERNEL_IBT=y. > Is it related? sorry for late reply.. I still did not find the reason, but I did not try with IBT yet, will test now jirka