[PATCH net 0/3] Fixes for BPF selftests on loongarch

[PATCH net 0/3] Fixes for BPF selftests on loongarch

[Geliang Tang]

From: Geliang Tang <tanggeliang@kylinos.cn>

When I ran BPF selftests on loongarch recently, some errors occur. Fix
them in this set.

Geliang Tang (3):
  skmsg: null check for page in sk_msg_recvmsg
  inet: null check for close in inet_release
  selftests/bpf: Null checks for link in bpf_tcp_ca

 net/core/skmsg.c                                    |  2 ++
 net/ipv4/af_inet.c                                  |  3 ++-
 tools/testing/selftests/bpf/prog_tests/bpf_tcp_ca.c | 12 ++++++++----
 3 files changed, 12 insertions(+), 5 deletions(-)

-- 
2.43.0

[PATCH net 1/3] skmsg: null check for page in sk_msg_recvmsg

[Geliang Tang]

From: Geliang Tang <tanggeliang@kylinos.cn>

Run the following BPF selftests on loongarch:

# ./test_progs -t sockmap_basic

A Kernel panic occurs:

'''
 Oops[#1]:
 CPU: 22 PID: 2824 Comm: test_progs Tainted: G           OE      6.10.0-rc2+ #18
 Hardware name: LOONGSON Dabieshan/Loongson-TC542F0, BIOS Loongson-UDK2018-V4.0.11
 pc 9000000004162774 ra 90000000048bf6c0 tp 90001000aa16c000 sp 90001000aa16fb90
 a0 0000000000000000 a1 0000000000000000 a2 0000000000000000 a3 90001000aa16fd70
 a4 0000000000000800 a5 0000000000000000 a6 000055557b63aae8 a7 00000000000000cf
 t0 0000000000000000 t1 0000000000004000 t2 0000000000000048 t3 0000000000000000
 t4 0000000000000001 t5 0000000000000002 t6 0000000000000001 t7 0000000000000002
 t8 0000000000000018 u0 9000000004856150 s9 0000000000000000 s0 0000000000000000
 s1 0000000000000000 s2 90001000aa16fd70 s3 0000000000000000 s4 0000000000000000
 s5 0000000000004000 s6 900010009284dc00 s7 0000000000000001 s8 900010009284dc00
    ra: 90000000048bf6c0 sk_msg_recvmsg+0x120/0x560
   ERA: 9000000004162774 copy_page_to_iter+0x74/0x1c0
  CRMD: 000000b0 (PLV0 -IE -DA +PG DACF=CC DACM=CC -WE)
  PRMD: 0000000c (PPLV0 +PIE +PWE)
  EUEN: 00000007 (+FPE +SXE +ASXE -BTE)
  ECFG: 00071c1d (LIE=0,2-4,10-12 VS=7)
 ESTAT: 00010000 [PIL] (IS= ECode=1 EsubCode=0)
  BADV: 0000000000000040
  PRID: 0014c011 (Loongson-64bit, Loongson-3C5000)
 Modules linked in: bpf_testmod(OE) xt_CHECKSUM xt_MASQUERADE xt_conntrack
 Process test_progs (pid: 2824, threadinfo=0000000000863a31, task=000000001cba0874)
 Stack : 0000000000000001 fffffffffffffffc 0000000000000000 0000000000000000
         0000000000000018 0000000000000000 0000000000000000 90000000048bf6c0
         90000000052cd638 90001000aa16fd70 900010008bf51580 900010009284f000
         90000000049f2b90 900010009284f188 900010009284f178 90001000861d4780
         9000100084dccd00 0000000000000800 0000000000000007 fffffffffffffff2
         000000000453e92f 90000000049aae34 90001000aa16fd60 900010009284f000
         0000000000000000 0000000000000000 900010008bf51580 90000000049f2b90
         0000000000000001 0000000000000000 9000100084dc3a10 900010009284f1ac
         90001000aa16fd40 0000555559953278 0000000000000001 0000000000000000
         90001000aa16fdc8 9000000005a5a000 90001000861d4780 0000000000000800
         ...
 Call Trace:
 [<9000000004162774>] copy_page_to_iter+0x74/0x1c0
 [<90000000048bf6c0>] sk_msg_recvmsg+0x120/0x560
 [<90000000049f2b90>] tcp_bpf_recvmsg_parser+0x170/0x4e0
 [<90000000049aae34>] inet_recvmsg+0x54/0x100
 [<900000000481ad5c>] sock_recvmsg+0x7c/0xe0
 [<900000000481e1a8>] __sys_recvfrom+0x108/0x1c0
 [<900000000481e27c>] sys_recvfrom+0x1c/0x40
 [<9000000004c076ec>] do_syscall+0x8c/0xc0
 [<9000000003731da4>] handle_syscall+0xc4/0x160

 Code: 0010b09b  440125a0  0011df8d <28c10364> 0012b70c  00133305  0013b1ac  0010dc84  00151585

 ---[ end trace 0000000000000000 ]---
 Kernel panic - not syncing: Fatal exception
 Kernel relocated by 0x3510000
  .text @ 0x9000000003710000
  .data @ 0x9000000004d70000
  .bss  @ 0x9000000006469400
 ---[ end Kernel panic - not syncing: Fatal exception ]---
'''

This is because "page" is NULL in that case. This patch adds null
check for it in sk_msg_recvmsg() to fix this error.

Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
---
 net/core/skmsg.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/core/skmsg.c b/net/core/skmsg.c
index fd20aae30be2..bafcc1e2eadf 100644
--- a/net/core/skmsg.c
+++ b/net/core/skmsg.c
@@ -432,6 +432,8 @@ int sk_msg_recvmsg(struct sock *sk, struct sk_psock *psock, struct msghdr *msg,
 			sge = sk_msg_elem(msg_rx, i);
 			copy = sge->length;
 			page = sg_page(sge);
+			if (!page)
+				goto out;
 			if (copied + copy > len)
 				copy = len - copied;
 			copy = copy_page_to_iter(page, sge->offset, copy, iter);
-- 
2.43.0

[PATCH net 2/3] inet: null check for close in inet_release

[Geliang Tang]

From: Geliang Tang <tanggeliang@kylinos.cn>

Run the following BPF selftests on loongarch:

# ./test_progs -t sockmap_listen

A Kernel panic occurs:

'''
 Oops[#1]:
 CPU: 49 PID: 233429 Comm: new_name Tainted: G           OE      6.10.0-rc2+ #20
 Hardware name: LOONGSON Dabieshan/Loongson-TC542F0, BIOS Loongson-UDK2018-V4.0.11
 pc 0000000000000000 ra 90000000051ea4a0 tp 900030008549c000 sp 900030008549fe00
 a0 9000300152524a00 a1 0000000000000000 a2 900030008549fe38 a3 900030008549fe30
 a4 900030008549fe30 a5 90003000c58c8d80 a6 0000000000000000 a7 0000000000000039
 t0 0000000000000000 t1 90003000c58c8d80 t2 0000000000000001 t3 0000000000000000
 t4 0000000000000001 t5 900000011a1bf580 t6 900000011a3aff60 t7 000000000000006b
 t8 00000fffffffffff u0 0000000000000000 s9 00007fffbbe9e930 s0 9000300152524a00
 s1 90003000c58c8d00 s2 9000000006c81568 s3 0000000000000000 s4 90003000c58c8d80
 s5 00007ffff236a000 s6 00007ffffbc292b0 s7 00007ffffbc29998 s8 00007fffbbe9f180
    ra: 90000000051ea4a0 inet_release+0x60/0xc0
   ERA: 0000000000000000 0x0
  CRMD: 000000b0 (PLV0 -IE -DA +PG DACF=CC DACM=CC -WE)
  PRMD: 0000000c (PPLV0 +PIE +PWE)
  EUEN: 00000000 (-FPE -SXE -ASXE -BTE)
  ECFG: 00071c1d (LIE=0,2-4,10-12 VS=7)
 ESTAT: 00030000 [PIF] (IS= ECode=3 EsubCode=0)
  BADV: 0000000000000000
  PRID: 0014c011 (Loongson-64bit, Loongson-3C5000)
 Modules linked in: xt_CHECKSUM xt_MASQUERADE xt_conntrack ipt_REJECT nf_nat_tftp
 Process new_name (pid: 233429, threadinfo=00000000b9196405, task=00000000c01df45b)
 Stack : 0000000000000000 90003000c58c8e20 90003000c58c8d00 900000000505960c
         0000000000000000 9000000101c6ad20 9000300086524540 00000000082e0003
         900030008bf57400 90000000050596bc 900030008bf57400 900000000434acac
         0000000000000016 00007ffff224e060 00007fffbbe9f180 900030008bf57400
         0000000000000000 9000000004341ce0 00007fffbbe9f180 00007ffff2369000
         900030008549fec0 90000000054476ec 000000000000006b 9000000003f71da4
         000000000000003a 00007ffff22b8a44 00007fffbbe9f8e0 00007fffbbe9e680
         ffffffffffffffda 0000000000000000 0000000000000000 0000000000000000
         00007fffbbe9f288 0000000000000000 0000000000000000 0000000000000039
         84c2431493ceab6e 84c23ceb2827425e 0000000000000007 00007ffff2271600
         ...
 Call Trace:
 [<900000000505960c>] __sock_release+0x4c/0xe0
 [<90000000050596bc>] sock_close+0x1c/0x40
 [<900000000434acac>] __fput+0xec/0x2e0
 [<9000000004341ce0>] sys_close+0x40/0xa0
 [<90000000054476ec>] do_syscall+0x8c/0xc0
 [<9000000003f71da4>] handle_syscall+0xc4/0x160

 Code: (Bad address in era)

 ---[ end trace 0000000000000000 ]---
 Kernel panic - not syncing: Fatal exception
 Kernel relocated by 0x3d50000
  .text @ 0x9000000003f50000
  .data @ 0x90000000055b0000
  .bss  @ 0x9000000006ca9400
 ---[ end Kernel panic - not syncing: Fatal exception ]---
'''

This is because "close" is NULL in that case. This patch adds null
check for it in inet_release() to fix this error.

Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
---
 net/ipv4/af_inet.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index b24d74616637..8e926018d011 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -434,7 +434,8 @@ int inet_release(struct socket *sock)
 		if (sock_flag(sk, SOCK_LINGER) &&
 		    !(current->flags & PF_EXITING))
 			timeout = sk->sk_lingertime;
-		sk->sk_prot->close(sk, timeout);
+		if (sk->sk_prot && sk->sk_prot->close)
+			sk->sk_prot->close(sk, timeout);
 		sock->sk = NULL;
 	}
 	return 0;
-- 
2.43.0

[PATCH net 3/3] selftests/bpf: Null checks for link in bpf_tcp_ca

[Geliang Tang]

From: Geliang Tang <tanggeliang@kylinos.cn>

Run BPF selftests bpf_tcp_ca on loongarch:

# ./test_progs -t bpf_tcp_ca

A "Segmentation fault" error occurs:

'''
 test_dctcp:PASS:bpf_dctcp__open_and_load 0 nsec
 test_dctcp:FAIL:bpf_map__attach_struct_ops unexpected error: -524
 #29/1    bpf_tcp_ca/dctcp:FAIL
 test_cubic:PASS:bpf_cubic__open_and_load 0 nsec
 test_cubic:FAIL:bpf_map__attach_struct_ops unexpected error: -524
 #29/2    bpf_tcp_ca/cubic:FAIL
 test_dctcp_fallback:PASS:dctcp_skel 0 nsec
 test_dctcp_fallback:PASS:bpf_dctcp__load 0 nsec
 test_dctcp_fallback:FAIL:dctcp link unexpected error: -524
 #29/4    bpf_tcp_ca/dctcp_fallback:FAIL
 test_write_sk_pacing:PASS:open_and_load 0 nsec
 test_write_sk_pacing:FAIL:attach_struct_ops unexpected error: -524
 #29/6    bpf_tcp_ca/write_sk_pacing:FAIL
 test_update_ca:PASS:open 0 nsec
 test_update_ca:FAIL:attach_struct_ops unexpected error: -524
 settcpca:FAIL:setsockopt unexpected setsockopt: actual -1 == expected -1
 (network_helpers.c:99: errno: No such file or directory) Failed to call post_socket_cb
 start_test:FAIL:start_server_str unexpected start_server_str: actual -1 == expected -1
 test_update_ca:FAIL:ca1_ca1_cnt unexpected ca1_ca1_cnt: actual 0 <= expected 0
 #29/9    bpf_tcp_ca/update_ca:FAIL
 #29      bpf_tcp_ca:FAIL
 Caught signal #11!
 Stack trace:
 ./test_progs(crash_handler+0x28)[0x5555567ed91c]
 linux-vdso.so.1(__vdso_rt_sigreturn+0x0)[0x7ffffee408b0]
 ./test_progs(bpf_link__update_map+0x80)[0x555556824a78]
 ./test_progs(+0x94d68)[0x5555564c4d68]
 ./test_progs(test_bpf_tcp_ca+0xe8)[0x5555564c6a88]
 ./test_progs(+0x3bde54)[0x5555567ede54]
 ./test_progs(main+0x61c)[0x5555567efd54]
 /usr/lib64/libc.so.6(+0x22208)[0x7ffff2aaa208]
 /usr/lib64/libc.so.6(__libc_start_main+0xac)[0x7ffff2aaa30c]
 ./test_progs(_start+0x48)[0x55555646bca8]
 Segmentation fault
'''

This is because "link" is NULL in that case. This patch adds null
checks for link in bpf_tcp_ca to fix this error.

Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
---
 tools/testing/selftests/bpf/prog_tests/bpf_tcp_ca.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/tools/testing/selftests/bpf/prog_tests/bpf_tcp_ca.c b/tools/testing/selftests/bpf/prog_tests/bpf_tcp_ca.c
index bceff5900016..8c0306f344e9 100644
--- a/tools/testing/selftests/bpf/prog_tests/bpf_tcp_ca.c
+++ b/tools/testing/selftests/bpf/prog_tests/bpf_tcp_ca.c
@@ -411,7 +411,8 @@ static void test_update_ca(void)
 		return;
 
 	link = bpf_map__attach_struct_ops(skel->maps.ca_update_1);
-	ASSERT_OK_PTR(link, "attach_struct_ops");
+	if (!ASSERT_OK_PTR(link, "attach_struct_ops"))
+		return;
 
 	do_test(&opts);
 	saved_ca1_cnt = skel->bss->ca1_cnt;
@@ -447,7 +448,8 @@ static void test_update_wrong(void)
 		return;
 
 	link = bpf_map__attach_struct_ops(skel->maps.ca_update_1);
-	ASSERT_OK_PTR(link, "attach_struct_ops");
+	if (!ASSERT_OK_PTR(link, "attach_struct_ops"))
+		return;
 
 	do_test(&opts);
 	saved_ca1_cnt = skel->bss->ca1_cnt;
@@ -484,7 +486,8 @@ static void test_mixed_links(void)
 	ASSERT_OK_PTR(link_nl, "attach_struct_ops_nl");
 
 	link = bpf_map__attach_struct_ops(skel->maps.ca_update_1);
-	ASSERT_OK_PTR(link, "attach_struct_ops");
+	if (!ASSERT_OK_PTR(link, "attach_struct_ops"))
+		return;
 
 	do_test(&opts);
 	ASSERT_GT(skel->bss->ca1_cnt, 0, "ca1_ca1_cnt");
@@ -536,7 +539,8 @@ static void test_link_replace(void)
 	bpf_link__destroy(link);
 
 	link = bpf_map__attach_struct_ops(skel->maps.ca_update_2);
-	ASSERT_OK_PTR(link, "attach_struct_ops_2nd");
+	if (!ASSERT_OK_PTR(link, "attach_struct_ops_2nd"))
+		return;
 
 	/* BPF_F_REPLACE with a wrong old map Fd. It should fail!
 	 *
-- 
2.43.0

Re: [PATCH net 2/3] inet: null check for close in inet_release

[Eric Dumazet]

On Mon, Jun 24, 2024 at 3:28 PM Geliang Tang <geliang@kernel.org> wrote:
>
> From: Geliang Tang <tanggeliang@kylinos.cn>
>
> Run the following BPF selftests on loongarch:
>
> # ./test_progs -t sockmap_listen
>
> A Kernel panic occurs:
>
> '''
>  Oops[#1]:
>  CPU: 49 PID: 233429 Comm: new_name Tainted: G           OE      6.10.0-rc2+ #20
>  Hardware name: LOONGSON Dabieshan/Loongson-TC542F0, BIOS Loongson-UDK2018-V4.0.11
>  pc 0000000000000000 ra 90000000051ea4a0 tp 900030008549c000 sp 900030008549fe00
>  a0 9000300152524a00 a1 0000000000000000 a2 900030008549fe38 a3 900030008549fe30
>  a4 900030008549fe30 a5 90003000c58c8d80 a6 0000000000000000 a7 0000000000000039
>  t0 0000000000000000 t1 90003000c58c8d80 t2 0000000000000001 t3 0000000000000000
>  t4 0000000000000001 t5 900000011a1bf580 t6 900000011a3aff60 t7 000000000000006b
>  t8 00000fffffffffff u0 0000000000000000 s9 00007fffbbe9e930 s0 9000300152524a00
>  s1 90003000c58c8d00 s2 9000000006c81568 s3 0000000000000000 s4 90003000c58c8d80
>  s5 00007ffff236a000 s6 00007ffffbc292b0 s7 00007ffffbc29998 s8 00007fffbbe9f180
>     ra: 90000000051ea4a0 inet_release+0x60/0xc0
>    ERA: 0000000000000000 0x0
>   CRMD: 000000b0 (PLV0 -IE -DA +PG DACF=CC DACM=CC -WE)
>   PRMD: 0000000c (PPLV0 +PIE +PWE)
>   EUEN: 00000000 (-FPE -SXE -ASXE -BTE)
>   ECFG: 00071c1d (LIE=0,2-4,10-12 VS=7)
>  ESTAT: 00030000 [PIF] (IS= ECode=3 EsubCode=0)
>   BADV: 0000000000000000
>   PRID: 0014c011 (Loongson-64bit, Loongson-3C5000)
>  Modules linked in: xt_CHECKSUM xt_MASQUERADE xt_conntrack ipt_REJECT nf_nat_tftp
>  Process new_name (pid: 233429, threadinfo=00000000b9196405, task=00000000c01df45b)
>  Stack : 0000000000000000 90003000c58c8e20 90003000c58c8d00 900000000505960c
>          0000000000000000 9000000101c6ad20 9000300086524540 00000000082e0003
>          900030008bf57400 90000000050596bc 900030008bf57400 900000000434acac
>          0000000000000016 00007ffff224e060 00007fffbbe9f180 900030008bf57400
>          0000000000000000 9000000004341ce0 00007fffbbe9f180 00007ffff2369000
>          900030008549fec0 90000000054476ec 000000000000006b 9000000003f71da4
>          000000000000003a 00007ffff22b8a44 00007fffbbe9f8e0 00007fffbbe9e680
>          ffffffffffffffda 0000000000000000 0000000000000000 0000000000000000
>          00007fffbbe9f288 0000000000000000 0000000000000000 0000000000000039
>          84c2431493ceab6e 84c23ceb2827425e 0000000000000007 00007ffff2271600
>          ...
>  Call Trace:
>  [<900000000505960c>] __sock_release+0x4c/0xe0
>  [<90000000050596bc>] sock_close+0x1c/0x40
>  [<900000000434acac>] __fput+0xec/0x2e0
>  [<9000000004341ce0>] sys_close+0x40/0xa0
>  [<90000000054476ec>] do_syscall+0x8c/0xc0
>  [<9000000003f71da4>] handle_syscall+0xc4/0x160
>
>  Code: (Bad address in era)
>
>  ---[ end trace 0000000000000000 ]---
>  Kernel panic - not syncing: Fatal exception
>  Kernel relocated by 0x3d50000
>   .text @ 0x9000000003f50000
>   .data @ 0x90000000055b0000
>   .bss  @ 0x9000000006ca9400
>  ---[ end Kernel panic - not syncing: Fatal exception ]---
> '''
>
> This is because "close" is NULL in that case. This patch adds null
> check for it in inet_release() to fix this error.
>

Please add a Fixes: tag, so that we can fully understand what is going on.

> Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
> ---
>  net/ipv4/af_inet.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
> index b24d74616637..8e926018d011 100644
> --- a/net/ipv4/af_inet.c
> +++ b/net/ipv4/af_inet.c
> @@ -434,7 +434,8 @@ int inet_release(struct socket *sock)
>                 if (sock_flag(sk, SOCK_LINGER) &&
>                     !(current->flags & PF_EXITING))
>                         timeout = sk->sk_lingertime;
> -               sk->sk_prot->close(sk, timeout);
> +               if (sk->sk_prot && sk->sk_prot->close)

Which one is NULL exactly ?  sk->sk_prot or the ->close pointer ?

Why add all these checks if only one is requested ?

> +                       sk->sk_prot->close(sk, timeout);
>                 sock->sk = NULL;
>         }
>         return 0;
> --
> 2.43.0
>

Re: [PATCH net 1/3] skmsg: null check for page in sk_msg_recvmsg

[Eric Dumazet]

On Mon, Jun 24, 2024 at 3:28 PM Geliang Tang <geliang@kernel.org> wrote:
>
> From: Geliang Tang <tanggeliang@kylinos.cn>
>
> Run the following BPF selftests on loongarch:
>
> # ./test_progs -t sockmap_basic
>
> A Kernel panic occurs:
>
> '''
>  Oops[#1]:
>  CPU: 22 PID: 2824 Comm: test_progs Tainted: G           OE      6.10.0-rc2+ #18
>  Hardware name: LOONGSON Dabieshan/Loongson-TC542F0, BIOS Loongson-UDK2018-V4.0.11
>  pc 9000000004162774 ra 90000000048bf6c0 tp 90001000aa16c000 sp 90001000aa16fb90
>  a0 0000000000000000 a1 0000000000000000 a2 0000000000000000 a3 90001000aa16fd70
>  a4 0000000000000800 a5 0000000000000000 a6 000055557b63aae8 a7 00000000000000cf
>  t0 0000000000000000 t1 0000000000004000 t2 0000000000000048 t3 0000000000000000
>  t4 0000000000000001 t5 0000000000000002 t6 0000000000000001 t7 0000000000000002
>  t8 0000000000000018 u0 9000000004856150 s9 0000000000000000 s0 0000000000000000
>  s1 0000000000000000 s2 90001000aa16fd70 s3 0000000000000000 s4 0000000000000000
>  s5 0000000000004000 s6 900010009284dc00 s7 0000000000000001 s8 900010009284dc00
>     ra: 90000000048bf6c0 sk_msg_recvmsg+0x120/0x560
>    ERA: 9000000004162774 copy_page_to_iter+0x74/0x1c0
>   CRMD: 000000b0 (PLV0 -IE -DA +PG DACF=CC DACM=CC -WE)
>   PRMD: 0000000c (PPLV0 +PIE +PWE)
>   EUEN: 00000007 (+FPE +SXE +ASXE -BTE)
>   ECFG: 00071c1d (LIE=0,2-4,10-12 VS=7)
>  ESTAT: 00010000 [PIL] (IS= ECode=1 EsubCode=0)
>   BADV: 0000000000000040
>   PRID: 0014c011 (Loongson-64bit, Loongson-3C5000)
>  Modules linked in: bpf_testmod(OE) xt_CHECKSUM xt_MASQUERADE xt_conntrack
>  Process test_progs (pid: 2824, threadinfo=0000000000863a31, task=000000001cba0874)
>  Stack : 0000000000000001 fffffffffffffffc 0000000000000000 0000000000000000
>          0000000000000018 0000000000000000 0000000000000000 90000000048bf6c0
>          90000000052cd638 90001000aa16fd70 900010008bf51580 900010009284f000
>          90000000049f2b90 900010009284f188 900010009284f178 90001000861d4780
>          9000100084dccd00 0000000000000800 0000000000000007 fffffffffffffff2
>          000000000453e92f 90000000049aae34 90001000aa16fd60 900010009284f000
>          0000000000000000 0000000000000000 900010008bf51580 90000000049f2b90
>          0000000000000001 0000000000000000 9000100084dc3a10 900010009284f1ac
>          90001000aa16fd40 0000555559953278 0000000000000001 0000000000000000
>          90001000aa16fdc8 9000000005a5a000 90001000861d4780 0000000000000800
>          ...
>  Call Trace:
>  [<9000000004162774>] copy_page_to_iter+0x74/0x1c0
>  [<90000000048bf6c0>] sk_msg_recvmsg+0x120/0x560
>  [<90000000049f2b90>] tcp_bpf_recvmsg_parser+0x170/0x4e0
>  [<90000000049aae34>] inet_recvmsg+0x54/0x100
>  [<900000000481ad5c>] sock_recvmsg+0x7c/0xe0
>  [<900000000481e1a8>] __sys_recvfrom+0x108/0x1c0
>  [<900000000481e27c>] sys_recvfrom+0x1c/0x40
>  [<9000000004c076ec>] do_syscall+0x8c/0xc0
>  [<9000000003731da4>] handle_syscall+0xc4/0x160
>
>  Code: 0010b09b  440125a0  0011df8d <28c10364> 0012b70c  00133305  0013b1ac  0010dc84  00151585
>
>  ---[ end trace 0000000000000000 ]---
>  Kernel panic - not syncing: Fatal exception
>  Kernel relocated by 0x3510000
>   .text @ 0x9000000003710000
>   .data @ 0x9000000004d70000
>   .bss  @ 0x9000000006469400
>  ---[ end Kernel panic - not syncing: Fatal exception ]---
> '''
>
> This is because "page" is NULL in that case. This patch adds null
> check for it in sk_msg_recvmsg() to fix this error.
>

Why would @page be NULL only for this architecture ?

Please elaborate, and add a Fixes: tag

> Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
> ---
>  net/core/skmsg.c | 2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/net/core/skmsg.c b/net/core/skmsg.c
> index fd20aae30be2..bafcc1e2eadf 100644
> --- a/net/core/skmsg.c
> +++ b/net/core/skmsg.c
> @@ -432,6 +432,8 @@ int sk_msg_recvmsg(struct sock *sk, struct sk_psock *psock, struct msghdr *msg,
>                         sge = sk_msg_elem(msg_rx, i);
>                         copy = sge->length;
>                         page = sg_page(sge);
> +                       if (!page)
> +                               goto out;
>                         if (copied + copy > len)
>                                 copy = len - copied;
>                         copy = copy_page_to_iter(page, sge->offset, copy, iter);
> --
> 2.43.0
>

Re: [PATCH net 3/3] selftests/bpf: Null checks for link in bpf_tcp_ca

[Eduard Zingerman]

On Mon, 2024-06-24 at 21:27 +0800, Geliang Tang wrote:

[...]

> diff --git a/tools/testing/selftests/bpf/prog_tests/bpf_tcp_ca.c b/tools/testing/selftests/bpf/prog_tests/bpf_tcp_ca.c
> index bceff5900016..8c0306f344e9 100644
> --- a/tools/testing/selftests/bpf/prog_tests/bpf_tcp_ca.c
> +++ b/tools/testing/selftests/bpf/prog_tests/bpf_tcp_ca.c
> @@ -411,7 +411,8 @@ static void test_update_ca(void)
>  		return;
>  
>  	link = bpf_map__attach_struct_ops(skel->maps.ca_update_1);
> -	ASSERT_OK_PTR(link, "attach_struct_ops");
> +	if (!ASSERT_OK_PTR(link, "attach_struct_ops"))
> +		return;

At this point the 'skel' is initialized and needs a call to
tcp_ca_update__destroy(). Please add a label at the end of this
function and goto there instead of 'return'.

Same problem in the rest of the hunks.

[...]