From: "Jiayuan Chen" <jiayuan.chen@linux.dev>
To: "Michal Luczaj" <mhal@rbox.co>,
xiyou.wangcong@gmail.com, john.fastabend@gmail.com,
jakub@cloudflare.com, martin.lau@linux.dev
Cc: davem@davemloft.net, edumazet@google.com, kuba@kernel.org,
pabeni@redhat.com, horms@kernel.org, andrii@kernel.org,
eddyz87@gmail.com, mykolal@fb.com, ast@kernel.org,
daniel@iogearbox.net, song@kernel.org, yonghong.song@linux.dev,
kpsingh@kernel.org, sdf@fomichev.me, haoluo@google.com,
jolsa@kernel.org, shuah@kernel.org, sgarzare@redhat.com,
netdev@vger.kernel.org, bpf@vger.kernel.org,
linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org,
mrpre@163.com, cong.wang@bytedance.com,
syzbot+dd90a702f518e0eac072@syzkaller.appspotmail.com
Subject: Re: [PATCH bpf-next v2 1/3] bpf, sockmap: avoid using sk_socket after free
Date: Mon, 10 Mar 2025 14:13:02 +0000 [thread overview]
Message-ID: <fe664471a8933c894ac98029bd704ccfb010eae3@linux.dev> (raw)
In-Reply-To: <d2d3eff9-23df-4098-87cc-d0ad5fde6e1e@rbox.co>
March 10, 2025 at 9:08 PM, "Michal Luczaj" <mhal@rbox.co> wrote:
>
> On 3/10/25 12:36, Jiayuan Chen wrote:
>
> >
> > March 7, 2025 at 5:45 PM, "Michal Luczaj" <mhal@rbox.co> wrote:
> >
> > ...
> >
> > >
> > > BTW, lockdep (CONFIG_LOCKDEP=y) complains about calling AF_UNIX's
> > >
> > > read_skb() under RCU read lock.
> > >
> >
> > My environment also has LOCKDEP enabled, but I didn't see similar
> >
> > warnings.
> >
> > Moreover, RCU assertions are typically written as:
> >
> >
> >
> > WARN_ON_ONCE(!rcu_read_lock_held())
> >
> >
> >
> > And when LOCKDEP is not enabled, rcu_read_lock_held() defaults to
> >
> > returning 1. So, it's unlikely to trigger a warning due to an RCU lock
> >
> > being held.
> >
> >
> >
> > Could you provide more of the call stack?
> >
>
> Sure, bpf-next with this series applied, test_progs -t sockmap_basic:
>
> =============================
>
> [ BUG: Invalid wait context ]
>
> 6.14.0-rc3+ #111 Tainted: G OE
>
> -----------------------------
>
> test_progs/37755 is trying to lock:
>
> ffff88810d9bc3c0 (&u->iolock){+.+.}-{4:4}, at: unix_stream_read_skb+0x30/0x120
>
> other info that might help us debug this:
>
> context-{5:5}
>
> 1 lock held by test_progs/37755:
>
> #0: ffffffff833700e0 (rcu_read_lock){....}-{1:3}, at: sk_psock_verdict_data_ready+0x3e/0x2a0
>
> stack backtrace:
>
> CPU: 13 UID: 0 PID: 37755 Comm: test_progs Tainted: G OE 6.14.0-rc3+ #111
>
> Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
>
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.16.3-1-1 04/01/2014
>
> Call Trace:
>
> dump_stack_lvl+0x68/0x90
>
> lock_acquire+0xcf/0x2e0
>
> __mutex_lock+0x9c/0xcc0
>
> unix_stream_read_skb+0x30/0x120
>
> sk_psock_verdict_data_ready+0x8d/0x2a0
>
> unix_stream_sendmsg+0x232/0x640
>
> __sys_sendto+0x1cd/0x1e0
>
> __x64_sys_sendto+0x20/0x30
>
> do_syscall_64+0x93/0x180
>
> entry_SYSCALL_64_after_hwframe+0x76/0x7e
>
Thanks, I got this stack too after enabling CONFIG_PROVE_LOCKING.
It seems that we can't call sleepable lock such as mutex_lock under rcu-locked context.
I'm working on it.
next prev parent reply other threads:[~2025-03-10 14:13 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-02-28 5:51 [PATCH bpf-next v2 0/3] bpf: Fix use-after-free of sockmap Jiayuan Chen
2025-02-28 5:51 ` [PATCH bpf-next v2 1/3] bpf, sockmap: avoid using sk_socket after free Jiayuan Chen
2025-03-07 9:45 ` Michal Luczaj
2025-03-10 11:36 ` Jiayuan Chen
2025-03-10 13:08 ` Michal Luczaj
2025-03-10 14:13 ` Jiayuan Chen [this message]
2025-02-28 5:51 ` [PATCH bpf-next v2 2/3] selftests/bpf: Add socketpair to create_pair to support unix socket Jiayuan Chen
2025-02-28 5:51 ` [PATCH bpf-next v2 3/3] selftests/bpf: Add edge case tests for sockmap Jiayuan Chen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=fe664471a8933c894ac98029bd704ccfb010eae3@linux.dev \
--to=jiayuan.chen@linux.dev \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=cong.wang@bytedance.com \
--cc=daniel@iogearbox.net \
--cc=davem@davemloft.net \
--cc=eddyz87@gmail.com \
--cc=edumazet@google.com \
--cc=haoluo@google.com \
--cc=horms@kernel.org \
--cc=jakub@cloudflare.com \
--cc=john.fastabend@gmail.com \
--cc=jolsa@kernel.org \
--cc=kpsingh@kernel.org \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-kselftest@vger.kernel.org \
--cc=martin.lau@linux.dev \
--cc=mhal@rbox.co \
--cc=mrpre@163.com \
--cc=mykolal@fb.com \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=sdf@fomichev.me \
--cc=sgarzare@redhat.com \
--cc=shuah@kernel.org \
--cc=song@kernel.org \
--cc=syzbot+dd90a702f518e0eac072@syzkaller.appspotmail.com \
--cc=xiyou.wangcong@gmail.com \
--cc=yonghong.song@linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).