From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-14.0 required=3.0 tests=BAYES_00,INCLUDES_CR_TRAILER, INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 201D7C43460 for ; Thu, 29 Apr 2021 21:28:48 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id E994B61461 for ; Thu, 29 Apr 2021 21:28:47 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237137AbhD2V3e convert rfc822-to-8bit (ORCPT ); Thu, 29 Apr 2021 17:29:34 -0400 Received: from us-smtp-delivery-44.mimecast.com ([207.211.30.44]:32617 "EHLO us-smtp-delivery-44.mimecast.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233293AbhD2V3d (ORCPT ); Thu, 29 Apr 2021 17:29:33 -0400 Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-27-wdsMpYtLOA2JuJj_M98MmA-1; Thu, 29 Apr 2021 17:28:40 -0400 X-MC-Unique: wdsMpYtLOA2JuJj_M98MmA-1 Received: from smtp.corp.redhat.com (int-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.12]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id 188ED8042A6; Thu, 29 Apr 2021 21:28:38 +0000 (UTC) Received: from krava.cust.in.nbox.cz (unknown [10.40.195.102]) by smtp.corp.redhat.com (Postfix) with ESMTP id A77DA36DE; Thu, 29 Apr 2021 21:28:35 +0000 (UTC) From: Jiri Olsa To: Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko Cc: netdev@vger.kernel.org, bpf@vger.kernel.org, Martin KaFai Lau , Song Liu , Yonghong Song , John Fastabend , KP Singh Subject: [PATCH RFC] bpf: Fix trampoline for functions with variable arguments Date: Thu, 29 Apr 2021 23:28:34 +0200 Message-Id: <20210429212834.82621-1-jolsa@kernel.org> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.79 on 10.5.11.12 Authentication-Results: relay.mimecast.com; auth=pass smtp.auth=CUSA124A263 smtp.mailfrom=jolsa@kernel.org X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: kernel.org Content-Transfer-Encoding: 8BIT Content-Type: text/plain; charset=WINDOWS-1252 Precedence: bulk List-ID: X-Mailing-List: bpf@vger.kernel.org For functions with variable arguments like: void set_worker_desc(const char *fmt, ...) the BTF data contains void argument at the end: [4061] FUNC_PROTO '(anon)' ret_type_id=0 vlen=2 'fmt' type_id=3 '(anon)' type_id=0 When attaching function with this void argument the btf_distill_func_proto will set last btf_func_model's argument with size 0 and that will cause extra loop in save_regs/restore_regs functions and generate trampoline code like: 55 push %rbp 48 89 e5 mov %rsp,%rbp 48 83 ec 10 sub $0x10,%rsp 53 push %rbx 48 89 7d f0 mov %rdi,-0x10(%rbp) 75 f8 jne 0xffffffffa00cf007 ^^^ extra jump It's causing soft lockups/crashes probably depends on what context is the attached function called, like for set_worker_desc: watchdog: BUG: soft lockup - CPU#16 stuck for 22s! [kworker/u40:4:239] CPU: 16 PID: 239 Comm: kworker/u40:4 Not tainted 5.12.0-rc4qemu+ #178 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-1.fc33 04/01/2014 Workqueue: writeback wb_workfn RIP: 0010:bpf_trampoline_6442464853_0+0xa/0x1000 Code: Unable to access opcode bytes at RIP 0xffffffffa3597fe0. RSP: 0018:ffffc90000687da8 EFLAGS: 00000217 Call Trace: set_worker_desc+0x5/0xb0 wb_workfn+0x48/0x4d0 ? psi_group_change+0x41/0x210 ? __bpf_prog_exit+0x15/0x20 ? bpf_trampoline_6442458903_0+0x3b/0x1000 ? update_pasid+0x5/0x90 ? __switch_to+0x187/0x450 process_one_work+0x1e7/0x380 worker_thread+0x50/0x3b0 ? rescuer_thread+0x380/0x380 kthread+0x11b/0x140 ? __kthread_bind_mask+0x60/0x60 ret_from_fork+0x22/0x30 This patch is removing the void argument from struct btf_func_model in btf_distill_func_proto, but perhaps we should also check for this in JIT's save_regs/restore_regs functions. Signed-off-by: Jiri Olsa --- kernel/bpf/btf.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c index b1a76fe046cb..017a80324139 100644 --- a/kernel/bpf/btf.c +++ b/kernel/bpf/btf.c @@ -5133,6 +5133,11 @@ int btf_distill_func_proto(struct bpf_verifier_log *log, tname, i, btf_kind_str[BTF_INFO_KIND(t->info)]); return -EINVAL; } + /* void at the end of args means '...' argument, skip it */ + if (!ret && (i + 1 == nargs)) { + nargs--; + break; + } m->arg_size[i] = ret; } m->nr_args = nargs; -- 2.30.2