* [syzbot] WARNING: ODEBUG bug in htab_map_alloc @ 2022-09-09 22:48 syzbot 2022-09-10 15:07 ` [PATCH] bpf: add missing percpu_counter_destroy() in htab_map_alloc() Tetsuo Handa [not found] ` <20220910020633.2620505-1-eadavis@sina.com> 0 siblings, 2 replies; 6+ messages in thread From: syzbot @ 2022-09-09 22:48 UTC (permalink / raw) To: andrii, ast, bpf, daniel, haoluo, john.fastabend, jolsa, kpsingh, linux-kernel, martin.lau, netdev, sdf, song, syzkaller-bugs, yhs Hello, syzbot found the following issue on: HEAD commit: 274052a2b0ab Merge branch 'bpf-allocator' git tree: bpf-next console+strace: https://syzkaller.appspot.com/x/log.txt?x=11a26bcd080000 kernel config: https://syzkaller.appspot.com/x/.config?x=924833c12349a8c0 dashboard link: https://syzkaller.appspot.com/bug?extid=5d1da78b375c3b5e6c2b compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=114109f5080000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11b3b56d080000 Downloadable assets: disk image: https://storage.googleapis.com/syzbot-assets/be8eff3df48b/disk-274052a2.raw.xz vmlinux: https://storage.googleapis.com/syzbot-assets/cd3150e84ddd/vmlinux-274052a2.xz IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+5d1da78b375c3b5e6c2b@syzkaller.appspotmail.com ------------[ cut here ]------------ ODEBUG: free active (active state 0) object type: percpu_counter hint: 0x0 WARNING: CPU: 0 PID: 3624 at lib/debugobjects.c:502 debug_print_object+0x16e/0x250 lib/debugobjects.c:502 Modules linked in: CPU: 0 PID: 3624 Comm: syz-executor257 Not tainted 5.19.0-syzkaller-14117-g274052a2b0ab #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 RIP: 0010:debug_print_object+0x16e/0x250 lib/debugobjects.c:502 Code: ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 af 00 00 00 48 8b 14 dd 60 0c 49 8a 4c 89 ee 48 c7 c7 00 00 49 8a e8 df f1 38 05 <0f> 0b 83 05 65 86 dd 09 01 48 83 c4 18 5b 5d 41 5c 41 5d 41 5e c3 RSP: 0018:ffffc90003edfa90 EFLAGS: 00010282 RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000000 RDX: ffff8880773cbb00 RSI: ffffffff8161f148 RDI: fffff520007dbf44 RBP: 0000000000000001 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000080000000 R11: 0000000000000000 R12: ffffffff8a4b90c0 R13: ffffffff8a490520 R14: 0000000000000000 R15: dffffc0000000000 FS: 00007f0136485700(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000200004c0 CR3: 0000000072b25000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> __debug_check_no_obj_freed lib/debugobjects.c:989 [inline] debug_check_no_obj_freed+0x301/0x420 lib/debugobjects.c:1020 slab_free_hook mm/slub.c:1729 [inline] slab_free_freelist_hook+0xeb/0x1c0 mm/slub.c:1780 slab_free mm/slub.c:3534 [inline] kfree+0xe2/0x580 mm/slub.c:4562 kvfree+0x42/0x50 mm/util.c:655 htab_map_alloc+0xc76/0x1620 kernel/bpf/hashtab.c:632 find_and_alloc_map kernel/bpf/syscall.c:131 [inline] map_create kernel/bpf/syscall.c:1105 [inline] __sys_bpf+0xa82/0x5f80 kernel/bpf/syscall.c:4938 __do_sys_bpf kernel/bpf/syscall.c:5060 [inline] __se_sys_bpf kernel/bpf/syscall.c:5058 [inline] __x64_sys_bpf+0x75/0xb0 kernel/bpf/syscall.c:5058 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f01364d3919 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 11 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f0136485318 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f013655b3e8 RCX: 00007f01364d3919 RDX: 0000000000000048 RSI: 00000000200004c0 RDI: 0000000000000000 RBP: 00007f013655b3e0 R08: 00007f0136485700 R09: 0000000000000000 R10: 00007f0136485700 R11: 0000000000000246 R12: 00007f013655b3ec R13: 00007ffee9a220af R14: 00007f0136485400 R15: 0000000000022000 </TASK> irq event stamp: 19441 hardirqs last enabled at (19445): [<ffffffff816188e8>] __down_trylock_console_sem+0x108/0x120 kernel/printk/printk.c:247 hardirqs last disabled at (19448): [<ffffffff816188ca>] __down_trylock_console_sem+0xea/0x120 kernel/printk/printk.c:245 softirqs last enabled at (19350): [<ffffffff814914c3>] invoke_softirq kernel/softirq.c:445 [inline] softirqs last enabled at (19350): [<ffffffff814914c3>] __irq_exit_rcu+0x123/0x180 kernel/softirq.c:650 softirqs last disabled at (19341): [<ffffffff814914c3>] invoke_softirq kernel/softirq.c:445 [inline] softirqs last disabled at (19341): [<ffffffff814914c3>] __irq_exit_rcu+0x123/0x180 kernel/softirq.c:650 ---[ end trace 0000000000000000 ]--- --- This report is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller@googlegroups.com. syzbot will keep track of this issue. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot. syzbot can test patches for this issue, for details see: https://goo.gl/tpsmEJ#testing-patches ^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH] bpf: add missing percpu_counter_destroy() in htab_map_alloc() 2022-09-09 22:48 [syzbot] WARNING: ODEBUG bug in htab_map_alloc syzbot @ 2022-09-10 15:07 ` Tetsuo Handa 2022-09-10 20:16 ` sdf ` (2 more replies) [not found] ` <20220910020633.2620505-1-eadavis@sina.com> 1 sibling, 3 replies; 6+ messages in thread From: Tetsuo Handa @ 2022-09-10 15:07 UTC (permalink / raw) To: Alexei Starovoitov, Daniel Borkmann, Andrii Nakryiko, Kumar Kartikeya Dwivedi Cc: syzbot, syzkaller-bugs, bpf, netdev syzbot is reporting ODEBUG bug in htab_map_alloc() [1], for commit 86fe28f7692d96d2 ("bpf: Optimize element count in non-preallocated hash map.") added percpu_counter_init() to htab_map_alloc() but forgot to add percpu_counter_destroy() to the error path. Link: https://syzkaller.appspot.com/bug?extid=5d1da78b375c3b5e6c2b [1] Reported-by: syzbot <syzbot+5d1da78b375c3b5e6c2b@syzkaller.appspotmail.com> Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Fixes: 86fe28f7692d96d2 ("bpf: Optimize element count in non-preallocated hash map.") --- kernel/bpf/hashtab.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c index 0fe3f136cbbe..86aec20c22d0 100644 --- a/kernel/bpf/hashtab.c +++ b/kernel/bpf/hashtab.c @@ -622,6 +622,8 @@ static struct bpf_map *htab_map_alloc(union bpf_attr *attr) free_prealloc: prealloc_destroy(htab); free_map_locked: + if (htab->use_percpu_counter) + percpu_counter_destroy(&htab->pcount); for (i = 0; i < HASHTAB_MAP_LOCK_COUNT; i++) free_percpu(htab->map_locked[i]); bpf_map_area_free(htab->buckets); -- 2.18.4 ^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH] bpf: add missing percpu_counter_destroy() in htab_map_alloc() 2022-09-10 15:07 ` [PATCH] bpf: add missing percpu_counter_destroy() in htab_map_alloc() Tetsuo Handa @ 2022-09-10 20:16 ` sdf 2022-09-10 23:11 ` Alexei Starovoitov 2022-09-10 23:20 ` patchwork-bot+netdevbpf 2 siblings, 0 replies; 6+ messages in thread From: sdf @ 2022-09-10 20:16 UTC (permalink / raw) To: Tetsuo Handa Cc: Alexei Starovoitov, Daniel Borkmann, Andrii Nakryiko, Kumar Kartikeya Dwivedi, syzbot, syzkaller-bugs, bpf, netdev On 09/11, Tetsuo Handa wrote: > syzbot is reporting ODEBUG bug in htab_map_alloc() [1], for > commit 86fe28f7692d96d2 ("bpf: Optimize element count in non-preallocated > hash map.") added percpu_counter_init() to htab_map_alloc() but forgot to > add percpu_counter_destroy() to the error path. > Link: https://syzkaller.appspot.com/bug?extid=5d1da78b375c3b5e6c2b [1] > Reported-by: syzbot > <syzbot+5d1da78b375c3b5e6c2b@syzkaller.appspotmail.com> > Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Thanks! Reviewed-by: Stanislav Fomichev <sdf@google.com> > Fixes: 86fe28f7692d96d2 ("bpf: Optimize element count in non-preallocated > hash map.") > --- > kernel/bpf/hashtab.c | 2 ++ > 1 file changed, 2 insertions(+) > diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c > index 0fe3f136cbbe..86aec20c22d0 100644 > --- a/kernel/bpf/hashtab.c > +++ b/kernel/bpf/hashtab.c > @@ -622,6 +622,8 @@ static struct bpf_map *htab_map_alloc(union bpf_attr > *attr) > free_prealloc: > prealloc_destroy(htab); > free_map_locked: > + if (htab->use_percpu_counter) > + percpu_counter_destroy(&htab->pcount); > for (i = 0; i < HASHTAB_MAP_LOCK_COUNT; i++) > free_percpu(htab->map_locked[i]); > bpf_map_area_free(htab->buckets); > -- > 2.18.4 ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] bpf: add missing percpu_counter_destroy() in htab_map_alloc() 2022-09-10 15:07 ` [PATCH] bpf: add missing percpu_counter_destroy() in htab_map_alloc() Tetsuo Handa 2022-09-10 20:16 ` sdf @ 2022-09-10 23:11 ` Alexei Starovoitov 2022-09-10 23:20 ` patchwork-bot+netdevbpf 2 siblings, 0 replies; 6+ messages in thread From: Alexei Starovoitov @ 2022-09-10 23:11 UTC (permalink / raw) To: Tetsuo Handa Cc: Alexei Starovoitov, Daniel Borkmann, Andrii Nakryiko, Kumar Kartikeya Dwivedi, syzbot, syzkaller-bugs, bpf, Network Development On Sat, Sep 10, 2022 at 8:08 AM Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp> wrote: > > syzbot is reporting ODEBUG bug in htab_map_alloc() [1], for > commit 86fe28f7692d96d2 ("bpf: Optimize element count in non-preallocated > hash map.") added percpu_counter_init() to htab_map_alloc() but forgot to > add percpu_counter_destroy() to the error path. > > Link: https://syzkaller.appspot.com/bug?extid=5d1da78b375c3b5e6c2b [1] > Reported-by: syzbot <syzbot+5d1da78b375c3b5e6c2b@syzkaller.appspotmail.com> > Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> > Fixes: 86fe28f7692d96d2 ("bpf: Optimize element count in non-preallocated hash map.") > --- > kernel/bpf/hashtab.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c > index 0fe3f136cbbe..86aec20c22d0 100644 > --- a/kernel/bpf/hashtab.c > +++ b/kernel/bpf/hashtab.c > @@ -622,6 +622,8 @@ static struct bpf_map *htab_map_alloc(union bpf_attr *attr) > free_prealloc: > prealloc_destroy(htab); > free_map_locked: > + if (htab->use_percpu_counter) > + percpu_counter_destroy(&htab->pcount); Thank you for the fix! Applied ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] bpf: add missing percpu_counter_destroy() in htab_map_alloc() 2022-09-10 15:07 ` [PATCH] bpf: add missing percpu_counter_destroy() in htab_map_alloc() Tetsuo Handa 2022-09-10 20:16 ` sdf 2022-09-10 23:11 ` Alexei Starovoitov @ 2022-09-10 23:20 ` patchwork-bot+netdevbpf 2 siblings, 0 replies; 6+ messages in thread From: patchwork-bot+netdevbpf @ 2022-09-10 23:20 UTC (permalink / raw) To: Tetsuo Handa Cc: ast, daniel, andrii, memxor, syzbot+5d1da78b375c3b5e6c2b, syzkaller-bugs, bpf, netdev Hello: This patch was applied to bpf/bpf-next.git (master) by Alexei Starovoitov <ast@kernel.org>: On Sun, 11 Sep 2022 00:07:11 +0900 you wrote: > syzbot is reporting ODEBUG bug in htab_map_alloc() [1], for > commit 86fe28f7692d96d2 ("bpf: Optimize element count in non-preallocated > hash map.") added percpu_counter_init() to htab_map_alloc() but forgot to > add percpu_counter_destroy() to the error path. > > Link: https://syzkaller.appspot.com/bug?extid=5d1da78b375c3b5e6c2b [1] > Reported-by: syzbot <syzbot+5d1da78b375c3b5e6c2b@syzkaller.appspotmail.com> > Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> > Fixes: 86fe28f7692d96d2 ("bpf: Optimize element count in non-preallocated hash map.") > > [...] Here is the summary with links: - bpf: add missing percpu_counter_destroy() in htab_map_alloc() https://git.kernel.org/bpf/bpf-next/c/cf7de6a53600 You are awesome, thank you! -- Deet-doot-dot, I am a bot. https://korg.docs.kernel.org/patchwork/pwbot.html ^ permalink raw reply [flat|nested] 6+ messages in thread
[parent not found: <20220910020633.2620505-1-eadavis@sina.com>]
* Re: [PATCH] kernel/bpf: htab_map_alloc() exit by free_map_locked logic issue [not found] ` <20220910020633.2620505-1-eadavis@sina.com> @ 2022-09-10 20:29 ` Stanislav Fomichev 0 siblings, 0 replies; 6+ messages in thread From: Stanislav Fomichev @ 2022-09-10 20:29 UTC (permalink / raw) To: eadavis Cc: syzbot+5d1da78b375c3b5e6c2b, andrii, ast, bpf, daniel, haoluo, john.fastabend, jolsa, kpsingh, linux-kernel, martin.lau, netdev, song, syzkaller-bugs, yhs, eadivs On Fri, Sep 9, 2022 at 7:07 PM <eadavis@sina.com> wrote: > > From: eadivs <eadivs@sina.com> > > syzbot is reporting WARNING: ODEBUG bug in htab_map_alloc(), the > loop exits without reaching length HASHTAB_MAP_LOCK_COUNT, and > the loop continues HASHTAB_MAP_LOCK_COUNT times in label > free_map_locked. Please use [PATCH bpf] vs [PATCH bpf-next] in subject to indicate which tree you're targeting. Also, it seems your email hasn't reached the mailing list for some reason. Are you sure that the issue is due to HASHTAB_MAP_LOCK_COUNT? The code seems fine as is; unconditionally calling free on NULL shouldn't be an issue. htab_map_alloc+0xc76/0x1620 kernel/bpf/hashtab.c:632 Which, if I'm looking at the function is: bpf_map_area_free(htab); ? > Link: https://syzkaller.appspot.com/bug?extid=5d1da78b375c3b5e6c2b > Reported-by: syzbot+5d1da78b375c3b5e6c2b@syzkaller.appspotmail.com > Signed-off-by: eadivs <eadivs@sina.com> > --- > kernel/bpf/hashtab.c | 8 +++++--- > 1 file changed, 5 insertions(+), 3 deletions(-) > > diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c > index 65877967f414..f5381e1c00a6 100644 > --- a/kernel/bpf/hashtab.c > +++ b/kernel/bpf/hashtab.c > @@ -473,7 +473,7 @@ static struct bpf_map *htab_map_alloc(union bpf_attr *attr) > bool percpu_lru = (attr->map_flags & BPF_F_NO_COMMON_LRU); > bool prealloc = !(attr->map_flags & BPF_F_NO_PREALLOC); > struct bpf_htab *htab; > - int err, i; > + int err, i, j = HASHTAB_MAP_LOCK_COUNT; > > htab = kzalloc(sizeof(*htab), GFP_USER | __GFP_ACCOUNT); > if (!htab) > @@ -523,8 +523,10 @@ static struct bpf_map *htab_map_alloc(union bpf_attr *attr) > sizeof(int), > sizeof(int), > GFP_USER); > - if (!htab->map_locked[i]) > + if (!htab->map_locked[i]) { > + j = i; > goto free_map_locked; > + } > } > > if (htab->map.map_flags & BPF_F_ZERO_SEED) > @@ -554,7 +556,7 @@ static struct bpf_map *htab_map_alloc(union bpf_attr *attr) > free_prealloc: > prealloc_destroy(htab); > free_map_locked: > - for (i = 0; i < HASHTAB_MAP_LOCK_COUNT; i++) > + for (i = 0; i < j; i++) > free_percpu(htab->map_locked[i]); > bpf_map_area_free(htab->buckets); > free_htab: > -- > 2.37.2 > ^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2022-09-10 23:20 UTC | newest] Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2022-09-09 22:48 [syzbot] WARNING: ODEBUG bug in htab_map_alloc syzbot 2022-09-10 15:07 ` [PATCH] bpf: add missing percpu_counter_destroy() in htab_map_alloc() Tetsuo Handa 2022-09-10 20:16 ` sdf 2022-09-10 23:11 ` Alexei Starovoitov 2022-09-10 23:20 ` patchwork-bot+netdevbpf [not found] ` <20220910020633.2620505-1-eadavis@sina.com> 2022-09-10 20:29 ` [PATCH] kernel/bpf: htab_map_alloc() exit by free_map_locked logic issue Stanislav Fomichev
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.