* [net/bpf] Re: WARNING in mark_lock [not found] ` <alpine.DEB.2.21.1906250820060.32342@nanos.tec.linutronix.de> @ 2019-06-25 7:29 ` Eric Biggers 2019-07-01 5:32 ` John Fastabend 0 siblings, 1 reply; 6+ messages in thread From: Eric Biggers @ 2019-06-25 7:29 UTC (permalink / raw) To: bpf; +Cc: syzbot, LKML, syzkaller-bugs, Thomas Gleixner, Peter Zijlstra [+bpf list] On Tue, Jun 25, 2019 at 08:20:56AM +0200, Thomas Gleixner wrote: > On Mon, 24 Jun 2019, syzbot wrote: > > > Hello, > > CC++ Peterz > > > > > syzbot found the following crash on: > > > > HEAD commit: dc636f5d Add linux-next specific files for 20190620 > > git tree: linux-next > > console output: https://syzkaller.appspot.com/x/log.txt?x=162b68b1a00000 > > kernel config: https://syzkaller.appspot.com/x/.config?x=99c104b0092a557b > > dashboard link: https://syzkaller.appspot.com/bug?extid=a861f52659ae2596492b > > compiler: gcc (GCC) 9.0.0 20181231 (experimental) > > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=110b24f6a00000 > > > > IMPORTANT: if you fix the bug, please add the following tag to the commit: > > Reported-by: syzbot+a861f52659ae2596492b@syzkaller.appspotmail.com The syz repro looks bpf related, and essentially the same repro is in lots of other open syzbot reports which I've assigned to the bpf subsystem... https://lore.kernel.org/lkml/20190624050114.GA30702@sol.localdomain/ {"threaded":true,"repeat":true,"procs":6,"sandbox":"none","fault_call":-1,"tun":true,"netdev":true,"resetnet":true,"cgroups":true,"binfmt_misc":true,"close_fds":true,"tmpdir":true,"segv":true} bpf$MAP_CREATE(0x0, &(0x7f0000000280)={0xf, 0x4, 0x4, 0x400, 0x0, 0x1}, 0x3c) socket$rxrpc(0x21, 0x2, 0x800000000a) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x1d4) connect$inet6(r0, &(0x7f0000000140), 0x1c) bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x5}, 0xfffffffffffffdcb) bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x77fffb, 0x0, 0x10020000000, 0x0}, 0x2c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) ^ permalink raw reply [flat|nested] 6+ messages in thread
* RE: [net/bpf] Re: WARNING in mark_lock 2019-06-25 7:29 ` [net/bpf] Re: WARNING in mark_lock Eric Biggers @ 2019-07-01 5:32 ` John Fastabend 2019-07-01 5:51 ` syzbot 0 siblings, 1 reply; 6+ messages in thread From: John Fastabend @ 2019-07-01 5:32 UTC (permalink / raw) To: Eric Biggers, bpf Cc: syzbot, LKML, syzkaller-bugs, Thomas Gleixner, Peter Zijlstra Eric Biggers wrote: > [+bpf list] > > On Tue, Jun 25, 2019 at 08:20:56AM +0200, Thomas Gleixner wrote: > > On Mon, 24 Jun 2019, syzbot wrote: > > > > > Hello, > > > > CC++ Peterz > > > > > > > > syzbot found the following crash on: > > > > > > HEAD commit: dc636f5d Add linux-next specific files for 20190620 > > > git tree: linux-next > > > console output: https://syzkaller.appspot.com/x/log.txt?x=162b68b1a00000 > > > kernel config: https://syzkaller.appspot.com/x/.config?x=99c104b0092a557b > > > dashboard link: https://syzkaller.appspot.com/bug?extid=a861f52659ae2596492b > > > compiler: gcc (GCC) 9.0.0 20181231 (experimental) > > > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=110b24f6a00000 > > > > > > IMPORTANT: if you fix the bug, please add the following tag to the commit: > > > Reported-by: syzbot+a861f52659ae2596492b@syzkaller.appspotmail.com > > The syz repro looks bpf related, and essentially the same repro is in lots of > other open syzbot reports which I've assigned to the bpf subsystem... > https://lore.kernel.org/lkml/20190624050114.GA30702@sol.localdomain/ > > {"threaded":true,"repeat":true,"procs":6,"sandbox":"none","fault_call":-1,"tun":true,"netdev":true,"resetnet":true,"cgroups":true,"binfmt_misc":true,"close_fds":true,"tmpdir":true,"segv":true} > bpf$MAP_CREATE(0x0, &(0x7f0000000280)={0xf, 0x4, 0x4, 0x400, 0x0, 0x1}, 0x3c) > socket$rxrpc(0x21, 0x2, 0x800000000a) > r0 = socket$inet6_tcp(0xa, 0x1, 0x0) > setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x1d4) > connect$inet6(r0, &(0x7f0000000140), 0x1c) > bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x5}, 0xfffffffffffffdcb) > bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x77fffb, 0x0, 0x10020000000, 0x0}, 0x2c) > setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) #syz test: git://github.com/cilium/linux ktls-unhash ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: WARNING in mark_lock 2019-07-01 5:32 ` John Fastabend @ 2019-07-01 5:51 ` syzbot 2019-07-08 16:21 ` John Fastabend 0 siblings, 1 reply; 6+ messages in thread From: syzbot @ 2019-07-01 5:51 UTC (permalink / raw) To: bpf, ebiggers, john.fastabend, linux-kernel, peterz, syzkaller-bugs, tglx Hello, syzbot has tested the proposed patch but the reproducer still triggered crash: KASAN: use-after-free Read in class_equal ================================================================== BUG: KASAN: use-after-free in class_equal+0x40/0x50 kernel/locking/lockdep.c:1527 Read of size 8 at addr ffff88808a268ba0 by task syz-executor.1/9270 CPU: 0 PID: 9270 Comm: syz-executor.1 Not tainted 5.2.0-rc3+ #1 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: Allocated by task 2647419968: BUG: unable to handle page fault for address: ffffffff8c00b020 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 8a70067 P4D 8a70067 PUD 8a71063 PMD 0 Thread overran stack, or stack corrupted Oops: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 9270 Comm: syz-executor.1 Not tainted 5.2.0-rc3+ #1 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:stack_depot_fetch+0x10/0x30 lib/stackdepot.c:203 Code: e9 7b fd ff ff 4c 89 ff e8 8d b4 62 fe e9 e6 fd ff ff 90 90 90 90 90 90 90 90 89 f8 c1 ef 11 25 ff ff 1f 00 81 e7 f0 3f 00 00 <48> 03 3c c5 20 6c 04 8b 48 8d 47 18 48 89 06 8b 47 0c c3 0f 1f 00 RSP: 0018:ffff88808a2688e8 EFLAGS: 00010006 RAX: 00000000001f8880 RBX: ffff88808a269304 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffff88808a2688f0 RDI: 0000000000003ff0 RBP: ffff88808a268908 R08: 0000000000000020 R09: ffffed1015d044fa R10: ffffed1015d044f9 R11: ffff8880ae8227cf R12: ffffea0002289a00 R13: ffff88808a268ba0 R14: ffff8880aa58ec40 R15: ffff88808a269300 FS: 00005555570ba940(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffff8c00b020 CR3: 000000008dd00000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: Modules linked in: CR2: ffffffff8c00b020 ---[ end trace 4acfe4b59fbc9cdb ]--- RIP: 0010:stack_depot_fetch+0x10/0x30 lib/stackdepot.c:203 Code: e9 7b fd ff ff 4c 89 ff e8 8d b4 62 fe e9 e6 fd ff ff 90 90 90 90 90 90 90 90 89 f8 c1 ef 11 25 ff ff 1f 00 81 e7 f0 3f 00 00 <48> 03 3c c5 20 6c 04 8b 48 8d 47 18 48 89 06 8b 47 0c c3 0f 1f 00 RSP: 0018:ffff88808a2688e8 EFLAGS: 00010006 RAX: 00000000001f8880 RBX: ffff88808a269304 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffff88808a2688f0 RDI: 0000000000003ff0 RBP: ffff88808a268908 R08: 0000000000000020 R09: ffffed1015d044fa R10: ffffed1015d044f9 R11: ffff8880ae8227cf R12: ffffea0002289a00 R13: ffff88808a268ba0 R14: ffff8880aa58ec40 R15: ffff88808a269300 FS: 00005555570ba940(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffff8c00b020 CR3: 000000008dd00000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Tested on: commit: 0b58d013 bpf: tls, implement unhash to avoid transition ou.. git tree: git://github.com/cilium/linux ktls-unhash console output: https://syzkaller.appspot.com/x/log.txt?x=153368a3a00000 kernel config: https://syzkaller.appspot.com/x/.config?x=2cc918d28ebd06b4 compiler: gcc (GCC) 9.0.0 20181231 (experimental) ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: WARNING in mark_lock 2019-07-01 5:51 ` syzbot @ 2019-07-08 16:21 ` John Fastabend 2019-07-08 22:03 ` syzbot 0 siblings, 1 reply; 6+ messages in thread From: John Fastabend @ 2019-07-08 16:21 UTC (permalink / raw) To: syzbot, bpf, ebiggers, john.fastabend, linux-kernel, peterz, syzkaller-bugs, tglx syzbot wrote: > Hello, > > syzbot has tested the proposed patch but the reproducer still triggered > crash: > KASAN: use-after-free Read in class_equal > > ================================================================== > BUG: KASAN: use-after-free in class_equal+0x40/0x50 > kernel/locking/lockdep.c:1527 > Read of size 8 at addr ffff88808a268ba0 by task syz-executor.1/9270 > > CPU: 0 PID: 9270 Comm: syz-executor.1 Not tainted 5.2.0-rc3+ #1 > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS > Google 01/01/2011 > Call Trace: > > Allocated by task 2647419968: > BUG: unable to handle page fault for address: ffffffff8c00b020 > #PF: supervisor read access in kernel mode > #PF: error_code(0x0000) - not-present page > PGD 8a70067 P4D 8a70067 PUD 8a71063 PMD 0 > Thread overran stack, or stack corrupted > Oops: 0000 [#1] PREEMPT SMP KASAN > CPU: 0 PID: 9270 Comm: syz-executor.1 Not tainted 5.2.0-rc3+ #1 > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS > Google 01/01/2011 > RIP: 0010:stack_depot_fetch+0x10/0x30 lib/stackdepot.c:203 > Code: e9 7b fd ff ff 4c 89 ff e8 8d b4 62 fe e9 e6 fd ff ff 90 90 90 90 90 > 90 90 90 89 f8 c1 ef 11 25 ff ff 1f 00 81 e7 f0 3f 00 00 <48> 03 3c c5 20 > 6c 04 8b 48 8d 47 18 48 89 06 8b 47 0c c3 0f 1f 00 > RSP: 0018:ffff88808a2688e8 EFLAGS: 00010006 > RAX: 00000000001f8880 RBX: ffff88808a269304 RCX: 0000000000000000 > RDX: 0000000000000000 RSI: ffff88808a2688f0 RDI: 0000000000003ff0 > RBP: ffff88808a268908 R08: 0000000000000020 R09: ffffed1015d044fa > R10: ffffed1015d044f9 R11: ffff8880ae8227cf R12: ffffea0002289a00 > R13: ffff88808a268ba0 R14: ffff8880aa58ec40 R15: ffff88808a269300 > FS: 00005555570ba940(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: ffffffff8c00b020 CR3: 000000008dd00000 CR4: 00000000001406f0 > DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 > DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 > Call Trace: > Modules linked in: > CR2: ffffffff8c00b020 > ---[ end trace 4acfe4b59fbc9cdb ]--- > RIP: 0010:stack_depot_fetch+0x10/0x30 lib/stackdepot.c:203 > Code: e9 7b fd ff ff 4c 89 ff e8 8d b4 62 fe e9 e6 fd ff ff 90 90 90 90 90 > 90 90 90 89 f8 c1 ef 11 25 ff ff 1f 00 81 e7 f0 3f 00 00 <48> 03 3c c5 20 > 6c 04 8b 48 8d 47 18 48 89 06 8b 47 0c c3 0f 1f 00 > RSP: 0018:ffff88808a2688e8 EFLAGS: 00010006 > RAX: 00000000001f8880 RBX: ffff88808a269304 RCX: 0000000000000000 > RDX: 0000000000000000 RSI: ffff88808a2688f0 RDI: 0000000000003ff0 > RBP: ffff88808a268908 R08: 0000000000000020 R09: ffffed1015d044fa > R10: ffffed1015d044f9 R11: ffff8880ae8227cf R12: ffffea0002289a00 > R13: ffff88808a268ba0 R14: ffff8880aa58ec40 R15: ffff88808a269300 > FS: 00005555570ba940(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: ffffffff8c00b020 CR3: 000000008dd00000 CR4: 00000000001406f0 > DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 > DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 > > > Tested on: > > commit: 0b58d013 bpf: tls, implement unhash to avoid transition ou.. > git tree: git://github.com/cilium/linux ktls-unhash > console output: https://syzkaller.appspot.com/x/log.txt?x=153368a3a00000 > kernel config: https://syzkaller.appspot.com/x/.config?x=2cc918d28ebd06b4 > compiler: gcc (GCC) 9.0.0 20181231 (experimental) > #syz test: git://github.com/cilium/linux fix-unhash ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: WARNING in mark_lock 2019-07-08 16:21 ` John Fastabend @ 2019-07-08 22:03 ` syzbot 0 siblings, 0 replies; 6+ messages in thread From: syzbot @ 2019-07-08 22:03 UTC (permalink / raw) To: bpf, ebiggers, john.fastabend, linux-kernel, peterz, syzkaller-bugs, tglx Hello, syzbot has tested the proposed patch and the reproducer did not trigger crash: Reported-and-tested-by: syzbot+a861f52659ae2596492b@syzkaller.appspotmail.com Tested on: commit: 17b3f125 tls: working code git tree: git://github.com/cilium/linux fix-unhash kernel config: https://syzkaller.appspot.com/x/.config?x=dd16b8dc9d0d210c compiler: gcc (GCC) 9.0.0 20181231 (experimental) Note: testing is done by a robot and is best-effort only. ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: WARNING in mark_lock [not found] <0000000000005aedf1058c1bf7e8@google.com> [not found] ` <alpine.DEB.2.21.1906250820060.32342@nanos.tec.linutronix.de> @ 2019-06-27 22:03 ` syzbot 1 sibling, 0 replies; 6+ messages in thread From: syzbot @ 2019-06-27 22:03 UTC (permalink / raw) To: ast, bpf, daniel, dvyukov, ebiggers, john.fastabend, linux-kernel, netdev, peterz, syzkaller-bugs, tglx syzbot has bisected this bug to: commit e9db4ef6bf4ca9894bb324c76e01b8f1a16b2650 Author: John Fastabend <john.fastabend@gmail.com> Date: Sat Jun 30 13:17:47 2018 +0000 bpf: sockhash fix omitted bucket lock in sock_close bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=1436e7e9a00000 start commit: dc636f5d Add linux-next specific files for 20190620 git tree: linux-next final crash: https://syzkaller.appspot.com/x/report.txt?x=1636e7e9a00000 console output: https://syzkaller.appspot.com/x/log.txt?x=1236e7e9a00000 kernel config: https://syzkaller.appspot.com/x/.config?x=99c104b0092a557b dashboard link: https://syzkaller.appspot.com/bug?extid=a861f52659ae2596492b syz repro: https://syzkaller.appspot.com/x/repro.syz?x=110b24f6a00000 Reported-by: syzbot+a861f52659ae2596492b@syzkaller.appspotmail.com Fixes: e9db4ef6bf4c ("bpf: sockhash fix omitted bucket lock in sock_close") For information about bisection process see: https://goo.gl/tpsmEJ#bisection ^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2019-07-08 22:03 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
[not found] <0000000000005aedf1058c1bf7e8@google.com>
[not found] ` <alpine.DEB.2.21.1906250820060.32342@nanos.tec.linutronix.de>
2019-06-25 7:29 ` [net/bpf] Re: WARNING in mark_lock Eric Biggers
2019-07-01 5:32 ` John Fastabend
2019-07-01 5:51 ` syzbot
2019-07-08 16:21 ` John Fastabend
2019-07-08 22:03 ` syzbot
2019-06-27 22:03 ` syzbot
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).