* Re: WARNING in bpf_jit_free [not found] <000000000000e92d1805711f5552@google.com> @ 2019-03-31 18:20 ` syzbot 2019-06-08 11:22 ` syzbot 1 sibling, 0 replies; 7+ messages in thread From: syzbot @ 2019-03-31 18:20 UTC (permalink / raw) To: airlied, ast, bpf, daniel, daniel, davem, dri-devel, hawk, jakub.kicinski, john.fastabend, kafai, linux-arm-kernel, linux-kernel, maxime.ripard, netdev, paul.kocialkowski, songliubraving, syzkaller-bugs, wens, xdp-newbies, yhs syzbot has bisected this bug to: commit 0fff724a33917ac581b5825375d0b57affedee76 Author: Paul Kocialkowski <paul.kocialkowski@bootlin.com> Date: Fri Jan 18 14:51:13 2019 +0000 drm/sun4i: backend: Use explicit fourcc helpers for packed YUV422 check bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=1467550f200000 start commit: 0e40da3e Merge tag 'kbuild-fixes-v5.1' of git://git.kernel.. git tree: upstream final crash: https://syzkaller.appspot.com/x/report.txt?x=1667550f200000 console output: https://syzkaller.appspot.com/x/log.txt?x=1267550f200000 kernel config: https://syzkaller.appspot.com/x/.config?x=8dcdce25ea72bedf dashboard link: https://syzkaller.appspot.com/bug?extid=2ff1e7cb738fd3c41113 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16973653200000 Reported-by: syzbot+2ff1e7cb738fd3c41113@syzkaller.appspotmail.com Fixes: 0fff724a3391 ("drm/sun4i: backend: Use explicit fourcc helpers for packed YUV422 check") For information about bisection process see: https://goo.gl/tpsmEJ#bisection _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: WARNING in bpf_jit_free [not found] <000000000000e92d1805711f5552@google.com> 2019-03-31 18:20 ` WARNING in bpf_jit_free syzbot @ 2019-06-08 11:22 ` syzbot 2019-06-11 8:04 ` Daniel Vetter 1 sibling, 1 reply; 7+ messages in thread From: syzbot @ 2019-06-08 11:22 UTC (permalink / raw) To: airlied, ast, bpf, daniel, daniel, davem, dri-devel, hawk, jakub.kicinski, john.fastabend, kafai, linux-arm-kernel, linux-kernel, maxime.ripard, netdev, paul.kocialkowski, songliubraving, syzkaller-bugs, wens, xdp-newbies, yhs syzbot has found a reproducer for the following crash on: HEAD commit: 79c3ba32 Merge tag 'drm-fixes-2019-06-07-1' of git://anong.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=1201b971a00000 kernel config: https://syzkaller.appspot.com/x/.config?x=60564cb52ab29d5b dashboard link: https://syzkaller.appspot.com/bug?extid=2ff1e7cb738fd3c41113 compiler: gcc (GCC) 9.0.0 20181231 (experimental) syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14a3bf51a00000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=120d19f2a00000 The bug was bisected to: commit 0fff724a33917ac581b5825375d0b57affedee76 Author: Paul Kocialkowski <paul.kocialkowski@bootlin.com> Date: Fri Jan 18 14:51:13 2019 +0000 drm/sun4i: backend: Use explicit fourcc helpers for packed YUV422 check bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=1467550f200000 final crash: https://syzkaller.appspot.com/x/report.txt?x=1667550f200000 console output: https://syzkaller.appspot.com/x/log.txt?x=1267550f200000 IMPORTANT: if you fix the bug, please add the following tag to the commit: Reported-by: syzbot+2ff1e7cb738fd3c41113@syzkaller.appspotmail.com Fixes: 0fff724a3391 ("drm/sun4i: backend: Use explicit fourcc helpers for packed YUV422 check") WARNING: CPU: 0 PID: 8951 at kernel/bpf/core.c:851 bpf_jit_free+0x157/0x1b0 Kernel panic - not syncing: panic_on_warn set ... CPU: 0 PID: 8951 Comm: kworker/0:0 Not tainted 5.2.0-rc3+ #23 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: events bpf_prog_free_deferred Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x172/0x1f0 lib/dump_stack.c:113 panic+0x2cb/0x744 kernel/panic.c:219 __warn.cold+0x20/0x4d kernel/panic.c:576 report_bug+0x263/0x2b0 lib/bug.c:186 fixup_bug arch/x86/kernel/traps.c:179 [inline] fixup_bug arch/x86/kernel/traps.c:174 [inline] do_error_trap+0x11b/0x200 arch/x86/kernel/traps.c:272 do_invalid_op+0x37/0x50 arch/x86/kernel/traps.c:291 invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:986 RIP: 0010:bpf_jit_free+0x157/0x1b0 Code: 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 75 5d 48 b8 00 02 00 00 00 00 ad de 48 39 43 70 0f 84 05 ff ff ff e8 f9 b5 f4 ff <0f> 0b e9 f9 fe ff ff e8 bd 53 2d 00 e9 d9 fe ff ff 48 89 7d e0 e8 RSP: 0018:ffff88808886fcb0 EFLAGS: 00010293 RAX: ffff88808cb6c480 RBX: ffff88809051d280 RCX: ffffffff817ae68d RDX: 0000000000000000 RSI: ffffffff817bf0f7 RDI: ffff88809051d2f0 RBP: ffff88808886fcd0 R08: 1ffffffff14ccaa8 R09: fffffbfff14ccaa9 R10: fffffbfff14ccaa8 R11: ffffffff8a665547 R12: ffffc90001925000 R13: ffff88809051d2e8 R14: ffff8880a0e43900 R15: ffff8880ae834840 bpf_prog_free_deferred+0x27a/0x350 kernel/bpf/core.c:1984 process_one_work+0x989/0x1790 kernel/workqueue.c:2269 worker_thread+0x98/0xe40 kernel/workqueue.c:2415 kthread+0x354/0x420 kernel/kthread.c:255 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352 Kernel Offset: disabled Rebooting in 86400 seconds.. _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: WARNING in bpf_jit_free 2019-06-08 11:22 ` syzbot @ 2019-06-11 8:04 ` Daniel Vetter 2019-06-11 8:33 ` Dmitry Vyukov 0 siblings, 1 reply; 7+ messages in thread From: Daniel Vetter @ 2019-06-11 8:04 UTC (permalink / raw) To: syzbot Cc: xdp-newbies, songliubraving, jakub.kicinski, hawk, daniel, syzkaller-bugs, airlied, linux-kernel, john.fastabend, ast, dri-devel, kafai, paul.kocialkowski, maxime.ripard, wens, daniel, netdev, yhs, bpf, davem, linux-arm-kernel On Sat, Jun 08, 2019 at 04:22:06AM -0700, syzbot wrote: > syzbot has found a reproducer for the following crash on: > > HEAD commit: 79c3ba32 Merge tag 'drm-fixes-2019-06-07-1' of git://anong.. > git tree: upstream > console output: https://syzkaller.appspot.com/x/log.txt?x=1201b971a00000 > kernel config: https://syzkaller.appspot.com/x/.config?x=60564cb52ab29d5b > dashboard link: https://syzkaller.appspot.com/bug?extid=2ff1e7cb738fd3c41113 > compiler: gcc (GCC) 9.0.0 20181231 (experimental) > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14a3bf51a00000 > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=120d19f2a00000 Looking at the reproducer I don't see any calls to ioctl which could end up anywhere in drm. > > The bug was bisected to: > > commit 0fff724a33917ac581b5825375d0b57affedee76 > Author: Paul Kocialkowski <paul.kocialkowski@bootlin.com> > Date: Fri Jan 18 14:51:13 2019 +0000 > > drm/sun4i: backend: Use explicit fourcc helpers for packed YUV422 check And most definitely not in drm/sun4i. You can only hit this if you have sun4i and run on arm, which per your config isn't the case. tldr; smells like bisect gone wrong. -Daniel > > bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=1467550f200000 > final crash: https://syzkaller.appspot.com/x/report.txt?x=1667550f200000 > console output: https://syzkaller.appspot.com/x/log.txt?x=1267550f200000 > > IMPORTANT: if you fix the bug, please add the following tag to the commit: > Reported-by: syzbot+2ff1e7cb738fd3c41113@syzkaller.appspotmail.com > Fixes: 0fff724a3391 ("drm/sun4i: backend: Use explicit fourcc helpers for > packed YUV422 check") > > WARNING: CPU: 0 PID: 8951 at kernel/bpf/core.c:851 bpf_jit_free+0x157/0x1b0 > Kernel panic - not syncing: panic_on_warn set ... > CPU: 0 PID: 8951 Comm: kworker/0:0 Not tainted 5.2.0-rc3+ #23 > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS > Google 01/01/2011 > Workqueue: events bpf_prog_free_deferred > Call Trace: > __dump_stack lib/dump_stack.c:77 [inline] > dump_stack+0x172/0x1f0 lib/dump_stack.c:113 > panic+0x2cb/0x744 kernel/panic.c:219 > __warn.cold+0x20/0x4d kernel/panic.c:576 > report_bug+0x263/0x2b0 lib/bug.c:186 > fixup_bug arch/x86/kernel/traps.c:179 [inline] > fixup_bug arch/x86/kernel/traps.c:174 [inline] > do_error_trap+0x11b/0x200 arch/x86/kernel/traps.c:272 > do_invalid_op+0x37/0x50 arch/x86/kernel/traps.c:291 > invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:986 > RIP: 0010:bpf_jit_free+0x157/0x1b0 > Code: 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 75 5d 48 b8 00 02 00 00 > 00 00 ad de 48 39 43 70 0f 84 05 ff ff ff e8 f9 b5 f4 ff <0f> 0b e9 f9 fe ff > ff e8 bd 53 2d 00 e9 d9 fe ff ff 48 89 7d e0 e8 > RSP: 0018:ffff88808886fcb0 EFLAGS: 00010293 > RAX: ffff88808cb6c480 RBX: ffff88809051d280 RCX: ffffffff817ae68d > RDX: 0000000000000000 RSI: ffffffff817bf0f7 RDI: ffff88809051d2f0 > RBP: ffff88808886fcd0 R08: 1ffffffff14ccaa8 R09: fffffbfff14ccaa9 > R10: fffffbfff14ccaa8 R11: ffffffff8a665547 R12: ffffc90001925000 > R13: ffff88809051d2e8 R14: ffff8880a0e43900 R15: ffff8880ae834840 > bpf_prog_free_deferred+0x27a/0x350 kernel/bpf/core.c:1984 > process_one_work+0x989/0x1790 kernel/workqueue.c:2269 > worker_thread+0x98/0xe40 kernel/workqueue.c:2415 > kthread+0x354/0x420 kernel/kthread.c:255 > ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352 > Kernel Offset: disabled > Rebooting in 86400 seconds.. > -- Daniel Vetter Software Engineer, Intel Corporation http://blog.ffwll.ch _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: WARNING in bpf_jit_free 2019-06-11 8:04 ` Daniel Vetter @ 2019-06-11 8:33 ` Dmitry Vyukov 2019-06-11 8:51 ` Daniel Vetter 0 siblings, 1 reply; 7+ messages in thread From: Dmitry Vyukov @ 2019-06-11 8:33 UTC (permalink / raw) To: syzbot, David Airlie, Alexei Starovoitov, bpf, Daniel Borkmann, David Miller, DRI, hawk, Jakub Kicinski, John Fastabend, Martin KaFai Lau, Linux ARM, LKML, maxime.ripard, netdev, paul.kocialkowski, Song Liu, syzkaller-bugs, wens, xdp-newbies, Yonghong Song Cc: Daniel Vetter On Tue, Jun 11, 2019 at 10:04 AM Daniel Vetter <daniel@ffwll.ch> wrote: > > On Sat, Jun 08, 2019 at 04:22:06AM -0700, syzbot wrote: > > syzbot has found a reproducer for the following crash on: > > > > HEAD commit: 79c3ba32 Merge tag 'drm-fixes-2019-06-07-1' of git://anong.. > > git tree: upstream > > console output: https://syzkaller.appspot.com/x/log.txt?x=1201b971a00000 > > kernel config: https://syzkaller.appspot.com/x/.config?x=60564cb52ab29d5b > > dashboard link: https://syzkaller.appspot.com/bug?extid=2ff1e7cb738fd3c41113 > > compiler: gcc (GCC) 9.0.0 20181231 (experimental) > > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14a3bf51a00000 > > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=120d19f2a00000 > > Looking at the reproducer I don't see any calls to ioctl which could end > up anywhere in drm. > > > > The bug was bisected to: > > > > commit 0fff724a33917ac581b5825375d0b57affedee76 > > Author: Paul Kocialkowski <paul.kocialkowski@bootlin.com> > > Date: Fri Jan 18 14:51:13 2019 +0000 > > > > drm/sun4i: backend: Use explicit fourcc helpers for packed YUV422 check > > And most definitely not in drm/sun4i. You can only hit this if you have > sun4i and run on arm, which per your config isn't the case. > > tldr; smells like bisect gone wrong. > -Daniel From the bisection log it looks like the bug is too hard to trigger for reliable bisection. So it probably classified one bad commit as good. But it should got quite close to the right one. > > bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=1467550f200000 > > final crash: https://syzkaller.appspot.com/x/report.txt?x=1667550f200000 > > console output: https://syzkaller.appspot.com/x/log.txt?x=1267550f200000 > > > > IMPORTANT: if you fix the bug, please add the following tag to the commit: > > Reported-by: syzbot+2ff1e7cb738fd3c41113@syzkaller.appspotmail.com > > Fixes: 0fff724a3391 ("drm/sun4i: backend: Use explicit fourcc helpers for > > packed YUV422 check") > > > > WARNING: CPU: 0 PID: 8951 at kernel/bpf/core.c:851 bpf_jit_free+0x157/0x1b0 > > Kernel panic - not syncing: panic_on_warn set ... > > CPU: 0 PID: 8951 Comm: kworker/0:0 Not tainted 5.2.0-rc3+ #23 > > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS > > Google 01/01/2011 > > Workqueue: events bpf_prog_free_deferred > > Call Trace: > > __dump_stack lib/dump_stack.c:77 [inline] > > dump_stack+0x172/0x1f0 lib/dump_stack.c:113 > > panic+0x2cb/0x744 kernel/panic.c:219 > > __warn.cold+0x20/0x4d kernel/panic.c:576 > > report_bug+0x263/0x2b0 lib/bug.c:186 > > fixup_bug arch/x86/kernel/traps.c:179 [inline] > > fixup_bug arch/x86/kernel/traps.c:174 [inline] > > do_error_trap+0x11b/0x200 arch/x86/kernel/traps.c:272 > > do_invalid_op+0x37/0x50 arch/x86/kernel/traps.c:291 > > invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:986 > > RIP: 0010:bpf_jit_free+0x157/0x1b0 > > Code: 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 75 5d 48 b8 00 02 00 00 > > 00 00 ad de 48 39 43 70 0f 84 05 ff ff ff e8 f9 b5 f4 ff <0f> 0b e9 f9 fe ff > > ff e8 bd 53 2d 00 e9 d9 fe ff ff 48 89 7d e0 e8 > > RSP: 0018:ffff88808886fcb0 EFLAGS: 00010293 > > RAX: ffff88808cb6c480 RBX: ffff88809051d280 RCX: ffffffff817ae68d > > RDX: 00000000> > > > -- > Daniel Vetter > Software Engineer, Intel Corporation > http://blog.ffwll.ch > > -- > You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group. > To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bugs+unsubscribe@googlegroups.com. > To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/20190611080431.GP21222%40phenom.ffwll.local. > For more options, visit https://groups.google.com/d/optout.00000000 RSI: ffffffff817bf0f7 RDI: ffff88809051d2f0 > > RBP: ffff88808886fcd0 R08: 1ffffffff14ccaa8 R09: fffffbfff14ccaa9 > > R10: fffffbfff14ccaa8 R11: ffffffff8a665547 R12: ffffc90001925000 > > R13: ffff88809051d2e8 R14: ffff8880a0e43900 R15: ffff8880ae834840 > > bpf_prog_free_deferred+0x27a/0x350 kernel/bpf/core.c:1984 > > process_one_work+0x989/0x1790 kernel/workqueue.c:2269 > > worker_thread+0x98/0xe40 kernel/workqueue.c:2415 > > kthread+0x354/0x420 kernel/kthread.c:255 > > ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352 > > Kernel Offset: disabled > > Rebooting in 86400 seconds.. _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: WARNING in bpf_jit_free 2019-06-11 8:33 ` Dmitry Vyukov @ 2019-06-11 8:51 ` Daniel Vetter 2019-06-11 9:01 ` Daniel Vetter 0 siblings, 1 reply; 7+ messages in thread From: Daniel Vetter @ 2019-06-11 8:51 UTC (permalink / raw) To: Dmitry Vyukov Cc: Song Liu, Jakub Kicinski, David Airlie, Alexei Starovoitov, DRI, hawk, xdp-newbies, Daniel Borkmann, John Fastabend, maxime.ripard, wens, Yonghong Song, syzbot, syzkaller-bugs, Linux ARM, netdev, LKML, David Miller, paul.kocialkowski, Daniel Vetter, bpf, Martin KaFai Lau On Tue, Jun 11, 2019 at 10:33:21AM +0200, Dmitry Vyukov wrote: > On Tue, Jun 11, 2019 at 10:04 AM Daniel Vetter <daniel@ffwll.ch> wrote: > > > > On Sat, Jun 08, 2019 at 04:22:06AM -0700, syzbot wrote: > > > syzbot has found a reproducer for the following crash on: > > > > > > HEAD commit: 79c3ba32 Merge tag 'drm-fixes-2019-06-07-1' of git://anong.. > > > git tree: upstream > > > console output: https://syzkaller.appspot.com/x/log.txt?x=1201b971a00000 > > > kernel config: https://syzkaller.appspot.com/x/.config?x=60564cb52ab29d5b > > > dashboard link: https://syzkaller.appspot.com/bug?extid=2ff1e7cb738fd3c41113 > > > compiler: gcc (GCC) 9.0.0 20181231 (experimental) > > > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14a3bf51a00000 > > > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=120d19f2a00000 > > > > Looking at the reproducer I don't see any calls to ioctl which could end > > up anywhere in drm. > > > > > > The bug was bisected to: > > > > > > commit 0fff724a33917ac581b5825375d0b57affedee76 > > > Author: Paul Kocialkowski <paul.kocialkowski@bootlin.com> > > > Date: Fri Jan 18 14:51:13 2019 +0000 > > > > > > drm/sun4i: backend: Use explicit fourcc helpers for packed YUV422 check > > > > And most definitely not in drm/sun4i. You can only hit this if you have > > sun4i and run on arm, which per your config isn't the case. > > > > tldr; smells like bisect gone wrong. > > -Daniel > > From the bisection log it looks like the bug is too hard to trigger > for reliable bisection. So it probably classified one bad commit as > good. But it should got quite close to the right one. Well statistically it'll get close, since there's a fair chance that it's one of the later bisect results that got mischaracterized. But you can be equally unlucky, and if it's one of the earliers, then it can easily be a few thousand commits of. Looking at the log it's mostly bad, with a few good sprinkled in, which could just be reproduction failures. So might very well be that the very first "good" result is wrong. And that very first "good" decision cuts away a big pile of bpf related commits. The next "good" decision then only cuts away a pile of drm commits, but at that point you're already off the rails most likely. I'd say re-test on f90d64483ebd394958841f67f8794ab203b319a7 a few times, I'm willing to bet that one is actually bad. Cheers, Daniel > > > > bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=1467550f200000 > > > final crash: https://syzkaller.appspot.com/x/report.txt?x=1667550f200000 > > > console output: https://syzkaller.appspot.com/x/log.txt?x=1267550f200000 > > > > > > IMPORTANT: if you fix the bug, please add the following tag to the commit: > > > Reported-by: syzbot+2ff1e7cb738fd3c41113@syzkaller.appspotmail.com > > > Fixes: 0fff724a3391 ("drm/sun4i: backend: Use explicit fourcc helpers for > > > packed YUV422 check") > > > > > > WARNING: CPU: 0 PID: 8951 at kernel/bpf/core.c:851 bpf_jit_free+0x157/0x1b0 > > > Kernel panic - not syncing: panic_on_warn set ... > > > CPU: 0 PID: 8951 Comm: kworker/0:0 Not tainted 5.2.0-rc3+ #23 > > > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS > > > Google 01/01/2011 > > > Workqueue: events bpf_prog_free_deferred > > > Call Trace: > > > __dump_stack lib/dump_stack.c:77 [inline] > > > dump_stack+0x172/0x1f0 lib/dump_stack.c:113 > > > panic+0x2cb/0x744 kernel/panic.c:219 > > > __warn.cold+0x20/0x4d kernel/panic.c:576 > > > report_bug+0x263/0x2b0 lib/bug.c:186 > > > fixup_bug arch/x86/kernel/traps.c:179 [inline] > > > fixup_bug arch/x86/kernel/traps.c:174 [inline] > > > do_error_trap+0x11b/0x200 arch/x86/kernel/traps.c:272 > > > do_invalid_op+0x37/0x50 arch/x86/kernel/traps.c:291 > > > invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:986 > > > RIP: 0010:bpf_jit_free+0x157/0x1b0 > > > Code: 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 75 5d 48 b8 00 02 00 00 > > > 00 00 ad de 48 39 43 70 0f 84 05 ff ff ff e8 f9 b5 f4 ff <0f> 0b e9 f9 fe ff > > > ff e8 bd 53 2d 00 e9 d9 fe ff ff 48 89 7d e0 e8 > > > RSP: 0018:ffff88808886fcb0 EFLAGS: 00010293 > > > RAX: ffff88808cb6c480 RBX: ffff88809051d280 RCX: ffffffff817ae68d > > > RDX: 00000000> > > > > > -- > > Daniel Vetter > > Software Engineer, Intel Corporation > > http://blog.ffwll.ch > > > > -- > > You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group. > > To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bugs+unsubscribe@googlegroups.com. > > To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/20190611080431.GP21222%40phenom.ffwll.local. > > For more options, visit https://groups.google.com/d/optout.00000000 RSI: ffffffff817bf0f7 RDI: ffff88809051d2f0 > > > RBP: ffff88808886fcd0 R08: 1ffffffff14ccaa8 R09: fffffbfff14ccaa9 > > > R10: fffffbfff14ccaa8 R11: ffffffff8a665547 R12: ffffc90001925000 > > > R13: ffff88809051d2e8 R14: ffff8880a0e43900 R15: ffff8880ae834840 > > > bpf_prog_free_deferred+0x27a/0x350 kernel/bpf/core.c:1984 > > > process_one_work+0x989/0x1790 kernel/workqueue.c:2269 > > > worker_thread+0x98/0xe40 kernel/workqueue.c:2415 > > > kthread+0x354/0x420 kernel/kthread.c:255 > > > ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352 > > > Kernel Offset: disabled > > > Rebooting in 86400 seconds.. -- Daniel Vetter Software Engineer, Intel Corporation http://blog.ffwll.ch _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: WARNING in bpf_jit_free 2019-06-11 8:51 ` Daniel Vetter @ 2019-06-11 9:01 ` Daniel Vetter 2019-06-11 9:08 ` Dmitry Vyukov 0 siblings, 1 reply; 7+ messages in thread From: Daniel Vetter @ 2019-06-11 9:01 UTC (permalink / raw) To: Dmitry Vyukov, syzbot, David Airlie, Alexei Starovoitov, bpf, Daniel Borkmann, David Miller, DRI, hawk, Jakub Kicinski, John Fastabend, Martin KaFai Lau, Linux ARM, LKML, maxime.ripard, netdev, paul.kocialkowski, Song Liu, syzkaller-bugs, wens, xdp-newbies, Yonghong Song On Tue, Jun 11, 2019 at 10:51:23AM +0200, Daniel Vetter wrote: > On Tue, Jun 11, 2019 at 10:33:21AM +0200, Dmitry Vyukov wrote: > > On Tue, Jun 11, 2019 at 10:04 AM Daniel Vetter <daniel@ffwll.ch> wrote: > > > > > > On Sat, Jun 08, 2019 at 04:22:06AM -0700, syzbot wrote: > > > > syzbot has found a reproducer for the following crash on: > > > > > > > > HEAD commit: 79c3ba32 Merge tag 'drm-fixes-2019-06-07-1' of git://anong.. > > > > git tree: upstream > > > > console output: https://syzkaller.appspot.com/x/log.txt?x=1201b971a00000 > > > > kernel config: https://syzkaller.appspot.com/x/.config?x=60564cb52ab29d5b > > > > dashboard link: https://syzkaller.appspot.com/bug?extid=2ff1e7cb738fd3c41113 > > > > compiler: gcc (GCC) 9.0.0 20181231 (experimental) > > > > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14a3bf51a00000 > > > > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=120d19f2a00000 > > > > > > Looking at the reproducer I don't see any calls to ioctl which could end > > > up anywhere in drm. > > > > > > > > The bug was bisected to: > > > > > > > > commit 0fff724a33917ac581b5825375d0b57affedee76 > > > > Author: Paul Kocialkowski <paul.kocialkowski@bootlin.com> > > > > Date: Fri Jan 18 14:51:13 2019 +0000 > > > > > > > > drm/sun4i: backend: Use explicit fourcc helpers for packed YUV422 check > > > > > > And most definitely not in drm/sun4i. You can only hit this if you have > > > sun4i and run on arm, which per your config isn't the case. > > > > > > tldr; smells like bisect gone wrong. > > > -Daniel > > > > From the bisection log it looks like the bug is too hard to trigger > > for reliable bisection. So it probably classified one bad commit as > > good. But it should got quite close to the right one. > > Well statistically it'll get close, since there's a fair chance that it's > one of the later bisect results that got mischaracterized. > > But you can be equally unlucky, and if it's one of the earliers, then it > can easily be a few thousand commits of. Looking at the log it's mostly > bad, with a few good sprinkled in, which could just be reproduction > failures. So might very well be that the very first "good" result is > wrong. And that very first "good" decision cuts away a big pile of bpf > related commits. The next "good" decision then only cuts away a pile of > drm commits, but at that point you're already off the rails most likely. > > I'd say re-test on f90d64483ebd394958841f67f8794ab203b319a7 a few times, > I'm willing to bet that one is actually bad. btw if this theory is right, we have a 1-in-4 chance of a spurious "good" with your test. If you get 10 repeated "good" then that should be good enough to make playing the lottery a better endeavor :-) -Daniel > > Cheers, Daniel > > > > > > > bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=1467550f200000 > > > > final crash: https://syzkaller.appspot.com/x/report.txt?x=1667550f200000 > > > > console output: https://syzkaller.appspot.com/x/log.txt?x=1267550f200000 > > > > > > > > IMPORTANT: if you fix the bug, please add the following tag to the commit: > > > > Reported-by: syzbot+2ff1e7cb738fd3c41113@syzkaller.appspotmail.com > > > > Fixes: 0fff724a3391 ("drm/sun4i: backend: Use explicit fourcc helpers for > > > > packed YUV422 check") > > > > > > > > WARNING: CPU: 0 PID: 8951 at kernel/bpf/core.c:851 bpf_jit_free+0x157/0x1b0 > > > > Kernel panic - not syncing: panic_on_warn set ... > > > > CPU: 0 PID: 8951 Comm: kworker/0:0 Not tainted 5.2.0-rc3+ #23 > > > > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS > > > > Google 01/01/2011 > > > > Workqueue: events bpf_prog_free_deferred > > > > Call Trace: > > > > __dump_stack lib/dump_stack.c:77 [inline] > > > > dump_stack+0x172/0x1f0 lib/dump_stack.c:113 > > > > panic+0x2cb/0x744 kernel/panic.c:219 > > > > __warn.cold+0x20/0x4d kernel/panic.c:576 > > > > report_bug+0x263/0x2b0 lib/bug.c:186 > > > > fixup_bug arch/x86/kernel/traps.c:179 [inline] > > > > fixup_bug arch/x86/kernel/traps.c:174 [inline] > > > > do_error_trap+0x11b/0x200 arch/x86/kernel/traps.c:272 > > > > do_invalid_op+0x37/0x50 arch/x86/kernel/traps.c:291 > > > > invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:986 > > > > RIP: 0010:bpf_jit_free+0x157/0x1b0 > > > > Code: 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 75 5d 48 b8 00 02 00 00 > > > > 00 00 ad de 48 39 43 70 0f 84 05 ff ff ff e8 f9 b5 f4 ff <0f> 0b e9 f9 fe ff > > > > ff e8 bd 53 2d 00 e9 d9 fe ff ff 48 89 7d e0 e8 > > > > RSP: 0018:ffff88808886fcb0 EFLAGS: 00010293 > > > > RAX: ffff88808cb6c480 RBX: ffff88809051d280 RCX: ffffffff817ae68d > > > > RDX: 00000000> > > > > > > > -- > > > Daniel Vetter > > > Software Engineer, Intel Corporation > > > http://blog.ffwll.ch > > > > > > -- > > > You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group. > > > To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bugs+unsubscribe@googlegroups.com. > > > To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/20190611080431.GP21222%40phenom.ffwll.local. > > > For more options, visit https://groups.google.com/d/optout.00000000 RSI: ffffffff817bf0f7 RDI: ffff88809051d2f0 > > > > RBP: ffff88808886fcd0 R08: 1ffffffff14ccaa8 R09: fffffbfff14ccaa9 > > > > R10: fffffbfff14ccaa8 R11: ffffffff8a665547 R12: ffffc90001925000 > > > > R13: ffff88809051d2e8 R14: ffff8880a0e43900 R15: ffff8880ae834840 > > > > bpf_prog_free_deferred+0x27a/0x350 kernel/bpf/core.c:1984 > > > > process_one_work+0x989/0x1790 kernel/workqueue.c:2269 > > > > worker_thread+0x98/0xe40 kernel/workqueue.c:2415 > > > > kthread+0x354/0x420 kernel/kthread.c:255 > > > > ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352 > > > > Kernel Offset: disabled > > > > Rebooting in 86400 seconds.. > > -- > Daniel Vetter > Software Engineer, Intel Corporation > http://blog.ffwll.ch -- Daniel Vetter Software Engineer, Intel Corporation http://blog.ffwll.ch _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: WARNING in bpf_jit_free 2019-06-11 9:01 ` Daniel Vetter @ 2019-06-11 9:08 ` Dmitry Vyukov 0 siblings, 0 replies; 7+ messages in thread From: Dmitry Vyukov @ 2019-06-11 9:08 UTC (permalink / raw) To: Dmitry Vyukov, syzbot, David Airlie, Alexei Starovoitov, bpf, Daniel Borkmann, David Miller, DRI, hawk, Jakub Kicinski, John Fastabend, Martin KaFai Lau, Linux ARM, LKML, maxime.ripard, netdev, paul.kocialkowski, Song Liu, syzkaller-bugs, wens, xdp-newbies, Yonghong Song On Tue, Jun 11, 2019 at 11:01 AM Daniel Vetter <daniel@ffwll.ch> wrote: > > On Tue, Jun 11, 2019 at 10:51:23AM +0200, Daniel Vetter wrote: > > On Tue, Jun 11, 2019 at 10:33:21AM +0200, Dmitry Vyukov wrote: > > > On Tue, Jun 11, 2019 at 10:04 AM Daniel Vetter <daniel@ffwll.ch> wrote: > > > > > > > > On Sat, Jun 08, 2019 at 04:22:06AM -0700, syzbot wrote: > > > > > syzbot has found a reproducer for the following crash on: > > > > > > > > > > HEAD commit: 79c3ba32 Merge tag 'drm-fixes-2019-06-07-1' of git://anong.. > > > > > git tree: upstream > > > > > console output: https://syzkaller.appspot.com/x/log.txt?x=1201b971a00000 > > > > > kernel config: https://syzkaller.appspot.com/x/.config?x=60564cb52ab29d5b > > > > > dashboard link: https://syzkaller.appspot.com/bug?extid=2ff1e7cb738fd3c41113 > > > > > compiler: gcc (GCC) 9.0.0 20181231 (experimental) > > > > > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14a3bf51a00000 > > > > > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=120d19f2a00000 > > > > > > > > Looking at the reproducer I don't see any calls to ioctl which could end > > > > up anywhere in drm. > > > > > > > > > > The bug was bisected to: > > > > > > > > > > commit 0fff724a33917ac581b5825375d0b57affedee76 > > > > > Author: Paul Kocialkowski <paul.kocialkowski@bootlin.com> > > > > > Date: Fri Jan 18 14:51:13 2019 +0000 > > > > > > > > > > drm/sun4i: backend: Use explicit fourcc helpers for packed YUV422 check > > > > > > > > And most definitely not in drm/sun4i. You can only hit this if you have > > > > sun4i and run on arm, which per your config isn't the case. > > > > > > > > tldr; smells like bisect gone wrong. > > > > -Daniel > > > > > > From the bisection log it looks like the bug is too hard to trigger > > > for reliable bisection. So it probably classified one bad commit as > > > good. But it should got quite close to the right one. > > > > Well statistically it'll get close, since there's a fair chance that it's > > one of the later bisect results that got mischaracterized. > > > > But you can be equally unlucky, and if it's one of the earliers, then it > > can easily be a few thousand commits of. Looking at the log it's mostly > > bad, with a few good sprinkled in, which could just be reproduction > > failures. So might very well be that the very first "good" result is > > wrong. And that very first "good" decision cuts away a big pile of bpf > > related commits. The next "good" decision then only cuts away a pile of > > drm commits, but at that point you're already off the rails most likely. > > > > I'd say re-test on f90d64483ebd394958841f67f8794ab203b319a7 a few times, > > I'm willing to bet that one is actually bad. > > btw if this theory is right, we have a 1-in-4 chance of a spurious "good" > with your test. If you get 10 repeated "good" then that should be good > enough to make playing the lottery a better endeavor :-) Yes, unfortunately. We could do more tests, but if bug reproduction chances are lower, we still the same lottery. And the more tests we do, the higher chances that we hit and get distracted by unrelated kernel bugs. When syzbot started bisecting bugs, I analyzed 120 bisections for correct/not correct and some classification of root causes: https://groups.google.com/forum/#!msg/syzkaller/sR8aAXaWEF4/tTWYRgvmAwAJ https://docs.google.com/spreadsheets/d/1WdBAN54-csaZpD3LgmTcIMR7NDFuQoOZZqPZ-CUqQgA/edit#gid=348315157 https://docs.google.com/spreadsheets/d/1WdBAN54-csaZpD3LgmTcIMR7NDFuQoOZZqPZ-CUqQgA/edit#gid=0 Hard to trigger bugs are a problem, but unrelated kernel bugs is even bigger problem... > -Daniel > > > > > > Cheers, Daniel > > > > > > > > > > bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=1467550f200000 > > > > > final crash: https://syzkaller.appspot.com/x/report.txt?x=1667550f200000 > > > > > console output: https://syzkaller.appspot.com/x/log.txt?x=1267550f200000 > > > > > > > > > > IMPORTANT: if you fix the bug, please add the following tag to the commit: > > > > > Reported-by: syzbot+2ff1e7cb738fd3c41113@syzkaller.appspotmail.com > > > > > Fixes: 0fff724a3391 ("drm/sun4i: backend: Use explicit fourcc helpers for > > > > > packed YUV422 check") > > > > > > > > > > WARNING: CPU: 0 PID: 8951 at kernel/bpf/core.c:851 bpf_jit_free+0x157/0x1b0 > > > > > Kernel panic - not syncing: panic_on_warn set ... > > > > > CPU: 0 PID: 8951 Comm: kworker/0:0 Not tainted 5.2.0-rc3+ #23 > > > > > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS > > > > > Google 01/01/2011 > > > > > Workqueue: events bpf_prog_free_deferred > > > > > Call Trace: > > > > > __dump_stack lib/dump_stack.c:77 [inline] > > > > > dump_stack+0x172/0x1f0 lib/dump_stack.c:113 > > > > > panic+0x2cb/0x744 kernel/panic.c:219 > > > > > __warn.cold+0x20/0x4d kernel/panic.c:576 > > > > > report_bug+0x263/0x2b0 lib/bug.c:186 > > > > > fixup_bug arch/x86/kernel/traps.c:179 [inline] > > > > > fixup_bug arch/x86/kernel/traps.c:174 [inline] > > > > > do_error_trap+0x11b/0x200 arch/x86/kernel/traps.c:272 > > > > > do_invalid_op+0x37/0x50 arch/x86/kernel/traps.c:291 > > > > > invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:986 > > > > > RIP: 0010:bpf_jit_free+0x157/0x1b0 > > > > > Code: 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 75 5d 48 b8 00 02 00 00 > > > > > 00 00 ad de 48 39 43 70 0f 84 05 ff ff ff e8 f9 b5 f4 ff <0f> 0b e9 f9 fe ff > > > > > ff e8 bd 53 2d 00 e9 d9 fe ff ff 48 89 7d e0 e8 > > > > > RSP: 0018:ffff88808886fcb0 EFLAGS: 00010293 > > > > > RAX: ffff88808cb6c480 RBX: ffff88809051d280 RCX: ffffffff817ae68d > > > > > RDX: 00000000> > > > > > > > > > -- > > > > Daniel Vetter > > > > Software Engineer, Intel Corporation > > > > http://blog.ffwll.ch > > > > > > > > -- > > > > You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group. > > > > To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bugs+unsubscribe@googlegroups.com. > > > > To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/20190611080431.GP21222%40phenom.ffwll.local. > > > > For more options, visit https://groups.google.com/d/optout.00000000 RSI: ffffffff817bf0f7 RDI: ffff88809051d2f0 > > > > > RBP: ffff88808886fcd0 R08: 1ffffffff14ccaa8 R09: fffffbfff14ccaa9 > > > > > R10: fffffbfff14ccaa8 R11: ffffffff8a665547 R12: ffffc90001925000 > > > > > R13: ffff88809051d2e8 R14: ffff8880a0e43900 R15: ffff8880ae834840 > > > > > bpf_prog_free_deferred+0x27a/0x350 kernel/bpf/core.c:1984 > > > > > process_one_work+0x989/0x1790 kernel/workqueue.c:2269 > > > > > worker_thread+0x98/0xe40 kernel/workqueue.c:2415 > > > > > kthread+0x354/0x420 kernel/kthread.c:255 > > > > > ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352 > > > > > Kernel Offset: disabled > > > > > Rebooting in 86400 seconds.. > > > > -- > > Daniel Vetter > > Software Engineer, Intel Corporation > > http://blog.ffwll.ch > > -- > Daniel Vetter > Software Engineer, Intel Corporation > http://blog.ffwll.ch _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel ^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2019-06-11 9:08 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
[not found] <000000000000e92d1805711f5552@google.com>
2019-03-31 18:20 ` WARNING in bpf_jit_free syzbot
2019-06-08 11:22 ` syzbot
2019-06-11 8:04 ` Daniel Vetter
2019-06-11 8:33 ` Dmitry Vyukov
2019-06-11 8:51 ` Daniel Vetter
2019-06-11 9:01 ` Daniel Vetter
2019-06-11 9:08 ` Dmitry Vyukov
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).