From: Eric Dumazet <edumazet@google.com>
To: Marco Elver <elver@google.com>
Cc: netdev <netdev@vger.kernel.org>,
Andrew Morton <akpm@linux-foundation.org>,
David Miller <davem@davemloft.net>,
Dmitry Vyukov <dvyukov@google.com>,
Alexander Potapenko <glider@google.com>,
Jann Horn <jannh@google.com>, Jakub Kicinski <kuba@kernel.org>,
LKML <linux-kernel@vger.kernel.org>,
Stephen Rothwell <sfr@canb.auug.org.au>,
syzkaller-bugs <syzkaller-bugs@googlegroups.com>,
Willem de Bruijn <willemb@google.com>,
syzbot <syzbot+7b99aafdcc2eedea6178@syzkaller.appspotmail.com>
Subject: Re: WARNING in sk_stream_kill_queues (5)
Date: Thu, 3 Dec 2020 17:42:54 +0100 [thread overview]
Message-ID: <CANn89iKWf1EVZUuAHup+5ndhxvOqGopq53=vZ9yeok=DnRjggg@mail.gmail.com> (raw)
In-Reply-To: <CANpmjNOaWbGJQ5Y=qC3cA31-R-Jy4Fbe+p=OBG5O2Amz8dLtLA@mail.gmail.com>
On Thu, Dec 3, 2020 at 5:34 PM Marco Elver <elver@google.com> wrote:
>
> On Thu, 3 Dec 2020 at 17:27, Eric Dumazet <edumazet@google.com> wrote:
> > On Thu, Dec 3, 2020 at 4:58 PM Marco Elver <elver@google.com> wrote:
> > >
> > > On Mon, Nov 30, 2020 at 12:40AM -0800, syzbot wrote:
> > > > Hello,
> > > >
> > > > syzbot found the following issue on:
> > > >
> > > > HEAD commit: 6147c83f Add linux-next specific files for 20201126
> > > > git tree: linux-next
> > > > console output: https://syzkaller.appspot.com/x/log.txt?x=117c9679500000
> > > > kernel config: https://syzkaller.appspot.com/x/.config?x=9b91566da897c24f
> > > > dashboard link: https://syzkaller.appspot.com/bug?extid=7b99aafdcc2eedea6178
> > > > compiler: gcc (GCC) 10.1.0-syz 20200507
> > > > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=103bf743500000
> > > > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=167c60c9500000
> > > >
> > > > The issue was bisected to:
> > > >
> > > > commit 145cd60fb481328faafba76842aa0fd242e2b163
> > > > Author: Alexander Potapenko <glider@google.com>
> > > > Date: Tue Nov 24 05:38:44 2020 +0000
> > > >
> > > > mm, kfence: insert KFENCE hooks for SLUB
> > > >
> > > > bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=13abe5b3500000
> > > > final oops: https://syzkaller.appspot.com/x/report.txt?x=106be5b3500000
> > > > console output: https://syzkaller.appspot.com/x/log.txt?x=17abe5b3500000
> > > >
> > > > IMPORTANT: if you fix the issue, please add the following tag to the commit:
> > > > Reported-by: syzbot+7b99aafdcc2eedea6178@syzkaller.appspotmail.com
> > > > Fixes: 145cd60fb481 ("mm, kfence: insert KFENCE hooks for SLUB")
> > > >
> > > > ------------[ cut here ]------------
> > > > WARNING: CPU: 0 PID: 11307 at net/core/stream.c:207 sk_stream_kill_queues+0x3c3/0x530 net/core/stream.c:207
> > > [...]
> > > > Call Trace:
> > > > inet_csk_destroy_sock+0x1a5/0x490 net/ipv4/inet_connection_sock.c:885
> > > > __tcp_close+0xd3e/0x1170 net/ipv4/tcp.c:2585
> > > > tcp_close+0x29/0xc0 net/ipv4/tcp.c:2597
> > > > inet_release+0x12e/0x280 net/ipv4/af_inet.c:431
> > > > __sock_release+0xcd/0x280 net/socket.c:596
> > > > sock_close+0x18/0x20 net/socket.c:1255
> > > > __fput+0x283/0x920 fs/file_table.c:280
> > > > task_work_run+0xdd/0x190 kernel/task_work.c:140
> > > > exit_task_work include/linux/task_work.h:30 [inline]
> > > > do_exit+0xb89/0x29e0 kernel/exit.c:823
> > > > do_group_exit+0x125/0x310 kernel/exit.c:920
> > > > get_signal+0x3ec/0x2010 kernel/signal.c:2770
> > > > arch_do_signal_or_restart+0x2a8/0x1eb0 arch/x86/kernel/signal.c:811
> > > > handle_signal_work kernel/entry/common.c:144 [inline]
> > > > exit_to_user_mode_loop kernel/entry/common.c:168 [inline]
> > > > exit_to_user_mode_prepare+0x124/0x200 kernel/entry/common.c:198
> > > > syscall_exit_to_user_mode+0x36/0x260 kernel/entry/common.c:275
> > > > entry_SYSCALL_64_after_hwframe+0x44/0xa9
> > >
> > > I've been debugging this and I think enabling KFENCE uncovered that some
> > > code is assuming that the following is always true:
> > >
> > > ksize(kmalloc(S)) == ksize(kmalloc(S))
> > >
> >
> >
> > I do not think we make this assumption.
> >
> > Each skb tracks the 'truesize' which is populated from __alloc_skb()
> > using ksize(allocated head) .
> >
> > So if ksize() decides to give us random data, it should be still fine,
> > because we use ksize(buff) only once at alloc skb time, and record the
> > value in skb->truesize
> > (only the socket buffer accounting would be off)
>
> Good, thanks for clarifying. So something else must be off then.
Actually we might have the following assumption :
buff = kmalloc(size, GFP...)
if (buff)
ASSERT(ksize(buff) >= size)
So obviously ksize() should not be completely random ;)
next prev parent reply other threads:[~2020-12-03 16:43 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-11-30 8:40 WARNING in sk_stream_kill_queues (5) syzbot
2020-12-03 15:58 ` Marco Elver
2020-12-03 16:27 ` Eric Dumazet
2020-12-03 16:34 ` Marco Elver
2020-12-03 16:42 ` Eric Dumazet [this message]
2020-12-03 17:41 ` Marco Elver
2020-12-03 18:01 ` Eric Dumazet
2020-12-07 15:30 ` Marco Elver
2020-12-07 16:28 ` Marco Elver
2020-12-08 19:06 ` Marco Elver
2020-12-09 12:47 ` Marco Elver
2020-12-10 16:51 ` Marco Elver
2020-12-10 17:14 ` Eric Dumazet
2020-12-10 19:01 ` Marco Elver
2020-12-14 10:09 ` Marco Elver
2020-12-14 10:47 ` Eric Dumazet
2021-01-11 8:55 ` Marco Elver
2021-02-03 10:25 ` Marco Elver
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CANn89iKWf1EVZUuAHup+5ndhxvOqGopq53=vZ9yeok=DnRjggg@mail.gmail.com' \
--to=edumazet@google.com \
--cc=akpm@linux-foundation.org \
--cc=davem@davemloft.net \
--cc=dvyukov@google.com \
--cc=elver@google.com \
--cc=glider@google.com \
--cc=jannh@google.com \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=sfr@canb.auug.org.au \
--cc=syzbot+7b99aafdcc2eedea6178@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
--cc=willemb@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).