From: Vegard Nossum <vegard.nossum@gmail.com>
To: Dmitry Vyukov <dvyukov@google.com>
Cc: syzbot <syzbot+5f326d255ca648131f87@syzkaller.appspotmail.com>,
"Andrew Morton" <akpm@linux-foundation.org>,
andrii@kernel.org, "Alexei Starovoitov" <ast@kernel.org>,
"Björn Töpel" <bjorn.topel@intel.com>,
"Borislav Petkov" <bp@alien8.de>, bpf <bpf@vger.kernel.org>,
"Daniel Borkmann" <daniel@iogearbox.net>,
"Dave Hansen" <dave.hansen@linux.intel.com>,
"David Miller" <davem@davemloft.net>,
"Jesper Dangaard Brouer" <hawk@kernel.org>,
"H. Peter Anvin" <hpa@zytor.com>,
"John Fastabend" <john.fastabend@gmail.com>,
jonathan.lemon@gmail.com, "Martin KaFai Lau" <kafai@fb.com>,
"KP Singh" <kpsingh@chromium.org>,
"Jakub Kicinski" <kuba@kernel.org>,
LKML <linux-kernel@vger.kernel.org>,
Linux-MM <linux-mm@kvack.org>,
"Andy Lutomirski" <luto@kernel.org>,
"Karlsson, Magnus" <magnus.karlsson@intel.com>,
marekx.majtyka@intel.com, "Ingo Molnar" <mingo@kernel.org>,
"Ingo Molnar" <mingo@redhat.com>, netdev <netdev@vger.kernel.org>,
"Peter Zijlstra" <peterz@infradead.org>,
"Song Liu" <songliubraving@fb.com>,
syzkaller-bugs <syzkaller-bugs@googlegroups.com>,
"Thomas Gleixner" <tglx@linutronix.de>,
"the arch/x86 maintainers" <x86@kernel.org>,
"Yonghong Song" <yhs@fb.com>
Subject: Re: kernel BUG at mm/vmalloc.c:LINE! (2)
Date: Mon, 24 Jan 2022 18:59:43 +0100 [thread overview]
Message-ID: <CAOMGZ=Eyfq4+H_7Uray9jXceTDAugm5bRorGoHZUf2W314Kr+w@mail.gmail.com> (raw)
In-Reply-To: <CACT4Y+a3Xe11dAkRAAewXQ7b=KzK1pk36Arwq=vCR7R-KQy9DQ@mail.gmail.com>
On Mon, 11 Jan 2021 at 10:16, Dmitry Vyukov <dvyukov@google.com> wrote:
>
> On Sun, Jan 10, 2021 at 10:34 PM syzbot
> <syzbot+5f326d255ca648131f87@syzkaller.appspotmail.com> wrote:
> >
> > syzbot suspects this issue was fixed by commit:
> >
> > commit 537cf4e3cc2f6cc9088dcd6162de573f603adc29
> > Author: Magnus Karlsson <magnus.karlsson@intel.com>
> > Date: Fri Nov 20 11:53:39 2020 +0000
> >
> > xsk: Fix umem cleanup bug at socket destruct
> >
> > bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=139f3dfb500000
> > start commit: e87d24fc Merge branch 'net-iucv-fixes-2020-11-09'
> > git tree: net
> > kernel config: https://syzkaller.appspot.com/x/.config?x=61033507391c77ff
> > dashboard link: https://syzkaller.appspot.com/bug?extid=5f326d255ca648131f87
> > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=10d10006500000
> > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=126c9eaa500000
> >
> > If the result looks correct, please mark the issue as fixed by replying with:
> >
> > #syz fix: xsk: Fix umem cleanup bug at socket destruct
> >
> > For information about bisection process see: https://goo.gl/tpsmEJ#bisection
>
> FTR, the bisection log looks clean, but this does not look like the
> fix for this. The reproducer does not destroy sockets.
I think it's the correct fix.
The crash report also has this, which shows the reproducer does
actually destroy sockets:
xdp_umem_addr_unmap net/xdp/xdp_umem.c:44 [inline]
xdp_umem_release net/xdp/xdp_umem.c:62 [inline]
xdp_put_umem+0x113/0x330 net/xdp/xdp_umem.c:80
xsk_destruct net/xdp/xsk.c:1150 [inline]
xsk_destruct+0xc0/0xf0 net/xdp/xsk.c:1142
__sk_destruct+0x4b/0x8f0 net/core/sock.c:1759
rcu_do_batch kernel/rcu/tree.c:2476 [inline]
I've tested the reproducer on both 537cf4e3cc2f and 537cf4e3cc2f^ and
it only reproduces on 537cf4e3cc2f^ here (with the same stack trace as
the syzbot report).
The repro I used was
https://syzkaller.appspot.com/text?tag=ReproSyz&x=10d10006500000 which
is just:
r0 = socket$xdp(0x2c, 0x3, 0x0)
setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4,
&(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x1000000, 0x1000}, 0x20)
so the socket definitely gets created/destroyed.
Feel free to undo if you disagree:
#syz fix: xsk: Fix umem cleanup bug at socket destruct
Vegard
prev parent reply other threads:[~2022-01-24 18:00 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-07-10 12:24 kernel BUG at mm/vmalloc.c:LINE! (2) syzbot
2020-07-20 16:48 ` syzbot
2020-07-20 20:06 ` Uladzislau Rezki
2020-07-22 14:28 ` Qian Cai
2020-07-22 14:46 ` Uladzislau Rezki
2020-07-24 2:50 ` Andrew Morton
2020-07-24 3:11 ` Stephen Rothwell
2020-07-24 4:28 ` Stephen Rothwell
2020-07-24 7:47 ` Thomas Gleixner
2020-07-22 6:17 ` syzbot
2021-01-10 21:34 ` syzbot
2021-01-11 9:15 ` Dmitry Vyukov
2022-01-24 17:59 ` Vegard Nossum [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAOMGZ=Eyfq4+H_7Uray9jXceTDAugm5bRorGoHZUf2W314Kr+w@mail.gmail.com' \
--to=vegard.nossum@gmail.com \
--cc=akpm@linux-foundation.org \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bjorn.topel@intel.com \
--cc=bp@alien8.de \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=dave.hansen@linux.intel.com \
--cc=davem@davemloft.net \
--cc=dvyukov@google.com \
--cc=hawk@kernel.org \
--cc=hpa@zytor.com \
--cc=john.fastabend@gmail.com \
--cc=jonathan.lemon@gmail.com \
--cc=kafai@fb.com \
--cc=kpsingh@chromium.org \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=luto@kernel.org \
--cc=magnus.karlsson@intel.com \
--cc=marekx.majtyka@intel.com \
--cc=mingo@kernel.org \
--cc=mingo@redhat.com \
--cc=netdev@vger.kernel.org \
--cc=peterz@infradead.org \
--cc=songliubraving@fb.com \
--cc=syzbot+5f326d255ca648131f87@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
--cc=tglx@linutronix.de \
--cc=x86@kernel.org \
--cc=yhs@fb.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).