* Re: kernel BUG at mm/vmalloc.c:LINE! (2)
[not found] <000000000000588c2c05aa156b2b@google.com>
@ 2021-01-10 21:34 ` syzbot
2021-01-11 9:15 ` Dmitry Vyukov
0 siblings, 1 reply; 3+ messages in thread
From: syzbot @ 2021-01-10 21:34 UTC (permalink / raw)
To: akpm, andrii, ast, bjorn.topel, bp, bpf, daniel, dave.hansen,
davem, hawk, hpa, john.fastabend, jonathan.lemon, kafai, kpsingh,
kuba, linux-kernel, linux-mm, luto, magnus.karlsson,
marekx.majtyka, mingo, mingo, netdev, peterz, songliubraving,
syzkaller-bugs, tglx, x86, yhs
syzbot suspects this issue was fixed by commit:
commit 537cf4e3cc2f6cc9088dcd6162de573f603adc29
Author: Magnus Karlsson <magnus.karlsson@intel.com>
Date: Fri Nov 20 11:53:39 2020 +0000
xsk: Fix umem cleanup bug at socket destruct
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=139f3dfb500000
start commit: e87d24fc Merge branch 'net-iucv-fixes-2020-11-09'
git tree: net
kernel config: https://syzkaller.appspot.com/x/.config?x=61033507391c77ff
dashboard link: https://syzkaller.appspot.com/bug?extid=5f326d255ca648131f87
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=10d10006500000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=126c9eaa500000
If the result looks correct, please mark the issue as fixed by replying with:
#syz fix: xsk: Fix umem cleanup bug at socket destruct
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: kernel BUG at mm/vmalloc.c:LINE! (2)
2021-01-10 21:34 ` kernel BUG at mm/vmalloc.c:LINE! (2) syzbot
@ 2021-01-11 9:15 ` Dmitry Vyukov
2022-01-24 17:59 ` Vegard Nossum
0 siblings, 1 reply; 3+ messages in thread
From: Dmitry Vyukov @ 2021-01-11 9:15 UTC (permalink / raw)
To: syzbot
Cc: Andrew Morton, andrii, Alexei Starovoitov, Björn Töpel,
Borislav Petkov, bpf, Daniel Borkmann, Dave Hansen, David Miller,
Jesper Dangaard Brouer, H. Peter Anvin, John Fastabend,
jonathan.lemon, Martin KaFai Lau, KP Singh, Jakub Kicinski, LKML,
Linux-MM, Andy Lutomirski, Karlsson, Magnus, marekx.majtyka,
Ingo Molnar, Ingo Molnar, netdev, Peter Zijlstra, Song Liu,
syzkaller-bugs, Thomas Gleixner, the arch/x86 maintainers,
Yonghong Song
On Sun, Jan 10, 2021 at 10:34 PM syzbot
<syzbot+5f326d255ca648131f87@syzkaller.appspotmail.com> wrote:
>
> syzbot suspects this issue was fixed by commit:
>
> commit 537cf4e3cc2f6cc9088dcd6162de573f603adc29
> Author: Magnus Karlsson <magnus.karlsson@intel.com>
> Date: Fri Nov 20 11:53:39 2020 +0000
>
> xsk: Fix umem cleanup bug at socket destruct
>
> bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=139f3dfb500000
> start commit: e87d24fc Merge branch 'net-iucv-fixes-2020-11-09'
> git tree: net
> kernel config: https://syzkaller.appspot.com/x/.config?x=61033507391c77ff
> dashboard link: https://syzkaller.appspot.com/bug?extid=5f326d255ca648131f87
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=10d10006500000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=126c9eaa500000
>
> If the result looks correct, please mark the issue as fixed by replying with:
>
> #syz fix: xsk: Fix umem cleanup bug at socket destruct
>
> For information about bisection process see: https://goo.gl/tpsmEJ#bisection
FTR, the bisection log looks clean, but this does not look like the
fix for this. The reproducer does not destroy sockets.
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: kernel BUG at mm/vmalloc.c:LINE! (2)
2021-01-11 9:15 ` Dmitry Vyukov
@ 2022-01-24 17:59 ` Vegard Nossum
0 siblings, 0 replies; 3+ messages in thread
From: Vegard Nossum @ 2022-01-24 17:59 UTC (permalink / raw)
To: Dmitry Vyukov
Cc: syzbot, Andrew Morton, andrii, Alexei Starovoitov,
Björn Töpel, Borislav Petkov, bpf, Daniel Borkmann,
Dave Hansen, David Miller, Jesper Dangaard Brouer,
H. Peter Anvin, John Fastabend, jonathan.lemon, Martin KaFai Lau,
KP Singh, Jakub Kicinski, LKML, Linux-MM, Andy Lutomirski,
Karlsson, Magnus, marekx.majtyka, Ingo Molnar, Ingo Molnar,
netdev, Peter Zijlstra, Song Liu, syzkaller-bugs,
Thomas Gleixner, the arch/x86 maintainers, Yonghong Song
On Mon, 11 Jan 2021 at 10:16, Dmitry Vyukov <dvyukov@google.com> wrote:
>
> On Sun, Jan 10, 2021 at 10:34 PM syzbot
> <syzbot+5f326d255ca648131f87@syzkaller.appspotmail.com> wrote:
> >
> > syzbot suspects this issue was fixed by commit:
> >
> > commit 537cf4e3cc2f6cc9088dcd6162de573f603adc29
> > Author: Magnus Karlsson <magnus.karlsson@intel.com>
> > Date: Fri Nov 20 11:53:39 2020 +0000
> >
> > xsk: Fix umem cleanup bug at socket destruct
> >
> > bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=139f3dfb500000
> > start commit: e87d24fc Merge branch 'net-iucv-fixes-2020-11-09'
> > git tree: net
> > kernel config: https://syzkaller.appspot.com/x/.config?x=61033507391c77ff
> > dashboard link: https://syzkaller.appspot.com/bug?extid=5f326d255ca648131f87
> > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=10d10006500000
> > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=126c9eaa500000
> >
> > If the result looks correct, please mark the issue as fixed by replying with:
> >
> > #syz fix: xsk: Fix umem cleanup bug at socket destruct
> >
> > For information about bisection process see: https://goo.gl/tpsmEJ#bisection
>
> FTR, the bisection log looks clean, but this does not look like the
> fix for this. The reproducer does not destroy sockets.
I think it's the correct fix.
The crash report also has this, which shows the reproducer does
actually destroy sockets:
xdp_umem_addr_unmap net/xdp/xdp_umem.c:44 [inline]
xdp_umem_release net/xdp/xdp_umem.c:62 [inline]
xdp_put_umem+0x113/0x330 net/xdp/xdp_umem.c:80
xsk_destruct net/xdp/xsk.c:1150 [inline]
xsk_destruct+0xc0/0xf0 net/xdp/xsk.c:1142
__sk_destruct+0x4b/0x8f0 net/core/sock.c:1759
rcu_do_batch kernel/rcu/tree.c:2476 [inline]
I've tested the reproducer on both 537cf4e3cc2f and 537cf4e3cc2f^ and
it only reproduces on 537cf4e3cc2f^ here (with the same stack trace as
the syzbot report).
The repro I used was
https://syzkaller.appspot.com/text?tag=ReproSyz&x=10d10006500000 which
is just:
r0 = socket$xdp(0x2c, 0x3, 0x0)
setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4,
&(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x1000000, 0x1000}, 0x20)
so the socket definitely gets created/destroyed.
Feel free to undo if you disagree:
#syz fix: xsk: Fix umem cleanup bug at socket destruct
Vegard
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2022-01-24 18:00 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
[not found] <000000000000588c2c05aa156b2b@google.com>
2021-01-10 21:34 ` kernel BUG at mm/vmalloc.c:LINE! (2) syzbot
2021-01-11 9:15 ` Dmitry Vyukov
2022-01-24 17:59 ` Vegard Nossum
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).