* [syzbot] WARNING: refcount bug in sk_psock_get @ 2021-04-09 15:39 syzbot 2021-04-09 19:44 ` John Fastabend 0 siblings, 1 reply; 3+ messages in thread From: syzbot @ 2021-04-09 15:39 UTC (permalink / raw) To: akpm, andrii, ast, borisp, bp, bpf, daniel, davem, hpa, jmattson, john.fastabend, joro, kafai, kpsingh, kuba, kvm, linux-kernel, mark.rutland, masahiroy, mingo, netdev, pbonzini, peterz, rafael.j.wysocki, rostedt, seanjc, songliubraving, syzkaller-bugs, tglx, vkuznets, wanpengli, will, x86, yhs Hello, syzbot found the following issue on: HEAD commit: 9c54130c Add linux-next specific files for 20210406 git tree: linux-next console output: https://syzkaller.appspot.com/x/log.txt?x=17d8d7aad00000 kernel config: https://syzkaller.appspot.com/x/.config?x=d125958c3995ddcd dashboard link: https://syzkaller.appspot.com/bug?extid=b54a1ce86ba4a623b7f0 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1729797ed00000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1190f46ad00000 The issue was bisected to: commit 997acaf6b4b59c6a9c259740312a69ea549cc684 Author: Mark Rutland <mark.rutland@arm.com> Date: Mon Jan 11 15:37:07 2021 +0000 lockdep: report broken irq restoration bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=11a6cc96d00000 final oops: https://syzkaller.appspot.com/x/report.txt?x=13a6cc96d00000 console output: https://syzkaller.appspot.com/x/log.txt?x=15a6cc96d00000 IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+b54a1ce86ba4a623b7f0@syzkaller.appspotmail.com Fixes: 997acaf6b4b5 ("lockdep: report broken irq restoration") ------------[ cut here ]------------ refcount_t: saturated; leaking memory. WARNING: CPU: 1 PID: 8414 at lib/refcount.c:19 refcount_warn_saturate+0xf4/0x1e0 lib/refcount.c:19 Modules linked in: CPU: 1 PID: 8414 Comm: syz-executor793 Not tainted 5.12.0-rc6-next-20210406-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:refcount_warn_saturate+0xf4/0x1e0 lib/refcount.c:19 Code: 1d 69 0c e6 09 31 ff 89 de e8 c8 b4 a6 fd 84 db 75 ab e8 0f ae a6 fd 48 c7 c7 e0 52 c2 89 c6 05 49 0c e6 09 01 e8 91 0f 00 05 <0f> 0b eb 8f e8 f3 ad a6 fd 0f b6 1d 33 0c e6 09 31 ff 89 de e8 93 RSP: 0018:ffffc90000eef388 EFLAGS: 00010282 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: ffff88801bbdd580 RSI: ffffffff815c2e05 RDI: fffff520001dde63 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: ffffffff815bcc6e R11: 0000000000000000 R12: 1ffff920001dde74 R13: 0000000090200301 R14: ffff888026e00000 R15: ffffc90000eef3c0 FS: 0000000001422300(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020000000 CR3: 0000000012b3b000 CR4: 00000000001506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __refcount_add_not_zero include/linux/refcount.h:163 [inline] __refcount_inc_not_zero include/linux/refcount.h:227 [inline] refcount_inc_not_zero include/linux/refcount.h:245 [inline] sk_psock_get+0x3b0/0x400 include/linux/skmsg.h:435 bpf_exec_tx_verdict+0x11e/0x11a0 net/tls/tls_sw.c:799 tls_sw_sendmsg+0xa41/0x1800 net/tls/tls_sw.c:1013 inet_sendmsg+0x99/0xe0 net/ipv4/af_inet.c:821 sock_sendmsg_nosec net/socket.c:654 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:674 sock_write_iter+0x289/0x3c0 net/socket.c:1001 call_write_iter include/linux/fs.h:2106 [inline] do_iter_readv_writev+0x46f/0x740 fs/read_write.c:740 do_iter_write+0x188/0x670 fs/read_write.c:866 vfs_writev+0x1aa/0x630 fs/read_write.c:939 do_writev+0x27f/0x300 fs/read_write.c:982 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x43efa9 Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffe9279f418 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 RAX: ffffffffffffffda RBX: 0000000000400488 RCX: 000000000043efa9 RDX: 0000000000000001 RSI: 0000000020000100 RDI: 0000000000000003 RBP: 0000000000402f90 R08: 0000000000400488 R09: 0000000000400488 R10: 0000000000000038 R11: 0000000000000246 R12: 0000000000403020 R13: 0000000000000000 R14: 00000000004ac018 R15: 0000000000400488 --- This report is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller@googlegroups.com. syzbot will keep track of this issue. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot. For information about bisection process see: https://goo.gl/tpsmEJ#bisection syzbot can test patches for this issue, for details see: https://goo.gl/tpsmEJ#testing-patches ^ permalink raw reply [flat|nested] 3+ messages in thread
* RE: [syzbot] WARNING: refcount bug in sk_psock_get 2021-04-09 15:39 [syzbot] WARNING: refcount bug in sk_psock_get syzbot @ 2021-04-09 19:44 ` John Fastabend 2021-04-10 16:41 ` Cong Wang 0 siblings, 1 reply; 3+ messages in thread From: John Fastabend @ 2021-04-09 19:44 UTC (permalink / raw) To: syzbot, akpm, andrii, ast, borisp, bp, bpf, daniel, davem, hpa, jmattson, john.fastabend, joro, kafai, kpsingh, kuba, kvm, linux-kernel, mark.rutland, masahiroy, mingo, netdev, pbonzini, peterz, rafael.j.wysocki, rostedt, seanjc, songliubraving, syzkaller-bugs, tglx, vkuznets, wanpengli, will, x86, yhs syzbot wrote: > Hello, > > syzbot found the following issue on: > > HEAD commit: 9c54130c Add linux-next specific files for 20210406 > git tree: linux-next > console output: https://syzkaller.appspot.com/x/log.txt?x=17d8d7aad00000 > kernel config: https://syzkaller.appspot.com/x/.config?x=d125958c3995ddcd > dashboard link: https://syzkaller.appspot.com/bug?extid=b54a1ce86ba4a623b7f0 > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1729797ed00000 > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1190f46ad00000 > > The issue was bisected to: > > commit 997acaf6b4b59c6a9c259740312a69ea549cc684 > Author: Mark Rutland <mark.rutland@arm.com> > Date: Mon Jan 11 15:37:07 2021 +0000 > > lockdep: report broken irq restoration > > bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=11a6cc96d00000 > final oops: https://syzkaller.appspot.com/x/report.txt?x=13a6cc96d00000 > console output: https://syzkaller.appspot.com/x/log.txt?x=15a6cc96d00000 > > IMPORTANT: if you fix the issue, please add the following tag to the commit: > Reported-by: syzbot+b54a1ce86ba4a623b7f0@syzkaller.appspotmail.com > Fixes: 997acaf6b4b5 ("lockdep: report broken irq restoration") > > ------------[ cut here ]------------ > refcount_t: saturated; leaking memory. > WARNING: CPU: 1 PID: 8414 at lib/refcount.c:19 refcount_warn_saturate+0xf4/0x1e0 lib/refcount.c:19 > Modules linked in: > CPU: 1 PID: 8414 Comm: syz-executor793 Not tainted 5.12.0-rc6-next-20210406-syzkaller #0 > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 > RIP: 0010:refcount_warn_saturate+0xf4/0x1e0 lib/refcount.c:19 > Code: 1d 69 0c e6 09 31 ff 89 de e8 c8 b4 a6 fd 84 db 75 ab e8 0f ae a6 fd 48 c7 c7 e0 52 c2 89 c6 05 49 0c e6 09 01 e8 91 0f 00 05 <0f> 0b eb 8f e8 f3 ad a6 fd 0f b6 1d 33 0c e6 09 31 ff 89 de e8 93 > RSP: 0018:ffffc90000eef388 EFLAGS: 00010282 > RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 > RDX: ffff88801bbdd580 RSI: ffffffff815c2e05 RDI: fffff520001dde63 > RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 > R10: ffffffff815bcc6e R11: 0000000000000000 R12: 1ffff920001dde74 > R13: 0000000090200301 R14: ffff888026e00000 R15: ffffc90000eef3c0 > FS: 0000000001422300(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: 0000000020000000 CR3: 0000000012b3b000 CR4: 00000000001506e0 > DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 > DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 > Call Trace: > __refcount_add_not_zero include/linux/refcount.h:163 [inline] > __refcount_inc_not_zero include/linux/refcount.h:227 [inline] > refcount_inc_not_zero include/linux/refcount.h:245 [inline] > sk_psock_get+0x3b0/0x400 include/linux/skmsg.h:435 > bpf_exec_tx_verdict+0x11e/0x11a0 net/tls/tls_sw.c:799 > tls_sw_sendmsg+0xa41/0x1800 net/tls/tls_sw.c:1013 > inet_sendmsg+0x99/0xe0 net/ipv4/af_inet.c:821 [...] This is likely a problem with latest round of sockmap patches I'll tke a look. ^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [syzbot] WARNING: refcount bug in sk_psock_get 2021-04-09 19:44 ` John Fastabend @ 2021-04-10 16:41 ` Cong Wang 0 siblings, 0 replies; 3+ messages in thread From: Cong Wang @ 2021-04-10 16:41 UTC (permalink / raw) To: John Fastabend Cc: syzbot, Andrew Morton, Andrii Nakryiko, Alexei Starovoitov, borisp, Borislav Petkov, bpf, Daniel Borkmann, David Miller, H. Peter Anvin, jmattson, Joerg Roedel, Martin KaFai Lau, kpsingh, Jakub Kicinski, kvm@vger.kernel.org list, LKML, Mark Rutland, masahiroy, Ingo Molnar, Linux Kernel Network Developers, pbonzini, Peter Zijlstra, Rafael J. Wysocki, Steven Rostedt, seanjc, Song Liu, syzkaller-bugs, Thomas Gleixner, vkuznets, wanpengli, Will Deacon, x86, Yonghong Song On Fri, Apr 9, 2021 at 12:45 PM John Fastabend <john.fastabend@gmail.com> wrote: > > syzbot wrote: > > Hello, > > > > syzbot found the following issue on: > > > > HEAD commit: 9c54130c Add linux-next specific files for 20210406 > > git tree: linux-next > > console output: https://syzkaller.appspot.com/x/log.txt?x=17d8d7aad00000 > > kernel config: https://syzkaller.appspot.com/x/.config?x=d125958c3995ddcd > > dashboard link: https://syzkaller.appspot.com/bug?extid=b54a1ce86ba4a623b7f0 > > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1729797ed00000 > > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1190f46ad00000 > > > > The issue was bisected to: > > > > commit 997acaf6b4b59c6a9c259740312a69ea549cc684 > > Author: Mark Rutland <mark.rutland@arm.com> > > Date: Mon Jan 11 15:37:07 2021 +0000 > > > > lockdep: report broken irq restoration > > > > bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=11a6cc96d00000 > > final oops: https://syzkaller.appspot.com/x/report.txt?x=13a6cc96d00000 > > console output: https://syzkaller.appspot.com/x/log.txt?x=15a6cc96d00000 > > > > IMPORTANT: if you fix the issue, please add the following tag to the commit: > > Reported-by: syzbot+b54a1ce86ba4a623b7f0@syzkaller.appspotmail.com > > Fixes: 997acaf6b4b5 ("lockdep: report broken irq restoration") > > > > ------------[ cut here ]------------ > > refcount_t: saturated; leaking memory. > > WARNING: CPU: 1 PID: 8414 at lib/refcount.c:19 refcount_warn_saturate+0xf4/0x1e0 lib/refcount.c:19 > > Modules linked in: > > CPU: 1 PID: 8414 Comm: syz-executor793 Not tainted 5.12.0-rc6-next-20210406-syzkaller #0 > > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 > > RIP: 0010:refcount_warn_saturate+0xf4/0x1e0 lib/refcount.c:19 > > Code: 1d 69 0c e6 09 31 ff 89 de e8 c8 b4 a6 fd 84 db 75 ab e8 0f ae a6 fd 48 c7 c7 e0 52 c2 89 c6 05 49 0c e6 09 01 e8 91 0f 00 05 <0f> 0b eb 8f e8 f3 ad a6 fd 0f b6 1d 33 0c e6 09 31 ff 89 de e8 93 > > RSP: 0018:ffffc90000eef388 EFLAGS: 00010282 > > RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 > > RDX: ffff88801bbdd580 RSI: ffffffff815c2e05 RDI: fffff520001dde63 > > RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 > > R10: ffffffff815bcc6e R11: 0000000000000000 R12: 1ffff920001dde74 > > R13: 0000000090200301 R14: ffff888026e00000 R15: ffffc90000eef3c0 > > FS: 0000000001422300(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000 > > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > > CR2: 0000000020000000 CR3: 0000000012b3b000 CR4: 00000000001506e0 > > DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 > > DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 > > Call Trace: > > __refcount_add_not_zero include/linux/refcount.h:163 [inline] > > __refcount_inc_not_zero include/linux/refcount.h:227 [inline] > > refcount_inc_not_zero include/linux/refcount.h:245 [inline] > > sk_psock_get+0x3b0/0x400 include/linux/skmsg.h:435 > > bpf_exec_tx_verdict+0x11e/0x11a0 net/tls/tls_sw.c:799 > > tls_sw_sendmsg+0xa41/0x1800 net/tls/tls_sw.c:1013 > > inet_sendmsg+0x99/0xe0 net/ipv4/af_inet.c:821 > > [...] > > This is likely a problem with latest round of sockmap patches I'll > tke a look. I bet this has nothing to do with my sockmap patches, as clearly the reproducer does not even have any BPF thing. And actually the reproducer creates an SMC socket, which coincidentally uses sk_user_data too, therefore triggers this bug. I think we should just prohibit TCP_ULP on SMC socket, something like this: diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c index 47340b3b514f..0d4d6d28f20c 100644 --- a/net/smc/af_smc.c +++ b/net/smc/af_smc.c @@ -2162,6 +2162,9 @@ static int smc_setsockopt(struct socket *sock, int level, int optname, struct smc_sock *smc; int val, rc; + if (optname == TCP_ULP) + return -EOPNOTSUPP; + smc = smc_sk(sk); /* generic setsockopts reaching us here always apply to the @@ -2186,7 +2189,6 @@ static int smc_setsockopt(struct socket *sock, int level, int optname, if (rc || smc->use_fallback) goto out; switch (optname) { - case TCP_ULP: case TCP_FASTOPEN: case TCP_FASTOPEN_CONNECT: case TCP_FASTOPEN_KEY: ^ permalink raw reply related [flat|nested] 3+ messages in thread
end of thread, other threads:[~2021-04-10 16:42 UTC | newest] Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2021-04-09 15:39 [syzbot] WARNING: refcount bug in sk_psock_get syzbot 2021-04-09 19:44 ` John Fastabend 2021-04-10 16:41 ` Cong Wang
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).