| Message ID | tencent_EF4FAF8DF125F00D8D9237DDCC5DE9990307@qq.com (mailing list archive) |
|---|---|
| State | Changes Requested |
| Delegated to: | BPF |
| Headers | show |
| Series | bpf: fix null ptr deref in dev_map_enqueue | expand |
On 31/03/2024 11.08, Edward Adam Davis wrote: > [Syzbot reported] > general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTI > KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] > CPU: 0 PID: 5179 Comm: syz-executor120 Not tainted 6.8.0-syzkaller-05271-gf99c5f563c17 #0 > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024 > RIP: 0010:dev_map_enqueue+0x31/0x3e0 kernel/bpf/devmap.c:539 > Code: 41 56 41 55 41 54 53 48 83 ec 18 49 89 d4 49 89 f5 48 89 fd 49 be 00 00 00 00 00 fc ff df e8 e6 45 d8 ff 48 89 e8 48 c1 e8 03 <42> 80 3c 30 00 74 08 48 89 ef e8 d0 8b 3b 00 4c 8b 7d 00 48 83 c5 > RSP: 0018:ffffc90003b0f688 EFLAGS: 00010246 > RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff888025258000 > RDX: 0000000000000000 RSI: ffff888024035070 RDI: 0000000000000000 > RBP: 0000000000000000 R08: 0000000000000005 R09: ffffffff894ff55e > R10: 0000000000000004 R11: ffff888025258000 R12: ffff8880157d8000 > R13: ffff888024035070 R14: dffffc0000000000 R15: ffff8880b943c088 > FS: 00007fd0098e46c0(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: 00000000200009c0 CR3: 0000000025314000 CR4: 00000000003506f0 > DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 > DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 > Call Trace: > <TASK> > __xdp_do_redirect_frame net/core/filter.c:4384 [inline] > xdp_do_redirect_frame+0x20d/0x4d0 net/core/filter.c:4438 > xdp_test_run_batch net/bpf/test_run.c:336 [inline] > bpf_test_run_xdp_live+0xe8a/0x1e90 net/bpf/test_run.c:384 > bpf_prog_test_run_xdp+0x813/0x11b0 net/bpf/test_run.c:1267 > bpf_prog_test_run+0x33a/0x3b0 kernel/bpf/syscall.c:4240 > __sys_bpf+0x48d/0x810 kernel/bpf/syscall.c:5649 > __do_sys_bpf kernel/bpf/syscall.c:5738 [inline] > __se_sys_bpf kernel/bpf/syscall.c:5736 [inline] > __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:5736 > do_syscall_64+0xfb/0x240 > entry_SYSCALL_64_after_hwframe+0x6d/0x75 > RIP: 0033:0x7fd00992a0d9 > Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 > RSP: 002b:00007fd0098e4238 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 > RAX: ffffffffffffffda RBX: 00007fd0099b43e8 RCX: 00007fd00992a0d9 > RDX: 0000000000000050 RSI: 0000000020000240 RDI: 000000000000000a > RBP: 00007fd0099b43e0 R08: 00007fd0098e46c0 R09: 00007fd0098e46c0 > R10: 00007fd0098e46c0 R11: 0000000000000246 R12: 00007fd009981060 > R13: 0000000000000016 R14: 00007fffcb70c160 R15: 00007fffcb70c248 > </TASK> > [Fix] > On the execution path of bpf_prog_test_run(), due to ri->map being NULL, > ri->tgtvalue was not set correctly. > > Reported-and-tested-by: syzbot+af9492708df9797198d6@syzkaller.appspotmail.com > Signed-off-by: Edward Adam Davis <eadavis@qq.com> > --- > kernel/bpf/devmap.c | 6 +++++- > 1 file changed, 5 insertions(+), 1 deletion(-) > > diff --git a/kernel/bpf/devmap.c b/kernel/bpf/devmap.c > index 4e2cdbb5629f..ef20de14154a 100644 > --- a/kernel/bpf/devmap.c > +++ b/kernel/bpf/devmap.c > @@ -86,6 +86,7 @@ struct bpf_dtab { > static DEFINE_PER_CPU(struct list_head, dev_flush_list); > static DEFINE_SPINLOCK(dev_map_lock); > static LIST_HEAD(dev_map_list); > +static bool is_valid_dst(struct bpf_dtab_netdev *obj, struct xdp_frame *xdpf); > > static struct hlist_head *dev_map_create_hash(unsigned int entries, > int numa_node) > @@ -536,7 +537,10 @@ int dev_xdp_enqueue(struct net_device *dev, struct xdp_frame *xdpf, > int dev_map_enqueue(struct bpf_dtab_netdev *dst, struct xdp_frame *xdpf, > struct net_device *dev_rx) > { > - struct net_device *dev = dst->dev; > + struct net_device *dev; > + if (!is_valid_dst(dst, xdpf)) This is overkill, because __xdp_enqueue() already contains most of the checks in is_valid_dst(). Why not: if (!dst) return -EINVAL; > + return -EINVAL; > + dev = dst->dev; > > return __xdp_enqueue(dev, xdpf, dev_rx, dst->xdp_prog); > } Is this fix pampering over another issue? To repeat myself: I think something is wrong in xdp_test_run_batch(). The `ri->tgt_value` is being set in __bpf_xdp_redirect_map(), but I cannot see __bpf_xdp_redirect_map() being used in xdp_test_run_batch(). Is this a case of XDP program returning XDP_REDIRECT without having called the BPF helper for redirect? --Jesper
On Mon, 1 Apr 2024 13:00:12 +0200, Jesper Dangaard Brouer wrote: > > [Fix] > > On the execution path of bpf_prog_test_run(), due to ri->map being NULL, > > ri->tgtvalue was not set correctly. > > > > Reported-and-tested-by: syzbot+af9492708df9797198d6@syzkaller.appspotmail.com > > Signed-off-by: Edward Adam Davis <eadavis@qq.com> > > --- > > kernel/bpf/devmap.c | 6 +++++- > > 1 file changed, 5 insertions(+), 1 deletion(-) > > > > diff --git a/kernel/bpf/devmap.c b/kernel/bpf/devmap.c > > index 4e2cdbb5629f..ef20de14154a 100644 > > --- a/kernel/bpf/devmap.c > > +++ b/kernel/bpf/devmap.c > > @@ -86,6 +86,7 @@ struct bpf_dtab { > > static DEFINE_PER_CPU(struct list_head, dev_flush_list); > > static DEFINE_SPINLOCK(dev_map_lock); > > static LIST_HEAD(dev_map_list); > > +static bool is_valid_dst(struct bpf_dtab_netdev *obj, struct xdp_frame *xdpf); > > > > static struct hlist_head *dev_map_create_hash(unsigned int entries, > > int numa_node) > > @@ -536,7 +537,10 @@ int dev_xdp_enqueue(struct net_device *dev, struct xdp_frame *xdpf, > > int dev_map_enqueue(struct bpf_dtab_netdev *dst, struct xdp_frame *xdpf, > > struct net_device *dev_rx) > > { > > - struct net_device *dev = dst->dev; > > + struct net_device *dev; > > + if (!is_valid_dst(dst, xdpf)) > > This is overkill, because __xdp_enqueue() already contains most of the > checks in is_valid_dst(). > > Why not: > > if (!dst) > return -EINVAL; This can work, but I think is_valid_dst() is better, as its internal inspection of dst is more thorough. > > > > + return -EINVAL; > > + dev = dst->dev; > > > > return __xdp_enqueue(dev, xdpf, dev_rx, dst->xdp_prog); > > } > > > Is this fix pampering over another issue? > > To repeat myself: > I think something is wrong in xdp_test_run_batch(). > The `ri->tgt_value` is being set in __bpf_xdp_redirect_map(), but I > cannot see __bpf_xdp_redirect_map() being used in xdp_test_run_batch(). As I mentioned earlier, because the value of "ri->map" is NULL, even if it can be executed to __bpf_xdp_redirect_map(), it is meaningless because "ri->map" is used internally to set "ri->tgt_value". > > Is this a case of XDP program returning XDP_REDIRECT without having > called the BPF helper for redirect? Edward
On 02/04/2024 05.03, Edward Adam Davis wrote: > On Mon, 1 Apr 2024 13:00:12 +0200, Jesper Dangaard Brouer wrote: >>> [Fix] >>> On the execution path of bpf_prog_test_run(), due to ri->map being NULL, >>> ri->tgtvalue was not set correctly. >>> >>> Reported-and-tested-by:syzbot+af9492708df9797198d6@syzkaller.appspotmail.com >>> Signed-off-by: Edward Adam Davis<eadavis@qq.com> >>> --- >>> kernel/bpf/devmap.c | 6 +++++- >>> 1 file changed, 5 insertions(+), 1 deletion(-) >>> >>> diff --git a/kernel/bpf/devmap.c b/kernel/bpf/devmap.c >>> index 4e2cdbb5629f..ef20de14154a 100644 >>> --- a/kernel/bpf/devmap.c >>> +++ b/kernel/bpf/devmap.c >>> @@ -86,6 +86,7 @@ struct bpf_dtab { >>> static DEFINE_PER_CPU(struct list_head, dev_flush_list); >>> static DEFINE_SPINLOCK(dev_map_lock); >>> static LIST_HEAD(dev_map_list); >>> +static bool is_valid_dst(struct bpf_dtab_netdev *obj, struct xdp_frame *xdpf); >>> >>> static struct hlist_head *dev_map_create_hash(unsigned int entries, >>> int numa_node) >>> @@ -536,7 +537,10 @@ int dev_xdp_enqueue(struct net_device *dev, struct xdp_frame *xdpf, >>> int dev_map_enqueue(struct bpf_dtab_netdev *dst, struct xdp_frame *xdpf, >>> struct net_device *dev_rx) >>> { >>> - struct net_device *dev = dst->dev; >>> + struct net_device *dev; >>> + if (!is_valid_dst(dst, xdpf)) >> This is overkill, because __xdp_enqueue() already contains most of the >> checks in is_valid_dst(). >> >> Why not: >> >> if (!dst) >> return -EINVAL; > This can work, but I think is_valid_dst() is better, as its internal inspection > of dst is more thorough. No, is_valid_dst() is not better, because it will repeat almost same checks (as I said) as __xdp_enqueue() already contains these checks. This is fast-path code, we don't want to repeat checks. --Jesper (copy-pasted function below to easier compare) static inline int __xdp_enqueue(struct net_device *dev, struct xdp_frame *xdpf, struct net_device *dev_rx, struct bpf_prog *xdp_prog) { int err; if (!(dev->xdp_features & NETDEV_XDP_ACT_NDO_XMIT)) return -EOPNOTSUPP; if (unlikely(!(dev->xdp_features & NETDEV_XDP_ACT_NDO_XMIT_SG) && xdp_frame_has_frags(xdpf))) return -EOPNOTSUPP; err = xdp_ok_fwd_dev(dev, xdp_get_frame_len(xdpf)); if (unlikely(err)) return err; bq_enqueue(dev, xdpf, dev_rx, xdp_prog); return 0; } static bool is_valid_dst(struct bpf_dtab_netdev *obj, struct xdp_frame *xdpf) { if (!obj) return false; if (!(obj->dev->xdp_features & NETDEV_XDP_ACT_NDO_XMIT)) return false; if (unlikely(!(obj->dev->xdp_features & NETDEV_XDP_ACT_NDO_XMIT_SG) && xdp_frame_has_frags(xdpf))) return false; if (xdp_ok_fwd_dev(obj->dev, xdp_get_frame_len(xdpf))) return false; return true; }
Jesper Dangaard Brouer <hawk@kernel.org> writes: > On 31/03/2024 11.08, Edward Adam Davis wrote: >> [Syzbot reported] >> general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTI >> KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] >> CPU: 0 PID: 5179 Comm: syz-executor120 Not tainted 6.8.0-syzkaller-05271-gf99c5f563c17 #0 >> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024 >> RIP: 0010:dev_map_enqueue+0x31/0x3e0 kernel/bpf/devmap.c:539 >> Code: 41 56 41 55 41 54 53 48 83 ec 18 49 89 d4 49 89 f5 48 89 fd 49 be 00 00 00 00 00 fc ff df e8 e6 45 d8 ff 48 89 e8 48 c1 e8 03 <42> 80 3c 30 00 74 08 48 89 ef e8 d0 8b 3b 00 4c 8b 7d 00 48 83 c5 >> RSP: 0018:ffffc90003b0f688 EFLAGS: 00010246 >> RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff888025258000 >> RDX: 0000000000000000 RSI: ffff888024035070 RDI: 0000000000000000 >> RBP: 0000000000000000 R08: 0000000000000005 R09: ffffffff894ff55e >> R10: 0000000000000004 R11: ffff888025258000 R12: ffff8880157d8000 >> R13: ffff888024035070 R14: dffffc0000000000 R15: ffff8880b943c088 >> FS: 00007fd0098e46c0(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000 >> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 >> CR2: 00000000200009c0 CR3: 0000000025314000 CR4: 00000000003506f0 >> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 >> DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 >> Call Trace: >> <TASK> >> __xdp_do_redirect_frame net/core/filter.c:4384 [inline] >> xdp_do_redirect_frame+0x20d/0x4d0 net/core/filter.c:4438 >> xdp_test_run_batch net/bpf/test_run.c:336 [inline] >> bpf_test_run_xdp_live+0xe8a/0x1e90 net/bpf/test_run.c:384 >> bpf_prog_test_run_xdp+0x813/0x11b0 net/bpf/test_run.c:1267 >> bpf_prog_test_run+0x33a/0x3b0 kernel/bpf/syscall.c:4240 >> __sys_bpf+0x48d/0x810 kernel/bpf/syscall.c:5649 >> __do_sys_bpf kernel/bpf/syscall.c:5738 [inline] >> __se_sys_bpf kernel/bpf/syscall.c:5736 [inline] >> __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:5736 >> do_syscall_64+0xfb/0x240 >> entry_SYSCALL_64_after_hwframe+0x6d/0x75 >> RIP: 0033:0x7fd00992a0d9 >> Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 >> RSP: 002b:00007fd0098e4238 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 >> RAX: ffffffffffffffda RBX: 00007fd0099b43e8 RCX: 00007fd00992a0d9 >> RDX: 0000000000000050 RSI: 0000000020000240 RDI: 000000000000000a >> RBP: 00007fd0099b43e0 R08: 00007fd0098e46c0 R09: 00007fd0098e46c0 >> R10: 00007fd0098e46c0 R11: 0000000000000246 R12: 00007fd009981060 >> R13: 0000000000000016 R14: 00007fffcb70c160 R15: 00007fffcb70c248 >> </TASK> >> [Fix] >> On the execution path of bpf_prog_test_run(), due to ri->map being NULL, >> ri->tgtvalue was not set correctly. >> >> Reported-and-tested-by: syzbot+af9492708df9797198d6@syzkaller.appspotmail.com >> Signed-off-by: Edward Adam Davis <eadavis@qq.com> >> --- >> kernel/bpf/devmap.c | 6 +++++- >> 1 file changed, 5 insertions(+), 1 deletion(-) >> >> diff --git a/kernel/bpf/devmap.c b/kernel/bpf/devmap.c >> index 4e2cdbb5629f..ef20de14154a 100644 >> --- a/kernel/bpf/devmap.c >> +++ b/kernel/bpf/devmap.c >> @@ -86,6 +86,7 @@ struct bpf_dtab { >> static DEFINE_PER_CPU(struct list_head, dev_flush_list); >> static DEFINE_SPINLOCK(dev_map_lock); >> static LIST_HEAD(dev_map_list); >> +static bool is_valid_dst(struct bpf_dtab_netdev *obj, struct xdp_frame *xdpf); >> >> static struct hlist_head *dev_map_create_hash(unsigned int entries, >> int numa_node) >> @@ -536,7 +537,10 @@ int dev_xdp_enqueue(struct net_device *dev, struct xdp_frame *xdpf, >> int dev_map_enqueue(struct bpf_dtab_netdev *dst, struct xdp_frame *xdpf, >> struct net_device *dev_rx) >> { >> - struct net_device *dev = dst->dev; >> + struct net_device *dev; >> + if (!is_valid_dst(dst, xdpf)) > > This is overkill, because __xdp_enqueue() already contains most of the > checks in is_valid_dst(). > > Why not: > > if (!dst) > return -EINVAL; > > >> + return -EINVAL; >> + dev = dst->dev; >> >> return __xdp_enqueue(dev, xdpf, dev_rx, dst->xdp_prog); >> } > > > Is this fix pampering over another issue? > > To repeat myself: > I think something is wrong in xdp_test_run_batch(). I did spot a bug in the test_run code related to XDP_TX, but I don't really see how that particular issue could trigger this bug, since AFAICT the reproducer doesn't return XDP_TX. It looks like the program is setting the BROADCAST flag, but I don't see how that can lead to dev_map_enqueue() being run. > The `ri->tgt_value` is being set in __bpf_xdp_redirect_map(), but I > cannot see __bpf_xdp_redirect_map() being used in xdp_test_run_batch(). __bpf_xdp_redirect_map() is always being called from inside the BPF programs (through the bpf_redirect_map()). I don't really think we have a way of ensuring that we always follow such a call with an XDP_REDIRECT return, so we're kinda relying on the XDP program to do the right thing, or we could risk stale data being left in bpf_redirect_info, no? I am not sure if that is what's going on here, though. > Is this a case of XDP program returning XDP_REDIRECT without having > called the BPF helper for redirect? From trying to run the reproducer, I don't *think* that is the case, but cf the above I don't think that is the case in this instance. Anyway, let's see if I can get syzbot to test the fix to xdp_test_run_batch(): #syz test diff --git a/net/bpf/test_run.c b/net/bpf/test_run.c index dfd919374017..a3f24486829e 100644 --- a/net/bpf/test_run.c +++ b/net/bpf/test_run.c @@ -281,9 +281,9 @@ static int xdp_recv_frames(struct xdp_frame **frames, int nframes, static int xdp_test_run_batch(struct xdp_test_data *xdp, struct bpf_prog *prog, u32 repeat) { - struct bpf_redirect_info *ri = this_cpu_ptr(&bpf_redirect_info); int err = 0, act, ret, i, nframes = 0, batch_sz; struct xdp_frame **frames = xdp->frames; + struct bpf_redirect_info *ri; struct xdp_page_head *head; struct xdp_frame *frm; bool redirect = false; @@ -294,6 +294,7 @@ static int xdp_test_run_batch(struct xdp_test_data *xdp, struct bpf_prog *prog, local_bh_disable(); xdp_set_return_frame_no_direct(); + ri = this_cpu_ptr(&bpf_redirect_info); for (i = 0; i < batch_sz; i++) { page = page_pool_dev_alloc_pages(xdp->pp);
Hello,
syzbot tried to test the proposed patch but the build/boot failed:
erface driver port100
[ 7.311436][ T1] usbcore: registered new interface driver nfcmrvl
[ 7.318515][ T1] Loading iSCSI transport class v2.0-870.
[ 7.335287][ T1] virtio_scsi virtio0: 1/0/0 default/read/poll queues
[ 7.343626][ T1] ------------[ cut here ]------------
[ 7.344498][ T1] refcount_t: decrement hit 0; leaking memory.
[ 7.345816][ T1] WARNING: CPU: 0 PID: 1 at lib/refcount.c:31 refcount_warn_saturate+0xfa/0x1d0
[ 7.347895][ T1] Modules linked in:
[ 7.348644][ T1] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.9.0-rc1-syzkaller-00245-g1cfa2f10f4e9-dirty #0
[ 7.350284][ T1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
[ 7.351743][ T1] RIP: 0010:refcount_warn_saturate+0xfa/0x1d0
[ 7.352725][ T1] Code: b2 00 00 00 e8 97 cf e9 fc 5b 5d c3 cc cc cc cc e8 8b cf e9 fc c6 05 6e 74 e8 0a 01 90 48 c7 c7 e0 33 1f 8c e8 c7 6b ac fc 90 <0f> 0b 90 90 eb d9 e8 6b cf e9 fc c6 05 4b 74 e8 0a 01 90 48 c7 c7
[ 7.355628][ T1] RSP: 0000:ffffc90000066e18 EFLAGS: 00010246
[ 7.356908][ T1] RAX: 97987c7bd8eab100 RBX: ffff8881472d6f6c RCX: ffff8880166d0000
[ 7.358339][ T1] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[ 7.359509][ T1] RBP: 0000000000000004 R08: ffffffff81580062 R09: fffffbfff1c396e0
[ 7.360660][ T1] R10: dffffc0000000000 R11: fffffbfff1c396e0 R12: ffffea0000856dc0
[ 7.361924][ T1] R13: ffffea0000856dc8 R14: 1ffffd400010adb9 R15: 0000000000000000
[ 7.363052][ T1] FS: 0000000000000000(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000
[ 7.364304][ T1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 7.365198][ T1] CR2: ffff88823ffff000 CR3: 000000000e132000 CR4: 00000000003506f0
[ 7.367259][ T1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 7.368495][ T1] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 7.369779][ T1] Call Trace:
[ 7.370257][ T1] <TASK>
[ 7.370879][ T1] ? __warn+0x163/0x4e0
[ 7.371456][ T1] ? refcount_warn_saturate+0xfa/0x1d0
[ 7.372221][ T1] ? report_bug+0x2b3/0x500
[ 7.372874][ T1] ? refcount_warn_saturate+0xfa/0x1d0
[ 7.373951][ T1] ? handle_bug+0x3e/0x70
[ 7.374586][ T1] ? exc_invalid_op+0x1a/0x50
[ 7.375235][ T1] ? asm_exc_invalid_op+0x1a/0x20
[ 7.375940][ T1] ? __warn_printk+0x292/0x360
[ 7.376982][ T1] ? refcount_warn_saturate+0xfa/0x1d0
[ 7.377792][ T1] ? refcount_warn_saturate+0xf9/0x1d0
[ 7.378630][ T1] __free_pages_ok+0xc60/0xd90
[ 7.379362][ T1] make_alloc_exact+0xa3/0xf0
[ 7.380045][ T1] vring_alloc_queue_split+0x20a/0x600
[ 7.380857][ T1] ? __pfx_vring_alloc_queue_split+0x10/0x10
[ 7.381697][ T1] ? vp_find_vqs+0x4c/0x4e0
[ 7.382711][ T1] ? virtscsi_probe+0x3ea/0xf60
[ 7.383786][ T1] ? virtio_dev_probe+0x991/0xaf0
[ 7.384631][ T1] ? really_probe+0x2b8/0xad0
[ 7.385324][ T1] ? driver_probe_device+0x50/0x430
[ 7.386103][ T1] vring_create_virtqueue_split+0xc6/0x310
[ 7.387313][ T1] ? ret_from_fork+0x4b/0x80
[ 7.388031][ T1] ? __pfx_vring_create_virtqueue_split+0x10/0x10
[ 7.389084][ T1] vring_create_virtqueue+0xca/0x110
[ 7.389967][ T1] ? __pfx_vp_notify+0x10/0x10
[ 7.390812][ T1] ? __pfx_virtscsi_ctrl_done+0x10/0x10
[ 7.391660][ T1] setup_vq+0xe9/0x2d0
[ 7.392432][ T1] ? __pfx_vp_notify+0x10/0x10
[ 7.393181][ T1] ? __pfx_virtscsi_ctrl_done+0x10/0x10
[ 7.393942][ T1] ? __pfx_virtscsi_ctrl_done+0x10/0x10
[ 7.394867][ T1] ? __pfx_virtscsi_ctrl_done+0x10/0x10
[ 7.395927][ T1] vp_setup_vq+0xbf/0x330
[ 7.397180][ T1] ? __pfx_vp_config_changed+0x10/0x10
[ 7.398233][ T1] ? ioread16+0x2f/0x90
[ 7.398859][ T1] ? __pfx_virtscsi_ctrl_done+0x10/0x10
[ 7.399621][ T1] vp_find_vqs_msix+0x8b2/0xc80
[ 7.400563][ T1] vp_find_vqs+0x4c/0x4e0
[ 7.401171][ T1] virtscsi_init+0x8db/0xd00
[ 7.401888][ T1] ? __pfx_virtscsi_init+0x10/0x10
[ 7.402696][ T1] ? __pfx_default_calc_sets+0x10/0x10
[ 7.403594][ T1] ? scsi_host_alloc+0xa57/0xea0
[ 7.404281][ T1] ? vp_get+0xfd/0x140
[ 7.404929][ T1] virtscsi_probe+0x3ea/0xf60
[ 7.405637][ T1] ? __pfx_virtscsi_probe+0x10/0x10
[ 7.406398][ T1] ? virtio_pci_modern_probe+0x1ad/0x270
[ 7.407182][ T1] ? __pfx_vp_set_status+0x10/0x10
[ 7.407898][ T1] ? vp_set_status+0x1a/0x40
[ 7.408529][ T1] ? virtio_no_restricted_mem_acc+0x9/0x10
[ 7.409355][ T1] ? virtio_features_ok+0x10c/0x270
[ 7.410072][ T1] virtio_dev_probe+0x991/0xaf0
[ 7.410754][ T1] ? __pfx_virtio_dev_probe+0x10/0x10
[ 7.411546][ T1] really_probe+0x2b8/0xad0
[ 7.412167][ T1] __driver_probe_device+0x1a2/0x390
[ 7.412887][ T1] driver_probe_device+0x50/0x430
[ 7.413590][ T1] __driver_attach+0x45f/0x710
[ 7.414237][ T1] ? __pfx___driver_attach+0x10/0x10
[ 7.414953][ T1] bus_for_each_dev+0x239/0x2b0
[ 7.415674][ T1] ? __pfx___driver_attach+0x10/0x10
[ 7.416541][ T1] ? __pfx_bus_for_each_dev+0x10/0x10
[ 7.417323][ T1] ? do_raw_spin_unlock+0x13c/0x8b0
[ 7.418091][ T1] bus_add_driver+0x347/0x620
[ 7.418770][ T1] driver_register+0x23a/0x320
[ 7.419601][ T1] ? __pfx_virtio_scsi_init+0x10/0x10
[ 7.420387][ T1] virtio_scsi_init+0x65/0xe0
[ 7.421063][ T1] ? __pfx_virtio_scsi_init+0x10/0x10
[ 7.421802][ T1] do_one_initcall+0x248/0x880
[ 7.422452][ T1] ? __pfx_virtio_scsi_init+0x10/0x10
[ 7.423191][ T1] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10
[ 7.424043][ T1] ? __pfx_do_one_initcall+0x10/0x10
[ 7.424842][ T1] ? __pfx_parse_args+0x10/0x10
[ 7.425562][ T1] ? do_initcalls+0x1c/0x80
[ 7.426235][ T1] ? rcu_is_watching+0x15/0xb0
[ 7.426902][ T1] do_initcall_level+0x157/0x210
[ 7.427580][ T1] do_initcalls+0x3f/0x80
[ 7.428174][ T1] kernel_init_freeable+0x435/0x5d0
[ 7.428912][ T1] ? __pfx_kernel_init_freeable+0x10/0x10
[ 7.429687][ T1] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10
[ 7.430608][ T1] ? __pfx_kernel_init+0x10/0x10
[ 7.431281][ T1] ? __pfx_kernel_init+0x10/0x10
[ 7.432008][ T1] ? __pfx_kernel_init+0x10/0x10
[ 7.432791][ T1] kernel_init+0x1d/0x2b0
[ 7.433667][ T1] ret_from_fork+0x4b/0x80
[ 7.434410][ T1] ? __pfx_kernel_init+0x10/0x10
[ 7.435247][ T1] ret_from_fork_asm+0x1a/0x30
[ 7.436036][ T1] </TASK>
[ 7.436777][ T1] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 7.437767][ T1] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.9.0-rc1-syzkaller-00245-g1cfa2f10f4e9-dirty #0
[ 7.439106][ T1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
[ 7.440461][ T1] Call Trace:
[ 7.440914][ T1] <TASK>
[ 7.441323][ T1] dump_stack_lvl+0x241/0x360
[ 7.441989][ T1] ? __pfx_dump_stack_lvl+0x10/0x10
[ 7.442706][ T1] ? __pfx__printk+0x10/0x10
[ 7.443350][ T1] ? _printk+0xd5/0x120
[ 7.443977][ T1] ? vscnprintf+0x5d/0x90
[ 7.444934][ T1] panic+0x349/0x860
[ 7.445694][ T1] ? __warn+0x172/0x4e0
[ 7.446290][ T1] ? __pfx_panic+0x10/0x10
[ 7.446639][ T1] ? show_trace_log_lvl+0x4e6/0x520
[ 7.446639][ T1] ? ret_from_fork_asm+0x1a/0x30
[ 7.446639][ T1] __warn+0x346/0x4e0
[ 7.446639][ T1] ? refcount_warn_saturate+0xfa/0x1d0
[ 7.446639][ T1] report_bug+0x2b3/0x500
[ 7.446639][ T1] ? refcount_warn_saturate+0xfa/0x1d0
[ 7.446639][ T1] handle_bug+0x3e/0x70
[ 7.446639][ T1] exc_invalid_op+0x1a/0x50
[ 7.446639][ T1] asm_exc_invalid_op+0x1a/0x20
[ 7.446639][ T1] RIP: 0010:refcount_warn_saturate+0xfa/0x1d0
[ 7.446639][ T1] Code: b2 00 00 00 e8 97 cf e9 fc 5b 5d c3 cc cc cc cc e8 8b cf e9 fc c6 05 6e 74 e8 0a 01 90 48 c7 c7 e0 33 1f 8c e8 c7 6b ac fc 90 <0f> 0b 90 90 eb d9 e8 6b cf e9 fc c6 05 4b 74 e8 0a 01 90 48 c7 c7
[ 7.446639][ T1] RSP: 0000:ffffc90000066e18 EFLAGS: 00010246
[ 7.446639][ T1] RAX: 97987c7bd8eab100 RBX: ffff8881472d6f6c RCX: ffff8880166d0000
[ 7.446639][ T1] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[ 7.446639][ T1] RBP: 0000000000000004 R08: ffffffff81580062 R09: fffffbfff1c396e0
[ 7.446639][ T1] R10: dffffc0000000000 R11: fffffbfff1c396e0 R12: ffffea0000856dc0
[ 7.446639][ T1] R13: ffffea0000856dc8 R14: 1ffffd400010adb9 R15: 0000000000000000
[ 7.446639][ T1] ? __warn_printk+0x292/0x360
[ 7.446639][ T1] ? refcount_warn_saturate+0xf9/0x1d0
[ 7.446639][ T1] __free_pages_ok+0xc60/0xd90
[ 7.446639][ T1] make_alloc_exact+0xa3/0xf0
[ 7.446639][ T1] vring_alloc_queue_split+0x20a/0x600
[ 7.446639][ T1] ? __pfx_vring_alloc_queue_split+0x10/0x10
[ 7.446639][ T1] ? vp_find_vqs+0x4c/0x4e0
[ 7.446639][ T1] ? virtscsi_probe+0x3ea/0xf60
[ 7.446639][ T1] ? virtio_dev_probe+0x991/0xaf0
[ 7.446639][ T1] ? really_probe+0x2b8/0xad0
[ 7.446639][ T1] ? driver_probe_device+0x50/0x430
[ 7.446639][ T1] vring_create_virtqueue_split+0xc6/0x310
[ 7.446639][ T1] ? ret_from_fork+0x4b/0x80
[ 7.446639][ T1] ? __pfx_vring_create_virtqueue_split+0x10/0x10
[ 7.446639][ T1] vring_create_virtqueue+0xca/0x110
[ 7.446639][ T1] ? __pfx_vp_notify+0x10/0x10
[ 7.446639][ T1] ? __pfx_virtscsi_ctrl_done+0x10/0x10
[ 7.446639][ T1] setup_vq+0xe9/0x2d0
[ 7.446639][ T1] ? __pfx_vp_notify+0x10/0x10
[ 7.446639][ T1] ? __pfx_virtscsi_ctrl_done+0x10/0x10
[ 7.446639][ T1] ? __pfx_virtscsi_ctrl_done+0x10/0x10
[ 7.446639][ T1] ? __pfx_virtscsi_ctrl_done+0x10/0x10
[ 7.446639][ T1] vp_setup_vq+0xbf/0x330
[ 7.446639][ T1] ? __pfx_vp_config_changed+0x10/0x10
[ 7.446639][ T1] ? ioread16+0x2f/0x90
[ 7.446639][ T1] ? __pfx_virtscsi_ctrl_done+0x10/0x10
[ 7.446639][ T1] vp_find_vqs_msix+0x8b2/0xc80
[ 7.446639][ T1] vp_find_vqs+0x4c/0x4e0
[ 7.446639][ T1] virtscsi_init+0x8db/0xd00
[ 7.446639][ T1] ? __pfx_virtscsi_init+0x10/0x10
[ 7.446639][ T1] ? __pfx_default_calc_sets+0x10/0x10
[ 7.446639][ T1] ? scsi_host_alloc+0xa57/0xea0
[ 7.446639][ T1] ? vp_get+0xfd/0x140
[ 7.446639][ T1] virtscsi_probe+0x3ea/0xf60
[ 7.446639][ T1] ? __pfx_virtscsi_probe+0x10/0x10
[ 7.446639][ T1] ? virtio_pci_modern_probe+0x1ad/0x270
[ 7.446639][ T1] ? __pfx_vp_set_status+0x10/0x10
[ 7.446639][ T1] ? vp_set_status+0x1a/0x40
[ 7.446639][ T1] ? virtio_no_restricted_mem_acc+0x9/0x10
[ 7.446639][ T1] ? virtio_features_ok+0x10c/0x270
[ 7.446639][ T1] virtio_dev_probe+0x991/0xaf0
[ 7.446639][ T1] ? __pfx_virtio_dev_probe+0x10/0x10
[ 7.446639][ T1] really_probe+0x2b8/0xad0
[ 7.446639][ T1] __driver_probe_device+0x1a2/0x390
[ 7.496320][ T1] driver_probe_device+0x50/0x430
[ 7.496320][ T1] __driver_attach+0x45f/0x710
[ 7.496320][ T1] ? __pfx___driver_attach+0x10/0x10
[ 7.496320][ T1] bus_for_each_dev+0x239/0x2b0
[ 7.496320][ T1] ? __pfx___driver_attach+0x10/0x10
[ 7.496320][ T1] ? __pfx_bus_for_each_dev+0x10/0x10
[ 7.496320][ T1] ? do_raw_spin_unlock+0x13c/0x8b0
[ 7.496320][ T1] bus_add_driver+0x347/0x620
[ 7.496320][ T1] driver_register+0x23a/0x320
[ 7.496320][ T1] ? __pfx_virtio_scsi_init+0x10/0x10
[ 7.496320][ T1] virtio_scsi_init+0x65/0xe0
[ 7.496320][ T1] ? __pfx_virtio_scsi_init+0x10/0x10
[ 7.496320][ T1] do_one_initcall+0x248/0x880
[ 7.496320][ T1] ? __pfx_virtio_scsi_init+0x10/0x10
[ 7.496320][ T1] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10
[ 7.496320][ T1] ? __pfx_do_one_initcall+0x10/0x10
[ 7.496320][ T1] ? __pfx_parse_args+0x10/0x10
[ 7.496320][ T1] ? do_initcalls+0x1c/0x80
[ 7.496320][ T1] ? rcu_is_watching+0x15/0xb0
[ 7.496320][ T1] do_initcall_level+0x157/0x210
[ 7.496320][ T1] do_initcalls+0x3f/0x80
[ 7.496320][ T1] kernel_init_freeable+0x435/0x5d0
[ 7.496320][ T1] ? __pfx_kernel_init_freeable+0x10/0x10
[ 7.496320][ T1] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10
[ 7.496320][ T1] ? __pfx_kernel_init+0x10/0x10
[ 7.496320][ T1] ? __pfx_kernel_init+0x10/0x10
[ 7.496320][ T1] ? __pfx_kernel_init+0x10/0x10
[ 7.496320][ T1] kernel_init+0x1d/0x2b0
[ 7.496320][ T1] ret_from_fork+0x4b/0x80
[ 7.496320][ T1] ? __pfx_kernel_init+0x10/0x10
[ 7.496320][ T1] ret_from_fork_asm+0x1a/0x30
[ 7.496320][ T1] </TASK>
[ 7.496320][ T1] Kernel Offset: disabled
[ 7.496320][ T1] Rebooting in 86400 seconds..
syzkaller build log:
go env (err=<nil>)
GO111MODULE='auto'
GOARCH='amd64'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFLAGS=''
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMODCACHE='/syzkaller/jobs-2/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs-2/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.21.4'
GCCGO='gccgo'
GOAMD64='v1'
AR='ar'
CC='gcc'
CXX='g++'
CGO_ENABLED='1'
GOMOD='/syzkaller/jobs-2/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOWORK=''
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
PKG_CONFIG='pkg-config'
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build2839934155=/tmp/go-build -gno-record-gcc-switches'
git status (err=<nil>)
HEAD detached at 454571b6a
nothing to commit, working tree clean
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' ./sys/syz-sysgen | grep -q false || go install ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=454571b6a16598f5a6e015b9fb1a04932bce7ab9 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20240326-163935'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-fuzzer github.com/google/syzkaller/syz-fuzzer
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=454571b6a16598f5a6e015b9fb1a04932bce7ab9 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20240326-163935'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=454571b6a16598f5a6e015b9fb1a04932bce7ab9 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20240326-163935'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-stress github.com/google/syzkaller/tools/syz-stress
mkdir -p ./bin/linux_amd64
gcc -o ./bin/linux_amd64/syz-executor executor/executor.cc \
-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -fpermissive -w -DGOOS_linux=1 -DGOARCH_amd64=1 \
-DHOSTGOOS_linux=1 -DGIT_REVISION=\"454571b6a16598f5a6e015b9fb1a04932bce7ab9\"
Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=17196223180000
Tested on:
commit: 1cfa2f10 Merge tag 'for-netdev' of https://git.kernel...
git tree: net
kernel config: https://syzkaller.appspot.com/x/.config?x=7b667bc37450fdcd
dashboard link: https://syzkaller.appspot.com/bug?extid=af9492708df9797198d6
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=11cdcca9180000
syzbot <syzbot+af9492708df9797198d6@syzkaller.appspotmail.com> writes: > Hello, > > syzbot tried to test the proposed patch but the build/boot failed: Trying again on a different branch: #syz test https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git 443574b03387 diff --git a/net/bpf/test_run.c b/net/bpf/test_run.c index dfd919374017..a3f24486829e 100644 --- a/net/bpf/test_run.c +++ b/net/bpf/test_run.c @@ -281,9 +281,9 @@ static int xdp_recv_frames(struct xdp_frame **frames, int nframes, static int xdp_test_run_batch(struct xdp_test_data *xdp, struct bpf_prog *prog, u32 repeat) { - struct bpf_redirect_info *ri = this_cpu_ptr(&bpf_redirect_info); int err = 0, act, ret, i, nframes = 0, batch_sz; struct xdp_frame **frames = xdp->frames; + struct bpf_redirect_info *ri; struct xdp_page_head *head; struct xdp_frame *frm; bool redirect = false; @@ -294,6 +294,7 @@ static int xdp_test_run_batch(struct xdp_test_data *xdp, struct bpf_prog *prog, local_bh_disable(); xdp_set_return_frame_no_direct(); + ri = this_cpu_ptr(&bpf_redirect_info); for (i = 0; i < batch_sz; i++) { page = page_pool_dev_alloc_pages(xdp->pp);
Hello, syzbot has tested the proposed patch but the reproducer is still triggering an issue: general protection fault in dev_map_enqueue general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] CPU: 0 PID: 8787 Comm: syz-executor.0 Not tainted 6.8.0-syzkaller-05236-g443574b03387-dirty #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 RIP: 0010:dev_map_enqueue+0x31/0x3e0 kernel/bpf/devmap.c:539 Code: 41 56 41 55 41 54 53 48 83 ec 18 49 89 d4 49 89 f5 48 89 fd 49 be 00 00 00 00 00 fc ff df e8 a6 42 d8 ff 48 89 e8 48 c1 e8 03 <42> 80 3c 30 00 74 08 48 89 ef e8 10 8a 3b 00 4c 8b 7d 00 48 83 c5 RSP: 0018:ffffc9000bc1f688 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff888011815a00 RDX: 0000000000000000 RSI: ffff88802bed7070 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000005 R09: ffffffff894ff90e R10: 0000000000000004 R11: ffff888011815a00 R12: ffff888022f4a000 R13: ffff88802bed7070 R14: dffffc0000000000 R15: ffff8880b943c088 FS: 00007f0b6b2916c0(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f0b6a5a80c0 CR3: 000000002dad2000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> __xdp_do_redirect_frame net/core/filter.c:4384 [inline] xdp_do_redirect_frame+0x20d/0x4d0 net/core/filter.c:4438 xdp_test_run_batch net/bpf/test_run.c:337 [inline] bpf_test_run_xdp_live+0xf0b/0x1f10 net/bpf/test_run.c:385 bpf_prog_test_run_xdp+0x813/0x11b0 net/bpf/test_run.c:1268 bpf_prog_test_run+0x33a/0x3b0 kernel/bpf/syscall.c:4240 __sys_bpf+0x48d/0x810 kernel/bpf/syscall.c:5649 __do_sys_bpf kernel/bpf/syscall.c:5738 [inline] __se_sys_bpf kernel/bpf/syscall.c:5736 [inline] __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:5736 do_syscall_64+0xfb/0x240 entry_SYSCALL_64_after_hwframe+0x6d/0x75 RIP: 0033:0x7f0b6a47dda9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f0b6b2910c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f0b6a5abf80 RCX: 00007f0b6a47dda9 RDX: 0000000000000050 RSI: 0000000020000240 RDI: 000000000000000a RBP: 00007f0b6a4ca47a R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 000000000000000b R14: 00007f0b6a5abf80 R15: 00007ffe8c70ed58 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:dev_map_enqueue+0x31/0x3e0 kernel/bpf/devmap.c:539 Code: 41 56 41 55 41 54 53 48 83 ec 18 49 89 d4 49 89 f5 48 89 fd 49 be 00 00 00 00 00 fc ff df e8 a6 42 d8 ff 48 89 e8 48 c1 e8 03 <42> 80 3c 30 00 74 08 48 89 ef e8 10 8a 3b 00 4c 8b 7d 00 48 83 c5 RSP: 0018:ffffc9000bc1f688 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff888011815a00 RDX: 0000000000000000 RSI: ffff88802bed7070 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000005 R09: ffffffff894ff90e R10: 0000000000000004 R11: ffff888011815a00 R12: ffff888022f4a000 R13: ffff88802bed7070 R14: dffffc0000000000 R15: ffff8880b943c088 FS: 00007f0b6b2916c0(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f0b6a5a80c0 CR3: 000000002dad2000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: 41 56 push %r14 2: 41 55 push %r13 4: 41 54 push %r12 6: 53 push %rbx 7: 48 83 ec 18 sub $0x18,%rsp b: 49 89 d4 mov %rdx,%r12 e: 49 89 f5 mov %rsi,%r13 11: 48 89 fd mov %rdi,%rbp 14: 49 be 00 00 00 00 00 movabs $0xdffffc0000000000,%r14 1b: fc ff df 1e: e8 a6 42 d8 ff call 0xffd842c9 23: 48 89 e8 mov %rbp,%rax 26: 48 c1 e8 03 shr $0x3,%rax * 2a: 42 80 3c 30 00 cmpb $0x0,(%rax,%r14,1) <-- trapping instruction 2f: 74 08 je 0x39 31: 48 89 ef mov %rbp,%rdi 34: e8 10 8a 3b 00 call 0x3b8a49 39: 4c 8b 7d 00 mov 0x0(%rbp),%r15 3d: 48 rex.W 3e: 83 .byte 0x83 3f: c5 .byte 0xc5 Tested on: commit: 443574b0 riscv, bpf: Fix kfunc parameters incompatibil.. git tree: https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git console output: https://syzkaller.appspot.com/x/log.txt?x=11ac5323180000 kernel config: https://syzkaller.appspot.com/x/.config?x=6fb1be60a193d440 dashboard link: https://syzkaller.appspot.com/bug?extid=af9492708df9797198d6 compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 patch: https://syzkaller.appspot.com/x/patch.diff?x=154653d3180000
syzbot <syzbot+af9492708df9797198d6@syzkaller.appspotmail.com> writes: > Hello, > > syzbot has tested the proposed patch but the reproducer is still triggering an issue: > general protection fault in dev_map_enqueue Alright, trying a different thing (not a correct patch, just testing a theory): #syz test https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git 443574b03387 diff --git a/net/core/filter.c b/net/core/filter.c index 786d792ac816..c2fd4f67766f 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -4301,8 +4301,9 @@ void bpf_clear_redirect_map(struct bpf_map *map) * cmpxchg() to make sure it hasn't been changed in * the meantime by remote CPU. */ - if (unlikely(READ_ONCE(ri->map) == map)) - cmpxchg(&ri->map, map, NULL); + if (unlikely(READ_ONCE(ri->map) == map) && + cmpxchg(&ri->map, map, NULL) == map) + WRITE_ONCE(ri->map_type, BPF_MAP_TYPE_UNSPEC); } }
Hello, syzbot has tested the proposed patch and the reproducer did not trigger any issue: Reported-and-tested-by: syzbot+af9492708df9797198d6@syzkaller.appspotmail.com Tested on: commit: 443574b0 riscv, bpf: Fix kfunc parameters incompatibil.. git tree: https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git console output: https://syzkaller.appspot.com/x/log.txt?x=125ea0e3180000 kernel config: https://syzkaller.appspot.com/x/.config?x=6fb1be60a193d440 dashboard link: https://syzkaller.appspot.com/bug?extid=af9492708df9797198d6 compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 patch: https://syzkaller.appspot.com/x/patch.diff?x=156227cd180000 Note: testing is done by a robot and is best-effort only.
syzbot <syzbot+af9492708df9797198d6@syzkaller.appspotmail.com> writes: > Hello, > > syzbot has tested the proposed patch and the reproducer did not trigger any issue: > > Reported-and-tested-by: syzbot+af9492708df9797198d6@syzkaller.appspotmail.com > > Tested on: > > commit: 443574b0 riscv, bpf: Fix kfunc parameters incompatibil.. > git tree: https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git > console output: https://syzkaller.appspot.com/x/log.txt?x=125ea0e3180000 > kernel config: https://syzkaller.appspot.com/x/.config?x=6fb1be60a193d440 > dashboard link: https://syzkaller.appspot.com/bug?extid=af9492708df9797198d6 > compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 > patch: https://syzkaller.appspot.com/x/patch.diff?x=156227cd180000 > > Note: testing is done by a robot and is best-effort only. And now the real patch: #syz test https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git 443574b03387 diff --git a/net/core/filter.c b/net/core/filter.c index 786d792ac816..8120c3dddf5e 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -4363,10 +4363,12 @@ static __always_inline int __xdp_do_redirect_frame(struct bpf_redirect_info *ri, enum bpf_map_type map_type = ri->map_type; void *fwd = ri->tgt_value; u32 map_id = ri->map_id; + u32 flags = ri->flags; struct bpf_map *map; int err; ri->map_id = 0; /* Valid map id idr range: [1,INT_MAX[ */ + ri->flags = 0; ri->map_type = BPF_MAP_TYPE_UNSPEC; if (unlikely(!xdpf)) { @@ -4378,11 +4380,20 @@ static __always_inline int __xdp_do_redirect_frame(struct bpf_redirect_info *ri, case BPF_MAP_TYPE_DEVMAP: fallthrough; case BPF_MAP_TYPE_DEVMAP_HASH: - map = READ_ONCE(ri->map); - if (unlikely(map)) { + if (unlikely(flags & BPF_F_BROADCAST)) { + map = READ_ONCE(ri->map); + + /* The map pointer is cleared when the map is being torn + * down by bpf_clear_redirect_map() + */ + if (unlikely(!map)) { + err = -ENOENT; + break; + } + WRITE_ONCE(ri->map, NULL); err = dev_map_enqueue_multi(xdpf, dev, map, - ri->flags & BPF_F_EXCLUDE_INGRESS); + flags & BPF_F_EXCLUDE_INGRESS); } else { err = dev_map_enqueue(fwd, xdpf, dev); } @@ -4445,9 +4456,9 @@ EXPORT_SYMBOL_GPL(xdp_do_redirect_frame); static int xdp_do_generic_redirect_map(struct net_device *dev, struct sk_buff *skb, struct xdp_buff *xdp, - struct bpf_prog *xdp_prog, - void *fwd, - enum bpf_map_type map_type, u32 map_id) + struct bpf_prog *xdp_prog, void *fwd, + enum bpf_map_type map_type, u32 map_id, + u32 flags) { struct bpf_redirect_info *ri = this_cpu_ptr(&bpf_redirect_info); struct bpf_map *map; @@ -4457,11 +4468,20 @@ static int xdp_do_generic_redirect_map(struct net_device *dev, case BPF_MAP_TYPE_DEVMAP: fallthrough; case BPF_MAP_TYPE_DEVMAP_HASH: - map = READ_ONCE(ri->map); - if (unlikely(map)) { + if (unlikely(flags & BPF_F_BROADCAST)) { + map = READ_ONCE(ri->map); + + /* The map pointer is cleared when the map is being torn + * down by bpf_clear_redirect_map() + */ + if (unlikely(!map)) { + err = -ENOENT; + break; + } + WRITE_ONCE(ri->map, NULL); err = dev_map_redirect_multi(dev, skb, xdp_prog, map, - ri->flags & BPF_F_EXCLUDE_INGRESS); + flags & BPF_F_EXCLUDE_INGRESS); } else { err = dev_map_generic_redirect(fwd, skb, xdp_prog); } @@ -4498,9 +4518,11 @@ int xdp_do_generic_redirect(struct net_device *dev, struct sk_buff *skb, enum bpf_map_type map_type = ri->map_type; void *fwd = ri->tgt_value; u32 map_id = ri->map_id; + u32 flags = ri->flags; int err; ri->map_id = 0; /* Valid map id idr range: [1,INT_MAX[ */ + ri->flags = 0; ri->map_type = BPF_MAP_TYPE_UNSPEC; if (map_type == BPF_MAP_TYPE_UNSPEC && map_id == INT_MAX) { @@ -4520,7 +4542,7 @@ int xdp_do_generic_redirect(struct net_device *dev, struct sk_buff *skb, return 0; } - return xdp_do_generic_redirect_map(dev, skb, xdp, xdp_prog, fwd, map_type, map_id); + return xdp_do_generic_redirect_map(dev, skb, xdp, xdp_prog, fwd, map_type, map_id, flags); err: _trace_xdp_redirect_err(dev, xdp_prog, ri->tgt_index, err); return err;
Hello, syzbot has tested the proposed patch and the reproducer did not trigger any issue: Reported-and-tested-by: syzbot+af9492708df9797198d6@syzkaller.appspotmail.com Tested on: commit: 443574b0 riscv, bpf: Fix kfunc parameters incompatibil.. git tree: https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git console output: https://syzkaller.appspot.com/x/log.txt?x=15d5b33b180000 kernel config: https://syzkaller.appspot.com/x/.config?x=6fb1be60a193d440 dashboard link: https://syzkaller.appspot.com/bug?extid=af9492708df9797198d6 compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 patch: https://syzkaller.appspot.com/x/patch.diff?x=12bfa653180000 Note: testing is done by a robot and is best-effort only.
diff --git a/kernel/bpf/devmap.c b/kernel/bpf/devmap.c index 4e2cdbb5629f..ef20de14154a 100644 --- a/kernel/bpf/devmap.c +++ b/kernel/bpf/devmap.c @@ -86,6 +86,7 @@ struct bpf_dtab { static DEFINE_PER_CPU(struct list_head, dev_flush_list); static DEFINE_SPINLOCK(dev_map_lock); static LIST_HEAD(dev_map_list); +static bool is_valid_dst(struct bpf_dtab_netdev *obj, struct xdp_frame *xdpf); static struct hlist_head *dev_map_create_hash(unsigned int entries, int numa_node) @@ -536,7 +537,10 @@ int dev_xdp_enqueue(struct net_device *dev, struct xdp_frame *xdpf, int dev_map_enqueue(struct bpf_dtab_netdev *dst, struct xdp_frame *xdpf, struct net_device *dev_rx) { - struct net_device *dev = dst->dev; + struct net_device *dev; + if (!is_valid_dst(dst, xdpf)) + return -EINVAL; + dev = dst->dev; return __xdp_enqueue(dev, xdpf, dev_rx, dst->xdp_prog); }
[Syzbot reported] general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] CPU: 0 PID: 5179 Comm: syz-executor120 Not tainted 6.8.0-syzkaller-05271-gf99c5f563c17 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024 RIP: 0010:dev_map_enqueue+0x31/0x3e0 kernel/bpf/devmap.c:539 Code: 41 56 41 55 41 54 53 48 83 ec 18 49 89 d4 49 89 f5 48 89 fd 49 be 00 00 00 00 00 fc ff df e8 e6 45 d8 ff 48 89 e8 48 c1 e8 03 <42> 80 3c 30 00 74 08 48 89 ef e8 d0 8b 3b 00 4c 8b 7d 00 48 83 c5 RSP: 0018:ffffc90003b0f688 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff888025258000 RDX: 0000000000000000 RSI: ffff888024035070 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000005 R09: ffffffff894ff55e R10: 0000000000000004 R11: ffff888025258000 R12: ffff8880157d8000 R13: ffff888024035070 R14: dffffc0000000000 R15: ffff8880b943c088 FS: 00007fd0098e46c0(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000200009c0 CR3: 0000000025314000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> __xdp_do_redirect_frame net/core/filter.c:4384 [inline] xdp_do_redirect_frame+0x20d/0x4d0 net/core/filter.c:4438 xdp_test_run_batch net/bpf/test_run.c:336 [inline] bpf_test_run_xdp_live+0xe8a/0x1e90 net/bpf/test_run.c:384 bpf_prog_test_run_xdp+0x813/0x11b0 net/bpf/test_run.c:1267 bpf_prog_test_run+0x33a/0x3b0 kernel/bpf/syscall.c:4240 __sys_bpf+0x48d/0x810 kernel/bpf/syscall.c:5649 __do_sys_bpf kernel/bpf/syscall.c:5738 [inline] __se_sys_bpf kernel/bpf/syscall.c:5736 [inline] __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:5736 do_syscall_64+0xfb/0x240 entry_SYSCALL_64_after_hwframe+0x6d/0x75 RIP: 0033:0x7fd00992a0d9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd0098e4238 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fd0099b43e8 RCX: 00007fd00992a0d9 RDX: 0000000000000050 RSI: 0000000020000240 RDI: 000000000000000a RBP: 00007fd0099b43e0 R08: 00007fd0098e46c0 R09: 00007fd0098e46c0 R10: 00007fd0098e46c0 R11: 0000000000000246 R12: 00007fd009981060 R13: 0000000000000016 R14: 00007fffcb70c160 R15: 00007fffcb70c248 </TASK> [Fix] On the execution path of bpf_prog_test_run(), due to ri->map being NULL, ri->tgtvalue was not set correctly. Reported-and-tested-by: syzbot+af9492708df9797198d6@syzkaller.appspotmail.com Signed-off-by: Edward Adam Davis <eadavis@qq.com> --- kernel/bpf/devmap.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)