From patchwork Thu Jul 5 07:46:31 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Daniel Borkmann X-Patchwork-Id: 10508337 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id E4502603D7 for ; Thu, 5 Jul 2018 07:47:03 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id D3B2528971 for ; Thu, 5 Jul 2018 07:47:03 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id C78A528B04; Thu, 5 Jul 2018 07:47:03 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-2.9 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,MAILING_LIST_MULTI autolearn=ham version=3.3.1 Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 0BF2228971 for ; Thu, 5 Jul 2018 07:47:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20170209; h=Sender: Content-Transfer-Encoding:Content-Type:Cc:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:In-Reply-To:MIME-Version:Date: Message-ID:From:References:To:Subject:Reply-To:Content-ID:Content-Description :Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=zcMCSh+t0BkKFw90p/gdWgmoenib+aaMbwzq1sGgvis=; b=PPR2Qb052rlvkm cqYfYLOuvjPBkeNHt3YSchBMYj2ZnP3un2LaY2sRpOplxsir3ACCVQ4f2AJgBvcEmjGLsqwThPDw5 ttYmiLHUCQ/lYg343+tKt/g6elZbzVmn069mratAg8veOhEp0sIr2iyWHJIeB22yP6DaSmleGavIU WpYAtLFztUKHGktZFyWA+8iQg7kRa+xtEQ76sn9OJpucIbF557nXxtcZ6gGe4DlTmcpPgxTnmTF9v bUZ/6XCD2ijc+iHNHGfieSEMyGwz84PRbDwzvi+jiCeOBH5RIDu+XL5DB3KD2xtjmZPG1qrE0bWKp 5hGh8Q6d0Q57z5+MB2/g==; Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.90_1 #2 (Red Hat Linux)) id 1fayye-0006qj-TN; Thu, 05 Jul 2018 07:46:56 +0000 Received: from www62.your-server.de ([213.133.104.62]) by bombadil.infradead.org with esmtps (Exim 4.90_1 #2 (Red Hat Linux)) id 1fayyZ-0006hm-Gp for linux-arm-kernel@lists.infradead.org; Thu, 05 Jul 2018 07:46:54 +0000 Received: from [78.46.172.3] (helo=sslproxy06.your-server.de) by www62.your-server.de with esmtpsa (TLSv1.2:DHE-RSA-AES256-GCM-SHA384:256) (Exim 4.85_2) (envelope-from ) id 1fayyG-0004ee-BF; Thu, 05 Jul 2018 09:46:32 +0200 Received: from [62.203.87.61] (helo=linux.home) by sslproxy06.your-server.de with esmtpsa (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.89) (envelope-from ) id 1fayyG-0003NE-6G; Thu, 05 Jul 2018 09:46:32 +0200 Subject: Re: [offlist] Re: Crash in netlink/sk_filter_trim_cap on ARMv7 on 4.18rc1 To: Russell King - ARM Linux , Peter Robinson References: <7ff516fd-1d01-4d7a-1d5d-b58932c0c69d@gmail.com> <20180704234154.GT17271@n2100.armlinux.org.uk> <20180705073120.GU17271@n2100.armlinux.org.uk> From: Daniel Borkmann Message-ID: <965d9f3e-cc24-9d7b-6416-f6596ced8e86@iogearbox.net> Date: Thu, 5 Jul 2018 09:46:31 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.3.0 MIME-Version: 1.0 In-Reply-To: <20180705073120.GU17271@n2100.armlinux.org.uk> Content-Language: en-US X-Authenticated-Sender: daniel@iogearbox.net X-Virus-Scanned: Clear (ClamAV 0.100.0/24724/Thu Jul 5 06:42:06 2018) X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20180705_004651_814520_7C211D96 X-CRM114-Status: GOOD ( 21.71 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: netdev@vger.kernel.org, labbott@redhat.com, Eric Dumazet , linux-arm-kernel@lists.infradead.org Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+patchwork-linux-arm=patchwork.kernel.org@lists.infradead.org X-Virus-Scanned: ClamAV using ClamSMTP On 07/05/2018 09:31 AM, Russell King - ARM Linux wrote: > On Thu, Jul 05, 2018 at 12:41:54AM +0100, Russell King - ARM Linux wrote: >> Subject says offlist, but this isn't... >> >> On Wed, Jul 04, 2018 at 08:33:20AM +0100, Peter Robinson wrote: >>> Sorry for the delay on this from my end. I noticed there was some bpf >>> bits land in the last net fixes pull request landed Monday so I built >>> a kernel with the JIT reenabled. It seems it's improved in that the >>> completely dead no output boot has gone but the original problem that >>> arrived in the merge window still persists: >>> >>> [ 17.564142] note: systemd-udevd[194] exited with preempt_count 1 >>> [ 17.592739] Unable to handle kernel NULL pointer dereference at >>> virtual address 0000000c >>> [ 17.601002] pgd = (ptrval) >>> [ 17.603819] [0000000c] *pgd=00000000 >>> [ 17.607487] Internal error: Oops: 805 [#10] SMP ARM >>> [ 17.612396] Modules linked in: >>> [ 17.615484] CPU: 0 PID: 195 Comm: systemd-udevd Tainted: G D >>> 4.18.0-0.rc3.git1.1.bpf1.fc29.armv7hl #1 >>> [ 17.626056] Hardware name: Generic AM33XX (Flattened Device Tree) >>> [ 17.632198] PC is at sk_filter_trim_cap+0x218/0x2fc >>> [ 17.637102] LR is at (null) >>> [ 17.640086] pc : [] lr : [<00000000>] psr: 60000013 >>> [ 17.646384] sp : cfe1dd48 ip : 00000000 fp : 00000000 >>> [ 17.651635] r10: d837e000 r9 : d833be00 r8 : 00000000 >>> [ 17.656887] r7 : 00000001 r6 : e003d000 r5 : 00000000 r4 : 00000000 >>> [ 17.663447] r3 : 00000007 r2 : 00000000 r1 : 00000000 r0 : 00000000 >>> [ 17.670009] Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none >>> [ 17.677180] Control: 10c5387d Table: 8fe20019 DAC: 00000051 >>> [ 17.682956] Process systemd-udevd (pid: 195, stack limit = 0x(ptrval)) >>> [ 17.689518] Stack: (0xcfe1dd48 to 0xcfe1e000) >> >> Can you provide a full disassembly of sk_filter_trim_cap from vmlinux >> (iow, annotated with its linked address) for the above dump please - >> alternatively a new dump with matching disassembly. Thanks. > > Also probably a good idea to have bpf_jit_enable set to 2 to get a > dump of the bpf program being run, which I think for your problem, > you'll have to hack the kernel source to do that. Agree, that would be good as well. You could use something like the below to bail out to interpreter after JIT did the dump. Dump will then land in kernel log which you could paste here. diff --git a/arch/arm/net/bpf_jit_32.c b/arch/arm/net/bpf_jit_32.c index f6a62ae..d6a7dfd 100644 --- a/arch/arm/net/bpf_jit_32.c +++ b/arch/arm/net/bpf_jit_32.c @@ -1844,6 +1844,13 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) /* there are 2 passes here */ bpf_jit_dump(prog->len, image_size, 2, ctx.target); + /* Defer to interpreter after dump. */ + if (1) { + bpf_jit_binary_free(header); + prog = orig_prog; + goto out_imms; + } + bpf_jit_binary_lock_ro(header); prog->bpf_func = (void *)ctx.target; prog->jited = 1;