Hello,
syzbot found the following issue on:
HEAD commit: 348551ddaf31 Merge tag 'pinctrl-v6.4-1' of git://git.kerne..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1375fdf8280000
kernel config: https://syzkaller.appspot.com/x/.config?x=35e09b26aabb80e5
dashboard link: https://syzkaller.appspot.com/bug?extid=eba589d8f49c73d356da
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/adddf809a67d/disk-348551dd.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/266c56354fa2/vmlinux-348551dd.xz
kernel image: https://storage.googleapis.com/syzbot-assets/e0fc2088acd1/bzImage-348551dd.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: [email protected]
infiniband syz2: set active
infiniband syz2: added bond_slave_1
INFO: trying to register non-static key.
The code is fine but needs lockdep annotation, or maybe
you didn't initialize this object before use?
turning off the locking correctness validator.
CPU: 1 PID: 31038 Comm: syz-executor.3 Not tainted 6.3.0-syzkaller-12728-g348551ddaf31 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xd9/0x150 lib/dump_stack.c:106
assign_lock_key kernel/locking/lockdep.c:982 [inline]
register_lock_class+0xdb6/0x1120 kernel/locking/lockdep.c:1295
__lock_acquire+0x10a/0x5df0 kernel/locking/lockdep.c:4951
lock_acquire kernel/locking/lockdep.c:5691 [inline]
lock_acquire+0x1b1/0x520 kernel/locking/lockdep.c:5656
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x3d/0x60 kernel/locking/spinlock.c:162
skb_dequeue+0x20/0x180 net/core/skbuff.c:3631
drain_resp_pkts drivers/infiniband/sw/rxe/rxe_comp.c:555 [inline]
rxe_completer+0x250d/0x3cc0 drivers/infiniband/sw/rxe/rxe_comp.c:652
rxe_qp_do_cleanup+0x1be/0x820 drivers/infiniband/sw/rxe/rxe_qp.c:761
execute_in_process_context+0x3b/0x150 kernel/workqueue.c:3473
__rxe_cleanup+0x21e/0x370 drivers/infiniband/sw/rxe/rxe_pool.c:233
rxe_create_qp+0x3f6/0x5f0 drivers/infiniband/sw/rxe/rxe_verbs.c:583
create_qp+0x5ac/0x970 drivers/infiniband/core/verbs.c:1235
ib_create_qp_kernel+0xa1/0x310 drivers/infiniband/core/verbs.c:1346
ib_create_qp include/rdma/ib_verbs.h:3743 [inline]
create_mad_qp+0x177/0x380 drivers/infiniband/core/mad.c:2905
ib_mad_port_open drivers/infiniband/core/mad.c:2986 [inline]
ib_mad_init_device+0xf40/0x1a90 drivers/infiniband/core/mad.c:3077
add_client_context+0x405/0x5e0 drivers/infiniband/core/device.c:721
enable_device_and_get+0x1cd/0x3b0 drivers/infiniband/core/device.c:1332
ib_register_device drivers/infiniband/core/device.c:1420 [inline]
ib_register_device+0x8b1/0xbc0 drivers/infiniband/core/device.c:1366
rxe_register_device+0x302/0x3e0 drivers/infiniband/sw/rxe/rxe_verbs.c:1485
rxe_net_add+0x90/0xf0 drivers/infiniband/sw/rxe/rxe_net.c:527
rxe_newlink+0xf0/0x1b0 drivers/infiniband/sw/rxe/rxe.c:197
nldev_newlink+0x332/0x5e0 drivers/infiniband/core/nldev.c:1731
rdma_nl_rcv_msg+0x371/0x6a0 drivers/infiniband/core/netlink.c:195
rdma_nl_rcv_skb.constprop.0.isra.0+0x2fc/0x440 drivers/infiniband/core/netlink.c:239
netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline]
netlink_unicast+0x547/0x7f0 net/netlink/af_netlink.c:1365
netlink_sendmsg+0x925/0xe30 net/netlink/af_netlink.c:1913
sock_sendmsg_nosec net/socket.c:724 [inline]
sock_sendmsg+0xde/0x190 net/socket.c:747
____sys_sendmsg+0x71c/0x900 net/socket.c:2503
___sys_sendmsg+0x110/0x1b0 net/socket.c:2557
__sys_sendmsg+0xf7/0x1c0 net/socket.c:2586
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7feddf48c169
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fede029f168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007feddf5abf80 RCX: 00007feddf48c169
RDX: 0000000000000000 RSI: 0000000020000240 RDI: 0000000000000003
RBP: 00007feddf4e7ca1 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffe1bb3e01f R14: 00007fede029f300 R15: 0000000000022000
</TASK>
general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037]
CPU: 1 PID: 31038 Comm: syz-executor.3 Not tainted 6.3.0-syzkaller-12728-g348551ddaf31 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023
RIP: 0010:flush_send_queue drivers/infiniband/sw/rxe/rxe_comp.c:597 [inline]
RIP: 0010:rxe_completer+0x255c/0x3cc0 drivers/infiniband/sw/rxe/rxe_comp.c:653
Code: 80 3c 02 00 0f 85 81 10 00 00 49 8b af 88 03 00 00 48 8d 45 30 48 89 c2 48 89 04 24 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 83 11 00 00 48 8d 45 2c 44 8b
RSP: 0018:ffffc90003526938 EFLAGS: 00010206
RAX: dffffc0000000000 RBX: ffffed100e3fe800 RCX: ffffc9000b403000
RDX: 0000000000000006 RSI: ffffffff877e467a RDI: ffff888071ff4388
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: fffffbfff1cf3682 R11: fffffffffffda5b0 R12: ffff888071ff41a0
R13: 0000000000000000 R14: 0000000000000000 R15: ffff888071ff4000
FS: 00007fede029f700(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2d822000 CR3: 000000002c7e6000 CR4: 00000000003506e0
Call Trace:
<TASK>
rxe_qp_do_cleanup+0x1be/0x820 drivers/infiniband/sw/rxe/rxe_qp.c:761
execute_in_process_context+0x3b/0x150 kernel/workqueue.c:3473
__rxe_cleanup+0x21e/0x370 drivers/infiniband/sw/rxe/rxe_pool.c:233
rxe_create_qp+0x3f6/0x5f0 drivers/infiniband/sw/rxe/rxe_verbs.c:583
create_qp+0x5ac/0x970 drivers/infiniband/core/verbs.c:1235
ib_create_qp_kernel+0xa1/0x310 drivers/infiniband/core/verbs.c:1346
ib_create_qp include/rdma/ib_verbs.h:3743 [inline]
create_mad_qp+0x177/0x380 drivers/infiniband/core/mad.c:2905
ib_mad_port_open drivers/infiniband/core/mad.c:2986 [inline]
ib_mad_init_device+0xf40/0x1a90 drivers/infiniband/core/mad.c:3077
add_client_context+0x405/0x5e0 drivers/infiniband/core/device.c:721
enable_device_and_get+0x1cd/0x3b0 drivers/infiniband/core/device.c:1332
ib_register_device drivers/infiniband/core/device.c:1420 [inline]
ib_register_device+0x8b1/0xbc0 drivers/infiniband/core/device.c:1366
rxe_register_device+0x302/0x3e0 drivers/infiniband/sw/rxe/rxe_verbs.c:1485
rxe_net_add+0x90/0xf0 drivers/infiniband/sw/rxe/rxe_net.c:527
rxe_newlink+0xf0/0x1b0 drivers/infiniband/sw/rxe/rxe.c:197
nldev_newlink+0x332/0x5e0 drivers/infiniband/core/nldev.c:1731
rdma_nl_rcv_msg+0x371/0x6a0 drivers/infiniband/core/netlink.c:195
rdma_nl_rcv_skb.constprop.0.isra.0+0x2fc/0x440 drivers/infiniband/core/netlink.c:239
netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline]
netlink_unicast+0x547/0x7f0 net/netlink/af_netlink.c:1365
netlink_sendmsg+0x925/0xe30 net/netlink/af_netlink.c:1913
sock_sendmsg_nosec net/socket.c:724 [inline]
sock_sendmsg+0xde/0x190 net/socket.c:747
____sys_sendmsg+0x71c/0x900 net/socket.c:2503
___sys_sendmsg+0x110/0x1b0 net/socket.c:2557
__sys_sendmsg+0xf7/0x1c0 net/socket.c:2586
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7feddf48c169
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fede029f168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007feddf5abf80 RCX: 00007feddf48c169
RDX: 0000000000000000 RSI: 0000000020000240 RDI: 0000000000000003
RBP: 00007feddf4e7ca1 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffe1bb3e01f R14: 00007fede029f300 R15: 0000000000022000
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:flush_send_queue drivers/infiniband/sw/rxe/rxe_comp.c:597 [inline]
RIP: 0010:rxe_completer+0x255c/0x3cc0 drivers/infiniband/sw/rxe/rxe_comp.c:653
Code: 80 3c 02 00 0f 85 81 10 00 00 49 8b af 88 03 00 00 48 8d 45 30 48 89 c2 48 89 04 24 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 83 11 00 00 48 8d 45 2c 44 8b
RSP: 0018:ffffc90003526938 EFLAGS: 00010206
RAX: dffffc0000000000 RBX: ffffed100e3fe800 RCX: ffffc9000b403000
RDX: 0000000000000006 RSI: ffffffff877e467a RDI: ffff888071ff4388
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: fffffbfff1cf3682 R11: fffffffffffda5b0 R12: ffff888071ff41a0
R13: 0000000000000000 R14: 0000000000000000 R15: ffff888071ff4000
FS: 00007fede029f700(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2d822000 CR3: 000000002c7e6000 CR4: 00000000003506e0
----------------
Code disassembly (best guess):
0: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1)
4: 0f 85 81 10 00 00 jne 0x108b
a: 49 8b af 88 03 00 00 mov 0x388(%r15),%rbp
11: 48 8d 45 30 lea 0x30(%rbp),%rax
15: 48 89 c2 mov %rax,%rdx
18: 48 89 04 24 mov %rax,(%rsp)
1c: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
23: fc ff df
26: 48 c1 ea 03 shr $0x3,%rdx
* 2a: 0f b6 04 02 movzbl (%rdx,%rax,1),%eax <-- trapping instruction
2e: 84 c0 test %al,%al
30: 74 08 je 0x3a
32: 3c 03 cmp $0x3,%al
34: 0f 8e 83 11 00 00 jle 0x11bd
3a: 48 8d 45 2c lea 0x2c(%rbp),%rax
3e: 44 rex.R
3f: 8b .byte 0x8b
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at [email protected].
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the bug is already fixed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to change bug's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the bug is a duplicate of another bug, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot has found a reproducer for the following issue on:
HEAD commit: ab87603b2511 net: wwan: t7xx: Ensure init is completed bef..
git tree: net
console output: https://syzkaller.appspot.com/x/log.txt?x=1157266a280000
kernel config: https://syzkaller.appspot.com/x/.config?x=eb92acf166a5d2cd
dashboard link: https://syzkaller.appspot.com/bug?extid=eba589d8f49c73d356da
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=124d5da6280000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/ac3ed2228400/disk-ab87603b.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/c51b74034116/vmlinux-ab87603b.xz
kernel image: https://storage.googleapis.com/syzbot-assets/98ab9d7ee1ee/bzImage-ab87603b.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: [email protected]
infiniband syz2: set active
infiniband syz2: added team0
INFO: trying to register non-static key.
The code is fine but needs lockdep annotation, or maybe
you didn't initialize this object before use?
turning off the locking correctness validator.
CPU: 0 PID: 5133 Comm: syz-executor.3 Not tainted 6.4.0-rc1-syzkaller-00136-gab87603b2511 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xd9/0x150 lib/dump_stack.c:106
assign_lock_key kernel/locking/lockdep.c:982 [inline]
register_lock_class+0xdb6/0x1120 kernel/locking/lockdep.c:1295
__lock_acquire+0x10a/0x5df0 kernel/locking/lockdep.c:4951
lock_acquire kernel/locking/lockdep.c:5691 [inline]
lock_acquire+0x1b1/0x520 kernel/locking/lockdep.c:5656
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x3d/0x60 kernel/locking/spinlock.c:162
skb_dequeue+0x20/0x180 net/core/skbuff.c:3639
drain_resp_pkts drivers/infiniband/sw/rxe/rxe_comp.c:555 [inline]
rxe_completer+0x250d/0x3cc0 drivers/infiniband/sw/rxe/rxe_comp.c:652
rxe_qp_do_cleanup+0x1be/0x820 drivers/infiniband/sw/rxe/rxe_qp.c:761
execute_in_process_context+0x3b/0x150 kernel/workqueue.c:3473
__rxe_cleanup+0x21e/0x370 drivers/infiniband/sw/rxe/rxe_pool.c:233
rxe_create_qp+0x3f6/0x5f0 drivers/infiniband/sw/rxe/rxe_verbs.c:583
create_qp+0x5ac/0x970 drivers/infiniband/core/verbs.c:1235
ib_create_qp_kernel+0xa1/0x310 drivers/infiniband/core/verbs.c:1346
ib_create_qp include/rdma/ib_verbs.h:3743 [inline]
create_mad_qp+0x177/0x380 drivers/infiniband/core/mad.c:2905
ib_mad_port_open drivers/infiniband/core/mad.c:2986 [inline]
ib_mad_init_device+0xf40/0x1a90 drivers/infiniband/core/mad.c:3077
add_client_context+0x405/0x5e0 drivers/infiniband/core/device.c:721
enable_device_and_get+0x1cd/0x3b0 drivers/infiniband/core/device.c:1332
ib_register_device drivers/infiniband/core/device.c:1420 [inline]
ib_register_device+0x8b1/0xbc0 drivers/infiniband/core/device.c:1366
rxe_register_device+0x302/0x3e0 drivers/infiniband/sw/rxe/rxe_verbs.c:1485
rxe_net_add+0x90/0xf0 drivers/infiniband/sw/rxe/rxe_net.c:527
rxe_newlink+0xf0/0x1b0 drivers/infiniband/sw/rxe/rxe.c:197
nldev_newlink+0x332/0x5e0 drivers/infiniband/core/nldev.c:1731
rdma_nl_rcv_msg+0x371/0x6a0 drivers/infiniband/core/netlink.c:195
rdma_nl_rcv_skb.constprop.0.isra.0+0x2fc/0x440 drivers/infiniband/core/netlink.c:239
netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline]
netlink_unicast+0x547/0x7f0 net/netlink/af_netlink.c:1365
netlink_sendmsg+0x925/0xe30 net/netlink/af_netlink.c:1913
sock_sendmsg_nosec net/socket.c:724 [inline]
sock_sendmsg+0xde/0x190 net/socket.c:747
____sys_sendmsg+0x71c/0x900 net/socket.c:2503
___sys_sendmsg+0x110/0x1b0 net/socket.c:2557
__sys_sendmsg+0xf7/0x1c0 net/socket.c:2586
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f7a1ee8c169
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f7a1fc76168 EFLAGS: 00000246
ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f7a1efabf80 RCX: 00007f7a1ee8c169
RDX: 0000000000000040 RSI: 0000000020000200 RDI: 0000000000000003
RBP: 00007f7a1eee7ca1 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fffc46ccb6f R14: 00007f7a1fc76300 R15: 0000000000022000
</TASK>
general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037]
CPU: 0 PID: 5133 Comm: syz-executor.3 Not tainted 6.4.0-rc1-syzkaller-00136-gab87603b2511 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023
RIP: 0010:flush_send_queue drivers/infiniband/sw/rxe/rxe_comp.c:597 [inline]
RIP: 0010:rxe_completer+0x255c/0x3cc0 drivers/infiniband/sw/rxe/rxe_comp.c:653
Code: 80 3c 02 00 0f 85 81 10 00 00 49 8b af 88 03 00 00 48 8d 45 30 48 89 c2 48 89 04 24 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 83 11 00 00 48 8d 45 2c 44 8b
RSP: 0018:ffffc9000419e938 EFLAGS: 00010206
RAX: dffffc0000000000 RBX: ffffed100f5fb800 RCX: 0000000000000000
RDX: 0000000000000006 RSI: ffffffff877f3bea RDI: ffff88807afdc388
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: fffffbfff1cf4e42 R11: 205d313330355420 R12: ffff88807afdc1a0
R13: 0000000000000000 R14: 0000000000000000 R15: ffff88807afdc000
FS: 00007f7a1fc76700(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000c001136000 CR3: 00000000206d3000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
rxe_qp_do_cleanup+0x1be/0x820 drivers/infiniband/sw/rxe/rxe_qp.c:761
execute_in_process_context+0x3b/0x150 kernel/workqueue.c:3473
__rxe_cleanup+0x21e/0x370 drivers/infiniband/sw/rxe/rxe_pool.c:233
rxe_create_qp+0x3f6/0x5f0 drivers/infiniband/sw/rxe/rxe_verbs.c:583
create_qp+0x5ac/0x970 drivers/infiniband/core/verbs.c:1235
ib_create_qp_kernel+0xa1/0x310 drivers/infiniband/core/verbs.c:1346
ib_create_qp include/rdma/ib_verbs.h:3743 [inline]
create_mad_qp+0x177/0x380 drivers/infiniband/core/mad.c:2905
ib_mad_port_open drivers/infiniband/core/mad.c:2986 [inline]
ib_mad_init_device+0xf40/0x1a90 drivers/infiniband/core/mad.c:3077
add_client_context+0x405/0x5e0 drivers/infiniband/core/device.c:721
enable_device_and_get+0x1cd/0x3b0 drivers/infiniband/core/device.c:1332
ib_register_device drivers/infiniband/core/device.c:1420 [inline]
ib_register_device+0x8b1/0xbc0 drivers/infiniband/core/device.c:1366
rxe_register_device+0x302/0x3e0 drivers/infiniband/sw/rxe/rxe_verbs.c:1485
rxe_net_add+0x90/0xf0 drivers/infiniband/sw/rxe/rxe_net.c:527
rxe_newlink+0xf0/0x1b0 drivers/infiniband/sw/rxe/rxe.c:197
nldev_newlink+0x332/0x5e0 drivers/infiniband/core/nldev.c:1731
rdma_nl_rcv_msg+0x371/0x6a0 drivers/infiniband/core/netlink.c:195
rdma_nl_rcv_skb.constprop.0.isra.0+0x2fc/0x440 drivers/infiniband/core/netlink.c:239
netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline]
netlink_unicast+0x547/0x7f0 net/netlink/af_netlink.c:1365
netlink_sendmsg+0x925/0xe30 net/netlink/af_netlink.c:1913
sock_sendmsg_nosec net/socket.c:724 [inline]
sock_sendmsg+0xde/0x190 net/socket.c:747
____sys_sendmsg+0x71c/0x900 net/socket.c:2503
___sys_sendmsg+0x110/0x1b0 net/socket.c:2557
__sys_sendmsg+0xf7/0x1c0 net/socket.c:2586
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f7a1ee8c169
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f7a1fc76168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f7a1efabf80 RCX: 00007f7a1ee8c169
RDX: 0000000000000040 RSI: 0000000020000200 RDI: 0000000000000003
RBP: 00007f7a1eee7ca1 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fffc46ccb6f R14: 00007f7a1fc76300 R15: 0000000000022000
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:flush_send_queue drivers/infiniband/sw/rxe/rxe_comp.c:597 [inline]
RIP: 0010:rxe_completer+0x255c/0x3cc0 drivers/infiniband/sw/rxe/rxe_comp.c:653
Code: 80 3c 02 00 0f 85 81 10 00 00 49 8b af 88 03 00 00 48 8d 45 30 48 89 c2 48 89 04 24 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 83 11 00 00 48 8d 45 2c 44 8b
RSP: 0018:ffffc9000419e938 EFLAGS: 00010206
RAX: dffffc0000000000 RBX: ffffed100f5fb800 RCX: 0000000000000000
RDX: 0000000000000006 RSI: ffffffff877f3bea RDI: ffff88807afdc388
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: fffffbfff1cf4e42 R11: 205d313330355420 R12: ffff88807afdc1a0
R13: 0000000000000000 R14: 0000000000000000 R15: ffff88807afdc000
FS: 00007f7a1fc76700(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000c001136000 CR3: 00000000206d3000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1)
4: 0f 85 81 10 00 00 jne 0x108b
a: 49 8b af 88 03 00 00 mov 0x388(%r15),%rbp
11: 48 8d 45 30 lea 0x30(%rbp),%rax
15: 48 89 c2 mov %rax,%rdx
18: 48 89 04 24 mov %rax,(%rsp)
1c: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
23: fc ff df
26: 48 c1 ea 03 shr $0x3,%rdx
* 2a: 0f b6 04 02 movzbl (%rdx,%rax,1),%eax <-- trapping instruction
2e: 84 c0 test %al,%al
30: 74 08 je 0x3a
32: 3c 03 cmp $0x3,%al
34: 0f 8e 83 11 00 00 jle 0x11bd
3a: 48 8d 45 2c lea 0x2c(%rbp),%rax
3e: 44 rex.R
3f: 8b .byte 0x8b
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-and-tested-by: [email protected]
Tested on:
commit: ab87603b net: wwan: t7xx: Ensure init is completed bef..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git
console output: https://syzkaller.appspot.com/x/log.txt?x=11bbc7d6280000
kernel config: https://syzkaller.appspot.com/x/.config?x=eb92acf166a5d2cd
dashboard link: https://syzkaller.appspot.com/bug?extid=eba589d8f49c73d356da
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
patch: https://syzkaller.appspot.com/x/patch.diff?x=1146610e280000
Note: testing is done by a robot and is best-effort only.
Hello,
syzbot tried to test the proposed patch but the build/boot failed:
failed to apply patch:
checking file drivers/infiniband/sw/rxe/rxe_qp.c
patch: **** unexpected end of file in patch
Tested on:
commit: 56518a60 RDMA/hns: Modify the value of long message lo..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma.git for-rc
dashboard link: https://syzkaller.appspot.com/bug?extid=eba589d8f49c73d356da
compiler:
patch: https://syzkaller.appspot.com/x/patch.diff?x=132bea5a280000
On 5/18/23 17:20, syzbot wrote:
> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: ab87603b2511 net: wwan: t7xx: Ensure init is completed bef..
> git tree: net
> console output: https://syzkaller.appspot.com/x/log.txt?x=1157266a280000
> kernel config: https://syzkaller.appspot.com/x/.config?x=eb92acf166a5d2cd
> dashboard link: https://syzkaller.appspot.com/bug?extid=eba589d8f49c73d356da
> compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=124d5da6280000
>
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/ac3ed2228400/disk-ab87603b.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/c51b74034116/vmlinux-ab87603b.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/98ab9d7ee1ee/bzImage-ab87603b.xz
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: [email protected]
>
> infiniband syz2: set active
> infiniband syz2: added team0
> INFO: trying to register non-static key.
> The code is fine but needs lockdep annotation, or maybe
> you didn't initialize this object before use?
> turning off the locking correctness validator.
> CPU: 0 PID: 5133 Comm: syz-executor.3 Not tainted 6.4.0-rc1-syzkaller-00136-gab87603b2511 #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023
> Call Trace:
> <TASK>
> __dump_stack lib/dump_stack.c:88 [inline]
> dump_stack_lvl+0xd9/0x150 lib/dump_stack.c:106
> assign_lock_key kernel/locking/lockdep.c:982 [inline]
> register_lock_class+0xdb6/0x1120 kernel/locking/lockdep.c:1295
> __lock_acquire+0x10a/0x5df0 kernel/locking/lockdep.c:4951
> lock_acquire kernel/locking/lockdep.c:5691 [inline]
> lock_acquire+0x1b1/0x520 kernel/locking/lockdep.c:5656
> __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
> _raw_spin_lock_irqsave+0x3d/0x60 kernel/locking/spinlock.c:162
> skb_dequeue+0x20/0x180 net/core/skbuff.c:3639
> drain_resp_pkts drivers/infiniband/sw/rxe/rxe_comp.c:555 [inline]
> rxe_completer+0x250d/0x3cc0 drivers/infiniband/sw/rxe/rxe_comp.c:652
> rxe_qp_do_cleanup+0x1be/0x820 drivers/infiniband/sw/rxe/rxe_qp.c:761
> execute_in_process_context+0x3b/0x150 kernel/workqueue.c:3473
> __rxe_cleanup+0x21e/0x370 drivers/infiniband/sw/rxe/rxe_pool.c:233
> rxe_create_qp+0x3f6/0x5f0 drivers/infiniband/sw/rxe/rxe_verbs.c:583
> create_qp+0x5ac/0x970 drivers/infiniband/core/verbs.c:1235
> ib_create_qp_kernel+0xa1/0x310 drivers/infiniband/core/verbs.c:1346
> ib_create_qp include/rdma/ib_verbs.h:3743 [inline]
> create_mad_qp+0x177/0x380 drivers/infiniband/core/mad.c:2905
> ib_mad_port_open drivers/infiniband/core/mad.c:2986 [inline]
> ib_mad_init_device+0xf40/0x1a90 drivers/infiniband/core/mad.c:3077
> add_client_context+0x405/0x5e0 drivers/infiniband/core/device.c:721
> enable_device_and_get+0x1cd/0x3b0 drivers/infiniband/core/device.c:1332
> ib_register_device drivers/infiniband/core/device.c:1420 [inline]
> ib_register_device+0x8b1/0xbc0 drivers/infiniband/core/device.c:1366
> rxe_register_device+0x302/0x3e0 drivers/infiniband/sw/rxe/rxe_verbs.c:1485
> rxe_net_add+0x90/0xf0 drivers/infiniband/sw/rxe/rxe_net.c:527
> rxe_newlink+0xf0/0x1b0 drivers/infiniband/sw/rxe/rxe.c:197
> nldev_newlink+0x332/0x5e0 drivers/infiniband/core/nldev.c:1731
> rdma_nl_rcv_msg+0x371/0x6a0 drivers/infiniband/core/netlink.c:195
> rdma_nl_rcv_skb.constprop.0.isra.0+0x2fc/0x440 drivers/infiniband/core/netlink.c:239
> netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline]
> netlink_unicast+0x547/0x7f0 net/netlink/af_netlink.c:1365
> netlink_sendmsg+0x925/0xe30 net/netlink/af_netlink.c:1913
> sock_sendmsg_nosec net/socket.c:724 [inline]
> sock_sendmsg+0xde/0x190 net/socket.c:747
> ____sys_sendmsg+0x71c/0x900 net/socket.c:2503
> ___sys_sendmsg+0x110/0x1b0 net/socket.c:2557
> __sys_sendmsg+0xf7/0x1c0 net/socket.c:2586
> do_syscall_x64 arch/x86/entry/common.c:50 [inline]
> do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
> entry_SYSCALL_64_after_hwframe+0x63/0xcd
> RIP: 0033:0x7f7a1ee8c169
> Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
> RSP: 002b:00007f7a1fc76168 EFLAGS: 00000246
> ORIG_RAX: 000000000000002e
> RAX: ffffffffffffffda RBX: 00007f7a1efabf80 RCX: 00007f7a1ee8c169
> RDX: 0000000000000040 RSI: 0000000020000200 RDI: 0000000000000003
> RBP: 00007f7a1eee7ca1 R08: 0000000000000000 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
> R13: 00007fffc46ccb6f R14: 00007f7a1fc76300 R15: 0000000000022000
> </TASK>
> general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN
> KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037]
> CPU: 0 PID: 5133 Comm: syz-executor.3 Not tainted 6.4.0-rc1-syzkaller-00136-gab87603b2511 #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023
> RIP: 0010:flush_send_queue drivers/infiniband/sw/rxe/rxe_comp.c:597 [inline]
> RIP: 0010:rxe_completer+0x255c/0x3cc0 drivers/infiniband/sw/rxe/rxe_comp.c:653
> Code: 80 3c 02 00 0f 85 81 10 00 00 49 8b af 88 03 00 00 48 8d 45 30 48 89 c2 48 89 04 24 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 83 11 00 00 48 8d 45 2c 44 8b
> RSP: 0018:ffffc9000419e938 EFLAGS: 00010206
> RAX: dffffc0000000000 RBX: ffffed100f5fb800 RCX: 0000000000000000
> RDX: 0000000000000006 RSI: ffffffff877f3bea RDI: ffff88807afdc388
> RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
> R10: fffffbfff1cf4e42 R11: 205d313330355420 R12: ffff88807afdc1a0
> R13: 0000000000000000 R14: 0000000000000000 R15: ffff88807afdc000
> FS: 00007f7a1fc76700(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 000000c001136000 CR3: 00000000206d3000 CR4: 00000000003506f0
> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> Call Trace:
> <TASK>
> rxe_qp_do_cleanup+0x1be/0x820 drivers/infiniband/sw/rxe/rxe_qp.c:761
> execute_in_process_context+0x3b/0x150 kernel/workqueue.c:3473
> __rxe_cleanup+0x21e/0x370 drivers/infiniband/sw/rxe/rxe_pool.c:233
> rxe_create_qp+0x3f6/0x5f0 drivers/infiniband/sw/rxe/rxe_verbs.c:583
> create_qp+0x5ac/0x970 drivers/infiniband/core/verbs.c:1235
> ib_create_qp_kernel+0xa1/0x310 drivers/infiniband/core/verbs.c:1346
> ib_create_qp include/rdma/ib_verbs.h:3743 [inline]
> create_mad_qp+0x177/0x380 drivers/infiniband/core/mad.c:2905
> ib_mad_port_open drivers/infiniband/core/mad.c:2986 [inline]
> ib_mad_init_device+0xf40/0x1a90 drivers/infiniband/core/mad.c:3077
> add_client_context+0x405/0x5e0 drivers/infiniband/core/device.c:721
> enable_device_and_get+0x1cd/0x3b0 drivers/infiniband/core/device.c:1332
> ib_register_device drivers/infiniband/core/device.c:1420 [inline]
> ib_register_device+0x8b1/0xbc0 drivers/infiniband/core/device.c:1366
> rxe_register_device+0x302/0x3e0 drivers/infiniband/sw/rxe/rxe_verbs.c:1485
> rxe_net_add+0x90/0xf0 drivers/infiniband/sw/rxe/rxe_net.c:527
> rxe_newlink+0xf0/0x1b0 drivers/infiniband/sw/rxe/rxe.c:197
> nldev_newlink+0x332/0x5e0 drivers/infiniband/core/nldev.c:1731
> rdma_nl_rcv_msg+0x371/0x6a0 drivers/infiniband/core/netlink.c:195
> rdma_nl_rcv_skb.constprop.0.isra.0+0x2fc/0x440 drivers/infiniband/core/netlink.c:239
> netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline]
> netlink_unicast+0x547/0x7f0 net/netlink/af_netlink.c:1365
> netlink_sendmsg+0x925/0xe30 net/netlink/af_netlink.c:1913
> sock_sendmsg_nosec net/socket.c:724 [inline]
> sock_sendmsg+0xde/0x190 net/socket.c:747
> ____sys_sendmsg+0x71c/0x900 net/socket.c:2503
> ___sys_sendmsg+0x110/0x1b0 net/socket.c:2557
> __sys_sendmsg+0xf7/0x1c0 net/socket.c:2586
> do_syscall_x64 arch/x86/entry/common.c:50 [inline]
> do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
> entry_SYSCALL_64_after_hwframe+0x63/0xcd
> RIP: 0033:0x7f7a1ee8c169
> Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
> RSP: 002b:00007f7a1fc76168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
> RAX: ffffffffffffffda RBX: 00007f7a1efabf80 RCX: 00007f7a1ee8c169
> RDX: 0000000000000040 RSI: 0000000020000200 RDI: 0000000000000003
> RBP: 00007f7a1eee7ca1 R08: 0000000000000000 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
> R13: 00007fffc46ccb6f R14: 00007f7a1fc76300 R15: 0000000000022000
> </TASK>
> Modules linked in:
> ---[ end trace 0000000000000000 ]---
> RIP: 0010:flush_send_queue drivers/infiniband/sw/rxe/rxe_comp.c:597 [inline]
> RIP: 0010:rxe_completer+0x255c/0x3cc0 drivers/infiniband/sw/rxe/rxe_comp.c:653
Looks if rxe_qp_from_init returns failure, qp->sq.queue is NULL but rxe
still de-reference it during cleanup. And it is the same for sk_buff_head.
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma.git
for-rc
diff --git a/drivers/infiniband/sw/rxe/rxe_qp.c
b/drivers/infiniband/sw/rxe/rxe_qp.c
index 61a2eb77d999..17ed41309756 100644
--- a/drivers/infiniband/sw/rxe/rxe_qp.c
+++ b/drivers/infiniband/sw/rxe/rxe_qp.c
@@ -758,19 +758,21 @@ static void rxe_qp_do_cleanup(struct work_struct
*work)
del_timer_sync(&qp->rnr_nak_timer);
}
- if (qp->resp.task.func)
+ /* flush out any receive wr's or pending requests */
+ if (qp->resp.task.func) {
rxe_cleanup_task(&qp->resp.task);
+ rxe_responder(qp);
+ }
- if (qp->req.task.func)
+ if (qp->req.task.func) {
rxe_cleanup_task(&qp->req.task);
+ rxe_requester(qp);
+ }
- if (qp->comp.task.func)
+ if (qp->comp.task.func) {
rxe_cleanup_task(&qp->comp.task);
-
- /* flush out any receive wr's or pending requests */
- rxe_requester(qp);
- rxe_completer(qp);
- rxe_responder(qp);
+ rxe_completer(qp);
+ }
if (qp->sq.queue)
rxe_queue_cleanup(qp->sq.queue);
On 5/23/23 10:13, syzbot wrote:
> Hello,
>
> syzbot tried to test the proposed patch but the build/boot failed:
>
> failed to apply patch:
> checking file drivers/infiniband/sw/rxe/rxe_qp.c
> patch: **** unexpected end of file in patch
>
>
>
> Tested on:
>
> commit: 56518a60 RDMA/hns: Modify the value of long message lo..
> git tree: git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma.git for-rc
> dashboard link: https://syzkaller.appspot.com/bug?extid=eba589d8f49c73d356da
> compiler:
> patch: https://syzkaller.appspot.com/x/patch.diff?x=132bea5a280000
>
Sorry, let me attach the temp patch.
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma.git
for-rc
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-and-tested-by: [email protected]
Tested on:
commit: 56518a60 RDMA/hns: Modify the value of long message lo..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma.git for-rc
console output: https://syzkaller.appspot.com/x/log.txt?x=1100bb5e280000
kernel config: https://syzkaller.appspot.com/x/.config?x=8bc832f563d8bf38
dashboard link: https://syzkaller.appspot.com/bug?extid=eba589d8f49c73d356da
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
patch: https://syzkaller.appspot.com/x/patch.diff?x=10847e2e280000
Note: testing is done by a robot and is best-effort only.
On 5/23/23 11:47, Zhu Yanjun wrote:
> On Tue, May 23, 2023 at 10:26 AM Guoqing Jiang <[email protected]> wrote:
>>
>>
>> On 5/23/23 10:13, syzbot wrote:
>>> Hello,
>>>
>>> syzbot tried to test the proposed patch but the build/boot failed:
>>>
>>> failed to apply patch:
>>> checking file drivers/infiniband/sw/rxe/rxe_qp.c
>>> patch: **** unexpected end of file in patch
> This is not the root cause. The fix is not good.
Could you explain about the root cause?
Thanks,
Guoqing
On 5/23/23 12:02, Zhu Yanjun wrote:
> On Tue, May 23, 2023 at 11:47 AM Zhu Yanjun <[email protected]> wrote:
>> On Tue, May 23, 2023 at 10:26 AM Guoqing Jiang <[email protected]> wrote:
>>>
>>>
>>> On 5/23/23 10:13, syzbot wrote:
>>>> Hello,
>>>>
>>>> syzbot tried to test the proposed patch but the build/boot failed:
>>>>
>>>> failed to apply patch:
>>>> checking file drivers/infiniband/sw/rxe/rxe_qp.c
>>>> patch: **** unexpected end of file in patch
>> This is not the root cause. The fix is not good.
> This problem is about "INFO: trying to register non-static key. The
> code is fine but needs lockdep annotation, or maybe"
Which is caused by "skb_queue_head_init(&qp->resp_pkts)" is not called
given rxe_qp_init_resp returns error, but the cleanup still trigger the
chain.
rxe_qp_do_cleanup -> rxe_completer -> drain_resp_pkts ->
skb_dequeue(&qp->resp_pkts)
But I might misunderstood it ...
Thanks,
Guoqing
On Tue, May 23, 2023 at 11:47 AM Zhu Yanjun <[email protected]> wrote:
>
> On Tue, May 23, 2023 at 10:26 AM Guoqing Jiang <[email protected]> wrote:
> >
> >
> >
> > On 5/23/23 10:13, syzbot wrote:
> > > Hello,
> > >
> > > syzbot tried to test the proposed patch but the build/boot failed:
> > >
> > > failed to apply patch:
> > > checking file drivers/infiniband/sw/rxe/rxe_qp.c
> > > patch: **** unexpected end of file in patch
>
> This is not the root cause. The fix is not good.
This problem is about "INFO: trying to register non-static key. The
code is fine but needs lockdep annotation, or maybe"
Zhu Yanjun
>
> Zhu Yanjun
>
> > >
> > >
> > >
> > > Tested on:
> > >
> > > commit: 56518a60 RDMA/hns: Modify the value of long message lo..
> > > git tree: git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma.git for-rc
> > > dashboard link: https://syzkaller.appspot.com/bug?extid=eba589d8f49c73d356da
> > > compiler:
> > > patch: https://syzkaller.appspot.com/x/patch.diff?x=132bea5a280000
> > >
> >
> > Sorry, let me attach the temp patch.
> >
> > #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma.git
> > for-rc
On Tue, May 23, 2023 at 12:10 PM Guoqing Jiang <[email protected]> wrote:
>
>
>
> On 5/23/23 12:02, Zhu Yanjun wrote:
> > On Tue, May 23, 2023 at 11:47 AM Zhu Yanjun <[email protected]> wrote:
> >> On Tue, May 23, 2023 at 10:26 AM Guoqing Jiang <[email protected]> wrote:
> >>>
> >>>
> >>> On 5/23/23 10:13, syzbot wrote:
> >>>> Hello,
> >>>>
> >>>> syzbot tried to test the proposed patch but the build/boot failed:
> >>>>
> >>>> failed to apply patch:
> >>>> checking file drivers/infiniband/sw/rxe/rxe_qp.c
> >>>> patch: **** unexpected end of file in patch
> >> This is not the root cause. The fix is not good.
> > This problem is about "INFO: trying to register non-static key. The
> > code is fine but needs lockdep annotation, or maybe"
This warning is from "lock is not initialized". This is a
use-before-initialized problem.
The correct fix is to initialize the lock that is complained before it is used.
Zhu Yanjun
>
> Which is caused by "skb_queue_head_init(&qp->resp_pkts)" is not called
> given rxe_qp_init_resp returns error, but the cleanup still trigger the
> chain.
>
> rxe_qp_do_cleanup -> rxe_completer -> drain_resp_pkts ->
> skb_dequeue(&qp->resp_pkts)
>
> But I might misunderstood it ...
>
> Thanks,
> Guoqing
On Tue, May 23, 2023 at 10:26 AM Guoqing Jiang <[email protected]> wrote:
>
>
>
> On 5/23/23 10:13, syzbot wrote:
> > Hello,
> >
> > syzbot tried to test the proposed patch but the build/boot failed:
> >
> > failed to apply patch:
> > checking file drivers/infiniband/sw/rxe/rxe_qp.c
> > patch: **** unexpected end of file in patch
This is not the root cause. The fix is not good.
Zhu Yanjun
> >
> >
> >
> > Tested on:
> >
> > commit: 56518a60 RDMA/hns: Modify the value of long message lo..
> > git tree: git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma.git for-rc
> > dashboard link: https://syzkaller.appspot.com/bug?extid=eba589d8f49c73d356da
> > compiler:
> > patch: https://syzkaller.appspot.com/x/patch.diff?x=132bea5a280000
> >
>
> Sorry, let me attach the temp patch.
>
> #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma.git
> for-rc
On Tue, May 23, 2023 at 12:29 PM Zhu Yanjun <[email protected]> wrote:
>
> On Tue, May 23, 2023 at 12:10 PM Guoqing Jiang <[email protected]> wrote:
> >
> >
> >
> > On 5/23/23 12:02, Zhu Yanjun wrote:
> > > On Tue, May 23, 2023 at 11:47 AM Zhu Yanjun <[email protected]> wrote:
> > >> On Tue, May 23, 2023 at 10:26 AM Guoqing Jiang <[email protected]> wrote:
> > >>>
> > >>>
> > >>> On 5/23/23 10:13, syzbot wrote:
> > >>>> Hello,
> > >>>>
> > >>>> syzbot tried to test the proposed patch but the build/boot failed:
> > >>>>
> > >>>> failed to apply patch:
> > >>>> checking file drivers/infiniband/sw/rxe/rxe_qp.c
> > >>>> patch: **** unexpected end of file in patch
> > >> This is not the root cause. The fix is not good.
> > > This problem is about "INFO: trying to register non-static key. The
> > > code is fine but needs lockdep annotation, or maybe"
>
> This warning is from "lock is not initialized". This is a
> use-before-initialized problem.
> The correct fix is to initialize the lock that is complained before it is used.
>
> Zhu Yanjun
Based on the call trace, the followings are the order of this call trace.
291 /* called by the create qp verb */
292 int rxe_qp_from_init(struct rxe_dev *rxe, struct rxe_qp *qp,
struct rxe_pd *pd,
297 {
...
317 rxe_qp_init_misc(rxe, qp, init);
...
322
323 err = rxe_qp_init_resp(rxe, qp, init, udata, uresp);
324 if (err)
325 goto err2; <--- error
...
334 err2:
335 rxe_queue_cleanup(qp->sq.queue); <--- Goto here
336 qp->sq.queue = NULL;
In rxe_qp_init_resp, the error occurs before skb_queue_head_init.
So this call trace appeared.
Zhu Yanjun
> >
> > Which is caused by "skb_queue_head_init(&qp->resp_pkts)" is not called
> > given rxe_qp_init_resp returns error, but the cleanup still trigger the
> > chain.
> >
> > rxe_qp_do_cleanup -> rxe_completer -> drain_resp_pkts ->
> > skb_dequeue(&qp->resp_pkts)
> >
> > But I might misunderstood it ...
> >
> > Thanks,
> > Guoqing
On Tue, May 23, 2023 at 1:08 PM Zhu Yanjun <[email protected]> wrote:
>
> On Tue, May 23, 2023 at 12:29 PM Zhu Yanjun <[email protected]> wrote:
> >
> > On Tue, May 23, 2023 at 12:10 PM Guoqing Jiang <[email protected]> wrote:
> > >
> > >
> > >
> > > On 5/23/23 12:02, Zhu Yanjun wrote:
> > > > On Tue, May 23, 2023 at 11:47 AM Zhu Yanjun <[email protected]> wrote:
> > > >> On Tue, May 23, 2023 at 10:26 AM Guoqing Jiang <[email protected]> wrote:
> > > >>>
> > > >>>
> > > >>> On 5/23/23 10:13, syzbot wrote:
> > > >>>> Hello,
> > > >>>>
> > > >>>> syzbot tried to test the proposed patch but the build/boot failed:
> > > >>>>
> > > >>>> failed to apply patch:
> > > >>>> checking file drivers/infiniband/sw/rxe/rxe_qp.c
> > > >>>> patch: **** unexpected end of file in patch
> > > >> This is not the root cause. The fix is not good.
> > > > This problem is about "INFO: trying to register non-static key. The
> > > > code is fine but needs lockdep annotation, or maybe"
> >
> > This warning is from "lock is not initialized". This is a
> > use-before-initialized problem.
> > The correct fix is to initialize the lock that is complained before it is used.
> >
> > Zhu Yanjun
>
> Based on the call trace, the followings are the order of this call trace.
>
> 291 /* called by the create qp verb */
> 292 int rxe_qp_from_init(struct rxe_dev *rxe, struct rxe_qp *qp,
> struct rxe_pd *pd,
> 297 {
> ...
> 317 rxe_qp_init_misc(rxe, qp, init);
> ...
> 322
> 323 err = rxe_qp_init_resp(rxe, qp, init, udata, uresp);
> 324 if (err)
> 325 goto err2; <--- error
>
> ...
>
> 334 err2:
> 335 rxe_queue_cleanup(qp->sq.queue); <--- Goto here
> 336 qp->sq.queue = NULL;
>
> In rxe_qp_init_resp, the error occurs before skb_queue_head_init.
> So this call trace appeared.
250 static int rxe_qp_init_resp(struct rxe_dev *rxe, struct rxe_qp *qp,
254 {
...
264
265 type = QUEUE_TYPE_FROM_CLIENT;
266 qp->rq.queue = rxe_queue_init(rxe, &qp->rq.max_wr,
267 wqe_size, type);
268 if (!qp->rq.queue)
269 return -ENOMEM; <---Error here
270
...
282 skb_queue_head_init(&qp->resp_pkts); <-this is not called.
...
This will make spin_lock of resp_pkts is used before initialized.
Zhu Yanjun
>
> Zhu Yanjun
>
> > >
> > > Which is caused by "skb_queue_head_init(&qp->resp_pkts)" is not called
> > > given rxe_qp_init_resp returns error, but the cleanup still trigger the
> > > chain.
> > >
> > > rxe_qp_do_cleanup -> rxe_completer -> drain_resp_pkts ->
> > > skb_dequeue(&qp->resp_pkts)
> > >
> > > But I might misunderstood it ...
> > >
> > > Thanks,
> > > Guoqing
On 5/23/23 13:18, Zhu Yanjun wrote:
> On Tue, May 23, 2023 at 1:08 PM Zhu Yanjun <[email protected]> wrote:
>> On Tue, May 23, 2023 at 12:29 PM Zhu Yanjun <[email protected]> wrote:
>>> On Tue, May 23, 2023 at 12:10 PM Guoqing Jiang <[email protected]> wrote:
>>>>
>>>>
>>>> On 5/23/23 12:02, Zhu Yanjun wrote:
>>>>> On Tue, May 23, 2023 at 11:47 AM Zhu Yanjun <[email protected]> wrote:
>>>>>> On Tue, May 23, 2023 at 10:26 AM Guoqing Jiang <[email protected]> wrote:
>>>>>>>
>>>>>>> On 5/23/23 10:13, syzbot wrote:
>>>>>>>> Hello,
>>>>>>>>
>>>>>>>> syzbot tried to test the proposed patch but the build/boot failed:
>>>>>>>>
>>>>>>>> failed to apply patch:
>>>>>>>> checking file drivers/infiniband/sw/rxe/rxe_qp.c
>>>>>>>> patch: **** unexpected end of file in patch
>>>>>> This is not the root cause. The fix is not good.
>>>>> This problem is about "INFO: trying to register non-static key. The
>>>>> code is fine but needs lockdep annotation, or maybe"
>>> This warning is from "lock is not initialized". This is a
>>> use-before-initialized problem.
>>> The correct fix is to initialize the lock that is complained before it is used.
>>>
>>> Zhu Yanjun
>> Based on the call trace, the followings are the order of this call trace.
>>
>> 291 /* called by the create qp verb */
>> 292 int rxe_qp_from_init(struct rxe_dev *rxe, struct rxe_qp *qp,
>> struct rxe_pd *pd,
>> 297 {
>> ...
>> 317 rxe_qp_init_misc(rxe, qp, init);
>> ...
>> 322
>> 323 err = rxe_qp_init_resp(rxe, qp, init, udata, uresp);
>> 324 if (err)
>> 325 goto err2; <--- error
>>
>> ...
>>
>> 334 err2:
>> 335 rxe_queue_cleanup(qp->sq.queue); <--- Goto here
>> 336 qp->sq.queue = NULL;
>>
>> In rxe_qp_init_resp, the error occurs before skb_queue_head_init.
>> So this call trace appeared.
> 250 static int rxe_qp_init_resp(struct rxe_dev *rxe, struct rxe_qp *qp,
> 254 {
> ...
> 264
> 265 type = QUEUE_TYPE_FROM_CLIENT;
> 266 qp->rq.queue = rxe_queue_init(rxe, &qp->rq.max_wr,
> 267 wqe_size, type);
> 268 if (!qp->rq.queue)
> 269 return -ENOMEM; <---Error here
> 270
>
> ...
>
> 282 skb_queue_head_init(&qp->resp_pkts); <-this is not called.
> ...
> This will make spin_lock of resp_pkts is used before initialized.
IMHO, the above is same as
> Which is caused by "skb_queue_head_init(&qp->resp_pkts)" is not called
> given rxe_qp_init_resp returns error, but the cleanup still trigger the
> chain.
>
> rxe_qp_do_cleanup -> rxe_completer -> drain_resp_pkts ->
> skb_dequeue(&qp->resp_pkts)
my previous analysis. If not, could you provide another better way to
fix it?
Guoqing
On 5/23/23 12:29, Zhu Yanjun wrote:
> On Tue, May 23, 2023 at 12:10 PM Guoqing Jiang <[email protected]> wrote:
>>
>>
>> On 5/23/23 12:02, Zhu Yanjun wrote:
>>> On Tue, May 23, 2023 at 11:47 AM Zhu Yanjun <[email protected]> wrote:
>>>> On Tue, May 23, 2023 at 10:26 AM Guoqing Jiang <[email protected]> wrote:
>>>>>
>>>>> On 5/23/23 10:13, syzbot wrote:
>>>>>> Hello,
>>>>>>
>>>>>> syzbot tried to test the proposed patch but the build/boot failed:
>>>>>>
>>>>>> failed to apply patch:
>>>>>> checking file drivers/infiniband/sw/rxe/rxe_qp.c
>>>>>> patch: **** unexpected end of file in patch
>>>> This is not the root cause. The fix is not good.
>>> This problem is about "INFO: trying to register non-static key. The
>>> code is fine but needs lockdep annotation, or maybe"
> This warning is from "lock is not initialized". This is a
> use-before-initialized problem.
Right, and it also applies to qp->sq.queue which is set to NULL while do
cleanup
still de-reference it.
> The correct fix is to initialize the lock that is complained before it is used.
The thing is it can't be initialized due to error, so I guess you want
to always init them
even for error cases.
Guoqing
On Tue, May 23, 2023 at 1:50 PM Guoqing Jiang <[email protected]> wrote:
>
>
>
> On 5/23/23 12:29, Zhu Yanjun wrote:
> > On Tue, May 23, 2023 at 12:10 PM Guoqing Jiang <[email protected]> wrote:
> >>
> >>
> >> On 5/23/23 12:02, Zhu Yanjun wrote:
> >>> On Tue, May 23, 2023 at 11:47 AM Zhu Yanjun <[email protected]> wrote:
> >>>> On Tue, May 23, 2023 at 10:26 AM Guoqing Jiang <[email protected]> wrote:
> >>>>>
> >>>>> On 5/23/23 10:13, syzbot wrote:
> >>>>>> Hello,
> >>>>>>
> >>>>>> syzbot tried to test the proposed patch but the build/boot failed:
> >>>>>>
> >>>>>> failed to apply patch:
> >>>>>> checking file drivers/infiniband/sw/rxe/rxe_qp.c
> >>>>>> patch: **** unexpected end of file in patch
> >>>> This is not the root cause. The fix is not good.
> >>> This problem is about "INFO: trying to register non-static key. The
> >>> code is fine but needs lockdep annotation, or maybe"
> > This warning is from "lock is not initialized". This is a
> > use-before-initialized problem.
>
> Right, and it also applies to qp->sq.queue which is set to NULL while do
> cleanup
> still de-reference it.
>
> > The correct fix is to initialize the lock that is complained before it is used.
>
> The thing is it can't be initialized due to error, so I guess you want
> to always init them
> even for error cases.
The complaining is about "spinlock is not initialized".
Zhu Yanjun
>
> Guoqing
On Tue, May 23, 2023 at 1:44 PM Guoqing Jiang <[email protected]> wrote:
>
>
>
> On 5/23/23 13:18, Zhu Yanjun wrote:
> > On Tue, May 23, 2023 at 1:08 PM Zhu Yanjun <[email protected]> wrote:
> >> On Tue, May 23, 2023 at 12:29 PM Zhu Yanjun <[email protected]> wrote:
> >>> On Tue, May 23, 2023 at 12:10 PM Guoqing Jiang <[email protected]> wrote:
> >>>>
> >>>>
> >>>> On 5/23/23 12:02, Zhu Yanjun wrote:
> >>>>> On Tue, May 23, 2023 at 11:47 AM Zhu Yanjun <[email protected]> wrote:
> >>>>>> On Tue, May 23, 2023 at 10:26 AM Guoqing Jiang <[email protected]> wrote:
> >>>>>>>
> >>>>>>> On 5/23/23 10:13, syzbot wrote:
> >>>>>>>> Hello,
> >>>>>>>>
> >>>>>>>> syzbot tried to test the proposed patch but the build/boot failed:
> >>>>>>>>
> >>>>>>>> failed to apply patch:
> >>>>>>>> checking file drivers/infiniband/sw/rxe/rxe_qp.c
> >>>>>>>> patch: **** unexpected end of file in patch
> >>>>>> This is not the root cause. The fix is not good.
> >>>>> This problem is about "INFO: trying to register non-static key. The
> >>>>> code is fine but needs lockdep annotation, or maybe"
> >>> This warning is from "lock is not initialized". This is a
> >>> use-before-initialized problem.
> >>> The correct fix is to initialize the lock that is complained before it is used.
> >>>
> >>> Zhu Yanjun
> >> Based on the call trace, the followings are the order of this call trace.
> >>
> >> 291 /* called by the create qp verb */
> >> 292 int rxe_qp_from_init(struct rxe_dev *rxe, struct rxe_qp *qp,
> >> struct rxe_pd *pd,
> >> 297 {
> >> ...
> >> 317 rxe_qp_init_misc(rxe, qp, init);
> >> ...
> >> 322
> >> 323 err = rxe_qp_init_resp(rxe, qp, init, udata, uresp);
> >> 324 if (err)
> >> 325 goto err2; <--- error
> >>
> >> ...
> >>
> >> 334 err2:
> >> 335 rxe_queue_cleanup(qp->sq.queue); <--- Goto here
> >> 336 qp->sq.queue = NULL;
> >>
> >> In rxe_qp_init_resp, the error occurs before skb_queue_head_init.
> >> So this call trace appeared.
> > 250 static int rxe_qp_init_resp(struct rxe_dev *rxe, struct rxe_qp *qp,
> > 254 {
> > ...
> > 264
> > 265 type = QUEUE_TYPE_FROM_CLIENT;
> > 266 qp->rq.queue = rxe_queue_init(rxe, &qp->rq.max_wr,
> > 267 wqe_size, type);
> > 268 if (!qp->rq.queue)
> > 269 return -ENOMEM; <---Error here
> > 270
> >
> > ...
> >
> > 282 skb_queue_head_init(&qp->resp_pkts); <-this is not called.
> > ...
> > This will make spin_lock of resp_pkts is used before initialized.
>
> IMHO, the above is same as
>
> > Which is caused by "skb_queue_head_init(&qp->resp_pkts)" is not called
> > given rxe_qp_init_resp returns error, but the cleanup still trigger the
> > chain.
> >
> > rxe_qp_do_cleanup -> rxe_completer -> drain_resp_pkts ->
> > skb_dequeue(&qp->resp_pkts)
>
> my previous analysis. If not, could you provide another better way to
> fix it?
Move the initialization to the beginning. This can fix this problem.
See below:
"
diff --git a/drivers/infiniband/sw/rxe/rxe_qp.c
b/drivers/infiniband/sw/rxe/rxe_qp.c
index c5451a4488ca..22ef6188d7b1 100644
--- a/drivers/infiniband/sw/rxe/rxe_qp.c
+++ b/drivers/infiniband/sw/rxe/rxe_qp.c
@@ -176,6 +176,9 @@ static void rxe_qp_init_misc(struct rxe_dev *rxe,
struct rxe_qp *qp,
spin_lock_init(&qp->rq.producer_lock);
spin_lock_init(&qp->rq.consumer_lock);
+ skb_queue_head_init(&qp->req_pkts);
+ skb_queue_head_init(&qp->resp_pkts);
+
atomic_set(&qp->ssn, 0);
atomic_set(&qp->skb_out, 0);
}
@@ -234,8 +237,6 @@ static int rxe_qp_init_req(struct rxe_dev *rxe,
struct rxe_qp *qp,
qp->req.opcode = -1;
qp->comp.opcode = -1;
- skb_queue_head_init(&qp->req_pkts);
-
rxe_init_task(&qp->req.task, qp, rxe_requester);
rxe_init_task(&qp->comp.task, qp, rxe_completer);
@@ -279,8 +280,6 @@ static int rxe_qp_init_resp(struct rxe_dev *rxe,
struct rxe_qp *qp,
}
}
- skb_queue_head_init(&qp->resp_pkts);
-
rxe_init_task(&qp->resp.task, qp, rxe_responder);
qp->resp.opcode = OPCODE_NONE;
"
>
> Guoqing
On 5/23/23 13:55, Zhu Yanjun wrote:
> On Tue, May 23, 2023 at 1:50 PM Guoqing Jiang <[email protected]> wrote:
>>
>>
>> On 5/23/23 12:29, Zhu Yanjun wrote:
>>> On Tue, May 23, 2023 at 12:10 PM Guoqing Jiang <[email protected]> wrote:
>>>>
>>>> On 5/23/23 12:02, Zhu Yanjun wrote:
>>>>> On Tue, May 23, 2023 at 11:47 AM Zhu Yanjun <[email protected]> wrote:
>>>>>> On Tue, May 23, 2023 at 10:26 AM Guoqing Jiang <[email protected]> wrote:
>>>>>>> On 5/23/23 10:13, syzbot wrote:
>>>>>>>> Hello,
>>>>>>>>
>>>>>>>> syzbot tried to test the proposed patch but the build/boot failed:
>>>>>>>>
>>>>>>>> failed to apply patch:
>>>>>>>> checking file drivers/infiniband/sw/rxe/rxe_qp.c
>>>>>>>> patch: **** unexpected end of file in patch
>>>>>> This is not the root cause. The fix is not good.
>>>>> This problem is about "INFO: trying to register non-static key. The
>>>>> code is fine but needs lockdep annotation, or maybe"
>>> This warning is from "lock is not initialized". This is a
>>> use-before-initialized problem.
>> Right, and it also applies to qp->sq.queue which is set to NULL while do
>> cleanup
>> still de-reference it.
>>
>>> The correct fix is to initialize the lock that is complained before it is used.
>> The thing is it can't be initialized due to error, so I guess you want
>> to always init them
>> even for error cases.
> The complaining is about "spinlock is not initialized".
There was another null-ptr-deref, no?
general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037]
CPU: 1 PID: 31038 Comm: syz-executor.3 Not tainted 6.3.0-syzkaller-12728-g348551ddaf31 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023
RIP: 0010:flush_send_queue drivers/infiniband/sw/rxe/rxe_comp.c:597 [inline]
RIP: 0010:rxe_completer+0x255c/0x3cc0 drivers/infiniband/sw/rxe/rxe_comp.c:653
Code: 80 3c 02 00 0f 85 81 10 00 00 49 8b af 88 03 00 00 48 8d 45 30 48 89 c2 48 89 04 24 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 83 11 00 00 48 8d 45 2c 44 8b
RSP: 0018:ffffc90003526938 EFLAGS: 00010206
RAX: dffffc0000000000 RBX: ffffed100e3fe800 RCX: ffffc9000b403000
RDX: 0000000000000006 RSI: ffffffff877e467a RDI: ffff888071ff4388
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: fffffbfff1cf3682 R11: fffffffffffda5b0 R12: ffff888071ff41a0
R13: 0000000000000000 R14: 0000000000000000 R15: ffff888071ff4000
FS: 00007fede029f700(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2d822000 CR3: 000000002c7e6000 CR4: 00000000003506e0
Call Trace:
<TASK>
rxe_qp_do_cleanup+0x1be/0x820 drivers/infiniband/sw/rxe/rxe_qp.c:761
execute_in_process_context+0x3b/0x150 kernel/workqueue.c:3473
__rxe_cleanup+0x21e/0x370 drivers/infiniband/sw/rxe/rxe_pool.c:233
rxe_create_qp+0x3f6/0x5f0 drivers/infiniband/sw/rxe/rxe_verbs.c:583
create_qp+0x5ac/0x970 drivers/infiniband/core/verbs.c:1235
ib_create_qp_kernel+0xa1/0x310 drivers/infiniband/core/verbs.c:1346
ib_create_qp include/rdma/ib_verbs.h:3743 [inline]
create_mad_qp+0x177/0x380 drivers/infiniband/core/mad.c:2905
ib_mad_port_open drivers/infiniband/core/mad.c:2986 [inline]
ib_mad_init_device+0xf40/0x1a90 drivers/infiniband/core/mad.c:3077
add_client_context+0x405/0x5e0 drivers/infiniband/core/device.c:721
enable_device_and_get+0x1cd/0x3b0 drivers/infiniband/core/device.c:1332
ib_register_device drivers/infiniband/core/device.c:1420 [inline]
ib_register_device+0x8b1/0xbc0 drivers/infiniband/core/device.c:1366
rxe_register_device+0x302/0x3e0 drivers/infiniband/sw/rxe/rxe_verbs.c:1485
rxe_net_add+0x90/0xf0 drivers/infiniband/sw/rxe/rxe_net.c:527
rxe_newlink+0xf0/0x1b0 drivers/infiniband/sw/rxe/rxe.c:197
nldev_newlink+0x332/0x5e0 drivers/infiniband/core/nldev.c:1731
rdma_nl_rcv_msg+0x371/0x6a0 drivers/infiniband/core/netlink.c:195
rdma_nl_rcv_skb.constprop.0.isra.0+0x2fc/0x440 drivers/infiniband/core/netlink.c:239
netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline]
netlink_unicast+0x547/0x7f0 net/netlink/af_netlink.c:1365
netlink_sendmsg+0x925/0xe30 net/netlink/af_netlink.c:1913
sock_sendmsg_nosec net/socket.c:724 [inline]
sock_sendmsg+0xde/0x190 net/socket.c:747
____sys_sendmsg+0x71c/0x900 net/socket.c:2503
___sys_sendmsg+0x110/0x1b0 net/socket.c:2557
__sys_sendmsg+0xf7/0x1c0 net/socket.c:2586
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7feddf48c169
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fede029f168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007feddf5abf80 RCX: 00007feddf48c169
RDX: 0000000000000000 RSI: 0000000020000240 RDI: 0000000000000003
RBP: 00007feddf4e7ca1 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffe1bb3e01f R14: 00007fede029f300 R15: 0000000000022000
</TASK>
Modules linked in:
Guoqing
On 5/23/23 13:52, Zhu Yanjun wrote:
> On Tue, May 23, 2023 at 1:44 PM Guoqing Jiang <[email protected]> wrote:
>>
>>
>> On 5/23/23 13:18, Zhu Yanjun wrote:
>>> On Tue, May 23, 2023 at 1:08 PM Zhu Yanjun <[email protected]> wrote:
>>>> On Tue, May 23, 2023 at 12:29 PM Zhu Yanjun <[email protected]> wrote:
>>>>> On Tue, May 23, 2023 at 12:10 PM Guoqing Jiang <[email protected]> wrote:
>>>>>>
>>>>>> On 5/23/23 12:02, Zhu Yanjun wrote:
>>>>>>> On Tue, May 23, 2023 at 11:47 AM Zhu Yanjun <[email protected]> wrote:
>>>>>>>> On Tue, May 23, 2023 at 10:26 AM Guoqing Jiang <[email protected]> wrote:
>>>>>>>>> On 5/23/23 10:13, syzbot wrote:
>>>>>>>>>> Hello,
>>>>>>>>>>
>>>>>>>>>> syzbot tried to test the proposed patch but the build/boot failed:
>>>>>>>>>>
>>>>>>>>>> failed to apply patch:
>>>>>>>>>> checking file drivers/infiniband/sw/rxe/rxe_qp.c
>>>>>>>>>> patch: **** unexpected end of file in patch
>>>>>>>> This is not the root cause. The fix is not good.
>>>>>>> This problem is about "INFO: trying to register non-static key. The
>>>>>>> code is fine but needs lockdep annotation, or maybe"
>>>>> This warning is from "lock is not initialized". This is a
>>>>> use-before-initialized problem.
>>>>> The correct fix is to initialize the lock that is complained before it is used.
>>>>>
>>>>> Zhu Yanjun
>>>> Based on the call trace, the followings are the order of this call trace.
>>>>
>>>> 291 /* called by the create qp verb */
>>>> 292 int rxe_qp_from_init(struct rxe_dev *rxe, struct rxe_qp *qp,
>>>> struct rxe_pd *pd,
>>>> 297 {
>>>> ...
>>>> 317 rxe_qp_init_misc(rxe, qp, init);
>>>> ...
>>>> 322
>>>> 323 err = rxe_qp_init_resp(rxe, qp, init, udata, uresp);
>>>> 324 if (err)
>>>> 325 goto err2; <--- error
>>>>
>>>> ...
>>>>
>>>> 334 err2:
>>>> 335 rxe_queue_cleanup(qp->sq.queue); <--- Goto here
>>>> 336 qp->sq.queue = NULL;
>>>>
>>>> In rxe_qp_init_resp, the error occurs before skb_queue_head_init.
>>>> So this call trace appeared.
>>> 250 static int rxe_qp_init_resp(struct rxe_dev *rxe, struct rxe_qp *qp,
>>> 254 {
>>> ...
>>> 264
>>> 265 type = QUEUE_TYPE_FROM_CLIENT;
>>> 266 qp->rq.queue = rxe_queue_init(rxe, &qp->rq.max_wr,
>>> 267 wqe_size, type);
>>> 268 if (!qp->rq.queue)
>>> 269 return -ENOMEM; <---Error here
>>> 270
>>>
>>> ...
>>>
>>> 282 skb_queue_head_init(&qp->resp_pkts); <-this is not called.
>>> ...
>>> This will make spin_lock of resp_pkts is used before initialized.
>> IMHO, the above is same as
>>
>>> Which is caused by "skb_queue_head_init(&qp->resp_pkts)" is not called
>>> given rxe_qp_init_resp returns error, but the cleanup still trigger the
>>> chain.
>>>
>>> rxe_qp_do_cleanup -> rxe_completer -> drain_resp_pkts ->
>>> skb_dequeue(&qp->resp_pkts)
>> my previous analysis. If not, could you provide another better way to
>> fix it?
> Move the initialization to the beginning. This can fix this problem.
> See below:
>
> "
> diff --git a/drivers/infiniband/sw/rxe/rxe_qp.c
> b/drivers/infiniband/sw/rxe/rxe_qp.c
> index c5451a4488ca..22ef6188d7b1 100644
> --- a/drivers/infiniband/sw/rxe/rxe_qp.c
> +++ b/drivers/infiniband/sw/rxe/rxe_qp.c
> @@ -176,6 +176,9 @@ static void rxe_qp_init_misc(struct rxe_dev *rxe,
> struct rxe_qp *qp,
> spin_lock_init(&qp->rq.producer_lock);
> spin_lock_init(&qp->rq.consumer_lock);
>
> + skb_queue_head_init(&qp->req_pkts);
> + skb_queue_head_init(&qp->resp_pkts);
> +
> atomic_set(&qp->ssn, 0);
> atomic_set(&qp->skb_out, 0);
> }
> @@ -234,8 +237,6 @@ static int rxe_qp_init_req(struct rxe_dev *rxe,
> struct rxe_qp *qp,
> qp->req.opcode = -1;
> qp->comp.opcode = -1;
>
> - skb_queue_head_init(&qp->req_pkts);
> -
> rxe_init_task(&qp->req.task, qp, rxe_requester);
> rxe_init_task(&qp->comp.task, qp, rxe_completer);
>
> @@ -279,8 +280,6 @@ static int rxe_qp_init_resp(struct rxe_dev *rxe,
> struct rxe_qp *qp,
> }
> }
>
> - skb_queue_head_init(&qp->resp_pkts);
> -
> rxe_init_task(&qp->resp.task, qp, rxe_responder);
>
> qp->resp.opcode = OPCODE_NONE;
> "
It is weird to me that init them in init_misc instead of init_req/resp,
given they
are dedicated/used for the different purpose. But just my 0.02$.
Guoqing
On Tue, May 23, 2023 at 2:00 PM Guoqing Jiang <[email protected]> wrote:
>
>
>
> On 5/23/23 13:55, Zhu Yanjun wrote:
> > On Tue, May 23, 2023 at 1:50 PM Guoqing Jiang <[email protected]> wrote:
> >>
> >>
> >> On 5/23/23 12:29, Zhu Yanjun wrote:
> >>> On Tue, May 23, 2023 at 12:10 PM Guoqing Jiang <[email protected]> wrote:
> >>>>
> >>>> On 5/23/23 12:02, Zhu Yanjun wrote:
> >>>>> On Tue, May 23, 2023 at 11:47 AM Zhu Yanjun <[email protected]> wrote:
> >>>>>> On Tue, May 23, 2023 at 10:26 AM Guoqing Jiang <[email protected]> wrote:
> >>>>>>> On 5/23/23 10:13, syzbot wrote:
> >>>>>>>> Hello,
> >>>>>>>>
> >>>>>>>> syzbot tried to test the proposed patch but the build/boot failed:
> >>>>>>>>
> >>>>>>>> failed to apply patch:
> >>>>>>>> checking file drivers/infiniband/sw/rxe/rxe_qp.c
> >>>>>>>> patch: **** unexpected end of file in patch
> >>>>>> This is not the root cause. The fix is not good.
> >>>>> This problem is about "INFO: trying to register non-static key. The
> >>>>> code is fine but needs lockdep annotation, or maybe"
> >>> This warning is from "lock is not initialized". This is a
> >>> use-before-initialized problem.
> >> Right, and it also applies to qp->sq.queue which is set to NULL while do
> >> cleanup
> >> still de-reference it.
> >>
> >>> The correct fix is to initialize the lock that is complained before it is used.
> >> The thing is it can't be initialized due to error, so I guess you want
> >> to always init them
> >> even for error cases.
> > The complaining is about "spinlock is not initialized".
>
> There was another null-ptr-deref, no?
Please show me the link. So I can delve into it.
Zhu Yanjun
>
> general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN
> KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037]
> CPU: 1 PID: 31038 Comm: syz-executor.3 Not tainted 6.3.0-syzkaller-12728-g348551ddaf31 #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023
> RIP: 0010:flush_send_queue drivers/infiniband/sw/rxe/rxe_comp.c:597 [inline]
> RIP: 0010:rxe_completer+0x255c/0x3cc0 drivers/infiniband/sw/rxe/rxe_comp.c:653
> Code: 80 3c 02 00 0f 85 81 10 00 00 49 8b af 88 03 00 00 48 8d 45 30 48 89 c2 48 89 04 24 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 83 11 00 00 48 8d 45 2c 44 8b
> RSP: 0018:ffffc90003526938 EFLAGS: 00010206
> RAX: dffffc0000000000 RBX: ffffed100e3fe800 RCX: ffffc9000b403000
> RDX: 0000000000000006 RSI: ffffffff877e467a RDI: ffff888071ff4388
> RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
> R10: fffffbfff1cf3682 R11: fffffffffffda5b0 R12: ffff888071ff41a0
> R13: 0000000000000000 R14: 0000000000000000 R15: ffff888071ff4000
> FS: 00007fede029f700(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 0000001b2d822000 CR3: 000000002c7e6000 CR4: 00000000003506e0
> Call Trace:
> <TASK>
> rxe_qp_do_cleanup+0x1be/0x820 drivers/infiniband/sw/rxe/rxe_qp.c:761
> execute_in_process_context+0x3b/0x150 kernel/workqueue.c:3473
> __rxe_cleanup+0x21e/0x370 drivers/infiniband/sw/rxe/rxe_pool.c:233
> rxe_create_qp+0x3f6/0x5f0 drivers/infiniband/sw/rxe/rxe_verbs.c:583
> create_qp+0x5ac/0x970 drivers/infiniband/core/verbs.c:1235
> ib_create_qp_kernel+0xa1/0x310 drivers/infiniband/core/verbs.c:1346
> ib_create_qp include/rdma/ib_verbs.h:3743 [inline]
> create_mad_qp+0x177/0x380 drivers/infiniband/core/mad.c:2905
> ib_mad_port_open drivers/infiniband/core/mad.c:2986 [inline]
> ib_mad_init_device+0xf40/0x1a90 drivers/infiniband/core/mad.c:3077
> add_client_context+0x405/0x5e0 drivers/infiniband/core/device.c:721
> enable_device_and_get+0x1cd/0x3b0 drivers/infiniband/core/device.c:1332
> ib_register_device drivers/infiniband/core/device.c:1420 [inline]
> ib_register_device+0x8b1/0xbc0 drivers/infiniband/core/device.c:1366
> rxe_register_device+0x302/0x3e0 drivers/infiniband/sw/rxe/rxe_verbs.c:1485
> rxe_net_add+0x90/0xf0 drivers/infiniband/sw/rxe/rxe_net.c:527
> rxe_newlink+0xf0/0x1b0 drivers/infiniband/sw/rxe/rxe.c:197
> nldev_newlink+0x332/0x5e0 drivers/infiniband/core/nldev.c:1731
> rdma_nl_rcv_msg+0x371/0x6a0 drivers/infiniband/core/netlink.c:195
> rdma_nl_rcv_skb.constprop.0.isra.0+0x2fc/0x440 drivers/infiniband/core/netlink.c:239
> netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline]
> netlink_unicast+0x547/0x7f0 net/netlink/af_netlink.c:1365
> netlink_sendmsg+0x925/0xe30 net/netlink/af_netlink.c:1913
> sock_sendmsg_nosec net/socket.c:724 [inline]
> sock_sendmsg+0xde/0x190 net/socket.c:747
> ____sys_sendmsg+0x71c/0x900 net/socket.c:2503
> ___sys_sendmsg+0x110/0x1b0 net/socket.c:2557
> __sys_sendmsg+0xf7/0x1c0 net/socket.c:2586
> do_syscall_x64 arch/x86/entry/common.c:50 [inline]
> do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
> entry_SYSCALL_64_after_hwframe+0x63/0xcd
> RIP: 0033:0x7feddf48c169
> Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
> RSP: 002b:00007fede029f168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
> RAX: ffffffffffffffda RBX: 00007feddf5abf80 RCX: 00007feddf48c169
> RDX: 0000000000000000 RSI: 0000000020000240 RDI: 0000000000000003
> RBP: 00007feddf4e7ca1 R08: 0000000000000000 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
> R13: 00007ffe1bb3e01f R14: 00007fede029f300 R15: 0000000000022000
> </TASK>
> Modules linked in:
>
>
> Guoqing
>
On Tue, May 23, 2023 at 1:56 PM Guoqing Jiang <[email protected]> wrote:
>
>
>
> On 5/23/23 13:52, Zhu Yanjun wrote:
> > On Tue, May 23, 2023 at 1:44 PM Guoqing Jiang <[email protected]> wrote:
> >>
> >>
> >> On 5/23/23 13:18, Zhu Yanjun wrote:
> >>> On Tue, May 23, 2023 at 1:08 PM Zhu Yanjun <[email protected]> wrote:
> >>>> On Tue, May 23, 2023 at 12:29 PM Zhu Yanjun <[email protected]> wrote:
> >>>>> On Tue, May 23, 2023 at 12:10 PM Guoqing Jiang <[email protected]> wrote:
> >>>>>>
> >>>>>> On 5/23/23 12:02, Zhu Yanjun wrote:
> >>>>>>> On Tue, May 23, 2023 at 11:47 AM Zhu Yanjun <[email protected]> wrote:
> >>>>>>>> On Tue, May 23, 2023 at 10:26 AM Guoqing Jiang <[email protected]> wrote:
> >>>>>>>>> On 5/23/23 10:13, syzbot wrote:
> >>>>>>>>>> Hello,
> >>>>>>>>>>
> >>>>>>>>>> syzbot tried to test the proposed patch but the build/boot failed:
> >>>>>>>>>>
> >>>>>>>>>> failed to apply patch:
> >>>>>>>>>> checking file drivers/infiniband/sw/rxe/rxe_qp.c
> >>>>>>>>>> patch: **** unexpected end of file in patch
> >>>>>>>> This is not the root cause. The fix is not good.
> >>>>>>> This problem is about "INFO: trying to register non-static key. The
> >>>>>>> code is fine but needs lockdep annotation, or maybe"
> >>>>> This warning is from "lock is not initialized". This is a
> >>>>> use-before-initialized problem.
> >>>>> The correct fix is to initialize the lock that is complained before it is used.
> >>>>>
> >>>>> Zhu Yanjun
> >>>> Based on the call trace, the followings are the order of this call trace.
> >>>>
> >>>> 291 /* called by the create qp verb */
> >>>> 292 int rxe_qp_from_init(struct rxe_dev *rxe, struct rxe_qp *qp,
> >>>> struct rxe_pd *pd,
> >>>> 297 {
> >>>> ...
> >>>> 317 rxe_qp_init_misc(rxe, qp, init);
> >>>> ...
> >>>> 322
> >>>> 323 err = rxe_qp_init_resp(rxe, qp, init, udata, uresp);
> >>>> 324 if (err)
> >>>> 325 goto err2; <--- error
> >>>>
> >>>> ...
> >>>>
> >>>> 334 err2:
> >>>> 335 rxe_queue_cleanup(qp->sq.queue); <--- Goto here
> >>>> 336 qp->sq.queue = NULL;
> >>>>
> >>>> In rxe_qp_init_resp, the error occurs before skb_queue_head_init.
> >>>> So this call trace appeared.
> >>> 250 static int rxe_qp_init_resp(struct rxe_dev *rxe, struct rxe_qp *qp,
> >>> 254 {
> >>> ...
> >>> 264
> >>> 265 type = QUEUE_TYPE_FROM_CLIENT;
> >>> 266 qp->rq.queue = rxe_queue_init(rxe, &qp->rq.max_wr,
> >>> 267 wqe_size, type);
> >>> 268 if (!qp->rq.queue)
> >>> 269 return -ENOMEM; <---Error here
> >>> 270
> >>>
> >>> ...
> >>>
> >>> 282 skb_queue_head_init(&qp->resp_pkts); <-this is not called.
> >>> ...
> >>> This will make spin_lock of resp_pkts is used before initialized.
> >> IMHO, the above is same as
> >>
> >>> Which is caused by "skb_queue_head_init(&qp->resp_pkts)" is not called
> >>> given rxe_qp_init_resp returns error, but the cleanup still trigger the
> >>> chain.
> >>>
> >>> rxe_qp_do_cleanup -> rxe_completer -> drain_resp_pkts ->
> >>> skb_dequeue(&qp->resp_pkts)
> >> my previous analysis. If not, could you provide another better way to
> >> fix it?
> > Move the initialization to the beginning. This can fix this problem.
> > See below:
> >
> > "
> > diff --git a/drivers/infiniband/sw/rxe/rxe_qp.c
> > b/drivers/infiniband/sw/rxe/rxe_qp.c
> > index c5451a4488ca..22ef6188d7b1 100644
> > --- a/drivers/infiniband/sw/rxe/rxe_qp.c
> > +++ b/drivers/infiniband/sw/rxe/rxe_qp.c
> > @@ -176,6 +176,9 @@ static void rxe_qp_init_misc(struct rxe_dev *rxe,
> > struct rxe_qp *qp,
> > spin_lock_init(&qp->rq.producer_lock);
> > spin_lock_init(&qp->rq.consumer_lock);
> >
> > + skb_queue_head_init(&qp->req_pkts);
> > + skb_queue_head_init(&qp->resp_pkts);
> > +
> > atomic_set(&qp->ssn, 0);
> > atomic_set(&qp->skb_out, 0);
> > }
> > @@ -234,8 +237,6 @@ static int rxe_qp_init_req(struct rxe_dev *rxe,
> > struct rxe_qp *qp,
> > qp->req.opcode = -1;
> > qp->comp.opcode = -1;
> >
> > - skb_queue_head_init(&qp->req_pkts);
> > -
> > rxe_init_task(&qp->req.task, qp, rxe_requester);
> > rxe_init_task(&qp->comp.task, qp, rxe_completer);
> >
> > @@ -279,8 +280,6 @@ static int rxe_qp_init_resp(struct rxe_dev *rxe,
> > struct rxe_qp *qp,
> > }
> > }
> >
> > - skb_queue_head_init(&qp->resp_pkts);
> > -
> > rxe_init_task(&qp->resp.task, qp, rxe_responder);
> >
> > qp->resp.opcode = OPCODE_NONE;
> > "
>
> It is weird to me that init them in init_misc instead of init_req/resp,
> given they
> are dedicated/used for the different purpose. But just my 0.02$.
There are some initialization problems in qp init. This needs
refactoring the related functions to fix all the problems.
Currently I am working on this. You know, this is not an easy task.
It will take me a lot of time and effort.
Now I use init_misc to initialize the related variables just as I did
in the past.
This is because init_misc is designed to initialize some variables.
And it will not cause the similar use-before-initialization problems.
Zhu Yanjun
>
> Guoqing
On 5/23/23 14:07, Zhu Yanjun wrote:
>> There was another null-ptr-deref, no?
> Please show me the link. So I can delve into it.
Just the first mail of the thread ...
>> general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN
>> KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037]
>> CPU: 1 PID: 31038 Comm: syz-executor.3 Not tainted 6.3.0-syzkaller-12728-g348551ddaf31 #0
>> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023
>> RIP: 0010:flush_send_queue drivers/infiniband/sw/rxe/rxe_comp.c:597 [inline]
>> RIP: 0010:rxe_completer+0x255c/0x3cc0 drivers/infiniband/sw/rxe/rxe_comp.c:653
>> Code: 80 3c 02 00 0f 85 81 10 00 00 49 8b af 88 03 00 00 48 8d 45 30 48 89 c2 48 89 04 24 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 83 11 00 00 48 8d 45 2c 44 8b
>> RSP: 0018:ffffc90003526938 EFLAGS: 00010206
>> RAX: dffffc0000000000 RBX: ffffed100e3fe800 RCX: ffffc9000b403000
>> RDX: 0000000000000006 RSI: ffffffff877e467a RDI: ffff888071ff4388
>> RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
>> R10: fffffbfff1cf3682 R11: fffffffffffda5b0 R12: ffff888071ff41a0
>> R13: 0000000000000000 R14: 0000000000000000 R15: ffff888071ff4000
>> FS: 00007fede029f700(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000
>> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>> CR2: 0000001b2d822000 CR3: 000000002c7e6000 CR4: 00000000003506e0
>> Call Trace:
>> <TASK>
>> rxe_qp_do_cleanup+0x1be/0x820 drivers/infiniband/sw/rxe/rxe_qp.c:761
>> execute_in_process_context+0x3b/0x150 kernel/workqueue.c:3473
>> __rxe_cleanup+0x21e/0x370 drivers/infiniband/sw/rxe/rxe_pool.c:233
>> rxe_create_qp+0x3f6/0x5f0 drivers/infiniband/sw/rxe/rxe_verbs.c:583
>> create_qp+0x5ac/0x970 drivers/infiniband/core/verbs.c:1235
>> ib_create_qp_kernel+0xa1/0x310 drivers/infiniband/core/verbs.c:1346
>> ib_create_qp include/rdma/ib_verbs.h:3743 [inline]
>> create_mad_qp+0x177/0x380 drivers/infiniband/core/mad.c:2905
>> ib_mad_port_open drivers/infiniband/core/mad.c:2986 [inline]
>> ib_mad_init_device+0xf40/0x1a90 drivers/infiniband/core/mad.c:3077
>> add_client_context+0x405/0x5e0 drivers/infiniband/core/device.c:721
>> enable_device_and_get+0x1cd/0x3b0 drivers/infiniband/core/device.c:1332
>> ib_register_device drivers/infiniband/core/device.c:1420 [inline]
>> ib_register_device+0x8b1/0xbc0 drivers/infiniband/core/device.c:1366
>> rxe_register_device+0x302/0x3e0 drivers/infiniband/sw/rxe/rxe_verbs.c:1485
>> rxe_net_add+0x90/0xf0 drivers/infiniband/sw/rxe/rxe_net.c:527
>> rxe_newlink+0xf0/0x1b0 drivers/infiniband/sw/rxe/rxe.c:197
>> nldev_newlink+0x332/0x5e0 drivers/infiniband/core/nldev.c:1731
>> rdma_nl_rcv_msg+0x371/0x6a0 drivers/infiniband/core/netlink.c:195
>> rdma_nl_rcv_skb.constprop.0.isra.0+0x2fc/0x440 drivers/infiniband/core/netlink.c:239
>> netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline]
>> netlink_unicast+0x547/0x7f0 net/netlink/af_netlink.c:1365
>> netlink_sendmsg+0x925/0xe30 net/netlink/af_netlink.c:1913
>> sock_sendmsg_nosec net/socket.c:724 [inline]
>> sock_sendmsg+0xde/0x190 net/socket.c:747
>> ____sys_sendmsg+0x71c/0x900 net/socket.c:2503
>> ___sys_sendmsg+0x110/0x1b0 net/socket.c:2557
>> __sys_sendmsg+0xf7/0x1c0 net/socket.c:2586
>> do_syscall_x64 arch/x86/entry/common.c:50 [inline]
>> do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
>> entry_SYSCALL_64_after_hwframe+0x63/0xcd
>> RIP: 0033:0x7feddf48c169
>> Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
>> RSP: 002b:00007fede029f168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
>> RAX: ffffffffffffffda RBX: 00007feddf5abf80 RCX: 00007feddf48c169
>> RDX: 0000000000000000 RSI: 0000000020000240 RDI: 0000000000000003
>> RBP: 00007feddf4e7ca1 R08: 0000000000000000 R09: 0000000000000000
>> R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
>> R13: 00007ffe1bb3e01f R14: 00007fede029f300 R15: 0000000000022000
>> </TASK>
>> Modules linked in:
>>
Anyway, pls check above in the link.
https://lore.kernel.org/linux-rdma/[email protected]/T/#m2d374949d62b017074545c2f2a1df9251e0bde32
Guoqing
On Tue, May 23, 2023 at 2:11 PM Guoqing Jiang <[email protected]> wrote:
>
>
>
> On 5/23/23 14:07, Zhu Yanjun wrote:
>
> >> There was another null-ptr-deref, no?
> > Please show me the link. So I can delve into it.
>
> Just the first mail of the thread ...
>
> >> general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN
> >> KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037]
> >> CPU: 1 PID: 31038 Comm: syz-executor.3 Not tainted 6.3.0-syzkaller-12728-g348551ddaf31 #0
> >> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023
> >> RIP: 0010:flush_send_queue drivers/infiniband/sw/rxe/rxe_comp.c:597 [inline]
> >> RIP: 0010:rxe_completer+0x255c/0x3cc0 drivers/infiniband/sw/rxe/rxe_comp.c:653
> >> Code: 80 3c 02 00 0f 85 81 10 00 00 49 8b af 88 03 00 00 48 8d 45 30 48 89 c2 48 89 04 24 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 83 11 00 00 48 8d 45 2c 44 8b
> >> RSP: 0018:ffffc90003526938 EFLAGS: 00010206
> >> RAX: dffffc0000000000 RBX: ffffed100e3fe800 RCX: ffffc9000b403000
> >> RDX: 0000000000000006 RSI: ffffffff877e467a RDI: ffff888071ff4388
> >> RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
> >> R10: fffffbfff1cf3682 R11: fffffffffffda5b0 R12: ffff888071ff41a0
> >> R13: 0000000000000000 R14: 0000000000000000 R15: ffff888071ff4000
> >> FS: 00007fede029f700(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000
> >> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> >> CR2: 0000001b2d822000 CR3: 000000002c7e6000 CR4: 00000000003506e0
> >> Call Trace:
> >> <TASK>
> >> rxe_qp_do_cleanup+0x1be/0x820 drivers/infiniband/sw/rxe/rxe_qp.c:761
> >> execute_in_process_context+0x3b/0x150 kernel/workqueue.c:3473
> >> __rxe_cleanup+0x21e/0x370 drivers/infiniband/sw/rxe/rxe_pool.c:233
> >> rxe_create_qp+0x3f6/0x5f0 drivers/infiniband/sw/rxe/rxe_verbs.c:583
> >> create_qp+0x5ac/0x970 drivers/infiniband/core/verbs.c:1235
> >> ib_create_qp_kernel+0xa1/0x310 drivers/infiniband/core/verbs.c:1346
> >> ib_create_qp include/rdma/ib_verbs.h:3743 [inline]
> >> create_mad_qp+0x177/0x380 drivers/infiniband/core/mad.c:2905
> >> ib_mad_port_open drivers/infiniband/core/mad.c:2986 [inline]
> >> ib_mad_init_device+0xf40/0x1a90 drivers/infiniband/core/mad.c:3077
> >> add_client_context+0x405/0x5e0 drivers/infiniband/core/device.c:721
> >> enable_device_and_get+0x1cd/0x3b0 drivers/infiniband/core/device.c:1332
> >> ib_register_device drivers/infiniband/core/device.c:1420 [inline]
> >> ib_register_device+0x8b1/0xbc0 drivers/infiniband/core/device.c:1366
> >> rxe_register_device+0x302/0x3e0 drivers/infiniband/sw/rxe/rxe_verbs.c:1485
> >> rxe_net_add+0x90/0xf0 drivers/infiniband/sw/rxe/rxe_net.c:527
> >> rxe_newlink+0xf0/0x1b0 drivers/infiniband/sw/rxe/rxe.c:197
> >> nldev_newlink+0x332/0x5e0 drivers/infiniband/core/nldev.c:1731
> >> rdma_nl_rcv_msg+0x371/0x6a0 drivers/infiniband/core/netlink.c:195
> >> rdma_nl_rcv_skb.constprop.0.isra.0+0x2fc/0x440 drivers/infiniband/core/netlink.c:239
> >> netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline]
> >> netlink_unicast+0x547/0x7f0 net/netlink/af_netlink.c:1365
> >> netlink_sendmsg+0x925/0xe30 net/netlink/af_netlink.c:1913
> >> sock_sendmsg_nosec net/socket.c:724 [inline]
> >> sock_sendmsg+0xde/0x190 net/socket.c:747
> >> ____sys_sendmsg+0x71c/0x900 net/socket.c:2503
> >> ___sys_sendmsg+0x110/0x1b0 net/socket.c:2557
> >> __sys_sendmsg+0xf7/0x1c0 net/socket.c:2586
> >> do_syscall_x64 arch/x86/entry/common.c:50 [inline]
> >> do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
> >> entry_SYSCALL_64_after_hwframe+0x63/0xcd
> >> RIP: 0033:0x7feddf48c169
> >> Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
> >> RSP: 002b:00007fede029f168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
> >> RAX: ffffffffffffffda RBX: 00007feddf5abf80 RCX: 00007feddf48c169
> >> RDX: 0000000000000000 RSI: 0000000020000240 RDI: 0000000000000003
> >> RBP: 00007feddf4e7ca1 R08: 0000000000000000 R09: 0000000000000000
> >> R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
> >> R13: 00007ffe1bb3e01f R14: 00007fede029f300 R15: 0000000000022000
> >> </TASK>
> >> Modules linked in:
> >>
>
> Anyway, pls check above in the link.
>
> https://lore.kernel.org/linux-rdma/[email protected]/T/#m2d374949d62b017074545c2f2a1df9251e0bde32
>
Based on the following analysis, the problem in the link is the same
with this problem.
infiniband syz2: set active
infiniband syz2: added bond_slave_1
INFO: trying to register non-static key.
The code is fine but needs lockdep annotation, or maybe
you didn't initialize this object before use?
<----This means that this is a use-before-initialization
problem
turning off the locking correctness validator.
CPU: 1 PID: 31038 Comm: syz-executor.3 Not tainted
6.3.0-syzkaller-12728-g348551ddaf31 #0
Hardware name: Google Google Compute Engine/Google Compute Engine,
BIOS Google 04/14/2023
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xd9/0x150 lib/dump_stack.c:106
assign_lock_key kernel/locking/lockdep.c:982 [inline]
register_lock_class+0xdb6/0x1120 kernel/locking/lockdep.c:1295
__lock_acquire+0x10a/0x5df0 kernel/locking/lockdep.c:4951
lock_acquire kernel/locking/lockdep.c:5691 [inline]
lock_acquire+0x1b1/0x520 kernel/locking/lockdep.c:5656
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x3d/0x60 kernel/locking/spinlock.c:162
skb_dequeue+0x20/0x180 net/core/skbuff.c:3631
drain_resp_pkts drivers/infiniband/sw/rxe/rxe_comp.c:555 [inline]
<----- when skb_dequeue is called, spin lock of
resp_pkts is not initialized.
rxe_completer+0x250d/0x3cc0 drivers/infiniband/sw/rxe/rxe_comp.c:652
rxe_qp_do_cleanup+0x1be/0x820 drivers/infiniband/sw/rxe/rxe_qp.c:761
execute_in_process_context+0x3b/0x150 kernel/workqueue.c:3473
__rxe_cleanup+0x21e/0x370 drivers/infiniband/sw/rxe/rxe_pool.c:233
rxe_create_qp+0x3f6/0x5f0 drivers/infiniband/sw/rxe/rxe_verbs.c:583 <---- Here.
"
573 err = rxe_qp_from_init(rxe, qp, pd, init, uresp, ibqp->pd, udata);
574 if (err) {
575 rxe_dbg_qp(qp, "create qp failed, err = %d", err);
576 goto err_cleanup;
577 }
578
579 rxe_finalize(qp);
580 return 0;
581
582 err_cleanup:
583 cleanup_err = rxe_cleanup(qp); <--- this is error handler.
"
create_qp+0x5ac/0x970 drivers/infiniband/core/verbs.c:1235
ib_create_qp_kernel+0xa1/0x310 drivers/infiniband/core/verbs.c:1346
Zhu Yanjun
> Guoqing