Hello,
syzbot found the following issue on:
HEAD commit: 6a66fdd29ea1 Merge tag 'rust-fixes-6.3' of https://github...
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=160d8948280000
kernel config: https://syzkaller.appspot.com/x/.config?x=fa4baf7c6b35b5d5
dashboard link: https://syzkaller.appspot.com/bug?extid=ebe648a84e8784763f82
compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/78937867b23a/disk-6a66fdd2.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/dfd6c176adff/vmlinux-6a66fdd2.xz
kernel image: https://storage.googleapis.com/syzbot-assets/51509bf47166/bzImage-6a66fdd2.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: [email protected]
==================================================================
BUG: KCSAN: data-race in __bpf_lru_list_rotate / __htab_lru_percpu_map_update_elem
write to 0xffff888137038deb of 1 bytes by task 11240 on cpu 1:
__bpf_lru_node_move kernel/bpf/bpf_lru_list.c:113 [inline]
__bpf_lru_list_rotate_active kernel/bpf/bpf_lru_list.c:149 [inline]
__bpf_lru_list_rotate+0x1bf/0x750 kernel/bpf/bpf_lru_list.c:240
bpf_lru_list_pop_free_to_local kernel/bpf/bpf_lru_list.c:329 [inline]
bpf_common_lru_pop_free kernel/bpf/bpf_lru_list.c:447 [inline]
bpf_lru_pop_free+0x638/0xe20 kernel/bpf/bpf_lru_list.c:499
prealloc_lru_pop kernel/bpf/hashtab.c:290 [inline]
__htab_lru_percpu_map_update_elem+0xe7/0x820 kernel/bpf/hashtab.c:1316
bpf_percpu_hash_update+0x5e/0x90 kernel/bpf/hashtab.c:2313
bpf_map_update_value+0x2a9/0x370 kernel/bpf/syscall.c:200
generic_map_update_batch+0x3ae/0x4f0 kernel/bpf/syscall.c:1687
bpf_map_do_batch+0x2d9/0x3d0 kernel/bpf/syscall.c:4534
__sys_bpf+0x338/0x810
__do_sys_bpf kernel/bpf/syscall.c:5096 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5094 [inline]
__x64_sys_bpf+0x43/0x50 kernel/bpf/syscall.c:5094
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
read to 0xffff888137038deb of 1 bytes by task 11241 on cpu 0:
bpf_lru_node_set_ref kernel/bpf/bpf_lru_list.h:70 [inline]
__htab_lru_percpu_map_update_elem+0x2f1/0x820 kernel/bpf/hashtab.c:1332
bpf_percpu_hash_update+0x5e/0x90 kernel/bpf/hashtab.c:2313
bpf_map_update_value+0x2a9/0x370 kernel/bpf/syscall.c:200
generic_map_update_batch+0x3ae/0x4f0 kernel/bpf/syscall.c:1687
bpf_map_do_batch+0x2d9/0x3d0 kernel/bpf/syscall.c:4534
__sys_bpf+0x338/0x810
__do_sys_bpf kernel/bpf/syscall.c:5096 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5094 [inline]
__x64_sys_bpf+0x43/0x50 kernel/bpf/syscall.c:5094
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
value changed: 0x01 -> 0x00
Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 11241 Comm: syz-executor.3 Not tainted 6.3.0-rc7-syzkaller-00136-g6a66fdd29ea1 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023
==================================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at [email protected].
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
Martin,
Please take a look at the trace below.
I think we just need to annotate bpf_lru_node_set_ref() with data_race().
wdyt?
Too bad there is no reproducer.
On Tue, Apr 25, 2023 at 12:31 AM syzbot
<[email protected]> wrote:
>
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: 6a66fdd29ea1 Merge tag 'rust-fixes-6.3' of https://github...
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=160d8948280000
> kernel config: https://syzkaller.appspot.com/x/.config?x=fa4baf7c6b35b5d5
> dashboard link: https://syzkaller.appspot.com/bug?extid=ebe648a84e8784763f82
> compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
>
> Unfortunately, I don't have any reproducer for this issue yet.
>
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/78937867b23a/disk-6a66fdd2.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/dfd6c176adff/vmlinux-6a66fdd2.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/51509bf47166/bzImage-6a66fdd2.xz
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: [email protected]
>
> ==================================================================
> BUG: KCSAN: data-race in __bpf_lru_list_rotate / __htab_lru_percpu_map_update_elem
>
> write to 0xffff888137038deb of 1 bytes by task 11240 on cpu 1:
> __bpf_lru_node_move kernel/bpf/bpf_lru_list.c:113 [inline]
> __bpf_lru_list_rotate_active kernel/bpf/bpf_lru_list.c:149 [inline]
> __bpf_lru_list_rotate+0x1bf/0x750 kernel/bpf/bpf_lru_list.c:240
> bpf_lru_list_pop_free_to_local kernel/bpf/bpf_lru_list.c:329 [inline]
> bpf_common_lru_pop_free kernel/bpf/bpf_lru_list.c:447 [inline]
> bpf_lru_pop_free+0x638/0xe20 kernel/bpf/bpf_lru_list.c:499
> prealloc_lru_pop kernel/bpf/hashtab.c:290 [inline]
> __htab_lru_percpu_map_update_elem+0xe7/0x820 kernel/bpf/hashtab.c:1316
> bpf_percpu_hash_update+0x5e/0x90 kernel/bpf/hashtab.c:2313
> bpf_map_update_value+0x2a9/0x370 kernel/bpf/syscall.c:200
> generic_map_update_batch+0x3ae/0x4f0 kernel/bpf/syscall.c:1687
> bpf_map_do_batch+0x2d9/0x3d0 kernel/bpf/syscall.c:4534
> __sys_bpf+0x338/0x810
> __do_sys_bpf kernel/bpf/syscall.c:5096 [inline]
> __se_sys_bpf kernel/bpf/syscall.c:5094 [inline]
> __x64_sys_bpf+0x43/0x50 kernel/bpf/syscall.c:5094
> do_syscall_x64 arch/x86/entry/common.c:50 [inline]
> do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
> entry_SYSCALL_64_after_hwframe+0x63/0xcd
>
> read to 0xffff888137038deb of 1 bytes by task 11241 on cpu 0:
> bpf_lru_node_set_ref kernel/bpf/bpf_lru_list.h:70 [inline]
> __htab_lru_percpu_map_update_elem+0x2f1/0x820 kernel/bpf/hashtab.c:1332
> bpf_percpu_hash_update+0x5e/0x90 kernel/bpf/hashtab.c:2313
> bpf_map_update_value+0x2a9/0x370 kernel/bpf/syscall.c:200
> generic_map_update_batch+0x3ae/0x4f0 kernel/bpf/syscall.c:1687
> bpf_map_do_batch+0x2d9/0x3d0 kernel/bpf/syscall.c:4534
> __sys_bpf+0x338/0x810
> __do_sys_bpf kernel/bpf/syscall.c:5096 [inline]
> __se_sys_bpf kernel/bpf/syscall.c:5094 [inline]
> __x64_sys_bpf+0x43/0x50 kernel/bpf/syscall.c:5094
> do_syscall_x64 arch/x86/entry/common.c:50 [inline]
> do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
> entry_SYSCALL_64_after_hwframe+0x63/0xcd
>
> value changed: 0x01 -> 0x00
>
> Reported by Kernel Concurrency Sanitizer on:
> CPU: 0 PID: 11241 Comm: syz-executor.3 Not tainted 6.3.0-rc7-syzkaller-00136-g6a66fdd29ea1 #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023
> ==================================================================
>
>
> ---
> This report is generated by a bot. It may contain errors.
> See https://goo.gl/tpsmEJ for more information about syzbot.
> syzbot engineers can be reached at [email protected].
>
> syzbot will keep track of this issue. See:
> https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
On 4/25/23 8:08 AM, Alexei Starovoitov wrote:
> Martin,
>
>
> Please take a look at the trace below.
> I think we just need to annotate bpf_lru_node_set_ref() with data_race().
> wdyt?
Agreed. node->ref needs a data_race(). I will post a patch.