Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1758310AbcKCQhd (ORCPT ); Thu, 3 Nov 2016 12:37:33 -0400 Received: from www62.your-server.de ([213.133.104.62]:42688 "EHLO www62.your-server.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1758148AbcKCQgO (ORCPT ); Thu, 3 Nov 2016 12:36:14 -0400 Message-ID: <581B6776.3060908@iogearbox.net> Date: Thu, 03 Nov 2016 17:36:06 +0100 From: Daniel Borkmann User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.7.0 MIME-Version: 1.0 To: Dmitry Vyukov , Alexei Starovoitov , netdev CC: LKML , syzkaller Subject: Re: bpf: kernel BUG in htab_elem_free References: In-Reply-To: Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit X-Authenticated-Sender: daniel@iogearbox.net Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 874 Lines: 28 On 11/03/2016 03:15 PM, Dmitry Vyukov wrote: > On Wed, Nov 2, 2016 at 11:14 PM, Dmitry Vyukov wrote: >> Here we go. >> >> The following program triggers kernel BUG in htab_elem_free. >> On commit 0c183d92b20b5c84ca655b45ef57b3318b83eb9e (Oct 31). >> Run as "while true; do ./a.out; done". This one fixes it for me. Could you check it from your side as well? I'll submit an official fix then. Thanks a lot for the catch! Daniel diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c index 570eeca..ad1bc67 100644 --- a/kernel/bpf/hashtab.c +++ b/kernel/bpf/hashtab.c @@ -687,7 +687,8 @@ static void delete_all_elements(struct bpf_htab *htab) hlist_for_each_entry_safe(l, n, head, hash_node) { hlist_del_rcu(&l->hash_node); - htab_elem_free(htab, l); + if (l->state != HTAB_EXTRA_ELEM_USED) + htab_elem_free(htab, l); } } }