Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Subject: Re: possible deadlock in bpf_lru_push_free
To:     Hillf Danton <hdanton@sina.com>
CC:     syzbot <syzbot+122b5421d14e68f29cd1@syzkaller.appspotmail.com>,
        <andriin@fb.com>, <ast@kernel.org>, <bpf@vger.kernel.org>,
        <daniel@iogearbox.net>, <kafai@fb.com>,
        <linux-kernel@vger.kernel.org>, <netdev@vger.kernel.org>,
        <songliubraving@fb.com>, <syzkaller-bugs@googlegroups.com>
References: <20200217052336.5556-1-hdanton@sina.com>
 <dca36c4b-bbf5-b215-faa9-1992240f2b69@fb.com>
 <20200219021542.3304-1-hdanton@sina.com>
From:   Yonghong Song <yhs@fb.com>
Message-ID: <7e8c1cf0-fccf-1ed9-40ed-3a13b2287cf8@fb.com>
Date:   Tue, 18 Feb 2020 20:03:06 -0800
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:68.0)
 Gecko/20100101 Thunderbird/68.5.0
In-Reply-To: <20200219021542.3304-1-hdanton@sina.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 7bit
MIME-Version: 1.0
Received-SPF: None (protection.outlook.com: fb.com does not designate
 permitted sender hosts)
X-MS-Exchange-CrossTenant-Network-Message-Id: 9f46ffc7-35e5-4cd3-fd05-08d7b4f0acbb
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 19 Feb 2020 04:03:28.2014
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 8ae927fe-1255-47a7-a2af-5f3a069daaa2
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: ncc4PglXqXvHac/KtZJwSdHBrvuGpoXPfeAIURjFdXGea66VtfcNzUW38fB9XqAf
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6PR15MB3912
X-OriginatorOrg: fb.com
X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.138,18.0.572
 definitions=2020-02-18_08:2020-02-18,2020-02-18 signatures=0
X-Proofpoint-Spam-Details: rule=fb_default_notspam policy=fb_default score=0 mlxlogscore=717
 mlxscore=0 suspectscore=2 lowpriorityscore=0 clxscore=1015 phishscore=0
 adultscore=0 priorityscore=1501 malwarescore=0 bulkscore=0 impostorscore=0
 spamscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2001150001 definitions=main-2002190028
X-FB-Internal: deliver
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org


On 2/18/20 6:15 PM, Hillf Danton wrote:
> 
> Hey
> 
> On Tue, 18 Feb 2020 15:55:02 -0800 Yonghong Song wrote:
>>
>> Thanks for Martin for explanation! I think changing l->hash_node.next is
>> unsafe here as another thread may execute on a different cpu and
>> traverse the same list. It will see hash_node.next = NULL and it is
> 
> Good catch.
> 
>> unexpected.
>>
>> How about the following patch?
>>
> Looks nicer, thanks :P
> 
>> diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c
>> index 2d182c4ee9d9..246ef0f2e985 100644
>> --- a/kernel/bpf/hashtab.c
>> +++ b/kernel/bpf/hashtab.c
>> @@ -56,6 +56,7 @@ struct htab_elem {
>>                           union {
>>                                   struct bpf_htab *htab;
>>                                   struct pcpu_freelist_node fnode;
>> +                               struct htab_elem *link;
>>                           };
>>                   };
>>           };
>> @@ -1256,6 +1257,7 @@ __htab_map_lookup_and_delete_batch(struct bpf_map *map,
>>           void __user *ukeys = u64_to_user_ptr(attr->batch.keys);
>>           void *ubatch = u64_to_user_ptr(attr->batch.in_batch);
>>           u32 batch, max_count, size, bucket_size;
>> +       struct htab_elem *node_to_free = NULL;
>>           u64 elem_map_flags, map_flags;
>>           struct hlist_nulls_head *head;
>>           struct hlist_nulls_node *n;
>> @@ -1370,9 +1372,14 @@ __htab_map_lookup_and_delete_batch(struct bpf_map *map,
>>                   }
>>                   if (do_delete) {
>>                           hlist_nulls_del_rcu(&l->hash_node);
>> -                       if (is_lru_map)
>> -                               bpf_lru_push_free(&htab->lru, &l->lru_node);
>> -                       else
>> +                       if (is_lru_map) {
>> +                               /* l->hnode overlaps with *l->hash_node.pprev
> 
> nit: looks like you mean l->link

Yes, my previous attempt uses "hnode" and later changed to "link" but 
forget to change the comments.

Will post a patch soon.

> 
>> +                                * in memory. l->hash_node.pprev has been
>> +                                * poisoned and nobody should access it.
>> +                                */
>> +                               l->link = node_to_free;
>> +                               node_to_free = l;
>> +                       } else
>>                                   free_htab_elem(htab, l);
>>                   }
>>                   dst_key += key_size;
>