Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   "Zhang, Qiang1" <qiang1.zhang@intel.com>
To:     "paulmck@kernel.org" <paulmck@kernel.org>
CC:     Kees Cook <keescook@chromium.org>,
        "Eric W. Biederman" <ebiederm@xmission.com>,
        syzbot <syzbot+9bb26e7c5e8e4fa7e641@syzkaller.appspotmail.com>,
        "brauner@kernel.org" <brauner@kernel.org>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        "syzkaller-bugs@googlegroups.com" <syzkaller-bugs@googlegroups.com>
Subject: RE: [syzbot] WARNING in exit_tasks_rcu_finish
Thread-Topic: [syzbot] WARNING in exit_tasks_rcu_finish
Thread-Index: AQHYfnKnPcEG5KPSqUKTUzyVmEvcrK1MN1mLgADFmMCAAHlEgIAAboyggAAbjYCAAAEvgIAABfiAgAAHecCAACTOAIAAAWGg
Date:   Tue, 14 Jun 2022 02:47:55 +0000
Message-ID: <PH0PR11MB5880D72E86AD3C5E9395B0D7DAAA9@PH0PR11MB5880.namprd11.prod.outlook.com>
References: <20220613233753.GK1790663@paulmck-ThinkPad-P17-Gen-1>
 <202206131639.DBA0A8D@keescook>
 <20220614000329.GO1790663@paulmck-ThinkPad-P17-Gen-1>
 <PH0PR11MB5880C6814BA88CD660610344DAAA9@PH0PR11MB5880.namprd11.prod.outlook.com>
 <20220614024158.GQ1790663@paulmck-ThinkPad-P17-Gen-1>
In-Reply-To: <20220614024158.GQ1790663@paulmck-ThinkPad-P17-Gen-1>
Accept-Language: en-US
Content-Language: en-US
dlp-product: dlpe-windows
dlp-version: 11.6.500.17
dlp-reaction: no-action
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?s6tmjG7ZWI2SqgYR3+Jf+xkTqxWMFNJWnOom+m8m2UXVoVNLRmxj7Z5ZiQdX?=
 =?us-ascii?Q?R7M6CQjTh9okk5v8Iu0Torl81Gx0OWYDvsgu4WyybGKwZVE4A9CTqwB42LlJ?=
 =?us-ascii?Q?GYLt/yP83n39S3N34gy8iL3MeRC+wvmIey/ADWvNEp173h072sVd9V1kwNYW?=
 =?us-ascii?Q?OrAsJM5YRH1jVtxnwapHbj47OgFeqYOwdqR5N0HNpIafzUQ+VQVRNLyPTSHa?=
 =?us-ascii?Q?cEtTPb1m/9blKIHoMgGuRoRB+tNR9WfYPJuITb6l76ECwuvuThwB8acIRMyA?=
 =?us-ascii?Q?nWiNJNQPmOzYgiv+rzTiT1AoJeG15FRhWvzTBJC+4gvQ3IFdUfEo/qBSk1st?=
 =?us-ascii?Q?JbAYaOwbispdBAzDpeH4iDi7KL482EOfp0vQmPhpHDd2b8OMZ5D7Vcp0Iw6u?=
 =?us-ascii?Q?Lst8jp0g9dG6WaQwK1g8PBamioc78xwXAb05XxDy3GGsYTTH6Sf62EJIfJRU?=
 =?us-ascii?Q?SsQWUeSRdWPKCYIjmkS8vbvO/SMwQuSCljRNZrByNqRQr9a9KPTye1OSsqck?=
 =?us-ascii?Q?mgY2UZ318MsS/ITRY1XZJiv+DUf6PXp7otw/cLpC+Z3mnEIbhzp3VW/oIOLJ?=
 =?us-ascii?Q?W82Putf21qfBevmkDHwSLT9bGUlsZ/z3Z0cR+yjABF1q5y6JuqDbgtoxoJnt?=
 =?us-ascii?Q?uJHlisrh8//ijM0eMEMBXWxWc14sGU9X3zxruqzq3v9LFtEaAzJReIpqU/1X?=
 =?us-ascii?Q?Sjx+oQhMUkScKkNIeTlpjb+X0bxqSPaPnl4asdlGl9sJ8ZCa3CYdAauf5853?=
 =?us-ascii?Q?LlDYoxFyZ3OHRfbZ4RQf0EZWgL+4XIaQ5muGDTN7zAsdcr6OKazj0zOYFyYg?=
 =?us-ascii?Q?yp3pFIm25nUk3Bvi2Xi1Uugtd9uwWmuKPirWP5pgRfv0m/4xhAnqjCXX4wPQ?=
 =?us-ascii?Q?nx8zAfI8qK7toaHBe2TblzHu1IwHra9gNgX+XN0UUOytWiDxSlD2+OFAwDYB?=
 =?us-ascii?Q?sJb4HToQnfQQb5pNYlVi8aP0kjuMyBPwmv2IawQUbxBA1TLBWr0VNphUZpjf?=
 =?us-ascii?Q?p0hotSTeCfikTw4ctIY5blZx+3VGRY7hUbRD2M5LJxyPDi3xT240981mHLuh?=
 =?us-ascii?Q?gK0IKXfDKzbBgI7tlyEFZQSWi0eyTQLzAXt8kAWSTsYvNAjHKjoQaGTHgzEm?=
 =?us-ascii?Q?qX5c6tRjU+uf/nQ5pzugHKEIIHteHSfYTyrbH29tdqiRwtMIZxJiC8JvuS7w?=
 =?us-ascii?Q?MqzOeW+J3q9YQAwc3XQRgvmQTdRqXFwkedn5nlNSWHyHTDfHXq3rPTXQ147X?=
 =?us-ascii?Q?NY7wr76agqDrviJ4gblWfnBgZMfbppDqN+Mh/8crIBX+RlbiGacDOKnGkUTF?=
 =?us-ascii?Q?yw3vO+kTaih3wYDosd9oG+cKTeVDW4vLr4NdPPBCL81zOGoY+gdfXoMoaWbj?=
 =?us-ascii?Q?h14DgKH7pZKFtTf41ddQlsphewtYQoBcD8BSb5V/swB4VZyzstMPN8KHI9cS?=
 =?us-ascii?Q?NcOkK3Ay2FrgTd/SSNxDUwnFTz7RRv2AOaimCxE0zIBWOgcLtI7UayK/G3As?=
 =?us-ascii?Q?IXHxFgOqMhP9gh/zRA3NDmqiPjRjopp82gA5blepWw41eI3eZIqYb/G9LYV7?=
 =?us-ascii?Q?n5G/+6VEOspzVwf+KKmzZGY8NYH3SL2n3mvvs9vh6jDYRET63F3jqFZcABQl?=
 =?us-ascii?Q?qeCQt14HkQSR6mgKsoBA5tr8e4r3/5bYaNthklkMhRwWmyMS2CH1TSUBicku?=
 =?us-ascii?Q?X+XwEVvBxBTUZzCMmR4/wS6vyACX0Fvcg9jDb+qZg4lIw1j01IaT8VEaUx9x?=
 =?us-ascii?Q?A6fQkGL9YA=3D=3D?=
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: PH0PR11MB5880.namprd11.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: d7473997-0ac7-4df7-19c1-08da4db048a0
X-MS-Exchange-CrossTenant-originalarrivaltime: 14 Jun 2022 02:47:55.4068
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 46c98d88-e344-4ed4-8496-4ed7712e255d
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: jo1Kd9bHjvvzsazdS/+YIPA9QP13Nh8EUEQmrGGCRKCbdnet/3yxaMK94L9eyyVTA71gslLpUBz9r0JvLP5wzw==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM5PR11MB1354
X-OriginatorOrg: intel.com
X-Spam-Status: No, score=-5.6 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH,
        DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_MED,
        RCVD_IN_MSPIKE_H3,RCVD_IN_MSPIKE_WL,SPF_HELO_NONE,SPF_NONE,
        T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Tue, Jun 14, 2022 at 12:52:23AM +0000, Zhang, Qiang1 wrote:
> On Mon, Jun 13, 2022 at 04:42:07PM -0700, Kees Cook wrote:
> > On Mon, Jun 13, 2022 at 10:36:07AM -0700, syzbot wrote:
> > > Hello,
> > >=20
> > > syzbot has tested the proposed patch and the reproducer did not trigg=
er any issue:
> > >=20
> > > Reported-and-tested-by:=20
> > > syzbot+9bb26e7c5e8e4fa7e641@syzkaller.appspotmail.com
> >=20
> > Looks like the patch solved the reproducer. :)
>=20
> >For one of the two possible ways to make the bug happen.  ;-)
> >
> >Still, good on Qiang for identifying one of the paths!  Not just anyone =
can do that.
>=20
> Thanks Paul, yes this patch can solved the reproducer and I also test it.
>=20
> I compiled "bpf_test" according to the c file in the following link
>=20
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=3D148207bff0000=
0
>=20
> Not apply this patch, this calltrace reproduce
>=20
> root@qemux86-64:/# ./bpf_test
> ^C
> root@qemux86-64:/# dmesg
> [  147.017232] ------------[ cut here ]------------ [  147.017234]=20
> WARNING: CPU: 3 PID: 21586 at kernel/rcu/tasks.h:1664=20
> exit_tasks_rcu_finish+0xbf/0x100 [  147.017245] Modules linked in:
> [  147.017249] CPU: 3 PID: 21586 Comm: bpf_test Not tainted=20
> 5.19.0-rc1-next-20220610-yoctodev-standard #204 [  147.017253]=20
> Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS=20
> rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 [  147.017256]=20
> RIP: 0010:exit_tasks_rcu_finish+0xbf/0x100
> [  147.017261] Code: 03 00 00 85 c0 75 59 f0 83 44 24 fc 00 49 8d bc=20
> 24 41 03 00 00 e8 21 09 2b 00 41 0f b6 84 24 41 03 00 00 83 e0 01 08=20
> d8 74 11 <0f> 8 [  147.017264] RSP: 0018:ffff88810ccd7af0 EFLAGS:=20
> 00010202 [  147.017268] RAX: 0000000000000001 RBX: 0000000000000201=20
> RCX: ffffffff897ab52f [  147.017271] RDX: 1ffff1102181d7c8 RSI:=20
> 0000000000000000 RDI: ffff88810c0ebe41 [  147.017274] RBP:=20
> ffff88810ccd7b08 R08: ffffffff897ab510 R09: 0000000000000000 [ =20
> 147.017277] R10: ffffffff8c407bbf R11: 0000000000000000 R12:=20
> ffff88810c0ebb00 [  147.017279] R13: ffff88810c0ebe38 R14:=20
> ffff88810ccd7b78 R15: ffff88810ccd76b0 [  147.017282] FS: =20
> 0000000000000000(0000) GS:ffff88815a000000(0000) knlGS:0000000000000000 [=
  147.017287] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [  147.0172=
89] CR2: 0000000000000000 CR3: 000000011ac16000 CR4: 00000000001506e0 [  14=
7.017292] Call Trace:
> [  147.017294]  <TASK>
> [  147.017297]  do_exit+0xe9a/0x13a0
> [  147.017305]  ? mm_update_next_owner+0x450/0x450 [  147.017309]  ?=20
> lock_downgrade+0x410/0x410 [  147.017313]  ?=20
> lock_contended+0x790/0x790 [  147.017317]  ?=20
> rcu_read_lock_held_common+0x1e/0x60
> [  147.017324]  do_group_exit+0x71/0x150 [  147.017329] =20
> get_signal+0x1319/0x1340 [  147.017334]  ?=20
> futex_wait_setup+0x180/0x180 [  147.017341]  ?=20
> exit_signals+0x4c0/0x4c0 [  147.017345]  ? futex_wake+0x29e/0x2e0 [ =20
> 147.017351]  arch_do_signal_or_restart+0x9c/0xc60
> [  147.017357]  ? rcu_read_lock_sched_held+0x60/0xd0
> [  147.017361]  ? rcu_read_lock_bh_held+0xb0/0xb0 [  147.017367]  ?=20
> get_sigframe_size+0x20/0x20 [  147.017371]  ? do_futex+0x1a2/0x240 [ =20
> 147.017375]  ? __ia32_sys_get_robust_list+0x240/0x240
> [  147.017378]  ? __context_tracking_exit+0x91/0xa0 [  147.017385]  ?=20
> lock_downgrade+0x410/0x410 [  147.017390]  ?=20
> __x64_sys_futex+0x125/0x2b0 [  147.017393]  ?=20
> rcu_read_lock_held_common+0x1e/0x60
> [  147.017399]  ? lockdep_hardirqs_on_prepare+0x13/0x230
> [  147.017403]  ? exit_to_user_mode_prepare+0x151/0x240
> [  147.017409]  exit_to_user_mode_prepare+0x16c/0x240
> [  147.017415]  syscall_exit_to_user_mode+0x1e/0x70
> [  147.017419]  do_syscall_64+0x50/0x90 [  147.017423] =20
> entry_SYSCALL_64_after_hwframe+0x46/0xb0
> [  147.017427] RIP: 0033:0x7f780e668fbd [  147.017431] Code: Unable to=20
> access opcode bytes at RIP 0x7f780e668f93.
> [  147.017433] RSP: 002b:00007f780e55bd48 EFLAGS: 00000246 ORIG_RAX:=20
> 00000000000000ca [  147.017437] RAX: fffffffffffffe00 RBX:=20
> 00007f780e55c640 RCX: 00007f780e668fbd [  147.017440] RDX:=20
> 0000000000000000 RSI: 0000000000000080 RDI: 000055ed9f3a8088 [ =20
> 147.017442] RBP: 00007f780e55bd60 R08: 0000000100000001 R09:=20
> 0000000100000001 [  147.017445] R10: 0000000000000000 R11:=20
> 0000000000000246 R12: fffffffffffffeb0 [  147.017447] R13:=20
> 0000000000000000 R14: 00007ffe5dcf20a0 R15: 00007f780e53c000 [ =20
> 147.017455]  </TASK> [  147.017458] irq event stamp: 0 [  147.017460]=20
> hardirqs last  enabled at (0): [<0000000000000000>] 0x0 [  147.017463]=20
> hardirqs last disabled at (0): [<ffffffff896b5990>]=20
> copy_process+0xe30/0x35f0 [  147.017467] softirqs last  enabled at=20
> (0): [<ffffffff896b5990>] copy_process+0xe30/0x35f0 [  147.017470]=20
> softirqs last disabled at (0): [<0000000000000000>] 0x0 [  147.017473]=20
> ---[ end trace 0000000000000000 ]---
>=20
> Apply this patch , this problem not reproduce.
>
>Thank you very much!  May I apply your Tested-by?

Thanks, I am very willing

>
>							Thanx, Paul

> Thanks
> Zqiang
>=20
> >
> >							Thanx, Paul
> >
> > > Tested on:
> > >=20
> > > commit:         6d0c8068 Add linux-next specific files for 20220610
> > > git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/next/li=
nux-next.git next-20220610
> > > console output:=20
> > > https://syzkaller.appspot.com/x/log.txt?x=3D12d068eff00000
> > > kernel config: =20
> > > https://syzkaller.appspot.com/x/.config?x=3Da30d6e3e814e5931
> > > dashboard link: https://syzkaller.appspot.com/bug?extid=3D9bb26e7c5e8=
e4fa7e641
> > > compiler:       gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Bi=
nutils for Debian) 2.35.2
> > > patch:          https://syzkaller.appspot.com/x/patch.diff?x=3D147f47=
c8080000
> > >=20
> > > Note: testing is done by a robot and is best-effort only.
> >=20
> > You can see the dashboard link above for testing details...
> >=20
> > --
> > Kees Cook