Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Tue, 14 Jun 2022 17:46:02 +0300
From:   Dan Carpenter <dan.carpenter@oracle.com>
To:     Zhen Chen <chenzhen126@huawei.com>
Cc:     syzbot <syzbot+2e3efb5eb71cb5075ba7@syzkaller.appspotmail.com>,
        davem@davemloft.net, jhs@mojatatu.com, jiri@resnulli.us,
        kuba@kernel.org, linux-kernel@vger.kernel.org,
        netdev@vger.kernel.org, syzkaller-bugs@googlegroups.com,
        xiyou.wangcong@gmail.com
Subject: Re: [syzbot] WARNING: ODEBUG bug in route4_destroy
Message-ID: <20220614144602.GJ2146@kadam>
References: <000000000000a81af205cb2e2878@google.com>
 <0c0468ae-5fe3-a71f-c987-18475756caca@huawei.com>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <0c0468ae-5fe3-a71f-c987-18475756caca@huawei.com>
User-Agent: Mutt/1.9.4 (2018-02-28)
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?zABqUpgDa7FleZhOo20/F0hADVuVXhE6xp96gGFN7ZBDM/d93XJWNKfE48Tj?=
 =?us-ascii?Q?q5dvHB5E/GIEnuRqtIoqggfL1czZpwBlB+5FqymLSpjJULeyf4eJndjtf3I1?=
 =?us-ascii?Q?RSXdIR6JXx5ZBJdj1+qe7n/pTaBcjCjsNQ317u6sTM9wRqfiet5ZG/7RfCSC?=
 =?us-ascii?Q?6l+vvMty1KaPBoMUERqaAMbHKzhCzu99+2yZBo7BZEJrljOxlazlliihFiF+?=
 =?us-ascii?Q?kYnKw3l+unreRGzfofr4aOJfu5UajgPeJxUZXNH1l1ReHiIM9syx2RC6NpiM?=
 =?us-ascii?Q?v+bU1S8XaHvFBkFYA/dA3ISjbobs5koKhmnVYn1rxg/wgyFMGb8OE4SGlPHe?=
 =?us-ascii?Q?XLbZfP69W0SXq/ji0tKpFABYa0KDZtuavw7zX3SdbeQ+uliUr2aGQabHkvcV?=
 =?us-ascii?Q?N5qtxK+yhDqqklNWLFj9dZ6z5La0CngNZ0t6Mra5bnrTV2KP9Ikgzi+oBLJx?=
 =?us-ascii?Q?4ToVcg6WvJTKqU2TYWOZ9thrYbMOeiqomPDurYQyyTv0Y7LIY1nPsmn96Dxw?=
 =?us-ascii?Q?1DaxuGKR40vG0Kf9dqRP6bVA4rb2yT7zcf23jyLcAKn/z8VqdfC8S5vERSR4?=
 =?us-ascii?Q?ViFvyREVSLnybRgriost/jtqIqtE95ch8nqkvkkoZfDG25rNkdNYiQUzfe7I?=
 =?us-ascii?Q?8qF+6gqO8xcrcHYVazwxIrG0f0WDRF5Fjllf9cVTHxlpTON4ISaUS74/Afb1?=
 =?us-ascii?Q?hEKE45Nb/GRgB2s3U8vcbenk8GizllcRlR/3NDlu4wvcr8gUjzo2zS5FmB6t?=
 =?us-ascii?Q?uFtKu0ycFS9EFQoXSxUsMyuKjWdVJ5hRmoCBRPNoclS9tPl3JZGTof40a1GX?=
 =?us-ascii?Q?lf9Pf+DlJ34XBIswlZmeABcDdHCdmaowT+0oFR7biIRTFoIo0e16RpUzH8Zl?=
 =?us-ascii?Q?DoU15mkiUtK+c2l2cvHVWvIzmwr0Q9Lr6cGbh3beLu5dRKcHb70TPS32JmTG?=
 =?us-ascii?Q?+mE6GZeWVMNeS+WAq//gwz5UkgQQeLwqGCGtGpV2WBP612xKVKpSJSDhtbne?=
 =?us-ascii?Q?1InJO8aImGKT7SPkQ9TARy4lTyMmM8r9TlhhdLupbJOF5P/cEPIZEUpA9o0W?=
 =?us-ascii?Q?1r1zluhiabYa1D5WjUfYFxnd1fCBwsowiDEINe+oX2qwOnmcfKMvdya86fNT?=
 =?us-ascii?Q?cjw6DWmyAbuLSxmGY6+tMHwOnubtrYMOsxgF9UPtbhPvsXZ2dol35YIw2aaK?=
 =?us-ascii?Q?Lw6+zuyTu9K8zp6NqnMNpDyRiqGw2Iw89BLwppqKodwtYrzw/c53OgsicNQU?=
 =?us-ascii?Q?zeSgVzAchuVzozyW9H1I9QOu+h59xuoWRK71k2uWzo2G8kQ7s5LMrUn4CTRQ?=
 =?us-ascii?Q?exb/KZJjFAwDCzOvHKRJB0IFY8wqjhJQZVPottHxy9buflIQuHKbnFgV4f07?=
 =?us-ascii?Q?9Les2T/VeY/iGVtqwLOMTeaxufzygtq+zkL6m7YOBh53/7Z99rOTW4OnAypL?=
 =?us-ascii?Q?HArbBBmH3YMiV25tpSMg2TPygAqw6kR/M7HArItcGhl5XTlApGLLqINAgaFJ?=
 =?us-ascii?Q?/yLFRSJ6Jgi48+zqwlHRe//CQeFpTX0B9o06gOpyjAcYQo1ePsRAN1u9CLrz?=
 =?us-ascii?Q?/ab30bKjsvcmVmMXgmjzlNCWJxX4Tk4tZ3kz1e5eJPCRz84BgvsRyRKVhFvY?=
 =?us-ascii?Q?ODFtnmndmSUItkudEVKpdlRlki0bfdWEfzkVwmp+wF6FDFHmiTj/Z/pQGc7f?=
 =?us-ascii?Q?FI51s5g7fT4sEinPk+nTq/9QRxlA+ocaTA1woeEqtbxuucsxe159u7OEh/o8?=
 =?us-ascii?Q?mAPYf0Vp9JS7pU4nEBOg7DxsFMXaQ4A=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: faa1f2ee-aa3b-49b1-c4fa-08da4e14a911
X-MS-Exchange-CrossTenant-AuthSource: MWHPR1001MB2365.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 14 Jun 2022 14:46:27.1516
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: 60q2Fwr5EqrmS/B5quBFrUpBRXzHIfk5xGa0H3qeuwiRvdai5EjkOy/QS8IaqlAv3TCXGwaSfovZvhXePqEnNUsvYvn3/ZlP4zb/lDfeZiI=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: MW4PR10MB5701
X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.517,18.0.874
 definitions=2022-06-14_05:2022-06-13,2022-06-14 signatures=0
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 bulkscore=0 malwarescore=0 mlxscore=0
 adultscore=0 suspectscore=0 mlxlogscore=999 spamscore=0 phishscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2204290000
 definitions=main-2206140058
X-Proofpoint-GUID: OdAU3QbrJdaDWmvtZ6s2rHLnt3eTvJ2U
X-Proofpoint-ORIG-GUID: OdAU3QbrJdaDWmvtZ6s2rHLnt3eTvJ2U
X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,
        RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_NONE,T_SCC_BODY_TEXT_LINE
        autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Tue, Jun 14, 2022 at 10:35:44PM +0800, 'Zhen Chen' via syzkaller-bugs wrote:
> 
> This looks like  route4_destroy is deleting the 'fold' which has been
> freed by tcf_queue_work in route4_change. It means 'fold' is still in
> the table.
> I have tested this patch on syzbot and it works well, but I am not
> sure whether it will introduce other issues...
> 
> diff --git a/net/sched/cls_route.c b/net/sched/cls_route.c
> index a35ab8c27866..758c21f9d628 100644
> --- a/net/sched/cls_route.c
> +++ b/net/sched/cls_route.c
> @@ -526,7 +526,7 @@ static int route4_change(struct net *net, struct sk_buff *in_skb,
>  	rcu_assign_pointer(f->next, f1);
>  	rcu_assign_pointer(*fp, f);
>  
> -	if (fold && fold->handle && f->handle != fold->handle) {
> +	if (fold && f->handle != fold->handle) {
                                 ^^^^^^^^^^^^
There is still a dereference here so your patch doesn't make sense. :/

regards,
dan carpenter

>  		th = to_hash(fold->handle);
>  		h = from_hash(fold->handle >> 16);
>  		b = rtnl_dereference(head->table[th]);
> 
> -- 
> You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bugs+unsubscribe@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/0c0468ae-5fe3-a71f-c987-18475756caca%40huawei.com.