Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:3 as permitted sender) client-ip=2620:137:e000::3:3;
Message-ID: <ccda3c93-40f8-c88a-3d34-f51247004552@intel.com>
Date:   Tue, 3 Oct 2023 12:26:56 +0200
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101
 Thunderbird/102.13.0
Subject: Re: [PATCH net-next v2] net/xdp: fix zero-size allocation warning in
 xskq_create()
To:     Andrew Kanner <andrew.kanner@gmail.com>
CC:     <bjorn@kernel.org>, <magnus.karlsson@intel.com>,
        <maciej.fijalkowski@intel.com>, <jonathan.lemon@gmail.com>,
        <davem@davemloft.net>, <edumazet@google.com>, <kuba@kernel.org>,
        <pabeni@redhat.com>, <xuanzhuo@linux.alibaba.com>,
        <ast@kernel.org>, <hawk@kernel.org>, <john.fastabend@gmail.com>,
        <daniel@iogearbox.net>,
        <linux-kernel-mentees@lists.linuxfoundation.org>,
        <netdev@vger.kernel.org>, <bpf@vger.kernel.org>,
        <linux-kernel@vger.kernel.org>,
        <syzbot+fae676d3cf469331fc89@syzkaller.appspotmail.com>
References: <20231002222939.1519-1-andrew.kanner@gmail.com>
Content-Language: en-US
From:   Alexander Lobakin <aleksander.lobakin@intel.com>
In-Reply-To: <20231002222939.1519-1-andrew.kanner@gmail.com>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?SytZVVBCQVNFbG90TllLRWt1OFc3cUI3RFpMbldUbldaRmhvZXRqcE14N0gy?=
 =?utf-8?B?eG1CL0RqckF3NlhuNUVWTGxaVnlOVkYwMnFXdS9HT3RUMmkyMW96RTNhZ0Fi?=
 =?utf-8?B?YVd3UlhuaExZRHMwRUlTejNYQXVoSzVmZmh2RVl0R1BLS0RwZmhKWGs5cy9x?=
 =?utf-8?B?ZWpLTFJxT2ZYZVJYNUJaNDdlRlVRSWppZndaZCs4bGZqZ2xubXROZGFQL09v?=
 =?utf-8?B?MmNkSHlVTExKVkMvZFNGRGJXYkVtZitoRDNnSFdldWx0dUsxSHJxK0Zlb3pv?=
 =?utf-8?B?UTArZWpwbEZ5VkxxNkRhZjlJdW1KQU4yeXZYZzQzb0FCbjNRV3JHdkpZaXhw?=
 =?utf-8?B?WW9xZy8wdGV6SHp5cUF6eG1scUt0OHRuQkRJUVFWU3ZuOUtyYVc0cHgxTWFB?=
 =?utf-8?B?ZDRDT0pKaC9UclRsMzQwUGRTeE40eFJ1WmxUNk40QlltSzdFM3FvOGprODBW?=
 =?utf-8?B?WHBsK3UwWlU4UzRURWhVSVFQeDl6VmRMN2xmMlNLTmJ2ZWdwTnZBRkJQMWJV?=
 =?utf-8?B?RXJ2aVp0dkJhNDBSalZ4Nm5UT2tpcEtUTml4TnQwbk1BeDkwampLalVxQlVw?=
 =?utf-8?B?TFg5TGJGQ3B3Y0kxMGsyQ1VtZnJtZThRck1RSXJMQkVWOWNHT1U5bVkvV2pS?=
 =?utf-8?B?MWxyZGE3TEYzY04zaFh3QXRNejVkeHRPcEpQZkZLRTZoSGNWZE1QR29mWkVC?=
 =?utf-8?B?ZGRkellXdENkM1FQNjcrUmpNcXFYNGtlZG1MNkw5TzJSbnFIbE1KRXRtdzkv?=
 =?utf-8?B?V2xCN0NrblJxYkdmNUhhRXJYM2l4Z2NRek14dzZzYkMwM29WNlAyUGFKSDhN?=
 =?utf-8?B?QVI0by9qdFZibFo4K2o1dTR5Z2h5QzViS051OFNrL21aTWplR0RWM0R2L1Vj?=
 =?utf-8?B?NytBUW8ycGF0eG1HSEJodG00ZFdYdzdrY1lyYTZYTWxMNFZ0cnl2TW5maXdZ?=
 =?utf-8?B?UXo5ZFpoQjVsWEUvZUpWcFdrd2JaUDJ4NStPRXV6WU94NEZnMEZwM0t2c3Va?=
 =?utf-8?B?dHY0d1JESmRzMjlUOG1sSG0xcjNpTVpaaDdPd1RPNlpDUHkyQWxIWHpLZmFU?=
 =?utf-8?B?a0VzNFVuQS90WXo2UWdvQlZ2T2FPWjdHQlBZMmJWTzZTVVExWkx2aGx3ZXQ2?=
 =?utf-8?B?UVRFWkhGNUtCZDJBNFdqK2JEYUozRENvdUk4QW15VUNGVFNBUHY3OTVBUE14?=
 =?utf-8?B?MEhhTjE1L0w4NGlHQlZIRGF3eW5aUHdCZHhFUzhPKzU4b2hvL0VMdmFxaWtS?=
 =?utf-8?B?LzlIV0JJZGFXUXBzTWhrN2grVzFhZHk5VDNvdW1CV29Lc1BkVG80eERQcUk2?=
 =?utf-8?B?UEkrZWU1Rms1dVUvWkFRQW1QMTNtRXJWWVlFVWgyeEVpK3FtNzZWM01WMzBO?=
 =?utf-8?B?ekdydVV0ZmViL3FsbnBxenVCYk1nRkU4QTkrM0RTOWVXZm41aFlPR2EzTXln?=
 =?utf-8?B?Nk9nZC9SNXptSDE5V2ozaXU4cW1GS3B2M0hBUmQ4QWxkeC9WdkllQ0dDQnBP?=
 =?utf-8?B?TXQvK21xdDVtVjJHeTAyWEovMEpKV0wyV3JuNFpHMDNRN0tRQ1YvNTRoTk9X?=
 =?utf-8?B?eWZJVnVxZGc3SWhSZUVOMUgwYVlaQXFYRUNyMTEyUlVMOXNOdXkraGZPK2Fa?=
 =?utf-8?B?K3pNZjJOYWJjQSsyNEp3WEhGUFlMUjR4WTUyaTk5VTFsbjJQWUtEeWdmb2ZM?=
 =?utf-8?B?blp3clRwZnluVndLdzRtMEhRdTY0cDZZZFVVNWtsQ0dpTmdyNjRMeVo1Wm1n?=
 =?utf-8?B?MFczUytKQnN2R3JMeGphblAzZGlkdkFWREN1Z2JYTWNLa1pxemVKYk1BYzQx?=
 =?utf-8?B?TDh6akdZNGFrTWlmRWhhUUdzOU1SSTRmSzQrUW0zOWZ4N3JXSHRDNUVHbFVr?=
 =?utf-8?B?NXl0MUR2dE55OHh1c1Rub3pyTEhzR1p0U0d5TFh3Nm9KUkFuZWp1b1pBMS9u?=
 =?utf-8?B?cW85YUZnR0t0bzJSYm9ZSGhVSThYNEwvTG1WQ0REQW5BN1VKN0laczI4emRE?=
 =?utf-8?B?cG0yRmN3S3psaDJkZkxoUHo5NExTeVkvL0htRnMvRTNBMW5YZS9IMFN6Kzdw?=
 =?utf-8?B?bktGaDZlN0JKK2xMVVZqTzZUcnRxWTRYMG01YTlzWEJGOFBHSXdJMTVneG1a?=
 =?utf-8?B?UUVBdXIvYy9qeFFlZ3RlMmhpOEtBQ3ZhNk9OZzY2dTN5Nk1NZUpLMkVXZ0NM?=
 =?utf-8?B?Vmc9PQ==?=
X-MS-Exchange-CrossTenant-Network-Message-Id: 05e7b1dc-4ad2-42db-ac08-08dbc3fb6a9e
X-MS-Exchange-CrossTenant-AuthSource: DM6PR11MB3625.namprd11.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 03 Oct 2023 10:28:00.2094
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 46c98d88-e344-4ed4-8496-4ed7712e255d
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: El9Uw/UJAC6cTj/mKoolevs0BaCUpNKMYuZuHe/fkPPcPTMzsACmHtG0B7wUEnE49HRIfdjtWE7hpolfqU0vR1MwG2NFU444SGPvS+wQpIc=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: LV2PR11MB6022
X-OriginatorOrg: intel.com
X-Spam-Status: No, score=-1.9 required=5.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED,
	DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,
	MAILING_LIST_MULTI,NICE_REPLY_A,SPF_HELO_NONE,SPF_PASS
	autolearn=unavailable autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lipwig.vger.email
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org
X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (lipwig.vger.email [0.0.0.0]); Tue, 03 Oct 2023 03:28:17 -0700 (PDT)

From: Andrew Kanner <andrew.kanner@gmail.com>
Date: Tue,  3 Oct 2023 01:29:40 +0300

> Syzkaller reported the following issue:
>  ------------[ cut here ]------------
>  WARNING: CPU: 0 PID: 2807 at mm/vmalloc.c:3247 __vmalloc_node_range (mm/vmalloc.c:3361)
>  Modules linked in:
>  CPU: 0 PID: 2807 Comm: repro Not tainted 6.6.0-rc2+ #12
>  Hardware name: Generic DT based system
>  unwind_backtrace from show_stack (arch/arm/kernel/traps.c:258)
>  show_stack from dump_stack_lvl (lib/dump_stack.c:107 (discriminator 1))
>  dump_stack_lvl from __warn (kernel/panic.c:633 kernel/panic.c:680)
>  __warn from warn_slowpath_fmt (./include/linux/context_tracking.h:153 kernel/panic.c:700)
>  warn_slowpath_fmt from __vmalloc_node_range (mm/vmalloc.c:3361 (discriminator 3))
>  __vmalloc_node_range from vmalloc_user (mm/vmalloc.c:3478)
>  vmalloc_user from xskq_create (net/xdp/xsk_queue.c:40)
>  xskq_create from xsk_setsockopt (net/xdp/xsk.c:953 net/xdp/xsk.c:1286)
>  xsk_setsockopt from __sys_setsockopt (net/socket.c:2308)
>  __sys_setsockopt from ret_fast_syscall (arch/arm/kernel/entry-common.S:68)
> 
> xskq_get_ring_size() uses struct_size() macro to safely calculate the
> size of struct xsk_queue and q->nentries of desc members. But the
> syzkaller repro was able to set q->nentries with the value initially
> taken from copy_from_sockptr() high enough to return SIZE_MAX by
> struct_size(). The next PAGE_ALIGN(size) is such case will overflow
> the size_t value and set it to 0. This will trigger WARN_ON_ONCE in
> vmalloc_user() -> __vmalloc_node_range().
> 
> The issue is reproducible on 32-bit arm kernel.
> 
> Reported-and-tested-by: syzbot+fae676d3cf469331fc89@syzkaller.appspotmail.com
> Closes: https://lore.kernel.org/all/000000000000c84b4705fb31741e@google.com/T/
> Link: https://syzkaller.appspot.com/bug?extid=fae676d3cf469331fc89
> Fixes: 9f78bf330a66 ("xsk: support use vaddr as ring")
> Signed-off-by: Andrew Kanner <andrew.kanner@gmail.com>

Reviewed-by: Alexander Lobakin <aleksander.lobakin@intel.com>

[...]

Thanks,
Olek