Received-SPF: pass (google.com: domain of linux-kernel+bounces-97491-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.80.249 as permitted sender) client-ip=147.75.80.249;
From: Kuniyuki Iwashima <kuniyu@amazon.com>
To: <syzbot+12c506c1aae251e70449@syzkaller.appspotmail.com>
CC: <davem@davemloft.net>, <dsahern@kernel.org>, <edumazet@google.com>,
	<kuba@kernel.org>, <linux-kernel@vger.kernel.org>, <netdev@vger.kernel.org>,
	<pabeni@redhat.com>, <syzkaller-bugs@googlegroups.com>
Subject: Re: [syzbot] [net?] WARNING in sk_nulls_del_node_init_rcu
Date: Fri, 8 Mar 2024 11:01:34 -0800
Message-ID: <20240308190134.58475-1-kuniyu@amazon.com>
In-Reply-To: <00000000000094b65a0613299ae7@google.com>
References: <00000000000094b65a0613299ae7@google.com>
Precedence: bulk
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Content-Type: text/plain

From: syzbot <syzbot+12c506c1aae251e70449@syzkaller.appspotmail.com>
Date: Fri, 08 Mar 2024 09:34:28 -0800
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    c055fc00c07b net/rds: fix WARNING in rds_conn_connect_if_d..
> git tree:       net
> console output: https://syzkaller.appspot.com/x/log.txt?x=16aa17f2180000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=fad652894fc96962
> dashboard link: https://syzkaller.appspot.com/bug?extid=12c506c1aae251e70449
> compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
> 
> Unfortunately, I don't have any reproducer for this issue yet.
> 
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/c39eb6fb3ad1/disk-c055fc00.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/110f1226eb89/vmlinux-c055fc00.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/1303e2df5cc4/bzImage-c055fc00.xz
> 
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+12c506c1aae251e70449@syzkaller.appspotmail.com
> 
> R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
> R13: 000000000000000b R14: 00007f3b817abf80 R15: 00007ffd3beb57b8
>  </TASK>
> ------------[ cut here ]------------
> WARNING: CPU: 0 PID: 23948 at include/net/sock.h:799 sk_nulls_del_node_init_rcu+0x166/0x1a0 include/net/sock.h:799
> Modules linked in:
> CPU: 0 PID: 23948 Comm: syz-executor.2 Not tainted 6.8.0-rc6-syzkaller-00159-gc055fc00c07b #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024
> RIP: 0010:sk_nulls_del_node_init_rcu+0x166/0x1a0 include/net/sock.h:799
> Code: e8 7f 71 c6 f7 83 fb 02 7c 25 e8 35 6d c6 f7 4d 85 f6 0f 95 c0 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc e8 1b 6d c6 f7 90 <0f> 0b 90 eb b2 e8 10 6d c6 f7 4c 89 e7 be 04 00 00 00 e8 63 e7 d2
> RSP: 0018:ffffc900032d7848 EFLAGS: 00010246
> RAX: ffffffff89cd0035 RBX: 0000000000000001 RCX: 0000000000040000
> RDX: ffffc90004de1000 RSI: 000000000003ffff RDI: 0000000000040000
> RBP: 1ffff1100439ac26 R08: ffffffff89ccffe3 R09: 1ffff1100439ac28
> R10: dffffc0000000000 R11: ffffed100439ac29 R12: ffff888021cd6140
> R13: dffffc0000000000 R14: ffff88802a9bf5c0 R15: ffff888021cd6130
> FS:  00007f3b823f16c0(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000
> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00007f3b823f0ff8 CR3: 000000004674a000 CR4: 00000000003506f0
> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> Call Trace:
>  <TASK>
>  __inet_hash_connect+0x140f/0x20b0 net/ipv4/inet_hashtables.c:1139

Here I had to use non-refcnt variant as check_established() doesn't
increment it.

I'll post a fix soon.

---8<---
diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
index 308ff34002ea..4e470f18487f 100644
--- a/net/ipv4/inet_hashtables.c
+++ b/net/ipv4/inet_hashtables.c
@@ -1136,7 +1136,7 @@ int __inet_hash_connect(struct inet_timewait_death_row *death_row,
 		sock_prot_inuse_add(net, sk->sk_prot, -1);
 
 		spin_lock(lock);
-		sk_nulls_del_node_init_rcu(sk);
+		__sk_nulls_del_node_init_rcu(sk);
 		spin_unlock(lock);
 
 		sk->sk_hash = 0;
---8<---