Received-SPF: pass (google.com: domain of linux-kernel+bounces-148483-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:4601:e00::3 as permitted sender) client-ip=2604:1380:4601:e00::3;
From: Toke =?utf-8?Q?H=C3=B8iland-J=C3=B8rgensen?= <toke@kernel.org>
To: syzbot <syzbot+af9492708df9797198d6@syzkaller.appspotmail.com>,
 andrii@kernel.org, ast@kernel.org, bpf@vger.kernel.org,
 daniel@iogearbox.net, davem@davemloft.net, eadavis@qq.com,
 eddyz87@gmail.com, haoluo@google.com, hawk@kernel.org,
 john.fastabend@gmail.com, jolsa@kernel.org, kpsingh@kernel.org,
 kuba@kernel.org, linux-kernel@vger.kernel.org, martin.lau@linux.dev,
 netdev@vger.kernel.org, sdf@google.com, song@kernel.org,
 syzkaller-bugs@googlegroups.com, yonghong.song@linux.dev
Subject: Re: [syzbot] [bpf?] [net?] general protection fault in dev_map_enqueue
In-Reply-To: <0000000000003a924406159cf8ee@google.com>
References: <0000000000003a924406159cf8ee@google.com>
Date: Tue, 16 Apr 2024 22:55:00 +0200
Message-ID: <87il0huixn.fsf@toke.dk>
Precedence: bulk
MIME-Version: 1.0
Content-Type: text/plain

syzbot <syzbot+af9492708df9797198d6@syzkaller.appspotmail.com> writes:

> Hello,
>
> syzbot has tested the proposed patch but the reproducer is still triggering an issue:
> general protection fault in dev_map_enqueue

Alright, trying a different thing (not a correct patch, just testing a theory):

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git 443574b03387

diff --git a/net/core/filter.c b/net/core/filter.c
index 786d792ac816..c2fd4f67766f 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -4301,8 +4301,9 @@ void bpf_clear_redirect_map(struct bpf_map *map)
                 * cmpxchg() to make sure it hasn't been changed in
                 * the meantime by remote CPU.
                 */
-               if (unlikely(READ_ONCE(ri->map) == map))
-                       cmpxchg(&ri->map, map, NULL);
+               if (unlikely(READ_ONCE(ri->map) == map) &&
+                   cmpxchg(&ri->map, map, NULL) == map)
+                       WRITE_ONCE(ri->map_type, BPF_MAP_TYPE_UNSPEC);
        }
 }