Received-SPF: pass (google.com: domain of linux-kernel+bounces-204429-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.199.223 as permitted sender) client-ip=147.75.199.223;
Precedence: bulk
MIME-Version: 1.0
Date: Thu, 06 Jun 2024 07:14:30 -0700
In-Reply-To: <000000000000adb08b061413919e@google.com>
Message-ID: <000000000000277099061a394d13@google.com>
Subject: Re: [syzbot] possible deadlock in trie_delete_elem
From: syzbot <syzbot+9d95beb2a3c260622518@syzkaller.appspotmail.com>
To: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: possible deadlock in trie_delete_elem
Author: norkam41@gmail.com

#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.g=
it c3f38fa61af77b49866b006939479069cd451173

Signed-off-by: Norbert Kami=C5=84ski <norkam41@gmail.com>
---
 kernel/trace/bpf_trace.c | 18 +++++++++++++++++-
 kernel/tracepoint.c      | 15 +++++++++++++--
 2 files changed, 30 insertions(+), 3 deletions(-)

diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
index 6249dac61701..75fdb8e3abaa 100644
--- a/kernel/trace/bpf_trace.c
+++ b/kernel/trace/bpf_trace.c
@@ -2391,7 +2391,23 @@ void __bpf_trace_run(struct bpf_raw_tp_link *link, u=
64 *args)
 	struct bpf_trace_run_ctx run_ctx;
=20
 	cant_sleep();
-	if (unlikely(this_cpu_inc_return(*(prog->active)) !=3D 1)) {
+
+	// return if instrumentation disabled, see: bpf_disable_instrumentation
+	int instrumentation =3D unlikely(__this_cpu_read(bpf_prog_active));
+	if (instrumentation) {
+		printk("SKIP FOR INSTRUMENTATION: %s > %s > %p /%i =3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D\n",
+				prog->aux->name,
+				link->btp->tp->name, prog, instrumentation);
+		bpf_prog_inc_misses_counter(prog);
+		return;
+	}
+
+	int active =3D this_cpu_inc_return(*(prog->active));
+	// printk("%s > %s > %p /%i\n", prog->aux->name, link->btp->tp->name, pro=
g, active);
+	if (active !=3D 1) {
+		printk("SKIP FOR ACTIVE: %s > %s > %p /%i =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D\n",
+				prog->aux->name,
+				link->btp->tp->name, prog, active);
 		bpf_prog_inc_misses_counter(prog);
 		goto out;
 	}
diff --git a/kernel/tracepoint.c b/kernel/tracepoint.c
index 8d1507dd0724..a0a0d8b16b41 100644
--- a/kernel/tracepoint.c
+++ b/kernel/tracepoint.c
@@ -168,12 +168,21 @@ static inline void release_probes(struct tracepoint_f=
unc *old)
 static void debug_print_probes(struct tracepoint_func *funcs)
 {
 	int i;
+	struct bpf_raw_tp_link *link;
=20
 	if (!tracepoint_debug || !funcs)
 		return;
=20
-	for (i =3D 0; funcs[i].func; i++)
-		printk(KERN_DEBUG "Probe %d : %p\n", i, funcs[i].func);
+	for (i =3D 0; funcs[i].func; i++) {
+		link =3D funcs[i].data;
+		int active =3D this_cpu_read(*(link->link.prog->active));
+		printk("Probe %d : %p / %p: %s/%d / %i\n", i,
+				funcs[i].func,
+				link,
+				link->link.prog->aux->name,
+				active,
+				funcs[i].prio);
+	}
 }
=20
 static struct tracepoint_func *
@@ -298,6 +307,8 @@ static enum tp_func_state nr_func_state(const struct tr=
acepoint_func *tp_funcs)
 {
 	if (!tp_funcs)
 		return TP_FUNC_0;
+	if (!tp_funcs[0].func)
+		return TP_FUNC_0;
 	if (!tp_funcs[1].func)
 		return TP_FUNC_1;
 	if (!tp_funcs[2].func)
--=20
2.34.1