Re: WARNING in is_bpf_text_address
From: Daniel Borkmann <daniel@iogearbox.net>
Date: 2019-08-15 08:52:26
Also in:
bpf, lkml
On 8/11/19 10:36 AM, Hillf Danton wrote:
On Sun, 11 Aug 2019 08:24:09 +0800quoted
syzbot has found a reproducer for the following crash on: HEAD commit: 451577f3 Merge tag 'kbuild-fixes-v5.3-3' of git://git.kern.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=120850a6600000 kernel config: https://syzkaller.appspot.com/x/.config?x=2031e7d221391b8a dashboard link: https://syzkaller.appspot.com/bug?extid=bd3bba6ff3fcea7a6ec6 compiler: clang version 9.0.0 (/home/glider/llvm/clang 80fee25776c2fb61e74c1ecb1a523375c2500b69) syz repro: https://syzkaller.appspot.com/x/repro.syz?x=130ffe4a600000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17137d2c600000 The bug was bisected to: commit a0b0fd53e1e67639b303b15939b9c653dbe7a8c4 Author: Bart Van Assche [off-list ref] Date: Thu Feb 14 23:00:46 2019 +0000 locking/lockdep: Free lock classes that are no longer in use
Hey Bart, don't think it's related in any way to your commit. I'll allocate some time on working on this issue today, thanks!
quoted hunk
quoted
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=152f6a9da00000 final crash: https://syzkaller.appspot.com/x/report.txt?x=172f6a9da00000 console output: https://syzkaller.appspot.com/x/log.txt?x=132f6a9da00000 IMPORTANT: if you fix the bug, please add the following tag to the commit: Reported-by: syzbot+bd3bba6ff3fcea7a6ec6@syzkaller.appspotmail.com Fixes: a0b0fd53e1e6 ("locking/lockdep: Free lock classes that are no longer in use") WARNING: CPU: 0 PID: 9604 at kernel/bpf/core.c:851 bpf_jit_free+0x1a8/0x1f0 Kernel panic - not syncing: panic_on_warn set ... CPU: 0 PID: 9604 Comm: kworker/0:5 Not tainted 5.3.0-rc3+ #71 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: events bpf_prog_free_deferred Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1d8/0x2f8 lib/dump_stack.c:113 panic+0x25c/0x799 kernel/panic.c:219 __warn+0x22f/0x230 kernel/panic.c:576 report_bug+0x190/0x290 lib/bug.c:186 BUG: unable to handle page fault for address: fffffbfff4001000 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 21ffee067 P4D 21ffee067 PUD 21ffed067 PMD 936de067 PTE 0 Oops: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 9604 Comm: kworker/0:5 Not tainted 5.3.0-rc3+ #71 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: events bpf_prog_free_deferred RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:537 [inline] RIP: 0010:bpf_tree_comp kernel/bpf/core.c:600 [inline] RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline] RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline] RIP: 0010:bpf_prog_kallsyms_find kernel/bpf/core.c:674 [inline] RIP: 0010:is_bpf_text_address+0x201/0x3b0 kernel/bpf/core.c:709 Code: 85 c4 f5 ff 4d 39 f4 76 10 e8 7b c2 f5 ff 49 83 c7 10 eb 46 0f 1f 44 00 00 4c 89 e0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <0f> b6 04 08 84 c0 75 7d 41 8b 1c 24 48 c1 e3 0c 4c 01 e3 48 89 df RSP: 0018:ffff888097eff828 EFLAGS: 00010806 RAX: 1ffffffff4001000 RBX: 0000000000000001 RCX: dffffc0000000000 RDX: ffff88809f1e0280 RSI: ffffffffff7a5520 RDI: ffffffffa0008000 RBP: ffff888097eff860 R08: ffffffff817dc73b R09: 0000000000000001 R10: fffffbfff117be6d R11: 0000000000000000 R12: ffffffffa0008000 R13: 0000000000000000 R14: ffffffffff7a5520 R15: ffff88809a46b2f8 FS: 0000000000000000(0000) GS:ffff8880aea00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: fffffbfff4001000 CR3: 0000000095d73000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace:[pruned] Pair bpf_prog_kallsyms_del_all() with bpf_prog_free() to silence WARNING at kernel/bpf/core.c:851, see __bpf_prog_release() in net/core/filter.c for why.--- a/kernel/bpf/core.c +++ b/kernel/bpf/core.c@@ -1987,6 +1987,7 @@ void bpf_prog_free(struct bpf_prog *fp) { struct bpf_prog_aux *aux = fp->aux; + bpf_prog_kallsyms_del_all(fp); INIT_WORK(&aux->work, bpf_prog_free_deferred); schedule_work(&aux->work); } --- a/kernel/bpf/syscall.c +++ b/kernel/bpf/syscall.c@@ -1328,7 +1328,6 @@ static void __bpf_prog_put(struct bpf_pr perf_event_bpf_event(prog, PERF_BPF_EVENT_PROG_UNLOAD, 0); /* bpf_prog_free_id() must be called first */ bpf_prog_free_id(prog, do_idr_lock); - bpf_prog_kallsyms_del_all(prog); btf_put(prog->aux->btf); kvfree(prog->aux->func_info); bpf_prog_free_linfo(prog); --