On Sun, Jan 10, 2021 at 10:34 PM syzbot
[off-list ref] wrote:
syzbot suspects this issue was fixed by commit:
commit 537cf4e3cc2f6cc9088dcd6162de573f603adc29
Author: Magnus Karlsson [off-list ref]
Date: Fri Nov 20 11:53:39 2020 +0000
xsk: Fix umem cleanup bug at socket destruct
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=139f3dfb500000
start commit: e87d24fc Merge branch 'net-iucv-fixes-2020-11-09'
git tree: net
kernel config: https://syzkaller.appspot.com/x/.config?x=61033507391c77ff
dashboard link: https://syzkaller.appspot.com/bug?extid=5f326d255ca648131f87
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=10d10006500000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=126c9eaa500000
If the result looks correct, please mark the issue as fixed by replying with:
#syz fix: xsk: Fix umem cleanup bug at socket destruct
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
FTR, the bisection log looks clean, but this does not look like the
fix for this. The reproducer does not destroy sockets.
On Mon, 11 Jan 2021 at 10:16, Dmitry Vyukov [off-list ref] wrote:
On Sun, Jan 10, 2021 at 10:34 PM syzbot
[off-list ref] wrote:
quoted
syzbot suspects this issue was fixed by commit:
commit 537cf4e3cc2f6cc9088dcd6162de573f603adc29
Author: Magnus Karlsson [off-list ref]
Date: Fri Nov 20 11:53:39 2020 +0000
xsk: Fix umem cleanup bug at socket destruct
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=139f3dfb500000
start commit: e87d24fc Merge branch 'net-iucv-fixes-2020-11-09'
git tree: net
kernel config: https://syzkaller.appspot.com/x/.config?x=61033507391c77ff
dashboard link: https://syzkaller.appspot.com/bug?extid=5f326d255ca648131f87
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=10d10006500000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=126c9eaa500000
If the result looks correct, please mark the issue as fixed by replying with:
#syz fix: xsk: Fix umem cleanup bug at socket destruct
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
FTR, the bisection log looks clean, but this does not look like the
fix for this. The reproducer does not destroy sockets.
I think it's the correct fix.
The crash report also has this, which shows the reproducer does
actually destroy sockets:
xdp_umem_addr_unmap net/xdp/xdp_umem.c:44 [inline]
xdp_umem_release net/xdp/xdp_umem.c:62 [inline]
xdp_put_umem+0x113/0x330 net/xdp/xdp_umem.c:80
xsk_destruct net/xdp/xsk.c:1150 [inline]
xsk_destruct+0xc0/0xf0 net/xdp/xsk.c:1142
__sk_destruct+0x4b/0x8f0 net/core/sock.c:1759
rcu_do_batch kernel/rcu/tree.c:2476 [inline]
I've tested the reproducer on both 537cf4e3cc2f and 537cf4e3cc2f^ and
it only reproduces on 537cf4e3cc2f^ here (with the same stack trace as
the syzbot report).
The repro I used was
https://syzkaller.appspot.com/text?tag=ReproSyz&x=10d10006500000 which
is just:
r0 = socket$xdp(0x2c, 0x3, 0x0)
setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4,
&(0x7f0000000040)={&(0x7f0000000000)=""/2, 0x1000000, 0x1000}, 0x20)
so the socket definitely gets created/destroyed.
Feel free to undo if you disagree:
#syz fix: xsk: Fix umem cleanup bug at socket destruct
Vegard