netdev - Re: Soft lockup in tc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 19 Dec 2016 18:39:17 +0200
From:   Shahar Klein <shahark@...lanox.com>
To:     Cong Wang <xiyou.wangcong@...il.com>,
        Or Gerlitz <gerlitz.or@...il.com>
CC:     <shahark@...lanox.com>, Daniel Borkmann <daniel@...earbox.net>,
        "Linux Netdev List" <netdev@...r.kernel.org>,
        Roi Dayan <roid@...lanox.com>,
        "David Miller" <davem@...emloft.net>,
        Jiri Pirko <jiri@...lanox.com>,
        John Fastabend <john.fastabend@...il.com>,
        Hadar Hen Zion <hadarh@...lanox.com>,
        "Daniel Borkmann" <daniel@...earbox.net>
Subject: Re: Soft lockup in tc_classify



On 12/13/2016 12:51 AM, Cong Wang wrote:
> On Mon, Dec 12, 2016 at 1:18 PM, Or Gerlitz <gerlitz.or@...il.com> wrote:
>> On Mon, Dec 12, 2016 at 3:28 PM, Daniel Borkmann <daniel@...earbox.net> wrote:
>>
>>> Note that there's still the RCU fix missing for the deletion race that
>>> Cong will still send out, but you say that the only thing you do is to
>>> add a single rule, but no other operation in involved during that test?
>>
>> What's missing to have the deletion race fixed? making a patch or
>> testing to a patch which was sent?
>
> If you think it would help for this problem, here is my patch rebased
> on the latest net-next.
>
> Again, I don't see how it could help this case yet, especially I don't
> see how we could have a loop in this singly linked list.
>

I've applied cong's patch and hit a different lockup(full log attached):

[  264.725414] RIP: 0010:fl_classify+0x1f1/0x2b0 [cls_flower]

(gdb) list *(fl_classify+0x1f1)
0x1591 is in fl_classify (net/sched/cls_flower.c:187).
182		if (f && !tc_skip_sw(f->flags)) {
183			*res = f->res;
184			return tcf_exts_exec(skb, &f->exts, res);
185		}
186		return -1;
187	}
188	
189	static int fl_init(struct tcf_proto *tp)
190	{
191		struct cls_fl_head *head;
(gdb)

Daniel suggested I'll add a print:
                 case RTM_DELTFILTER:
-                   err = tp->ops->delete(tp, fh);
+                 printk(KERN_ERR "DEBUGG:SK %s:%d\n", __func__, __LINE__);
+                 err = tp->ops->delete(tp, fh, &last);
                         if (err == 0) {

and I couldn't see this print in the output.....





View attachment "lockup_with_congs_patch" of type "text/plain" (16549 bytes)