linux-kernel - Re: false positive deadlock? Was: [syzbot] [bpf?] possible deadlock in kvfree_call

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAADnVQLKzumBG0GG3cSxQMVRKM_Km9YMb6ub=n9C957qx8=ExQ@mail.gmail.com>
Date: Wed, 27 Mar 2024 17:12:57 -0700
From: Alexei Starovoitov <alexei.starovoitov@...il.com>
To: "Paul E. McKenney" <paulmck@...nel.org>
Cc: syzbot <syzbot+1fa663a2100308ab6eab@...kaller.appspotmail.com>, 
	Andrii Nakryiko <andrii@...nel.org>, Alexei Starovoitov <ast@...nel.org>, bpf <bpf@...r.kernel.org>, 
	Daniel Borkmann <daniel@...earbox.net>, Eddy Z <eddyz87@...il.com>, Hao Luo <haoluo@...gle.com>, 
	John Fastabend <john.fastabend@...il.com>, Jiri Olsa <jolsa@...nel.org>, 
	KP Singh <kpsingh@...nel.org>, LKML <linux-kernel@...r.kernel.org>, 
	Martin KaFai Lau <martin.lau@...ux.dev>, Stanislav Fomichev <sdf@...gle.com>, Song Liu <song@...nel.org>, 
	syzkaller-bugs <syzkaller-bugs@...glegroups.com>, Yonghong Song <yonghong.song@...ux.dev>, 
	Uladzislau Rezki <urezki@...il.com>, rcu@...r.kernel.org
Subject: Re: false positive deadlock? Was: [syzbot] [bpf?] possible deadlock
 in kvfree_call_rcu

On Tue, Mar 26, 2024 at 10:04 PM Paul E. McKenney <paulmck@...nel.org> wrote:
>
> On Tue, Mar 26, 2024 at 09:37:43PM -0700, Paul E. McKenney wrote:
> > On Tue, Mar 26, 2024 at 12:53:35PM -0700, Alexei Starovoitov wrote:
> > > Hi Paul,
> > >
> > > syzbot found an interesting false positive deadlock.
> > > See below.
> > > My understanding is the following:
> > >
> > > cpu 2:
> > >   grabs timer_base lock
> > >     spins on bpf_lpm lock
> > >
> > > cpu 1:
> > >   grab rcu krcp lock
> > >     spins on timer_base lock
> > >
> > > cpu 0:
> > >   grab bpf_lpm lock
> > >     spins on rcu krcp lock
> > >
> > > bpf_lpm lock can be the same.
> > > timer_base lock can also be the same due to timer migration.
> > >
> > > but rcu krcp lock is always per-cpu, so it cannot be the same lock.
> > > Hence it's a false positive, but still interesting.
> > >
> > > I don't think rcu can tell lockdep that these are different locks.
> >
> > It might be possible.  I will play with this tomorrow, modeling after
> > the use of lockdep_set_class_and_name() in rcu_init_one().  I am a bit
> > concerned about systems with thousands of CPUs, but it just might be OK.
>
> Except that each of the resulting separate locks would eventually be
> classified as participating in the same type of potential deadlock cycle.  :-(

That sounds like we have to address it on bpf side,
since we're being spammed with syzbot reports of various
forms and all of them are about this false positive.