| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20250514085421.GO22843@unreal>
Date: Wed, 14 May 2025 11:54:21 +0300
From: Leon Romanovsky <leon@...nel.org>
To: jgg@...pe.ca
Cc: syzbot <syzbot+b0da83a6c0e2e2bddbd4@...kaller.appspotmail.com>,
linux-kernel@...r.kernel.org, linux-rdma@...r.kernel.org,
syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [rdma?] WARNING in gid_table_release_one (3)
On Tue, May 13, 2025 at 04:35:23AM -0700, syzbot wrote:
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: c32f8dc5aaf9 Merge branch 'for-next/core' into for-kernelci
> git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
> console output: https://syzkaller.appspot.com/x/log.txt?x=10789768580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=ea4635ffd6ad5b4a
> dashboard link: https://syzkaller.appspot.com/bug?extid=b0da83a6c0e2e2bddbd4
> compiler: Debian clang version 20.1.2 (++20250402124445+58df0ef89dd6-1~exp1~20250402004600.97), Debian LLD 20.1.2
> userspace arch: arm64
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15a08cf4580000
>
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/b921498959d4/disk-c32f8dc5.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/04e6ad946c4b/vmlinux-c32f8dc5.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/d4f0d8db50ee/Image-c32f8dc5.gz.xz
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+b0da83a6c0e2e2bddbd4@...kaller.appspotmail.com
>
> --
> ------------[ cut here ]------------
> GID entry ref leak for dev syz1 index 2 ref=573
Jason,
According to repro https://syzkaller.appspot.com/x/repro.syz?x=15a08cf4580000, we joined multicast group,
but never left it. This is how we can get "ref=573".
write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f00000001c0)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000100)={<r2=>0xffffffffffffffff}, 0x13f, 0x4}}, 0x20)
write$RDMA_USER_CM_CMD_BIND_IP(r1, &(0x7f0000000180)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x4e25, 0x10001, @local, 0xb}, r2}}, 0x30)
write$RDMA_USER_CM_CMD_JOIN_MCAST(r1, &(0x7f0000000900)={0x16, 0x98, 0xfa00, {0x0, 0x5, r2, 0x10, 0x1, @in={0x2, 0x4e23, @loopback}}}, 0xa0)
Thanks
> WARNING: CPU: 1 PID: 655 at drivers/infiniband/core/cache.c:809 release_gid_table drivers/infiniband/core/cache.c:806 [inline]
> WARNING: CPU: 1 PID: 655 at drivers/infiniband/core/cache.c:809 gid_table_release_one+0x284/0x3cc drivers/infiniband/core/cache.c:886
> Modules linked in:
> CPU: 1 UID: 0 PID: 655 Comm: kworker/u8:10 Not tainted 6.15.0-rc5-syzkaller-gc32f8dc5aaf9 #0 PREEMPT
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
> Workqueue: ib-unreg-wq ib_unregister_work
> pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
> pc : release_gid_table drivers/infiniband/core/cache.c:806 [inline]
> pc : gid_table_release_one+0x284/0x3cc drivers/infiniband/core/cache.c:886
> lr : release_gid_table drivers/infiniband/core/cache.c:806 [inline]
> lr : gid_table_release_one+0x284/0x3cc drivers/infiniband/core/cache.c:886
> sp : ffff80009c927860
> x29: ffff80009c9278b0 x28: ffff0000d2b52f00 x27: ffff0000d77ee8d8
> x26: ffff0000d77ee800 x25: 0000000000000010 x24: 0000000000000001
> x23: ffff800092818000 x22: dfff800000000000 x21: 0000000000000003
> x20: 1fffe0001aefdd1b x19: 1fffe0001aefdd00 x18: 00000000ffffffff
> x17: 0000000000000000 x16: ffff80008adb410c x15: 0000000000000001
> x14: 1fffe000338716e2 x13: 0000000000000000 x12: 0000000000000000
> x11: ffff6000338716e3 x10: 0000000000ff0100 x9 : 1b90c18326689500
> x8 : 1b90c18326689500 x7 : 0000000000000001 x6 : 0000000000000001
> x5 : ffff80009c9271b8 x4 : ffff80008f405b40 x3 : ffff8000807b1330
> x2 : 0000000000000001 x1 : 0000000100000000 x0 : 0000000000000000
> Call trace:
> release_gid_table drivers/infiniband/core/cache.c:806 [inline] (P)
> gid_table_release_one+0x284/0x3cc drivers/infiniband/core/cache.c:886 (P)
> ib_cache_release_one+0x144/0x174 drivers/infiniband/core/cache.c:1636
> ib_device_release+0xc4/0x194 drivers/infiniband/core/device.c:482
> device_release+0x8c/0x1ac drivers/base/core.c:-1
> kobject_cleanup lib/kobject.c:689 [inline]
> kobject_release lib/kobject.c:720 [inline]
> kref_put include/linux/kref.h:65 [inline]
> kobject_put+0x2b0/0x438 lib/kobject.c:737
> put_device+0x28/0x40 drivers/base/core.c:3800
> ib_unregister_work+0x28/0x38 drivers/infiniband/core/device.c:1629
> process_one_work+0x7e8/0x156c kernel/workqueue.c:3238
> process_scheduled_works kernel/workqueue.c:3319 [inline]
> worker_thread+0x958/0xed8 kernel/workqueue.c:3400
> kthread+0x5fc/0x75c kernel/kthread.c:464
> ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:847
> irq event stamp: 1499918
> hardirqs last enabled at (1499917): [<ffff80008054cc08>] __up_console_sem kernel/printk/printk.c:344 [inline]
> hardirqs last enabled at (1499917): [<ffff80008054cc08>] __console_unlock+0x70/0xc4 kernel/printk/printk.c:2885
> hardirqs last disabled at (1499918): [<ffff80008adaf5e0>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:511
> softirqs last enabled at (1496318): [<ffff8000803cbf1c>] softirq_handle_end kernel/softirq.c:425 [inline]
> softirqs last enabled at (1496318): [<ffff8000803cbf1c>] handle_softirqs+0xaf8/0xc88 kernel/softirq.c:607
> softirqs last disabled at (1496303): [<ffff800080020efc>] __do_softirq+0x14/0x20 kernel/softirq.c:613
> ---[ end trace 0000000000000000 ]---
> wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
> wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
>
>
> ---
> This report is generated by a bot. It may contain errors.
> See https://goo.gl/tpsmEJ for more information about syzbot.
> syzbot engineers can be reached at syzkaller@...glegroups.com.
>
> syzbot will keep track of this issue. See:
> https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
>
> If the report is already addressed, let syzbot know by replying with:
> #syz fix: exact-commit-title
>
> If you want syzbot to run the reproducer, reply with:
> #syz test: git://repo/address.git branch-or-commit-hash
> If you attach or paste a git patch, syzbot will apply it before testing.
>
> If you want to overwrite report's subsystems, reply with:
> #syz set subsystems: new-subsystem
> (See the list of subsystem names on the web dashboard)
>
> If the report is a duplicate of another one, reply with:
> #syz dup: exact-subject-of-another-report
>
> If you want to undo deduplication, reply with:
> #syz undup
Powered by blists - more mailing lists