netdev - Re: [PATCH AUTOSEL 4.19 040/123] bpf: allocate local storage buffers using GFP

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 7 Dec 2018 12:10:03 +0530
From:   Naresh Kamboju <naresh.kamboju@...aro.org>
To:     Daniel Borkmann <daniel@...earbox.net>,
        Roman Gushchin <guro@...com>
Cc:     linux- stable <stable@...r.kernel.org>,
        open list <linux-kernel@...r.kernel.org>, guroan@...il.com,
        ast@...nel.org, sashal@...nel.org, netdev@...r.kernel.org
Subject: Re: [PATCH AUTOSEL 4.19 040/123] bpf: allocate local storage buffers
 using GFP_ATOMIC

On Wed, 5 Dec 2018 at 15:08, Sasha Levin <sashal@...nel.org> wrote:
>
> From: Roman Gushchin <guroan@...il.com>
>
> [ Upstream commit 569a933b03f3c48b392fe67c0086b3a6b9306b5a ]
>
> Naresh reported an issue with the non-atomic memory allocation of
> cgroup local storage buffers:
>
> [   73.047526] BUG: sleeping function called from invalid context at
> /srv/oe/build/tmp-rpb-glibc/work-shared/intel-corei7-64/kernel-source/mm/slab.h:421
> [   73.060915] in_atomic(): 1, irqs_disabled(): 0, pid: 3157, name: test_cgroup_sto
> [   73.068342] INFO: lockdep is turned off.
> [   73.072293] CPU: 2 PID: 3157 Comm: test_cgroup_sto Not tainted
> 4.20.0-rc2-next-20181113 #1
> [   73.080548] Hardware name: Supermicro SYS-5019S-ML/X11SSH-F, BIOS
> 2.0b 07/27/2017
> [   73.088018] Call Trace:
> [   73.090463]  dump_stack+0x70/0xa5
> [   73.093783]  ___might_sleep+0x152/0x240
> [   73.097619]  __might_sleep+0x4a/0x80
> [   73.101191]  __kmalloc_node+0x1cf/0x2f0
> [   73.105031]  ? cgroup_storage_update_elem+0x46/0x90
> [   73.109909]  cgroup_storage_update_elem+0x46/0x90
>
> cgroup_storage_update_elem() (as well as other update map update
> callbacks) is called with disabled preemption, so GFP_ATOMIC
> allocation should be used: e.g. alloc_htab_elem() in hashtab.c.
>
> Reported-by: Naresh Kamboju <naresh.kamboju@...aro.org>
> Tested-by: Naresh Kamboju <naresh.kamboju@...aro.org>
> Signed-off-by: Roman Gushchin <guro@...com>
> Cc: Alexei Starovoitov <ast@...nel.org>
> Cc: Daniel Borkmann <daniel@...earbox.net>
> Signed-off-by: Alexei Starovoitov <ast@...nel.org>
> Signed-off-by: Sasha Levin <sashal@...nel.org>

I have reported above issue on 4.20.0-rc2-next-20181113.
Now this BUG re-occurring on 4.19.8-rc1 on x86_64 and arm64 devices.

[   70.288592] BUG: sleeping function called from invalid context at
/srv/oe/build/tmp-rpb-glibc/work-shared/intel-corei7-64/kernel-source/mm/slab.h:421
[   70.301992] in_atomic(): 1, irqs_disabled(): 0, pid: 3001, name:
test_cgroup_sto
[   70.309424] INFO: lockdep is turned off.
[   70.313416] CPU: 0 PID: 3001 Comm: test_cgroup_sto Not tainted 4.19.8-rc1 #1
[   70.320483] Hardware name: Supermicro SYS-5019S-ML/X11SSH-F, BIOS
2.0b 07/27/2017
[   70.327953] Call Trace:
[   70.330402]  dump_stack+0x70/0xa5
[   70.333765]  ___might_sleep+0x152/0x240
[   70.337599]  __might_sleep+0x4a/0x80
[   70.341169]  __kmalloc_node+0x1d1/0x300
[   70.345003]  ? cgroup_storage_update_elem+0x46/0x90
[   70.349881]  cgroup_storage_update_elem+0x46/0x90
[   70.354585]  map_update_elem+0x1fd/0x450
[   70.358504]  __x64_sys_bpf+0x129/0x270
[   70.362258]  do_syscall_64+0x55/0x190
[   70.365923]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[   70.370974] RIP: 0033:0x7f42e0ebb969
[   70.374544] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00
00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24
08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d df e4 2b 00 f7 d8 64 89
01 48
[   70.393281] RSP: 002b:00007ffde61a0a08 EFLAGS: 00000202 ORIG_RAX:
0000000000000141
[   70.400845] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f42e0ebb969
[   70.407971] RDX: 0000000000000048 RSI: 00007ffde61a0a50 RDI: 0000000000000002
[   70.415094] RBP: 00007ffde61a0a20 R08: 00007ffde61a0a50 R09: 00007ffde61a0a50
[   70.422216] R10: 00007ffde61a0a50 R11: 0000000000000202 R12: 0000000000000005
[   70.429342] R13: 00007ffde61a0c10 R14: 0000000000000000 R15: 0000000000000000
selftests: bpf: test_cgroup_storage

Full test log links,
arm64 Juno
https://lkft.validation.linaro.org/scheduler/job/537820#L2971

x86_64 Supermicro SYS-5019S-ML/X11SSH-F
https://lkft.validation.linaro.org/scheduler/job/537772#L2724

Best regards
Naresh Kamboju

> ---
>  kernel/bpf/local_storage.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/kernel/bpf/local_storage.c b/kernel/bpf/local_storage.c
> index 830d7f095748..fc1605aee5ea 100644
> --- a/kernel/bpf/local_storage.c
> +++ b/kernel/bpf/local_storage.c
> @@ -138,7 +138,8 @@ static int cgroup_storage_update_elem(struct bpf_map *map, void *_key,
>                 return -ENOENT;
>
>         new = kmalloc_node(sizeof(struct bpf_storage_buffer) +
> -                          map->value_size, __GFP_ZERO | GFP_USER,
> +                          map->value_size,
> +                          __GFP_ZERO | GFP_ATOMIC | __GFP_NOWARN,
>                            map->numa_node);
>         if (!new)
>                 return -ENOMEM;
> --
> 2.17.1
>