netdev - Re: [linux-next:master] [net] 18429e6e0c: WARNING:at_net/socket.c:#__sock

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20241023173925.34267-1-kuniyu@amazon.com>
Date: Wed, 23 Oct 2024 10:39:25 -0700
From: Kuniyuki Iwashima <kuniyu@...zon.com>
To: <oliver.sang@...el.com>
CC: <edumazet@...gle.com>, <ignat@...udflare.com>, <kuba@...nel.org>,
	<kuniyu@...zon.com>, <lkp@...el.com>, <netdev@...r.kernel.org>,
	<oe-lkp@...ts.linux.dev>
Subject: Re: [linux-next:master] [net]  18429e6e0c: WARNING:at_net/socket.c:#__sock_create

From: kernel test robot <oliver.sang@...el.com>
Date: Wed, 23 Oct 2024 15:02:51 +0800
> 
> Hello,
> 
> kernel test robot noticed "WARNING:at_net/socket.c:#__sock_create" on:
> 
> commit: 18429e6e0c2ad26250862a786964d8c73400d9a0 ("Revert "net: do not leave a dangling sk pointer, when socket creation fails"")
> https://git.kernel.org/cgit/linux/kernel/git/next/linux-next.git master
> 
> [test failed on linux-next/master f2493655d2d3d5c6958ed996b043c821c23ae8d3]
> 
> in testcase: trinity
> version: 
> with following parameters:
> 
> 	runtime: 600s
> 
> 
> 
> config: x86_64-randconfig-072-20241019
> compiler: gcc-12
> test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 16G
> 
> (please refer to attached dmesg/kmsg for entire log/backtrace)
> 
> 
> +------------------------------------------------+------------+------------+
> |                                                | 48156296a0 | 18429e6e0c |
> +------------------------------------------------+------------+------------+
> | WARNING:at_net/socket.c:#__sock_create         | 0          | 23         |
> | RIP:__sock_create                              | 0          | 23         |
> +------------------------------------------------+------------+------------+
> 
> 
> If you fix the issue in a separate patch/commit (i.e. not just a new version of
> the same patch/commit), kindly add following tags
> | Reported-by: kernel test robot <oliver.sang@...el.com>
> | Closes: https://lore.kernel.org/oe-lkp/202410231427.633734b3-lkp@intel.com
> 
> 
> [   81.874092][  T849] ------------[ cut here ]------------
> [ 81.874427][ T849] WARNING: CPU: 0 PID: 849 at net/socket.c:1581 __sock_create (net/socket.c:1581 (discriminator 1)) 
> [   81.874997][  T849] Modules linked in:
> [   81.875214][  T849] CPU: 0 UID: 8192 PID: 849 Comm: trinity-c5 Not tainted 6.12.0-rc2-00650-g18429e6e0c2a #1
> [ 81.875701][ T849] RIP: 0010:__sock_create (net/socket.c:1581 (discriminator 1)) 
> [ 81.876000][ T849] Code: e9 19 fd ff ff e8 a3 16 d7 fd e9 4f f9 ff ff 41 bd 9f ff ff ff e9 b8 fa ff ff 41 bd ea ff ff ff e9 ad fa ff ff e8 83 95 9c fd <0f> 0b e9 72 ff ff ff e8 77 95 9c fd e8 62 72 12 00 31 ff 89 c3 89
[...]
> [   81.881295][  T849] Call Trace:
> [   81.881474][  T849]  <TASK>
> [ 81.881634][ T849] ? __sock_create (net/socket.c:1581 (discriminator 1)) 
> [ 81.881908][ T849] ? __warn (kernel/panic.c:748) 
> [ 81.882130][ T849] ? __sock_create (net/socket.c:1581 (discriminator 1)) 
> [ 81.882395][ T849] ? report_bug (lib/bug.c:180 lib/bug.c:219) 
> [ 81.882655][ T849] ? handle_bug (arch/x86/kernel/traps.c:285) 
> [ 81.882910][ T849] ? exc_invalid_op (arch/x86/kernel/traps.c:309 (discriminator 1)) 
> [ 81.883164][ T849] ? asm_exc_invalid_op (arch/x86/include/asm/idtentry.h:621) 
> [ 81.883446][ T849] ? __sock_create (net/socket.c:1581 (discriminator 1)) 
> [ 81.883725][ T849] __sys_socket (net/socket.c:1670 net/socket.c:1716) 
> [ 81.883995][ T849] ? update_socket_protocol+0x20/0x20 
> [ 81.884432][ T849] ? ftrace_likely_update (arch/x86/include/asm/smap.h:56 kernel/trace/trace_branch.c:229) 
> [ 81.885031][ T849] ? tracer_hardirqs_on (kernel/trace/trace_irqsoff.c:57 kernel/trace/trace_irqsoff.c:613) 
> [ 81.885310][ T849] __ia32_sys_socket (net/socket.c:1728) 
> [ 81.885863][ T849] do_int80_emulation (arch/x86/entry/common.c:165 arch/x86/entry/common.c:253) 
> [ 81.886413][ T849] asm_int80_emulation (arch/x86/include/asm/idtentry.h:626)

I find this stack trace useless unless we have a strace log or
repro as syzkaller provides.

I should've suggested like below to make debugging easier.

This might be already fixed by Eric's vsock patch, but I'll post a
patch later.

---8<---
diff --git a/include/net/net_debug.h b/include/net/net_debug.h
index 1e74684cbbdb..5bcd9a18d00a 100644
--- a/include/net/net_debug.h
+++ b/include/net/net_debug.h
@@ -150,8 +150,10 @@ do {								\
 
 #if defined(CONFIG_DEBUG_NET)
 #define DEBUG_NET_WARN_ON_ONCE(cond) (void)WARN_ON_ONCE(cond)
+#define DEBUG_NET_WARN_ONCE(cond, format...) (void)WARN_ONCE(cond, format)
 #else
 #define DEBUG_NET_WARN_ON_ONCE(cond) BUILD_BUG_ON_INVALID(cond)
+#define DEBUG_NET_WARN_ONCE(cond, format...) BUILD_BUG_ON_INVALID(cond)
 #endif
 
 #endif	/* _LINUX_NET_DEBUG_H */
diff --git a/net/socket.c b/net/socket.c
index 9a8e4452b9b2..da00db3824e3 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -1578,7 +1578,9 @@ int __sock_create(struct net *net, int family, int type, int protocol,
 		/* ->create should release the allocated sock->sk object on error
 		 * and make sure sock->sk is set to NULL to avoid use-after-free
 		 */
-		DEBUG_NET_WARN_ON_ONCE(sock->sk);
+		DEBUG_NET_WARN_ONCE(sock->sk,
+				    "%pS must clear sock->sk on failure, family: %d, type: %d, protocol: %d\n",
+				    pf->create, family, type, protocol);
 		goto out_module_put;
 	}
 
---8<---