| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <e5a894e5-5637-4aba-89c2-66173df1a589@uliege.be>
Date: Tue, 15 Apr 2025 11:29:43 +0200
From: Justin Iurman <justin.iurman@...ege.be>
To: Eduard Zingerman <eddyz87@...il.com>
Cc: netdev@...r.kernel.org, davem@...emloft.net, dsahern@...nel.org,
edumazet@...gle.com, kuba@...nel.org, pabeni@...hat.com, horms@...nel.org
Subject: Re: [PATCH net v2 0/3] net: fix lwtunnel reentry loops
On 4/15/25 00:30, Eduard Zingerman wrote:
> Justin Iurman <justin.iurman@...ege.be> writes:
>
>> v2:
>> - removed some patches from the -v1 series
>> - added a patch that was initially sent separately
>> - code style for the selftest (thanks Paolo)
>> v1:
>> - https://lore.kernel.org/all/20250311141238.19862-1-justin.iurman@uliege.be/
>
> Hi Justin,
>
> I've noticed a BUG splat likely introduced by this patch.
> The splat is reported when executing some BPF selftests,
> e.g. lwt_ip_encap_ipv4/egress
> (defined in tools/testing/selftests/bpf/prog_tests/lwt_ip_encap.c and
> tools/testing/selftests/bpf/progs/test_lwt_ip_encap.c).
>
> Decoded splat is at the end of the email.
> Line numbers correspond to commit
> a27a97f71394 ("Merge branch 'bpf-support-atomic-update-for-htab-of-maps'")
> from the kernel/git/bpf/bpf-next.git tree.
Hi Eduard,
This is currently discussed in [1]. We have a solution, but no consensus
on the fix yet.
[1]
https://lore.kernel.org/netdev/3cee5141-c525-4e83-830e-bf21828aed51@uliege.be/T/#t
Thanks for the report,
Justin
> Thanks,
> Eduard
>
> ---
>
> [ 193.993893] BUG: using __this_cpu_add() in preemptible [00000000] code: test_progs/206
> [ 193.994292] caller is lwtunnel_xmit (net/core/dev.h:340 net/core/lwtunnel.c:408)
> [ 193.994601] Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
> [ 193.994603] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-4.el9 04/01/2014
> [ 193.994605] Call Trace:
> [ 193.994608] <TASK>
> [ 193.994611] dump_stack_lvl (lib/dump_stack.c:122)
> [ 193.994622] check_preemption_disabled (lib/smp_processor_id.c:0)
> [ 193.994630] ? lwtunnel_xmit (./include/linux/rcupdate.h:331 ./include/linux/rcupdate.h:841 net/core/lwtunnel.c:403)
> [ 193.994637] lwtunnel_xmit (net/core/dev.h:340 net/core/lwtunnel.c:408)
> [ 193.994648] ip_finish_output2 (net/ipv4/ip_output.c:222)
> [ 193.994655] ? ip_skb_dst_mtu (./include/net/ip.h:517)
> [ 193.994659] ? ip_skb_dst_mtu (./include/linux/rcupdate.h:331 ./include/linux/rcupdate.h:841 ./include/net/ip.h:471 ./include/net/ip.h:512)
> [ 193.994669] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:182)
> [ 193.994672] ? __ip_finish_output (net/ipv4/ip_output.c:306)
> [ 193.994683] ? __ip_queue_xmit (./include/linux/rcupdate.h:331 ./include/linux/rcupdate.h:841 net/ipv4/ip_output.c:470)
> [ 193.994688] __ip_queue_xmit (net/ipv4/ip_output.c:527)
> [ 193.994693] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:182)
> [ 193.994711] ? __ip_queue_xmit (./include/linux/rcupdate.h:331 ./include/linux/rcupdate.h:841 net/ipv4/ip_output.c:470)
> [ 193.994726] __tcp_transmit_skb (net/ipv4/tcp_output.c:1479)
> [ 193.994800] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:182)
> [ 193.994804] ? __asan_memset (mm/kasan/shadow.c:84)
> [ 193.994810] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:182)
> [ 193.994824] tcp_connect (net/ipv4/tcp_output.c:0 net/ipv4/tcp_output.c:4155)
> [ 193.994890] tcp_v4_connect (net/ipv4/tcp_ipv4.c:343)
> [ 193.994926] __inet_stream_connect (net/ipv4/af_inet.c:678)
> [ 193.994944] ? __local_bh_enable_ip (./arch/x86/include/asm/irqflags.h:42 ./arch/x86/include/asm/irqflags.h:119 kernel/softirq.c:412)
> [ 193.994950] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:182)
> [ 193.994953] ? lockdep_hardirqs_on (kernel/locking/lockdep.c:4473)
> [ 193.994967] inet_stream_connect (net/ipv4/af_inet.c:748)
> [ 193.994976] ? __pfx_inet_stream_connect (net/ipv4/af_inet.c:744)
> [ 193.994981] __sys_connect (./include/linux/file.h:62 ./include/linux/file.h:83 net/socket.c:2058)
> [ 193.995013] __x64_sys_connect (net/socket.c:2063 net/socket.c:2060 net/socket.c:2060)
> [ 193.995022] do_syscall_64 (arch/x86/entry/syscall_64.c:0)
> [ 193.995026] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:182)
> [ 193.995030] ? lockdep_hardirqs_on (kernel/locking/lockdep.c:4473)
> [ 193.995038] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
> [ 193.995042] RIP: 0033:0x7faec2d0f9cb
> [ 193.995047] Code: 83 ec 18 89 54 24 0c 48 89 34 24 89 7c 24 08 e8 4b 70 f7 ff 8b 54 24 0c 48 8b 34 24 41 89 c0 8b 7c 24 08 b8 2a 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 44 89 c7 89 44 24 08 e8 a1 70 f7 ff 8b 44
> All code
> ========
> 0: 83 ec 18 sub $0x18,%esp
> 3: 89 54 24 0c mov %edx,0xc(%rsp)
> 7: 48 89 34 24 mov %rsi,(%rsp)
> b: 89 7c 24 08 mov %edi,0x8(%rsp)
> f: e8 4b 70 f7 ff call 0xfffffffffff7705f
> 14: 8b 54 24 0c mov 0xc(%rsp),%edx
> 18: 48 8b 34 24 mov (%rsp),%rsi
> 1c: 41 89 c0 mov %eax,%r8d
> 1f: 8b 7c 24 08 mov 0x8(%rsp),%edi
> 23: b8 2a 00 00 00 mov $0x2a,%eax
> 28: 0f 05 syscall
> 2a:* 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax <-- trapping instruction
> 30: 77 35 ja 0x67
> 32: 44 89 c7 mov %r8d,%edi
> 35: 89 44 24 08 mov %eax,0x8(%rsp)
> 39: e8 a1 70 f7 ff call 0xfffffffffff770df
> 3e: 8b .byte 0x8b
> 3f: 44 rex.R
>
> Code starting with the faulting instruction
> ===========================================
> 0: 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax
> 6: 77 35 ja 0x3d
> 8: 44 89 c7 mov %r8d,%edi
> b: 89 44 24 08 mov %eax,0x8(%rsp)
> f: e8 a1 70 f7 ff call 0xfffffffffff770b5
> 14: 8b .byte 0x8b
> 15: 44 rex.R
> [ 193.995050] RSP: 002b:00007fff992d3a20 EFLAGS: 00000293 ORIG_RAX: 000000000000002a
> [ 193.995054] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007faec2d0f9cb
> [ 193.995057] RDX: 0000000000000010 RSI: 00007fff992d3ad8 RDI: 0000000000000035
> [ 193.995059] RBP: 00007fff992d3ac0 R08: 0000000000000000 R09: 0000000000000004
> [ 193.995062] R10: 00007fff992d39b0 R11: 0000000000000293 R12: 00007fff992d7b78
> [ 193.995064] R13: 000000000095f760 R14: 0000000002e38b90 R15: 00007faec373d000
> [ 193.995091] </TASK>
>
Powered by blists - more mailing lists