Re: [syzbot] [bpf?] [net?] WARNING in sock_map_del_link

[Daniel Borkmann]

On 4/13/23 5:33 PM, syzbot wrote:
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit:    d319f344561d mm: Fix copy_from_user_nofault().
> git tree:       bpf-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=15930c9dc80000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=78c9d875f0a80d33
> dashboard link: https://syzkaller.appspot.com/bug?extid=49f6cef45247ff249498
> compiler:       gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
>
> Unfortunately, I don't have any reproducer for this issue yet.
>
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/229f3623b7df/disk-d319f344.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/6da0db75c9aa/vmlinux-d319f344.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/01f022fb9a13/bzImage-d319f344.xz
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+49f6cef45247ff249498@xxxxxxxxxxxxxxxxxxxxxxxxx

Xin, fyi, given we're currently prepping bpf-next pr we unfortunately had to revert commit
ed17aa92dc56 ("bpf, sockmap: fix deadlocks in the sockhash and sockmap") which is causing
this new syzkaller splat. There's another one in the syzkaller queue we've been made
aware of which bisected to earlier mentioned commit.

https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git/commit/?id=8c5c2a4898e3d6bad86e29d471e023c8a19ba799

> ------------[ cut here ]------------
> WARNING: CPU: 1 PID: 7921 at kernel/softirq.c:376 __local_bh_enable_ip+0xbe/0x130 kernel/softirq.c:376
> Modules linked in:
> CPU: 1 PID: 7921 Comm: syz-executor.4 Not tainted 6.2.0-syzkaller-13249-gd319f344561d #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023
> RIP: 0010:__local_bh_enable_ip+0xbe/0x130 kernel/softirq.c:376
> Code: 45 bf 01 00 00 00 e8 b1 44 0a 00 e8 9c 41 3d 00 fb 65 8b 05 2c 61 b5 7e 85 c0 74 58 5b 5d c3 65 8b 05 12 2f b4 7e 85 c0 75 a2 <0f> 0b eb 9e e8 e9 41 3d 00 eb 9f 48 89 ef e8 ff 30 18 00 eb a8 0f
> RSP: 0018:ffffc90007bffbe8 EFLAGS: 00010046
> RAX: 0000000000000000 RBX: 0000000000000201 RCX: 1ffffffff1cf0736
> RDX: 0000000000000000 RSI: 0000000000000201 RDI: ffffffff882bf40a
> RBP: ffffffff882bf40a R08: 0000000000000000 R09: ffff88801cc6327b
> R10: ffffed100398c64f R11: 1ffffffff21917f0 R12: ffff88801cc63268
> R13: ffff88801cc63268 R14: ffff8880188ef500 R15: 0000000000000000
> FS:  00007f378f724700(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000
> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00007fbbc57831b8 CR3: 00000000210ad000 CR4: 00000000003506e0
> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> Call Trace:
>   <TASK>
>   spin_unlock_bh include/linux/spinlock.h:395 [inline]
>   sock_map_del_link+0x2ea/0x510 net/core/sock_map.c:165
>   sock_map_unref+0xb0/0x1d0 net/core/sock_map.c:184
>   sock_hash_delete_elem+0x1ec/0x2a0 net/core/sock_map.c:945
>   map_delete_elem kernel/bpf/syscall.c:1536 [inline]
>   __sys_bpf+0x2edc/0x53e0 kernel/bpf/syscall.c:5053
>   __do_sys_bpf kernel/bpf/syscall.c:5166 [inline]
>   __se_sys_bpf kernel/bpf/syscall.c:5164 [inline]
>   __x64_sys_bpf+0x79/0xc0 kernel/bpf/syscall.c:5164
>   do_syscall_x64 arch/x86/entry/common.c:50 [inline]
>   do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
>   entry_SYSCALL_64_after_hwframe+0x63/0xcd
> RIP: 0033:0x7f378ea8c169
> Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
> RSP: 002b:00007f378f724168 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
> RAX: ffffffffffffffda RBX: 00007f378ebabf80 RCX: 00007f378ea8c169
> RDX: 0000000000000020 RSI: 0000000020000140 RDI: 0000000000000003
> RBP: 00007f378eae7ca1 R08: 0000000000000000 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
> R13: 00007ffe9737aebf R14: 00007f378f724300 R15: 0000000000022000
>   </TASK>
>
>
> ---
> This report is generated by a bot. It may contain errors.
> See https://goo.gl/tpsmEJ for more information about syzbot.
> syzbot engineers can be reached at syzkaller@xxxxxxxxxxxxxxxx.
>
> syzbot will keep track of this issue. See:
> https://goo.gl/tpsmEJ#status for how to communicate with syzbot.