Re: [syzbot] possible deadlock in trie_delete_elem

From: syzbot
Date: Thu Jun 06 2024 - 10:26:22 EST


For archival purposes, forwarding an incoming command email to
linux-kernel@xxxxxxxxxxxxxxx, syzkaller-bugs@xxxxxxxxxxxxxxxx.

***

Subject: possible deadlock in trie_delete_elem
Author: norkam41@xxxxxxxxx

#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git c3f38fa61af77b49866b006939479069cd451173

Signed-off-by: Norbert Kamiński <norkam41@xxxxxxxxx>
---
kernel/trace/bpf_trace.c | 18 +++++++++++++++++-
kernel/tracepoint.c | 15 +++++++++++++--
2 files changed, 30 insertions(+), 3 deletions(-)

diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
index 6249dac61701..75fdb8e3abaa 100644
--- a/kernel/trace/bpf_trace.c
+++ b/kernel/trace/bpf_trace.c
@@ -2391,7 +2391,23 @@ void __bpf_trace_run(struct bpf_raw_tp_link *link, u64 *args)
struct bpf_trace_run_ctx run_ctx;

cant_sleep();
- if (unlikely(this_cpu_inc_return(*(prog->active)) != 1)) {
+
+ // return if instrumentation disabled, see: bpf_disable_instrumentation
+ int instrumentation = unlikely(__this_cpu_read(bpf_prog_active));
+ if (instrumentation) {
+ printk("SKIP FOR INSTRUMENTATION: %s > %s > %p /%i ==============\n",
+ prog->aux->name,
+ link->btp->tp->name, prog, instrumentation);
+ bpf_prog_inc_misses_counter(prog);
+ return;
+ }
+
+ int active = this_cpu_inc_return(*(prog->active));
+ // printk("%s > %s > %p /%i\n", prog->aux->name, link->btp->tp->name, prog, active);
+ if (active != 1) {
+ printk("SKIP FOR ACTIVE: %s > %s > %p /%i =======================\n",
+ prog->aux->name,
+ link->btp->tp->name, prog, active);
bpf_prog_inc_misses_counter(prog);
goto out;
}
diff --git a/kernel/tracepoint.c b/kernel/tracepoint.c
index 8d1507dd0724..a0a0d8b16b41 100644
--- a/kernel/tracepoint.c
+++ b/kernel/tracepoint.c
@@ -168,12 +168,21 @@ static inline void release_probes(struct tracepoint_func *old)
static void debug_print_probes(struct tracepoint_func *funcs)
{
int i;
+ struct bpf_raw_tp_link *link;

if (!tracepoint_debug || !funcs)
return;

- for (i = 0; funcs[i].func; i++)
- printk(KERN_DEBUG "Probe %d : %p\n", i, funcs[i].func);
+ for (i = 0; funcs[i].func; i++) {
+ link = funcs[i].data;
+ int active = this_cpu_read(*(link->link.prog->active));
+ printk("Probe %d : %p / %p: %s/%d / %i\n", i,
+ funcs[i].func,
+ link,
+ link->link.prog->aux->name,
+ active,
+ funcs[i].prio);
+ }
}

static struct tracepoint_func *
@@ -298,6 +307,8 @@ static enum tp_func_state nr_func_state(const struct tracepoint_func *tp_funcs)
{
if (!tp_funcs)
return TP_FUNC_0;
+ if (!tp_funcs[0].func)
+ return TP_FUNC_0;
if (!tp_funcs[1].func)
return TP_FUNC_1;
if (!tp_funcs[2].func)
--
2.34.1