On Fri, Feb 02, 2018 at 06:58:01AM -0800, syzbot wrote:
> Hello,
>
> syzbot hit the following crash on bpf-next commit
> b2fe5fa68642860e7de76167c3111623aa0d5de1 (Wed Jan 31 22:31:10 2018 +0000)
> Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next
>
> So far this crash happened 1575 times on bpf-next.
> C reproducer is attached.
> syzkaller reproducer is attached.
> Raw console output is attached.
> compiler: gcc (GCC) 7.1.1 20170620
> .config is attached.
>
> IMPORTANT: if you fix the bug, please add the following tag to the commit:
> Reported-by: syzbot+7dbcd2d3b85f9b608...@syzkaller.appspotmail.com
> It will help syzbot understand when the bug is fixed. See footer for
> details.
> If you forward the report, please keep this part and the footer.
>
> audit: type=1400 audit(1517546098.866:9): avc: denied { prog_run } for
> pid=4159 comm="syzkaller076311"
> scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023
> tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=bpf
> permissive=1
>
> =============================
> WARNING: suspicious RCU usage
> 4.15.0+ #10 Not tainted
> -----------------------------
> ./include/linux/rcupdate.h:302 Illegal context switch in RCU read-side
> critical section!
>
> other info that might help us debug this:
>
>
> rcu_scheduler_active = 2, debug_locks = 1
> 3 locks held by syzkaller076311/4159:
> #0: (&ctx->mutex){+.+.}, at: [<0000000027c8872d>]
> perf_event_ctx_lock_nested+0x21b/0x450 kernel/events/core.c:1253
> #1: (bpf_event_mutex){+.+.}, at: [<0000000092294d8c>]
> perf_event_query_prog_array+0x10e/0x280 kernel/trace/bpf_trace.c:876
> #2: (rcu_read_lock){....}, at: [<000000002b518ca0>]
> bpf_prog_array_copy_to_user+0x0/0x4d0 kernel/bpf/core.c:1568
>
> stack backtrace:
> CPU: 0 PID: 4159 Comm: syzkaller076311 Not tainted 4.15.0+ #10
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
> Google 01/01/2011
> Call Trace:
> __dump_stack lib/dump_stack.c:17 [inline]
> dump_stack+0x194/0x257 lib/dump_stack.c:53
> lockdep_rcu_suspicious+0x123/0x170 kernel/locking/lockdep.c:4592
> rcu_preempt_sleep_check include/linux/rcupdate.h:301 [inline]
> ___might_sleep+0x385/0x470 kernel/sched/core.c:6079
> __might_sleep+0x95/0x190 kernel/sched/core.c:6067
> __might_fault+0xab/0x1d0 mm/memory.c:4532
> _copy_to_user+0x2c/0xc0 lib/usercopy.c:25
> copy_to_user include/linux/uaccess.h:155 [inline]
> bpf_prog_array_copy_to_user+0x217/0x4d0 kernel/bpf/core.c:1587
> bpf_prog_array_copy_info+0x17b/0x1c0 kernel/bpf/core.c:1685
> perf_event_query_prog_array+0x196/0x280 kernel/trace/bpf_trace.c:877
> _perf_ioctl kernel/events/core.c:4737 [inline]
> perf_ioctl+0x3e1/0x1480 kernel/events/core.c:4757
> vfs_ioctl fs/ioctl.c:46 [inline]
fyi
it was copy_to_user in rcu section bug.
Submitted a fix here:
https://patchwork.ozlabs.org/patch/868824/
