On Thu, 2018-04-05 at 11:23 -0400, Lucas Bates wrote:
> Hi Davide,
>
> Our overnight tc test runs of net-next revealed a kernel bug on one of
> the BPF tests you submitted, d959. The add action completes
> successfully, but the bug occurs on the verify when tdc does a get of
> the action that was just added. Here's the text of the dump:
>
looking at the call trace, I think cfg->filter is NULL when
tcf_bpf_cleanup() is called, and apparently we are in the error path of
tcf_bpf_init(), when
prog->bpf_ops = cfg.bpf_ops;
...
rcu_assign_pointer(prog->filter, cfg.filter);
have not been executed yet.
If tcf_idr_release() is called in this situation, cfg->is_ebpf is assigned
to true, and bpf_prog_put() can dereference a NULL pointer.
I will try reproducing in the next hours, and eventually followup with a
patch.
thanks!
regards,
--
davide
