[syzbot] [rdma?] INFO: trying to register non-static key in skb_dequeue (2)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 348551ddaf31 Merge tag 'pinctrl-v6.4-1' of git://git.kerne..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1375fdf8280000
kernel config: https://syzkaller.appspot.com/x/.config?x=35e09b26aabb80e5
dashboard link: https://syzkaller.appspot.com/bug?extid=eba589d8f49c73d356da
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/adddf809a67d/disk-348551dd.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/266c56354fa2/vmlinux-348551dd.xz
kernel image: https://storage.googleapis.com/syzbot-assets/e0fc2088acd1/bzImage-348551dd.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+eba589...@syzkaller.appspotmail.com

infiniband syz2: set active
infiniband syz2: added bond_slave_1
INFO: trying to register non-static key.
The code is fine but needs lockdep annotation, or maybe
you didn't initialize this object before use?
turning off the locking correctness validator.
CPU: 1 PID: 31038 Comm: syz-executor.3 Not tainted 6.3.0-syzkaller-12728-g348551ddaf31 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xd9/0x150 lib/dump_stack.c:106
assign_lock_key kernel/locking/lockdep.c:982 [inline]
register_lock_class+0xdb6/0x1120 kernel/locking/lockdep.c:1295
__lock_acquire+0x10a/0x5df0 kernel/locking/lockdep.c:4951
lock_acquire kernel/locking/lockdep.c:5691 [inline]
lock_acquire+0x1b1/0x520 kernel/locking/lockdep.c:5656
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x3d/0x60 kernel/locking/spinlock.c:162
skb_dequeue+0x20/0x180 net/core/skbuff.c:3631
drain_resp_pkts drivers/infiniband/sw/rxe/rxe_comp.c:555 [inline]
rxe_completer+0x250d/0x3cc0 drivers/infiniband/sw/rxe/rxe_comp.c:652
rxe_qp_do_cleanup+0x1be/0x820 drivers/infiniband/sw/rxe/rxe_qp.c:761
execute_in_process_context+0x3b/0x150 kernel/workqueue.c:3473
__rxe_cleanup+0x21e/0x370 drivers/infiniband/sw/rxe/rxe_pool.c:233
rxe_create_qp+0x3f6/0x5f0 drivers/infiniband/sw/rxe/rxe_verbs.c:583
create_qp+0x5ac/0x970 drivers/infiniband/core/verbs.c:1235
ib_create_qp_kernel+0xa1/0x310 drivers/infiniband/core/verbs.c:1346
ib_create_qp include/rdma/ib_verbs.h:3743 [inline]
create_mad_qp+0x177/0x380 drivers/infiniband/core/mad.c:2905
ib_mad_port_open drivers/infiniband/core/mad.c:2986 [inline]
ib_mad_init_device+0xf40/0x1a90 drivers/infiniband/core/mad.c:3077
add_client_context+0x405/0x5e0 drivers/infiniband/core/device.c:721
enable_device_and_get+0x1cd/0x3b0 drivers/infiniband/core/device.c:1332
ib_register_device drivers/infiniband/core/device.c:1420 [inline]
ib_register_device+0x8b1/0xbc0 drivers/infiniband/core/device.c:1366
rxe_register_device+0x302/0x3e0 drivers/infiniband/sw/rxe/rxe_verbs.c:1485
rxe_net_add+0x90/0xf0 drivers/infiniband/sw/rxe/rxe_net.c:527
rxe_newlink+0xf0/0x1b0 drivers/infiniband/sw/rxe/rxe.c:197
nldev_newlink+0x332/0x5e0 drivers/infiniband/core/nldev.c:1731
rdma_nl_rcv_msg+0x371/0x6a0 drivers/infiniband/core/netlink.c:195
rdma_nl_rcv_skb.constprop.0.isra.0+0x2fc/0x440 drivers/infiniband/core/netlink.c:239
netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline]
netlink_unicast+0x547/0x7f0 net/netlink/af_netlink.c:1365
netlink_sendmsg+0x925/0xe30 net/netlink/af_netlink.c:1913
sock_sendmsg_nosec net/socket.c:724 [inline]
sock_sendmsg+0xde/0x190 net/socket.c:747
____sys_sendmsg+0x71c/0x900 net/socket.c:2503
___sys_sendmsg+0x110/0x1b0 net/socket.c:2557
__sys_sendmsg+0xf7/0x1c0 net/socket.c:2586
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7feddf48c169
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fede029f168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007feddf5abf80 RCX: 00007feddf48c169
RDX: 0000000000000000 RSI: 0000000020000240 RDI: 0000000000000003
RBP: 00007feddf4e7ca1 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffe1bb3e01f R14: 00007fede029f300 R15: 0000000000022000
</TASK>
general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037]
CPU: 1 PID: 31038 Comm: syz-executor.3 Not tainted 6.3.0-syzkaller-12728-g348551ddaf31 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023
RIP: 0010:flush_send_queue drivers/infiniband/sw/rxe/rxe_comp.c:597 [inline]
RIP: 0010:rxe_completer+0x255c/0x3cc0 drivers/infiniband/sw/rxe/rxe_comp.c:653
Code: 80 3c 02 00 0f 85 81 10 00 00 49 8b af 88 03 00 00 48 8d 45 30 48 89 c2 48 89 04 24 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 83 11 00 00 48 8d 45 2c 44 8b
RSP: 0018:ffffc90003526938 EFLAGS: 00010206
RAX: dffffc0000000000 RBX: ffffed100e3fe800 RCX: ffffc9000b403000
RDX: 0000000000000006 RSI: ffffffff877e467a RDI: ffff888071ff4388
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: fffffbfff1cf3682 R11: fffffffffffda5b0 R12: ffff888071ff41a0
R13: 0000000000000000 R14: 0000000000000000 R15: ffff888071ff4000
FS: 00007fede029f700(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2d822000 CR3: 000000002c7e6000 CR4: 00000000003506e0
Call Trace:
<TASK>
rxe_qp_do_cleanup+0x1be/0x820 drivers/infiniband/sw/rxe/rxe_qp.c:761
execute_in_process_context+0x3b/0x150 kernel/workqueue.c:3473
__rxe_cleanup+0x21e/0x370 drivers/infiniband/sw/rxe/rxe_pool.c:233
rxe_create_qp+0x3f6/0x5f0 drivers/infiniband/sw/rxe/rxe_verbs.c:583
create_qp+0x5ac/0x970 drivers/infiniband/core/verbs.c:1235
ib_create_qp_kernel+0xa1/0x310 drivers/infiniband/core/verbs.c:1346
ib_create_qp include/rdma/ib_verbs.h:3743 [inline]
create_mad_qp+0x177/0x380 drivers/infiniband/core/mad.c:2905
ib_mad_port_open drivers/infiniband/core/mad.c:2986 [inline]
ib_mad_init_device+0xf40/0x1a90 drivers/infiniband/core/mad.c:3077
add_client_context+0x405/0x5e0 drivers/infiniband/core/device.c:721
enable_device_and_get+0x1cd/0x3b0 drivers/infiniband/core/device.c:1332
ib_register_device drivers/infiniband/core/device.c:1420 [inline]
ib_register_device+0x8b1/0xbc0 drivers/infiniband/core/device.c:1366
rxe_register_device+0x302/0x3e0 drivers/infiniband/sw/rxe/rxe_verbs.c:1485
rxe_net_add+0x90/0xf0 drivers/infiniband/sw/rxe/rxe_net.c:527
rxe_newlink+0xf0/0x1b0 drivers/infiniband/sw/rxe/rxe.c:197
nldev_newlink+0x332/0x5e0 drivers/infiniband/core/nldev.c:1731
rdma_nl_rcv_msg+0x371/0x6a0 drivers/infiniband/core/netlink.c:195
rdma_nl_rcv_skb.constprop.0.isra.0+0x2fc/0x440 drivers/infiniband/core/netlink.c:239
netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline]
netlink_unicast+0x547/0x7f0 net/netlink/af_netlink.c:1365
netlink_sendmsg+0x925/0xe30 net/netlink/af_netlink.c:1913
sock_sendmsg_nosec net/socket.c:724 [inline]
sock_sendmsg+0xde/0x190 net/socket.c:747
____sys_sendmsg+0x71c/0x900 net/socket.c:2503
___sys_sendmsg+0x110/0x1b0 net/socket.c:2557
__sys_sendmsg+0xf7/0x1c0 net/socket.c:2586
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7feddf48c169
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fede029f168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007feddf5abf80 RCX: 00007feddf48c169
RDX: 0000000000000000 RSI: 0000000020000240 RDI: 0000000000000003
RBP: 00007feddf4e7ca1 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffe1bb3e01f R14: 00007fede029f300 R15: 0000000000022000
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:flush_send_queue drivers/infiniband/sw/rxe/rxe_comp.c:597 [inline]
RIP: 0010:rxe_completer+0x255c/0x3cc0 drivers/infiniband/sw/rxe/rxe_comp.c:653
Code: 80 3c 02 00 0f 85 81 10 00 00 49 8b af 88 03 00 00 48 8d 45 30 48 89 c2 48 89 04 24 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 83 11 00 00 48 8d 45 2c 44 8b
RSP: 0018:ffffc90003526938 EFLAGS: 00010206
RAX: dffffc0000000000 RBX: ffffed100e3fe800 RCX: ffffc9000b403000
RDX: 0000000000000006 RSI: ffffffff877e467a RDI: ffff888071ff4388
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: fffffbfff1cf3682 R11: fffffffffffda5b0 R12: ffff888071ff41a0
R13: 0000000000000000 R14: 0000000000000000 R15: ffff888071ff4000
FS: 00007fede029f700(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2d822000 CR3: 000000002c7e6000 CR4: 00000000003506e0
----------------
Code disassembly (best guess):
0: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1)
4: 0f 85 81 10 00 00 jne 0x108b
a: 49 8b af 88 03 00 00 mov 0x388(%r15),%rbp
11: 48 8d 45 30 lea 0x30(%rbp),%rax
15: 48 89 c2 mov %rax,%rdx
18: 48 89 04 24 mov %rax,(%rsp)
1c: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
23: fc ff df
26: 48 c1 ea 03 shr $0x3,%rdx
* 2a: 0f b6 04 02 movzbl (%rdx,%rax,1),%eax <-- trapping instruction
2e: 84 c0 test %al,%al
30: 74 08 je 0x3a
32: 3c 03 cmp $0x3,%al
34: 0f 8e 83 11 00 00 jle 0x11bd
3a: 48 8d 45 2c lea 0x2c(%rbp),%rax
3e: 44 rex.R
3f: 8b .byte 0x8b


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the bug is already fixed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to change bug's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the bug is a duplicate of another bug, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: ab87603b2511 net: wwan: t7xx: Ensure init is completed bef..
git tree: net
console output: https://syzkaller.appspot.com/x/log.txt?x=1157266a280000
kernel config: https://syzkaller.appspot.com/x/.config?x=eb92acf166a5d2cd

dashboard link: https://syzkaller.appspot.com/bug?extid=eba589d8f49c73d356da
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=124d5da6280000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/ac3ed2228400/disk-ab87603b.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/c51b74034116/vmlinux-ab87603b.xz
kernel image: https://storage.googleapis.com/syzbot-assets/98ab9d7ee1ee/bzImage-ab87603b.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+eba589...@syzkaller.appspotmail.com

infiniband syz2: set active

infiniband syz2: added team0

INFO: trying to register non-static key.
The code is fine but needs lockdep annotation, or maybe
you didn't initialize this object before use?
turning off the locking correctness validator.

CPU: 0 PID: 5133 Comm: syz-executor.3 Not tainted 6.4.0-rc1-syzkaller-00136-gab87603b2511 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023

Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xd9/0x150 lib/dump_stack.c:106
assign_lock_key kernel/locking/lockdep.c:982 [inline]
register_lock_class+0xdb6/0x1120 kernel/locking/lockdep.c:1295
__lock_acquire+0x10a/0x5df0 kernel/locking/lockdep.c:4951
lock_acquire kernel/locking/lockdep.c:5691 [inline]
lock_acquire+0x1b1/0x520 kernel/locking/lockdep.c:5656
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x3d/0x60 kernel/locking/spinlock.c:162

skb_dequeue+0x20/0x180 net/core/skbuff.c:3639

RIP: 0033:0x7f7a1ee8c169

Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48

RSP: 002b:00007f7a1fc76168 EFLAGS: 00000246
ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f7a1efabf80 RCX: 00007f7a1ee8c169
RDX: 0000000000000040 RSI: 0000000020000200 RDI: 0000000000000003
RBP: 00007f7a1eee7ca1 R08: 0000000000000000 R09: 0000000000000000

R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000

R13: 00007fffc46ccb6f R14: 00007f7a1fc76300 R15: 0000000000022000

</TASK>
general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037]

CPU: 0 PID: 5133 Comm: syz-executor.3 Not tainted 6.4.0-rc1-syzkaller-00136-gab87603b2511 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023

RIP: 0010:flush_send_queue drivers/infiniband/sw/rxe/rxe_comp.c:597 [inline]
RIP: 0010:rxe_completer+0x255c/0x3cc0 drivers/infiniband/sw/rxe/rxe_comp.c:653
Code: 80 3c 02 00 0f 85 81 10 00 00 49 8b af 88 03 00 00 48 8d 45 30 48 89 c2 48 89 04 24 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 83 11 00 00 48 8d 45 2c 44 8b

RSP: 0018:ffffc9000419e938 EFLAGS: 00010206
RAX: dffffc0000000000 RBX: ffffed100f5fb800 RCX: 0000000000000000
RDX: 0000000000000006 RSI: ffffffff877f3bea RDI: ffff88807afdc388

RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000

R10: fffffbfff1cf4e42 R11: 205d313330355420 R12: ffff88807afdc1a0
R13: 0000000000000000 R14: 0000000000000000 R15: ffff88807afdc000
FS: 00007f7a1fc76700(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 000000c001136000 CR3: 00000000206d3000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

RIP: 0033:0x7f7a1ee8c169

Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48

RSP: 002b:00007f7a1fc76168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f7a1efabf80 RCX: 00007f7a1ee8c169
RDX: 0000000000000040 RSI: 0000000020000200 RDI: 0000000000000003
RBP: 00007f7a1eee7ca1 R08: 0000000000000000 R09: 0000000000000000

R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000

R13: 00007fffc46ccb6f R14: 00007f7a1fc76300 R15: 0000000000022000

</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:flush_send_queue drivers/infiniband/sw/rxe/rxe_comp.c:597 [inline]
RIP: 0010:rxe_completer+0x255c/0x3cc0 drivers/infiniband/sw/rxe/rxe_comp.c:653
Code: 80 3c 02 00 0f 85 81 10 00 00 49 8b af 88 03 00 00 48 8d 45 30 48 89 c2 48 89 04 24 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 83 11 00 00 48 8d 45 2c 44 8b

RSP: 0018:ffffc9000419e938 EFLAGS: 00010206
RAX: dffffc0000000000 RBX: ffffed100f5fb800 RCX: 0000000000000000
RDX: 0000000000000006 RSI: ffffffff877f3bea RDI: ffff88807afdc388

RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000

R10: fffffbfff1cf4e42 R11: 205d313330355420 R12: ffff88807afdc1a0
R13: 0000000000000000 R14: 0000000000000000 R15: ffff88807afdc000
FS: 00007f7a1fc76700(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 000000c001136000 CR3: 00000000206d3000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

----------------
Code disassembly (best guess):
0: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1)
4: 0f 85 81 10 00 00 jne 0x108b
a: 49 8b af 88 03 00 00 mov 0x388(%r15),%rbp
11: 48 8d 45 30 lea 0x30(%rbp),%rax
15: 48 89 c2 mov %rax,%rdx
18: 48 89 04 24 mov %rax,(%rsp)
1c: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
23: fc ff df
26: 48 c1 ea 03 shr $0x3,%rdx
* 2a: 0f b6 04 02 movzbl (%rdx,%rax,1),%eax <-- trapping instruction
2e: 84 c0 test %al,%al
30: 74 08 je 0x3a
32: 3c 03 cmp $0x3,%al
34: 0f 8e 83 11 00 00 jle 0x11bd
3a: 48 8d 45 2c lea 0x2c(%rbp),%rax
3e: 44 rex.R
3f: 8b .byte 0x8b


---

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

[Hillf Danton]

On 18 May 2023 02:20:06 -0700

> HEAD commit: ab87603b2511 net: wwan: t7xx: Ensure init is completed bef..
> git tree: net

> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=124d5da6280000

Shuffle the init sequence.

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git ab87603b2511

--- x/drivers/infiniband/sw/rxe/rxe_comp.c
+++ y/drivers/infiniband/sw/rxe/rxe_comp.c
@@ -594,6 +594,8 @@ static void flush_send_queue(struct rxe_
struct rxe_queue *q = qp->sq.queue;
int err;

+ if (!q)
+ return;
while ((wqe = queue_head(q, q->type))) {
if (notify) {
err = flush_send_wqe(qp, wqe);
--- x/drivers/infiniband/sw/rxe/rxe_qp.c
+++ y/drivers/infiniband/sw/rxe/rxe_qp.c
@@ -256,6 +256,7 @@ static int rxe_qp_init_resp(struct rxe_d
int wqe_size;
enum queue_type type;

+ skb_queue_head_init(&qp->resp_pkts);
if (!qp->srq) {
qp->rq.max_wr = init->cap.max_recv_wr;
qp->rq.max_sge = init->cap.max_recv_sge;
@@ -279,8 +280,6 @@ static int rxe_qp_init_resp(struct rxe_d
}
}

- skb_queue_head_init(&qp->resp_pkts);
-
rxe_init_task(&qp->resp.task, qp, rxe_responder);

qp->resp.opcode = OPCODE_NONE;
--

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-and-tested-by: syzbot+eba589...@syzkaller.appspotmail.com

Tested on:

commit: ab87603b net: wwan: t7xx: Ensure init is completed bef..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git
console output: https://syzkaller.appspot.com/x/log.txt?x=11bbc7d6280000

kernel config: https://syzkaller.appspot.com/x/.config?x=eb92acf166a5d2cd
dashboard link: https://syzkaller.appspot.com/bug?extid=eba589d8f49c73d356da
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2

patch: https://syzkaller.appspot.com/x/patch.diff?x=1146610e280000

Note: testing is done by a robot and is best-effort only.

[Guoqing Jiang]

Looks if rxe_qp_from_init returns failure, qp->sq.queue is NULL but rxe
still de-reference it during cleanup. And it is the same for sk_buff_head.

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma.git
for-rc

diff --git a/drivers/infiniband/sw/rxe/rxe_qp.c
b/drivers/infiniband/sw/rxe/rxe_qp.c
index 61a2eb77d999..17ed41309756 100644
--- a/drivers/infiniband/sw/rxe/rxe_qp.c
+++ b/drivers/infiniband/sw/rxe/rxe_qp.c
@@ -758,19 +758,21 @@ static void rxe_qp_do_cleanup(struct work_struct
*work)
                del_timer_sync(&qp->rnr_nak_timer);
        }

-       if (qp->resp.task.func)
+       /* flush out any receive wr's or pending requests */
+       if (qp->resp.task.func) {
                rxe_cleanup_task(&qp->resp.task);
+               rxe_responder(qp);
+       }

-       if (qp->req.task.func)
+       if (qp->req.task.func) {
                rxe_cleanup_task(&qp->req.task);
+               rxe_requester(qp);
+       }

-       if (qp->comp.task.func)
+       if (qp->comp.task.func) {
                rxe_cleanup_task(&qp->comp.task);
-
-       /* flush out any receive wr's or pending requests */
-       rxe_requester(qp);
-       rxe_completer(qp);
-       rxe_responder(qp);
+               rxe_completer(qp);
+       }

        if (qp->sq.queue)
                rxe_queue_cleanup(qp->sq.queue);

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

failed to apply patch:
checking file drivers/infiniband/sw/rxe/rxe_qp.c
patch: **** unexpected end of file in patch



Tested on:

commit: 56518a60 RDMA/hns: Modify the value of long message lo..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma.git for-rc

dashboard link: https://syzkaller.appspot.com/bug?extid=eba589d8f49c73d356da
compiler:

patch: https://syzkaller.appspot.com/x/patch.diff?x=132bea5a280000

[Guoqing Jiang]

Sorry, let me attach the temp patch.

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-and-tested-by: syzbot+eba589...@syzkaller.appspotmail.com

Tested on:

commit: 56518a60 RDMA/hns: Modify the value of long message lo..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma.git for-rc

console output: https://syzkaller.appspot.com/x/log.txt?x=1100bb5e280000
kernel config: https://syzkaller.appspot.com/x/.config?x=8bc832f563d8bf38
dashboard link: https://syzkaller.appspot.com/bug?extid=eba589d8f49c73d356da

compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2

patch: https://syzkaller.appspot.com/x/patch.diff?x=10847e2e280000

[Guoqing Jiang]

On 5/23/23 11:47, Zhu Yanjun wrote:

> On Tue, May 23, 2023 at 10:26 AM Guoqing Jiang <guoqin...@linux.dev> wrote:
>>
>>
>> On 5/23/23 10:13, syzbot wrote:
>>> Hello,
>>>
>>> syzbot tried to test the proposed patch but the build/boot failed:
>>>
>>> failed to apply patch:
>>> checking file drivers/infiniband/sw/rxe/rxe_qp.c
>>> patch: **** unexpected end of file in patch

> This is not the root cause. The fix is not good.

Could you explain about the root cause?

Thanks,
Guoqing

[Guoqing Jiang]

On 5/23/23 12:02, Zhu Yanjun wrote:

> On Tue, May 23, 2023 at 11:47 AM Zhu Yanjun <zyjzy...@gmail.com> wrote:
>> On Tue, May 23, 2023 at 10:26 AM Guoqing Jiang <guoqin...@linux.dev> wrote:
>>>
>>>

>>> On 5/23/23 10:13, syzbot wrote:
>>>> Hello,
>>>>
>>>> syzbot tried to test the proposed patch but the build/boot failed:
>>>>
>>>> failed to apply patch:
>>>> checking file drivers/infiniband/sw/rxe/rxe_qp.c
>>>> patch: **** unexpected end of file in patch

>> This is not the root cause. The fix is not good.

> This problem is about "INFO: trying to register non-static key. The

> code is fine but needs lockdep annotation, or maybe"

Which is caused by  "skb_queue_head_init(&qp->resp_pkts)" is not called
given rxe_qp_init_resp returns error, but the cleanup still trigger the
chain.

rxe_qp_do_cleanup -> rxe_completer -> drain_resp_pkts ->
skb_dequeue(&qp->resp_pkts)

But I might misunderstood it ...

Thanks,
Guoqing

[Guoqing Jiang]

On 5/23/23 13:18, Zhu Yanjun wrote:
> On Tue, May 23, 2023 at 1:08 PM Zhu Yanjun <zyjzy...@gmail.com> wrote:
>> On Tue, May 23, 2023 at 12:29 PM Zhu Yanjun <zyjzy...@gmail.com> wrote:

>>> On Tue, May 23, 2023 at 12:10 PM Guoqing Jiang <guoqin...@linux.dev> wrote:
>>>>
>>>>
>>>> On 5/23/23 12:02, Zhu Yanjun wrote:
>>>>> On Tue, May 23, 2023 at 11:47 AM Zhu Yanjun <zyjzy...@gmail.com> wrote:
>>>>>> On Tue, May 23, 2023 at 10:26 AM Guoqing Jiang <guoqin...@linux.dev> wrote:
>>>>>>>
>>>>>>> On 5/23/23 10:13, syzbot wrote:
>>>>>>>> Hello,
>>>>>>>>
>>>>>>>> syzbot tried to test the proposed patch but the build/boot failed:
>>>>>>>>
>>>>>>>> failed to apply patch:
>>>>>>>> checking file drivers/infiniband/sw/rxe/rxe_qp.c
>>>>>>>> patch: **** unexpected end of file in patch
>>>>>> This is not the root cause. The fix is not good.
>>>>> This problem is about "INFO: trying to register non-static key. The
>>>>> code is fine but needs lockdep annotation, or maybe"

>>> This warning is from "lock is not initialized". This is a
>>> use-before-initialized problem.
>>> The correct fix is to initialize the lock that is complained before it is used.
>>>
>>> Zhu Yanjun
>> Based on the call trace, the followings are the order of this call trace.
>>
>> 291 /* called by the create qp verb */
>> 292 int rxe_qp_from_init(struct rxe_dev *rxe, struct rxe_qp *qp,
>> struct rxe_pd *pd,
>> 297 {
>> ...
>> 317 rxe_qp_init_misc(rxe, qp, init);
>> ...
>> 322
>> 323 err = rxe_qp_init_resp(rxe, qp, init, udata, uresp);
>> 324 if (err)
>> 325 goto err2; <--- error
>>
>> ...
>>
>> 334 err2:
>> 335 rxe_queue_cleanup(qp->sq.queue); <--- Goto here
>> 336 qp->sq.queue = NULL;
>>
>> In rxe_qp_init_resp, the error occurs before skb_queue_head_init.
>> So this call trace appeared.
> 250 static int rxe_qp_init_resp(struct rxe_dev *rxe, struct rxe_qp *qp,
> 254 {
> ...
> 264
> 265 type = QUEUE_TYPE_FROM_CLIENT;
> 266 qp->rq.queue = rxe_queue_init(rxe, &qp->rq.max_wr,
> 267 wqe_size, type);
> 268 if (!qp->rq.queue)
> 269 return -ENOMEM; <---Error here
> 270
>
> ...
>
> 282 skb_queue_head_init(&qp->resp_pkts); <-this is not called.
> ...
> This will make spin_lock of resp_pkts is used before initialized.

IMHO, the above is same as

> Which is caused by "skb_queue_head_init(&qp->resp_pkts)" is not called
> given rxe_qp_init_resp returns error, but the cleanup still trigger the
> chain.
>
> rxe_qp_do_cleanup -> rxe_completer -> drain_resp_pkts ->
> skb_dequeue(&qp->resp_pkts)

my previous analysis. If not, could you provide another better way to
fix it?

Guoqing

[Guoqing Jiang]

On 5/23/23 12:29, Zhu Yanjun wrote:

> On Tue, May 23, 2023 at 12:10 PM Guoqing Jiang <guoqin...@linux.dev> wrote:
>>
>>
>> On 5/23/23 12:02, Zhu Yanjun wrote:
>>> On Tue, May 23, 2023 at 11:47 AM Zhu Yanjun <zyjzy...@gmail.com> wrote:
>>>> On Tue, May 23, 2023 at 10:26 AM Guoqing Jiang <guoqin...@linux.dev> wrote:
>>>>>
>>>>> On 5/23/23 10:13, syzbot wrote:
>>>>>> Hello,
>>>>>>
>>>>>> syzbot tried to test the proposed patch but the build/boot failed:
>>>>>>
>>>>>> failed to apply patch:
>>>>>> checking file drivers/infiniband/sw/rxe/rxe_qp.c
>>>>>> patch: **** unexpected end of file in patch
>>>> This is not the root cause. The fix is not good.
>>> This problem is about "INFO: trying to register non-static key. The
>>> code is fine but needs lockdep annotation, or maybe"

> This warning is from "lock is not initialized". This is a
> use-before-initialized problem.

Right, and it also applies to qp->sq.queue which is set to NULL while do
cleanup
still de-reference it.

> The correct fix is to initialize the lock that is complained before it is used.

The thing is it can't be initialized due to error, so I guess you want
to always init them
even for error cases.

Guoqing

[Guoqing Jiang]

On 5/23/23 13:52, Zhu Yanjun wrote:

> Move the initialization to the beginning. This can fix this problem.
> See below:
>
> "
> diff --git a/drivers/infiniband/sw/rxe/rxe_qp.c
> b/drivers/infiniband/sw/rxe/rxe_qp.c
> index c5451a4488ca..22ef6188d7b1 100644
> --- a/drivers/infiniband/sw/rxe/rxe_qp.c
> +++ b/drivers/infiniband/sw/rxe/rxe_qp.c
> @@ -176,6 +176,9 @@ static void rxe_qp_init_misc(struct rxe_dev *rxe,
> struct rxe_qp *qp,
> spin_lock_init(&qp->rq.producer_lock);
> spin_lock_init(&qp->rq.consumer_lock);
>
> + skb_queue_head_init(&qp->req_pkts);
> + skb_queue_head_init(&qp->resp_pkts);
> +
> atomic_set(&qp->ssn, 0);
> atomic_set(&qp->skb_out, 0);
> }
> @@ -234,8 +237,6 @@ static int rxe_qp_init_req(struct rxe_dev *rxe,
> struct rxe_qp *qp,
> qp->req.opcode = -1;
> qp->comp.opcode = -1;
>
> - skb_queue_head_init(&qp->req_pkts);
> -
> rxe_init_task(&qp->req.task, qp, rxe_requester);
> rxe_init_task(&qp->comp.task, qp, rxe_completer);
>
> @@ -279,8 +280,6 @@ static int rxe_qp_init_resp(struct rxe_dev *rxe,
> struct rxe_qp *qp,
> }
> }
>

> - skb_queue_head_init(&qp->resp_pkts);
> -
> rxe_init_task(&qp->resp.task, qp, rxe_responder);
>
> qp->resp.opcode = OPCODE_NONE;
> "

It is weird to me that init them in init_misc instead of init_req/resp,
given they
are dedicated/used for the different purpose. But just my 0.02$.

Guoqing

[Guoqing Jiang]

On 5/23/23 13:55, Zhu Yanjun wrote:

> The complaining is about "spinlock is not initialized".

There was another null-ptr-deref, no?

general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037]

CPU: 1 PID: 31038 Comm: syz-executor.3 Not tainted 6.3.0-syzkaller-12728-g348551ddaf31 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023

RIP: 0010:flush_send_queue drivers/infiniband/sw/rxe/rxe_comp.c:597 [inline]
RIP: 0010:rxe_completer+0x255c/0x3cc0 drivers/infiniband/sw/rxe/rxe_comp.c:653
Code: 80 3c 02 00 0f 85 81 10 00 00 49 8b af 88 03 00 00 48 8d 45 30 48 89 c2 48 89 04 24 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 83 11 00 00 48 8d 45 2c 44 8b

RSP: 0018:ffffc90003526938 EFLAGS: 00010206
RAX: dffffc0000000000 RBX: ffffed100e3fe800 RCX: ffffc9000b403000
RDX: 0000000000000006 RSI: ffffffff877e467a RDI: ffff888071ff4388

RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000

R10: fffffbfff1cf3682 R11: fffffffffffda5b0 R12: ffff888071ff41a0
R13: 0000000000000000 R14: 0000000000000000 R15: ffff888071ff4000

FS: 00007fede029f700(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 0000001b2d822000 CR3: 000000002c7e6000 CR4: 00000000003506e0

RIP: 0033:0x7feddf48c169

Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48

RSP: 002b:00007fede029f168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007feddf5abf80 RCX: 00007feddf48c169
RDX: 0000000000000000 RSI: 0000000020000240 RDI: 0000000000000003

RBP: 00007feddf4e7ca1 R08: 0000000000000000 R09: 0000000000000000

R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000

R13: 00007ffe1bb3e01f R14: 00007fede029f300 R15: 0000000000022000
</TASK>
Modules linked in:


Guoqing

[Guoqing Jiang]

On 5/23/23 14:07, Zhu Yanjun wrote:

>> There was another null-ptr-deref, no?

> Please show me the link. So I can delve into it.

Just the first mail of the thread ...

Anyway, pls check above in the link.

https://lore.kernel.org/linux-rdma/3cc9f12a-d680-e05c...@linux.dev/T/#m2d374949d62b017074545c2f2a1df9251e0bde32

Guoqing

[Zhu Yanjun]

On Tue, May 23, 2023 at 10:26 AM Guoqing Jiang <guoqin...@linux.dev> wrote:
>
>
>

> On 5/23/23 10:13, syzbot wrote:
> > Hello,
> >
> > syzbot tried to test the proposed patch but the build/boot failed:
> >
> > failed to apply patch:
> > checking file drivers/infiniband/sw/rxe/rxe_qp.c
> > patch: **** unexpected end of file in patch

This is not the root cause. The fix is not good.

Zhu Yanjun

[Zhu Yanjun]

On Tue, May 23, 2023 at 11:47 AM Zhu Yanjun <zyjzy...@gmail.com> wrote:
>

> On Tue, May 23, 2023 at 10:26 AM Guoqing Jiang <guoqin...@linux.dev> wrote:
> >
> >
> >
> > On 5/23/23 10:13, syzbot wrote:
> > > Hello,
> > >
> > > syzbot tried to test the proposed patch but the build/boot failed:
> > >
> > > failed to apply patch:
> > > checking file drivers/infiniband/sw/rxe/rxe_qp.c
> > > patch: **** unexpected end of file in patch
>
> This is not the root cause. The fix is not good.

This problem is about "INFO: trying to register non-static key. The
code is fine but needs lockdep annotation, or maybe"

Zhu Yanjun

[Zhu Yanjun]

On Tue, May 23, 2023 at 12:10 PM Guoqing Jiang <guoqin...@linux.dev> wrote:
>
>
>
> On 5/23/23 12:02, Zhu Yanjun wrote:
> > On Tue, May 23, 2023 at 11:47 AM Zhu Yanjun <zyjzy...@gmail.com> wrote:
> >> On Tue, May 23, 2023 at 10:26 AM Guoqing Jiang <guoqin...@linux.dev> wrote:
> >>>
> >>>
> >>> On 5/23/23 10:13, syzbot wrote:
> >>>> Hello,
> >>>>
> >>>> syzbot tried to test the proposed patch but the build/boot failed:
> >>>>
> >>>> failed to apply patch:
> >>>> checking file drivers/infiniband/sw/rxe/rxe_qp.c
> >>>> patch: **** unexpected end of file in patch
> >> This is not the root cause. The fix is not good.
> > This problem is about "INFO: trying to register non-static key. The
> > code is fine but needs lockdep annotation, or maybe"

This warning is from "lock is not initialized". This is a
use-before-initialized problem.

The correct fix is to initialize the lock that is complained before it is used.

Zhu Yanjun

[Zhu Yanjun]

On Tue, May 23, 2023 at 12:29 PM Zhu Yanjun <zyjzy...@gmail.com> wrote:
>
> On Tue, May 23, 2023 at 12:10 PM Guoqing Jiang <guoqin...@linux.dev> wrote:
> >
> >
> >
> > On 5/23/23 12:02, Zhu Yanjun wrote:
> > > On Tue, May 23, 2023 at 11:47 AM Zhu Yanjun <zyjzy...@gmail.com> wrote:
> > >> On Tue, May 23, 2023 at 10:26 AM Guoqing Jiang <guoqin...@linux.dev> wrote:
> > >>>
> > >>>
> > >>> On 5/23/23 10:13, syzbot wrote:
> > >>>> Hello,
> > >>>>
> > >>>> syzbot tried to test the proposed patch but the build/boot failed:
> > >>>>
> > >>>> failed to apply patch:
> > >>>> checking file drivers/infiniband/sw/rxe/rxe_qp.c
> > >>>> patch: **** unexpected end of file in patch
> > >> This is not the root cause. The fix is not good.
> > > This problem is about "INFO: trying to register non-static key. The
> > > code is fine but needs lockdep annotation, or maybe"
>
> This warning is from "lock is not initialized". This is a
> use-before-initialized problem.
> The correct fix is to initialize the lock that is complained before it is used.
>
> Zhu Yanjun

Based on the call trace, the followings are the order of this call trace.

291 /* called by the create qp verb */
292 int rxe_qp_from_init(struct rxe_dev *rxe, struct rxe_qp *qp,
struct rxe_pd *pd,
297 {
...
317 rxe_qp_init_misc(rxe, qp, init);
...
322
323 err = rxe_qp_init_resp(rxe, qp, init, udata, uresp);
324 if (err)
325 goto err2; <--- error

...

334 err2:
335 rxe_queue_cleanup(qp->sq.queue); <--- Goto here
336 qp->sq.queue = NULL;

In rxe_qp_init_resp, the error occurs before skb_queue_head_init.
So this call trace appeared.

[Zhu Yanjun]

The complaining is about "spinlock is not initialized".

Zhu Yanjun

>
> Guoqing

[Zhu Yanjun]

There are some initialization problems in qp init. This needs
refactoring the related functions to fix all the problems.
Currently I am working on this. You know, this is not an easy task.
It will take me a lot of time and effort.
Now I use init_misc to initialize the related variables just as I did
in the past.
This is because init_misc is designed to initialize some variables.
And it will not cause the similar use-before-initialization problems.

Zhu Yanjun
>
> Guoqing

[Zhu Yanjun]

250 static int rxe_qp_init_resp(struct rxe_dev *rxe, struct rxe_qp *qp,
254 {
...
264
265 type = QUEUE_TYPE_FROM_CLIENT;
266 qp->rq.queue = rxe_queue_init(rxe, &qp->rq.max_wr,
267 wqe_size, type);
268 if (!qp->rq.queue)
269 return -ENOMEM; <---Error here
270

...

282 skb_queue_head_init(&qp->resp_pkts); <-this is not called.
...
This will make spin_lock of resp_pkts is used before initialized.

Zhu Yanjun

[Zhu Yanjun]

Move the initialization to the beginning. This can fix this problem.
See below:

"
diff --git a/drivers/infiniband/sw/rxe/rxe_qp.c
b/drivers/infiniband/sw/rxe/rxe_qp.c
index c5451a4488ca..22ef6188d7b1 100644
--- a/drivers/infiniband/sw/rxe/rxe_qp.c
+++ b/drivers/infiniband/sw/rxe/rxe_qp.c

@@ -176,6 +176,9 @@ static void rxe_qp_init_misc(struct rxe_dev *rxe,
struct rxe_qp *qp,

spin_lock_init(&qp->rq.producer_lock);
spin_lock_init(&qp->rq.consumer_lock);

+ skb_queue_head_init(&qp->req_pkts);
+ skb_queue_head_init(&qp->resp_pkts);
+
atomic_set(&qp->ssn, 0);
atomic_set(&qp->skb_out, 0);
}

@@ -234,8 +237,6 @@ static int rxe_qp_init_req(struct rxe_dev *rxe,
struct rxe_qp *qp,

qp->req.opcode = -1;
qp->comp.opcode = -1;

- skb_queue_head_init(&qp->req_pkts);
-
rxe_init_task(&qp->req.task, qp, rxe_requester);
rxe_init_task(&qp->comp.task, qp, rxe_completer);

@@ -279,8 +280,6 @@ static int rxe_qp_init_resp(struct rxe_dev *rxe,
struct rxe_qp *qp,
}
}

- skb_queue_head_init(&qp->resp_pkts);
-
rxe_init_task(&qp->resp.task, qp, rxe_responder);

qp->resp.opcode = OPCODE_NONE;
"

>

> Guoqing

[Zhu Yanjun]

Please show me the link. So I can delve into it.

Zhu Yanjun

[Zhu Yanjun]

Based on the following analysis, the problem in the link is the same
with this problem.

infiniband syz2: set active
infiniband syz2: added bond_slave_1

INFO: trying to register non-static key.
The code is fine but needs lockdep annotation, or maybe

you didn't initialize this object before use?

<----This means that this is a use-before-initialization
problem

turning off the locking correctness validator.

CPU: 1 PID: 31038 Comm: syz-executor.3 Not tainted
6.3.0-syzkaller-12728-g348551ddaf31 #0
Hardware name: Google Google Compute Engine/Google Compute Engine,
BIOS Google 04/14/2023

Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xd9/0x150 lib/dump_stack.c:106
assign_lock_key kernel/locking/lockdep.c:982 [inline]
register_lock_class+0xdb6/0x1120 kernel/locking/lockdep.c:1295
__lock_acquire+0x10a/0x5df0 kernel/locking/lockdep.c:4951
lock_acquire kernel/locking/lockdep.c:5691 [inline]
lock_acquire+0x1b1/0x520 kernel/locking/lockdep.c:5656
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x3d/0x60 kernel/locking/spinlock.c:162

skb_dequeue+0x20/0x180 net/core/skbuff.c:3631
drain_resp_pkts drivers/infiniband/sw/rxe/rxe_comp.c:555 [inline]

<----- when skb_dequeue is called, spin lock of
resp_pkts is not initialized.
rxe_completer+0x250d/0x3cc0 drivers/infiniband/sw/rxe/rxe_comp.c:652

rxe_qp_do_cleanup+0x1be/0x820 drivers/infiniband/sw/rxe/rxe_qp.c:761
execute_in_process_context+0x3b/0x150 kernel/workqueue.c:3473
__rxe_cleanup+0x21e/0x370 drivers/infiniband/sw/rxe/rxe_pool.c:233

rxe_create_qp+0x3f6/0x5f0 drivers/infiniband/sw/rxe/rxe_verbs.c:583 <---- Here.

"
573 err = rxe_qp_from_init(rxe, qp, pd, init, uresp, ibqp->pd, udata);
574 if (err) {
575 rxe_dbg_qp(qp, "create qp failed, err = %d", err);
576 goto err_cleanup;
577 }
578
579 rxe_finalize(qp);
580 return 0;
581
582 err_cleanup:
583 cleanup_err = rxe_cleanup(qp); <--- this is error handler.

"
create_qp+0x5ac/0x970 drivers/infiniband/core/verbs.c:1235
ib_create_qp_kernel+0xa1/0x310 drivers/infiniband/core/verbs.c:1346

Zhu Yanjun
> Guoqing