general protection fault in smap_list_hash_remove

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: 2bdea157b999 Merge branch 'sctp-fully-support-for-dscp-and..
git tree: bpf-next
console output: https://syzkaller.appspot.com/x/log.txt?x=102e5b48400000
kernel config: https://syzkaller.appspot.com/x/.config?x=f62553dc846b0692
dashboard link: https://syzkaller.appspot.com/bug?extid=b912ba691bb508925d72
compiler: gcc (GCC) 8.0.1 20180413 (experimental)
syzkaller repro:https://syzkaller.appspot.com/x/repro.syz?x=168d1662400000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1556a594400000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+b912ba...@syzkaller.appspotmail.com

random: sshd: uninitialized urandom read (32 bytes read)
random: sshd: uninitialized urandom read (32 bytes read)
random: sshd: uninitialized urandom read (32 bytes read)
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] SMP KASAN
CPU: 0 PID: 4454 Comm: syz-executor594 Not tainted 4.18.0-rc3+ #45
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:do_raw_spin_lock+0x27/0x200 kernel/locking/spinlock_debug.c:111
Code: 00 00 00 48 b8 00 00 00 00 00 fc ff df 55 48 89 e5 41 56 41 55 41 54
53 48 89 fb 48 83 c7 04 48 89 fa 48 c1 ea 03 48 83 ec 08 <0f> b6 14 02 48
89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 7b
RSP: 0018:ffff8801ad3e77c8 EFLAGS: 00010292
RAX: dffffc0000000000 RBX: 0000000000000230 RCX: 0000000000000000
RDX: 0000000000000046 RSI: 0000000000000000 RDI: 0000000000000234
RBP: ffff8801ad3e77f0 R08: 0000000000000001 R09: 0000000000000000
R10: ffffed00359b8286 R11: ffff8801acdc1433 R12: dffffc0000000000
R13: ffff8801d8b35540 R14: ffff8801c65bb118 R15: ffff8801c65bb100
FS: 00007f51a93fb700(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffc4338af60 CR3: 00000001ad3f7000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:136 [inline]
_raw_spin_lock_bh+0x39/0x40 kernel/locking/spinlock.c:168
spin_lock_bh include/linux/spinlock.h:315 [inline]
smap_list_hash_remove+0xa3/0x470 kernel/bpf/sockmap.c:1683
sock_hash_ctx_update_elem.isra.27+0x1140/0x1690 kernel/bpf/sockmap.c:2384
sock_hash_update_elem+0x157/0x2f0 kernel/bpf/sockmap.c:2418
map_update_elem+0x5c4/0xc90 kernel/bpf/syscall.c:765
__do_sys_bpf kernel/bpf/syscall.c:2296 [inline]
__se_sys_bpf kernel/bpf/syscall.c:2267 [inline]
__x64_sys_bpf+0x32d/0x510 kernel/bpf/syscall.c:2267
do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x445d19
Code: e8 2c b7 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7
48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff
ff 0f 83 2b 12 fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f51a93face8 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00000000006dac3c RCX: 0000000000445d19
RDX: 0000000000000020 RSI: 0000000020000180 RDI: 0000000000000002
RBP: 00000000006dac38 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffd36a1e17f R14: 00007f51a93fb9c0 R15: 0000000000000005
Modules linked in:
Dumping ftrace buffer:
(ftrace buffer empty)
---[ end trace 996d9c1f5fab271a ]---
RIP: 0010:do_raw_spin_lock+0x27/0x200 kernel/locking/spinlock_debug.c:111
Code: 00 00 00 48 b8 00 00 00 00 00 fc ff df 55 48 89 e5 41 56 41 55 41 54
53 48 89 fb 48 83 c7 04 48 89 fa 48 c1 ea 03 48 83 ec 08 <0f> b6 14 02 48
89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 7b
RSP: 0018:ffff8801ad3e77c8 EFLAGS: 00010292
RAX: dffffc0000000000 RBX: 0000000000000230 RCX: 0000000000000000
RDX: 0000000000000046 RSI: 0000000000000000 RDI: 0000000000000234
RBP: ffff8801ad3e77f0 R08: 0000000000000001 R09: 0000000000000000
R10: ffffed00359b8286 R11: ffff8801acdc1433 R12: dffffc0000000000
R13: ffff8801d8b35540 R14: ffff8801c65bb118 R15: ffff8801c65bb100
FS: 00007f51a93fb700(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffc4338af60 CR3: 00000001ad3f7000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#bug-status-tracking for how to communicate with
syzbot.
syzbot can test patches for this bug, for details see:
https://goo.gl/tpsmEJ#testing-patches

[John Fastabend]

#syz test: git://github.com/cilium/linux.git test-pointers-fix

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer still triggered
crash:
INFO: task hung in lock_sock_nested

INFO: task syz-executor1:20665 blocked for more than 120 seconds.
Not tainted 4.18.0-rc2+ #1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor1 D21056 20665 4889 0x80000002
Call Trace:
context_switch kernel/sched/core.c:2862 [inline]
__schedule+0x87c/0x1ed0 kernel/sched/core.c:3504
schedule+0xfb/0x450 kernel/sched/core.c:3548
__lock_sock+0x1fb/0x360 net/core/sock.c:2318
lock_sock_nested+0x103/0x120 net/core/sock.c:2836
lock_sock include/net/sock.h:1474 [inline]
tcp_close+0x83/0x12d0 net/ipv4/tcp.c:2313
bpf_tcp_close+0xd3d/0x1060 kernel/bpf/sockmap.c:320
inet_release+0x104/0x1f0 net/ipv4/af_inet.c:427
inet6_release+0x50/0x70 net/ipv6/af_inet6.c:459
__sock_release+0xd7/0x260 net/socket.c:603
sock_close+0x19/0x20 net/socket.c:1186
__fput+0x35b/0x8b0 fs/file_table.c:209
____fput+0x15/0x20 fs/file_table.c:243
task_work_run+0x1ec/0x2a0 kernel/task_work.c:113
exit_task_work include/linux/task_work.h:22 [inline]
do_exit+0x1b08/0x2750 kernel/exit.c:865
do_group_exit+0x177/0x440 kernel/exit.c:968
get_signal+0x88e/0x1970 kernel/signal.c:2468
do_signal+0x9c/0x21c0 arch/x86/kernel/signal.c:816
exit_to_usermode_loop+0x2e0/0x370 arch/x86/entry/common.c:162
prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline]
syscall_return_slowpath arch/x86/entry/common.c:268 [inline]
do_syscall_64+0x6be/0x820 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x455ab9
Code: Bad RIP value.
RSP: 002b:00007f1e96776ce8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 000000000072bf68 RCX: 0000000000455ab9
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000072bf68
RBP: 000000000072bf68 R08: 0000000000000000 R09: 000000000072bf48

R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000

R13: 00007fff789f738f R14: 00007f1e967779c0 R15: 0000000000000001
INFO: task syz-executor7:24512 blocked for more than 120 seconds.
Not tainted 4.18.0-rc2+ #1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor7 D23320 24512 4890 0x80000002
Call Trace:
context_switch kernel/sched/core.c:2862 [inline]
__schedule+0x87c/0x1ed0 kernel/sched/core.c:3504
schedule+0xfb/0x450 kernel/sched/core.c:3548
__lock_sock+0x1fb/0x360 net/core/sock.c:2318
lock_sock_nested+0x103/0x120 net/core/sock.c:2836
lock_sock include/net/sock.h:1474 [inline]
tcp_close+0x83/0x12d0 net/ipv4/tcp.c:2313
bpf_tcp_close+0xd3d/0x1060 kernel/bpf/sockmap.c:320
inet_release+0x104/0x1f0 net/ipv4/af_inet.c:427
inet6_release+0x50/0x70 net/ipv6/af_inet6.c:459
__sock_release+0xd7/0x260 net/socket.c:603
sock_close+0x19/0x20 net/socket.c:1186
__fput+0x35b/0x8b0 fs/file_table.c:209
____fput+0x15/0x20 fs/file_table.c:243
task_work_run+0x1ec/0x2a0 kernel/task_work.c:113
exit_task_work include/linux/task_work.h:22 [inline]
do_exit+0x1b08/0x2750 kernel/exit.c:865
do_group_exit+0x177/0x440 kernel/exit.c:968
__do_sys_exit_group kernel/exit.c:979 [inline]
__se_sys_exit_group kernel/exit.c:977 [inline]
__x64_sys_exit_group+0x3e/0x50 kernel/exit.c:977
do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x455ab9
Code: Bad RIP value.
RSP: 002b:00007ffee8f06168 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000455ab9
RDX: 0000000000000000 RSI: 00000000007310f8 RDI: 0000000000000000
RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000

R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000

R13: 0000000000000000 R14: 00007ffee8f06830 R15: 00000000007024c0

Showing all locks held in the system:
2 locks held by kworker/0:0/5:
#0: (____ptrval____) ((wq_completion)"events"){+.+.}, at:
__write_once_size include/linux/compiler.h:215 [inline]
#0: (____ptrval____) ((wq_completion)"events"){+.+.}, at:
arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]
#0: (____ptrval____) ((wq_completion)"events"){+.+.}, at: atomic64_set
include/asm-generic/atomic-instrumented.h:40 [inline]
#0: (____ptrval____) ((wq_completion)"events"){+.+.}, at: atomic_long_set
include/asm-generic/atomic-long.h:59 [inline]
#0: (____ptrval____) ((wq_completion)"events"){+.+.}, at: set_work_data
kernel/workqueue.c:617 [inline]
#0: (____ptrval____) ((wq_completion)"events"){+.+.}, at:
set_work_pool_and_clear_pending kernel/workqueue.c:644 [inline]
#0: (____ptrval____) ((wq_completion)"events"){+.+.}, at:
process_one_work+0xb44/0x1ba0 kernel/workqueue.c:2124
#1: (____ptrval____) ((work_completion)(&map->work)){+.+.}, at:
process_one_work+0xb9b/0x1ba0 kernel/workqueue.c:2128
2 locks held by kworker/0:1/26:
#0: (____ptrval____) ((wq_completion)"events"){+.+.}, at:
__write_once_size include/linux/compiler.h:215 [inline]
#0: (____ptrval____) ((wq_completion)"events"){+.+.}, at:
arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]
#0: (____ptrval____) ((wq_completion)"events"){+.+.}, at: atomic64_set
include/asm-generic/atomic-instrumented.h:40 [inline]
#0: (____ptrval____) ((wq_completion)"events"){+.+.}, at: atomic_long_set
include/asm-generic/atomic-long.h:59 [inline]
#0: (____ptrval____) ((wq_completion)"events"){+.+.}, at: set_work_data
kernel/workqueue.c:617 [inline]
#0: (____ptrval____) ((wq_completion)"events"){+.+.}, at:
set_work_pool_and_clear_pending kernel/workqueue.c:644 [inline]
#0: (____ptrval____) ((wq_completion)"events"){+.+.}, at:
process_one_work+0xb44/0x1ba0 kernel/workqueue.c:2124
#1: (____ptrval____) ((work_completion)(&map->work)){+.+.}, at:
process_one_work+0xb9b/0x1ba0 kernel/workqueue.c:2128
2 locks held by kworker/0:2/27:
#0: (____ptrval____) ((wq_completion)"events"){+.+.}, at:
__write_once_size include/linux/compiler.h:215 [inline]
#0: (____ptrval____) ((wq_completion)"events"){+.+.}, at:
arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]
#0: (____ptrval____) ((wq_completion)"events"){+.+.}, at: atomic64_set
include/asm-generic/atomic-instrumented.h:40 [inline]
#0: (____ptrval____) ((wq_completion)"events"){+.+.}, at: atomic_long_set
include/asm-generic/atomic-long.h:59 [inline]
#0: (____ptrval____) ((wq_completion)"events"){+.+.}, at: set_work_data
kernel/workqueue.c:617 [inline]
#0: (____ptrval____) ((wq_completion)"events"){+.+.}, at:
set_work_pool_and_clear_pending kernel/workqueue.c:644 [inline]
#0: (____ptrval____) ((wq_completion)"events"){+.+.}, at:
process_one_work+0xb44/0x1ba0 kernel/workqueue.c:2124
#1: (____ptrval____) ((work_completion)(&map->work)){+.+.}, at:
process_one_work+0xb9b/0x1ba0 kernel/workqueue.c:2128
1 lock held by khungtaskd/899:
#0: (____ptrval____) (rcu_read_lock){....}, at:
debug_show_all_locks+0xd0/0x428 kernel/locking/lockdep.c:4461
2 locks held by kworker/0:3/2174:
#0: (____ptrval____) ((wq_completion)"events"){+.+.}, at:
__write_once_size include/linux/compiler.h:215 [inline]
#0: (____ptrval____) ((wq_completion)"events"){+.+.}, at:
arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]
#0: (____ptrval____) ((wq_completion)"events"){+.+.}, at: atomic64_set
include/asm-generic/atomic-instrumented.h:40 [inline]
#0: (____ptrval____) ((wq_completion)"events"){+.+.}, at: atomic_long_set
include/asm-generic/atomic-long.h:59 [inline]
#0: (____ptrval____) ((wq_completion)"events"){+.+.}, at: set_work_data
kernel/workqueue.c:617 [inline]
#0: (____ptrval____) ((wq_completion)"events"){+.+.}, at:
set_work_pool_and_clear_pending kernel/workqueue.c:644 [inline]
#0: (____ptrval____) ((wq_completion)"events"){+.+.}, at:
process_one_work+0xb44/0x1ba0 kernel/workqueue.c:2124
#1: (____ptrval____) ((work_completion)(&map->work)){+.+.}, at:
process_one_work+0xb9b/0x1ba0 kernel/workqueue.c:2128
1 lock held by rsyslogd/4405:
#0: (____ptrval____) (&f->f_pos_lock){+.+.}, at: __fdget_pos+0x1bb/0x200
fs/file.c:766
2 locks held by getty/4495:
#0: (____ptrval____) (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:365
#1: (____ptrval____) (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x335/0x1ce0 drivers/tty/n_tty.c:2131
2 locks held by getty/4496:
#0: (____ptrval____) (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:365
#1: (____ptrval____) (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x335/0x1ce0 drivers/tty/n_tty.c:2131
2 locks held by getty/4497:
#0: (____ptrval____) (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:365
#1: (____ptrval____) (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x335/0x1ce0 drivers/tty/n_tty.c:2131
2 locks held by getty/4498:
#0: (____ptrval____) (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:365
#1: (____ptrval____) (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x335/0x1ce0 drivers/tty/n_tty.c:2131
2 locks held by getty/4499:
#0: (____ptrval____) (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:365
#1: (____ptrval____) (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x335/0x1ce0 drivers/tty/n_tty.c:2131
2 locks held by getty/4500:
#0: (____ptrval____) (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:365
#1: (____ptrval____) (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x335/0x1ce0 drivers/tty/n_tty.c:2131
2 locks held by getty/4501:
#0: (____ptrval____) (&tty->ldisc_sem){++++}, at:
ldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:365
#1: (____ptrval____) (&ldata->atomic_read_lock){+.+.}, at:
n_tty_read+0x335/0x1ce0 drivers/tty/n_tty.c:2131
2 locks held by kworker/0:4/4567:
#0: (____ptrval____) ((wq_completion)"events"){+.+.}, at:
__write_once_size include/linux/compiler.h:215 [inline]
#0: (____ptrval____) ((wq_completion)"events"){+.+.}, at:
arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]
#0: (____ptrval____) ((wq_completion)"events"){+.+.}, at: atomic64_set
include/asm-generic/atomic-instrumented.h:40 [inline]
#0: (____ptrval____) ((wq_completion)"events"){+.+.}, at: atomic_long_set
include/asm-generic/atomic-long.h:59 [inline]
#0: (____ptrval____) ((wq_completion)"events"){+.+.}, at: set_work_data
kernel/workqueue.c:617 [inline]
#0: (____ptrval____) ((wq_completion)"events"){+.+.}, at:
set_work_pool_and_clear_pending kernel/workqueue.c:644 [inline]
#0: (____ptrval____) ((wq_completion)"events"){+.+.}, at:
process_one_work+0xb44/0x1ba0 kernel/workqueue.c:2124
#1: (____ptrval____) ((work_completion)(&map->work)){+.+.}, at:
process_one_work+0xb9b/0x1ba0 kernel/workqueue.c:2128
2 locks held by kworker/0:5/7227:
#0: (____ptrval____) ((wq_completion)"events"){+.+.}, at:
__write_once_size include/linux/compiler.h:215 [inline]
#0: (____ptrval____) ((wq_completion)"events"){+.+.}, at:
arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]
#0: (____ptrval____) ((wq_completion)"events"){+.+.}, at: atomic64_set
include/asm-generic/atomic-instrumented.h:40 [inline]
#0: (____ptrval____) ((wq_completion)"events"){+.+.}, at: atomic_long_set
include/asm-generic/atomic-long.h:59 [inline]
#0: (____ptrval____) ((wq_completion)"events"){+.+.}, at: set_work_data
kernel/workqueue.c:617 [inline]
#0: (____ptrval____) ((wq_completion)"events"){+.+.}, at:
set_work_pool_and_clear_pending kernel/workqueue.c:644 [inline]
#0: (____ptrval____) ((wq_completion)"events"){+.+.}, at:
process_one_work+0xb44/0x1ba0 kernel/workqueue.c:2124
#1: (____ptrval____) ((work_completion)(&map->work)){+.+.}, at:
process_one_work+0xb9b/0x1ba0 kernel/workqueue.c:2128
2 locks held by kworker/0:6/8289:
#0: (____ptrval____) ((wq_completion)"events"){+.+.}, at:
__write_once_size include/linux/compiler.h:215 [inline]
#0: (____ptrval____) ((wq_completion)"events"){+.+.}, at:
arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]
#0: (____ptrval____) ((wq_completion)"events"){+.+.}, at: atomic64_set
include/asm-generic/atomic-instrumented.h:40 [inline]
#0: (____ptrval____) ((wq_completion)"events"){+.+.}, at: atomic_long_set
include/asm-generic/atomic-long.h:59 [inline]
#0: (____ptrval____) ((wq_completion)"events"){+.+.}, at: set_work_data
kernel/workqueue.c:617 [inline]
#0: (____ptrval____) ((wq_completion)"events"){+.+.}, at:
set_work_pool_and_clear_pending kernel/workqueue.c:644 [inline]
#0: (____ptrval____) ((wq_completion)"events"){+.+.}, at:
process_one_work+0xb44/0x1ba0 kernel/workqueue.c:2124
#1: (____ptrval____) ((work_completion)(&map->work)){+.+.}, at:
process_one_work+0xb9b/0x1ba0 kernel/workqueue.c:2128
2 locks held by syz-executor1/20665:
#0: (____ptrval____) (&sb->s_type->i_mutex_key#11){+.+.}, at: inode_lock
include/linux/fs.h:715 [inline]
#0: (____ptrval____) (&sb->s_type->i_mutex_key#11){+.+.}, at:
__sock_release+0x8b/0x260 net/socket.c:602
#1: (____ptrval____) (sk_lock-AF_INET6){+.+.}, at: lock_sock
include/net/sock.h:1474 [inline]
#1: (____ptrval____) (sk_lock-AF_INET6){+.+.}, at:
bpf_tcp_close+0xcb/0x1060 kernel/bpf/sockmap.c:315
2 locks held by syz-executor7/24512:
#0: (____ptrval____) (&sb->s_type->i_mutex_key#11){+.+.}, at: inode_lock
include/linux/fs.h:715 [inline]
#0: (____ptrval____) (&sb->s_type->i_mutex_key#11){+.+.}, at:
__sock_release+0x8b/0x260 net/socket.c:602
#1: (____ptrval____) (sk_lock-AF_INET6){+.+.}, at: lock_sock
include/net/sock.h:1474 [inline]
#1: (____ptrval____) (sk_lock-AF_INET6){+.+.}, at:
bpf_tcp_close+0xcb/0x1060 kernel/bpf/sockmap.c:315
2 locks held by kworker/0:8/9869:
#0: (____ptrval____) ((wq_completion)"events"){+.+.}, at:
__write_once_size include/linux/compiler.h:215 [inline]
#0: (____ptrval____) ((wq_completion)"events"){+.+.}, at:
arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]
#0: (____ptrval____) ((wq_completion)"events"){+.+.}, at: atomic64_set
include/asm-generic/atomic-instrumented.h:40 [inline]
#0: (____ptrval____) ((wq_completion)"events"){+.+.}, at: atomic_long_set
include/asm-generic/atomic-long.h:59 [inline]
#0: (____ptrval____) ((wq_completion)"events"){+.+.}, at: set_work_data
kernel/workqueue.c:617 [inline]
#0: (____ptrval____) ((wq_completion)"events"){+.+.}, at:
set_work_pool_and_clear_pending kernel/workqueue.c:644 [inline]
#0: (____ptrval____) ((wq_completion)"events"){+.+.}, at:
process_one_work+0xb44/0x1ba0 kernel/workqueue.c:2124
#1: (____ptrval____) ((work_completion)(&map->work)){+.+.}, at:
process_one_work+0xb9b/0x1ba0 kernel/workqueue.c:2128
2 locks held by kworker/0:9/9878:
#0: (____ptrval____) ((wq_completion)"events"){+.+.}, at:
__write_once_size include/linux/compiler.h:215 [inline]
#0: (____ptrval____) ((wq_completion)"events"){+.+.}, at:
arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]
#0: (____ptrval____) ((wq_completion)"events"){+.+.}, at: atomic64_set
include/asm-generic/atomic-instrumented.h:40 [inline]
#0: (____ptrval____) ((wq_completion)"events"){+.+.}, at: atomic_long_set
include/asm-generic/atomic-long.h:59 [inline]
#0: (____ptrval____) ((wq_completion)"events"){+.+.}, at: set_work_data
kernel/workqueue.c:617 [inline]
#0: (____ptrval____) ((wq_completion)"events"){+.+.}, at:
set_work_pool_and_clear_pending kernel/workqueue.c:644 [inline]
#0: (____ptrval____) ((wq_completion)"events"){+.+.}, at:
process_one_work+0xb44/0x1ba0 kernel/workqueue.c:2124
#1: (____ptrval____) ((work_completion)(&map->work)){+.+.}, at:
process_one_work+0xb9b/0x1ba0 kernel/workqueue.c:2128
2 locks held by kworker/0:11/9891:
#0: (____ptrval____) ((wq_completion)"events"){+.+.}, at:
__write_once_size include/linux/compiler.h:215 [inline]
#0: (____ptrval____) ((wq_completion)"events"){+.+.}, at:
arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]
#0: (____ptrval____) ((wq_completion)"events"){+.+.}, at: atomic64_set
include/asm-generic/atomic-instrumented.h:40 [inline]
#0: (____ptrval____) ((wq_completion)"events"){+.+.}, at: atomic_long_set
include/asm-generic/atomic-long.h:59 [inline]
#0: (____ptrval____) ((wq_completion)"events"){+.+.}, at: set_work_data
kernel/workqueue.c:617 [inline]
#0: (____ptrval____) ((wq_completion)"events"){+.+.}, at:
set_work_pool_and_clear_pending kernel/workqueue.c:644 [inline]
#0: (____ptrval____) ((wq_completion)"events"){+.+.}, at:
process_one_work+0xb44/0x1ba0 kernel/workqueue.c:2124
#1: (____ptrval____) ((work_completion)(&map->work)){+.+.}, at:
process_one_work+0xb9b/0x1ba0 kernel/workqueue.c:2128
1 lock held by syz-executor0/19432:
#0: (____ptrval____) (event_mutex){+.+.}, at:
perf_trace_destroy+0x28/0x100 kernel/trace/trace_event_perf.c:235
3 locks held by syz-executor4/19434:
#0: (____ptrval____) (&sig->cred_guard_mutex){+.+.}, at:
__do_sys_perf_event_open+0x1319/0x30f0 kernel/events/core.c:10474
#1: (____ptrval____) (&pmus_srcu){....}, at:
perf_event_alloc.part.93+0xfc0/0x30b0 kernel/events/core.c:10033
#2: (____ptrval____) (event_mutex){+.+.}, at: perf_trace_init+0x50/0x250
kernel/trace/trace_event_perf.c:217
3 locks held by syz-executor2/19445:
#0: (____ptrval____) (&sig->cred_guard_mutex){+.+.}, at:
__do_sys_perf_event_open+0x1319/0x30f0 kernel/events/core.c:10474
#1: (____ptrval____) (&pmus_srcu){....}, at:
perf_event_alloc.part.93+0xfc0/0x30b0 kernel/events/core.c:10033
#2: (____ptrval____) (event_mutex){+.+.}, at: perf_trace_init+0x50/0x250
kernel/trace/trace_event_perf.c:217
3 locks held by syz-executor1/19442:
#0: (____ptrval____) (&sig->cred_guard_mutex){+.+.}, at:
__do_sys_perf_event_open+0x1319/0x30f0 kernel/events/core.c:10474
#1: (____ptrval____) (&pmus_srcu){....}, at:
perf_event_alloc.part.93+0xfc0/0x30b0 kernel/events/core.c:10033
#2: (____ptrval____) (event_mutex){+.+.}, at: perf_trace_init+0x50/0x250
kernel/trace/trace_event_perf.c:217
3 locks held by syz-executor5/19444:
#0: (____ptrval____) (&sig->cred_guard_mutex){+.+.}, at:
__do_sys_perf_event_open+0x1319/0x30f0 kernel/events/core.c:10474
#1: (____ptrval____) (&pmus_srcu){....}, at:
perf_event_alloc.part.93+0xfc0/0x30b0 kernel/events/core.c:10033
#2: (____ptrval____) (event_mutex){+.+.}, at: perf_trace_init+0x50/0x250
kernel/trace/trace_event_perf.c:217
3 locks held by syz-executor6/19451:
#0: (____ptrval____) (&sig->cred_guard_mutex){+.+.}, at:
__do_sys_perf_event_open+0x1319/0x30f0 kernel/events/core.c:10474
#1: (____ptrval____) (&pmus_srcu){....}, at:
perf_event_alloc.part.93+0xfc0/0x30b0 kernel/events/core.c:10033
#2: (____ptrval____) (event_mutex){+.+.}, at: perf_trace_init+0x50/0x250
kernel/trace/trace_event_perf.c:217
3 locks held by syz-executor3/19455:
#0: (____ptrval____) (&sig->cred_guard_mutex){+.+.}, at:
__do_sys_perf_event_open+0x1319/0x30f0 kernel/events/core.c:10474
#1: (____ptrval____) (&pmus_srcu){....}, at:
perf_event_alloc.part.93+0xfc0/0x30b0 kernel/events/core.c:10033
#2: (____ptrval____) (event_mutex){+.+.}, at: perf_trace_init+0x50/0x250
kernel/trace/trace_event_perf.c:217
3 locks held by syz-executor7/19456:
#0: (____ptrval____) (&sig->cred_guard_mutex){+.+.}, at:
__do_sys_perf_event_open+0x1319/0x30f0 kernel/events/core.c:10474
#1: (____ptrval____) (&pmus_srcu){....}, at:
perf_event_alloc.part.93+0xfc0/0x30b0 kernel/events/core.c:10033
#2: (____ptrval____) (event_mutex){+.+.}, at: perf_trace_init+0x50/0x250
kernel/trace/trace_event_perf.c:217

=============================================

NMI backtrace for cpu 1
CPU: 1 PID: 899 Comm: khungtaskd Not tainted 4.18.0-rc2+ #1

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011

Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1c9/0x2b4 lib/dump_stack.c:113
nmi_cpu_backtrace.cold.4+0x19/0xce lib/nmi_backtrace.c:103
nmi_trigger_cpumask_backtrace+0x151/0x192 lib/nmi_backtrace.c:62
arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38
trigger_all_cpu_backtrace include/linux/nmi.h:138 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:196 [inline]
watchdog+0x9c4/0xf80 kernel/hung_task.c:252
kthread+0x345/0x410 kernel/kthread.c:240
ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:412
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0 skipped: idling at native_safe_halt+0x6/0x10
arch/x86/include/asm/irqflags.h:54


Tested on:

commit: 385ddcb9f136 bpf: sockmap, convert bpf_compute_data_pointe..
git tree: git://github.com/cilium/linux.git/test-pointers-fix
console output: https://syzkaller.appspot.com/x/log.txt?x=17a14e70400000
kernel config: https://syzkaller.appspot.com/x/.config?x=a63be0c83e84d370

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger
crash:

Reported-and-tested-by:
syzbot+b912ba...@syzkaller.appspotmail.com

Tested on:

commit: 3f86eb1920e6 bpf: sockmap, convert bpf_compute_data_pointe..
git tree: git://github.com/cilium/linux.git/test-pointers-fix

kernel config: https://syzkaller.appspot.com/x/.config?x=a63be0c83e84d370
compiler: gcc (GCC) 8.0.1 20180413 (experimental)

Note: testing is done by a robot and is best-effort only.

[Eric Biggers]

> --
> You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bug...@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/000000000000b0e80905702dcf6f%40google.com.
> For more options, visit https://groups.google.com/d/optout.

#syz fix: bpf: sockhash, disallow bpf_tcp_close and update in parallel