Messages in this thread | | | From | Dongliang Mu <> | Date | Wed, 2 Mar 2022 13:46:04 +0800 | Subject | Re: [PATCH] bpf: cgroup: remove WARN_ON at bpf_cgroup_link_release |
| |
On Wed, Mar 2, 2022 at 12:28 AM Daniel Borkmann <daniel@iogearbox.net> wrote: > > On 2/27/22 2:40 PM, Dongliang Mu wrote: > > From: Dongliang Mu <mudongliangabcd@gmail.com> > > > > When syzkaller injects fault into memory allocation at > > bpf_prog_array_alloc, the kernel encounters a memory failure and > > returns non-zero, thus leading to one WARN_ON at > > bpf_cgroup_link_release. The stack trace is as follows: > > > > __kmalloc+0x7e/0x3d0 > > bpf_prog_array_alloc+0x4f/0x60 > > compute_effective_progs+0x132/0x580 > > ? __sanitizer_cov_trace_pc+0x1a/0x40 > > update_effective_progs+0x5e/0x260 > > __cgroup_bpf_detach+0x293/0x760 > > bpf_cgroup_link_release+0xad/0x400 > > bpf_link_free+0xca/0x190 > > bpf_link_put+0x161/0x1b0 > > bpf_link_release+0x33/0x40 > > __fput+0x286/0x9f0 > > > > Fix this by removing the WARN_ON for __cgroup_bpf_detach. > > > > Reported-by: syzkaller <syzkaller@googlegroups.com> > > Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com> > > --- > > kernel/bpf/cgroup.c | 4 ++-- > > 1 file changed, 2 insertions(+), 2 deletions(-) > > > > diff --git a/kernel/bpf/cgroup.c b/kernel/bpf/cgroup.c > > index 514b4681a90a..fdbdcee6c9fa 100644 > > --- a/kernel/bpf/cgroup.c > > +++ b/kernel/bpf/cgroup.c > > @@ -896,8 +896,8 @@ static void bpf_cgroup_link_release(struct bpf_link *link) > > return; > > } > > > > - WARN_ON(__cgroup_bpf_detach(cg_link->cgroup, NULL, cg_link, > > - cg_link->type)); > > + __cgroup_bpf_detach(cg_link->cgroup, NULL, cg_link, > > + cg_link->type); > > "Fixing" by removing WARN_ON is just papering over the issue which in this case as > mentioned is allocation failure on detach/teardown when allocating and recomputing > effective prog arrays..
Hi Daniel,
you're right. This is not a good fix, any idea to fix the underlying bug perfectly?
> > > cg = cg_link->cgroup; > > cg_link->cgroup = NULL; > > >
| |