On Mon, 2023-10-30 at 11:29 +0100, Hao Sun wrote: > On Sun, Oct 29, 2023 at 2:35 AM Alexei Starovoitov > <alexei.starovoitov@xxxxxxxxx> wrote: > > > > On Fri, Oct 27, 2023 at 2:09 AM Hao Sun <sunhao.th@xxxxxxxxx> wrote: > > > > > > Hi, > > > > > > The following C repro contains a bpf program that can cause rcu > > > stall/soft lockup during running in bpf_prog_run(). Seems the verifier > > > incorrectly passed the program with an infinite loop. > > > > > > C repro: https://pastebin.com/raw/ymzAxjeU > > > > Thanks for the report. > > Did you debug what exactly caused this bug? > > Are you planning to work on the fix? > > This bug is really hard to debug. Here is a simplified view of > the original program: > > loop: > 0: r4 = r8 > 1: r1 = 0x1f > 2: r8 -= -8 > 3: if r1 > r7 goto pc+1 > 4: r7 <<= r1 ; LSH r7 by 31 > 5: r5 = r0 > 6: r5 *= 2 > 7: if r5 < r0 goto pc+1 > 8: r8 s>>= 6 > 9: w7 &= w7 ; r7 = 0 after the first iter > 10: r8 -= r7 > 11: r8 -= -1 > 12: if r4 >= 0x9 goto loop > 13: exit > > At runtime, r7 is updated to 0 through #4 and #9 at the first iteration, > so the following iteration will not take #3 to #4, so #3 can be ignored > after the first iteration. r0 is init by get_current_task, and r5 is always > smaller than r0 at runtime, so #7 to #8 will never run. So, the update > to r8 is only #2 and #11, which together add 9 to r8. Since r4 is set > to r8 at the start of each iteration, so it's an infinite loop at runtime. > > Based on the log, the verifier keeps tracking #7 to #8 and to #9, and > at some point, the verifier prunes states and path from #7 to #9, so > it stops checking. The log is huge and hard to follow, the issue is likely > in pruning logic, but I don't have much knowledge about that part. I can take a look at this issue but closer to the end of the week (Thu/Fri). > > > > > > Verifier's log: https://pastebin.com/raw/thZDTFJc > > > > log is trimmed. > > Full log: https://pastebin.com/raw/cTC8wmDH >
