On Sun, Jun 02, 2024 at 12:09:50PM +0900, Masami Hiramatsu wrote: > On Thu, 30 May 2024 23:50:32 -0700 > syzbot <syzbot+list0820d438c1905c75bc71@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote: > > > Hello trace maintainers/developers, > > > > This is a 31-day syzbot report for the trace subsystem. > > All related reports/information can be found at: > > https://syzkaller.appspot.com/upstream/s/trace > > > > During the period, 1 new issues were detected and 0 were fixed. > > In total, 10 issues are still open and 35 have been fixed so far. > > > > Some of the still happening issues: > > > > Ref Crashes Repro Title > > <1> 705 Yes WARNING in format_decode (3) > > https://syzkaller.appspot.com/bug?extid=e2c932aec5c8a6e1d31c > > Could you send this to bpf folks? It seems bpf_trace_printk caused this errror. > (Maybe skipping fmt string check?) > > > <2> 26 Yes INFO: task hung in blk_trace_ioctl (4) > > https://syzkaller.appspot.com/bug?extid=ed812ed461471ab17a0c > > This looks like debugfs_mutex lock leakage. Need to rerun with lockdep. > > > <3> 7 Yes WARNING in get_probe_ref > > https://syzkaller.appspot.com/bug?extid=8672dcb9d10011c0a160 > > Hm, fail on register_trace_block_rq_insert(). blktrace issue. > > > <4> 6 Yes INFO: task hung in blk_trace_remove (2) > > https://syzkaller.appspot.com/bug?extid=2373f6be3e6de4f92562 > > This looks like debugfs_mutex lock leakage too. > > > <5> 5 Yes general protection fault in bpf_get_attach_cookie_tracing > > https://syzkaller.appspot.com/bug?extid=3ab78ff125b7979e45f9 > > This is also BPF problem. this one seems to be easy to fix, can't reproduce with either the change below or with instrumenting __bpf_prog_test_run_raw_tp to set current->bpf_ctx as in __bpf_trace_run will send a patch thanks, jirka --- diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c index 593efccc2030..fc303c20f402 100644 --- a/kernel/trace/bpf_trace.c +++ b/kernel/trace/bpf_trace.c @@ -1148,6 +1148,8 @@ BPF_CALL_1(bpf_get_attach_cookie_trace, void *, ctx) { struct bpf_trace_run_ctx *run_ctx; + if (!current->bpf_ctx) + return 0; run_ctx = container_of(current->bpf_ctx, struct bpf_trace_run_ctx, run_ctx); return run_ctx->bpf_cookie; }
