On Thu, Apr 16, 2020 at 3:29 AM Dan Carpenter <dan.carpenter@xxxxxxxxxx> wrote: > > On Wed, Apr 15, 2020 at 09:51:40AM -0700, 'Andrii Nakryiko' via syzkaller-bugs wrote: > > On 4/15/20 4:57 AM, Daniel Borkmann wrote: > > > On 4/15/20 8:55 AM, syzbot wrote: > > > > Hello, > > > > > > > > syzbot found the following crash on: > > > > > > Andrii, ptal. > > > > > > > HEAD commit: 1a323ea5 x86: get rid of 'errret' argument to > > > > __get_user_x.. > > > > git tree: bpf-next > > > > console output: https://urldefense.proofpoint.com/v2/url?u=https-3A__syzkaller.appspot.com_x_log.txt-3Fx-3D148ccb57e00000&d=DwICaQ&c=5VD0RTtNlTh3ycd41b3MUw&r=vxqvl81C2rT6GOGdPyz8iQ&m=T2Ez0XmyIpHmEa_MPTTUOh61jMDXqwETtTaTbSe-2M4&s=-6XBbsNV1O4X5flrx4Yssfjc56d0qeSHgwHhd92UPJc&e= > > > > kernel config: https://urldefense.proofpoint.com/v2/url?u=https-3A__syzkaller.appspot.com_x_.config-3Fx-3D8c1e98458335a7d1&d=DwICaQ&c=5VD0RTtNlTh3ycd41b3MUw&r=vxqvl81C2rT6GOGdPyz8iQ&m=T2Ez0XmyIpHmEa_MPTTUOh61jMDXqwETtTaTbSe-2M4&s=s5-1AlWtSiBvo66WN4_UXoXMGIGIqsoUCrmAnxNnfX0&e= > > > > dashboard link: https://urldefense.proofpoint.com/v2/url?u=https-3A__syzkaller.appspot.com_bug-3Fextid-3D8a5dadc5c0b1d7055945&d=DwICaQ&c=5VD0RTtNlTh3ycd41b3MUw&r=vxqvl81C2rT6GOGdPyz8iQ&m=T2Ez0XmyIpHmEa_MPTTUOh61jMDXqwETtTaTbSe-2M4&s=hAA0702qJH5EwRwvG0RKmj8FwIRm1O8hvmoS7ne5Dls&e= > > > > compiler: gcc (GCC) 9.0.0 20181231 (experimental) > > > > > > > > Unfortunately, I don't have any reproducer for this crash yet. > > > > > > > > IMPORTANT: if you fix the bug, please add the following tag to the > > > > commit: > > > > Reported-by: syzbot+8a5dadc5c0b1d7055945@xxxxxxxxxxxxxxxxxxxxxxxxx > > > > > > > > ------------[ cut here ]------------ > > > > WARNING: CPU: 0 PID: 25081 at kernel/bpf/cgroup.c:796 > > > > bpf_cgroup_link_release+0x260/0x3a0 kernel/bpf/cgroup.c:796 > > > > This warning is triggered due to __cgroup_bpf_detach returning an error. It > > can do it only in two cases: either attached item is not found, which from > > starting at code some moreI don't see how that can happen. The other reason > > - kmalloc() failing to allocate memory for new effective prog array. > > If you look at the log file then this was allocation fault injection in > bpf_prog_array_alloc(). Ah, I see, thanks for pointing this out! So that confirms that it's not a bug, but just unfortunate result of potentially failing cgroup BPF program detach code path. > > https://syzkaller.appspot.com/x/log.txt?x=148ccb57e00000 > > regards, > dan carpenter >
