Subject: Re: [syzbot] [bpf?] [net?] general protection fault in dev_map_enqueue

From: Toke Høiland-Jørgensen <[email-masked]>
Date: Thu, 28 Mar 2024 21:39:48 +0100

Jesper Dangaard Brouer <[email-masked]> writes:

> On 27/03/2024 16.19, Alexei Starovoitov wrote:
>> Toke, Jesper,
>> 
>> please take a look.
>> It's reproducible 100% of the time.
>> dst is NULL in dev_map_enqueue().
>> 
>
> The `dst` (NULL) is basically `ri->tgt_value` being passed through
> (unmodified) via xdp_do_redirect_frame() and __xdp_do_redirect_frame()
> into dev_map_enqueue().
>
> I think something is wrong in xdp_test_run_batch().
> The `ri->tgt_value` is being set in __bpf_xdp_redirect_map(), but I
> cannot see __bpf_xdp_redirect_map() being used in xdp_test_run_batch().
>
> Toke, can you take a look at xdp_test_run_batch() and where
> `ri->tgt_value` is getting set?

Sure! I'm off for Easter, but I'll take a look when I get back next week :)

-Toke