From: "Toke Høiland-Jørgensen" <toke@kernel•org>
To: syzbot <syzbot+af9492708df9797198d6@syzkaller•appspotmail.com>,
andrii@kernel•org, ast@kernel•org, bpf@vger•kernel.org,
daniel@iogearbox•net, davem@davemloft•net, eadavis@qq•com,
eddyz87@gmail•com, haoluo@google•com, hawk@kernel•org,
john.fastabend@gmail•com, jolsa@kernel•org, kpsingh@kernel•org,
kuba@kernel•org, linux-kernel@vger•kernel.org,
martin.lau@linux•dev, netdev@vger•kernel.org, sdf@google•com,
song@kernel•org, syzkaller-bugs@googlegroups•com,
yonghong.song@linux•dev
Subject: Re: [syzbot] [bpf?] [net?] general protection fault in dev_map_enqueue
Date: Tue, 16 Apr 2024 22:55:00 +0200 [thread overview]
Message-ID: <87il0huixn.fsf@toke.dk> (raw)
In-Reply-To: <0000000000003a924406159cf8ee@google.com>
syzbot <syzbot+af9492708df9797198d6@syzkaller•appspotmail.com> writes:
> Hello,
>
> syzbot has tested the proposed patch but the reproducer is still triggering an issue:
> general protection fault in dev_map_enqueue
Alright, trying a different thing (not a correct patch, just testing a theory):
#syz test https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git 443574b03387
diff --git a/net/core/filter.c b/net/core/filter.c
index 786d792ac816..c2fd4f67766f 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -4301,8 +4301,9 @@ void bpf_clear_redirect_map(struct bpf_map *map)
* cmpxchg() to make sure it hasn't been changed in
* the meantime by remote CPU.
*/
- if (unlikely(READ_ONCE(ri->map) == map))
- cmpxchg(&ri->map, map, NULL);
+ if (unlikely(READ_ONCE(ri->map) == map) &&
+ cmpxchg(&ri->map, map, NULL) == map)
+ WRITE_ONCE(ri->map_type, BPF_MAP_TYPE_UNSPEC);
}
}
next prev parent reply other threads:[~2024-04-17 12:37 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-03-26 19:00 [syzbot] [bpf?] [net?] general protection fault in dev_map_enqueue syzbot
2024-03-27 8:10 ` syzbot
2024-03-27 15:19 ` Alexei Starovoitov
2024-03-28 8:58 ` Jesper Dangaard Brouer
2024-03-28 20:39 ` Toke Høiland-Jørgensen
2024-03-31 9:08 ` [PATCH] bpf: fix null ptr deref " Edward Adam Davis
2024-04-01 11:00 ` Jesper Dangaard Brouer
2024-04-02 3:03 ` Edward Adam Davis
2024-04-04 11:03 ` Jesper Dangaard Brouer
2024-04-04 21:02 ` Toke Høiland-Jørgensen
2024-04-05 3:55 ` [syzbot] [bpf?] [net?] general protection fault " syzbot
2024-04-08 15:30 ` Toke Høiland-Jørgensen
2024-04-08 22:03 ` syzbot
2024-04-16 20:55 ` Toke Høiland-Jørgensen [this message]
2024-04-17 14:49 ` syzbot
2024-04-17 19:18 ` Toke Høiland-Jørgensen
2024-04-18 2:51 ` syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87il0huixn.fsf@toke.dk \
--to=toke@kernel$(echo .)org \
--cc=andrii@kernel$(echo .)org \
--cc=ast@kernel$(echo .)org \
--cc=bpf@vger$(echo .)kernel.org \
--cc=daniel@iogearbox$(echo .)net \
--cc=davem@davemloft$(echo .)net \
--cc=eadavis@qq$(echo .)com \
--cc=eddyz87@gmail$(echo .)com \
--cc=haoluo@google$(echo .)com \
--cc=hawk@kernel$(echo .)org \
--cc=john.fastabend@gmail$(echo .)com \
--cc=jolsa@kernel$(echo .)org \
--cc=kpsingh@kernel$(echo .)org \
--cc=kuba@kernel$(echo .)org \
--cc=linux-kernel@vger$(echo .)kernel.org \
--cc=martin.lau@linux$(echo .)dev \
--cc=netdev@vger$(echo .)kernel.org \
--cc=sdf@google$(echo .)com \
--cc=song@kernel$(echo .)org \
--cc=syzbot+af9492708df9797198d6@syzkaller$(echo .)appspotmail.com \
--cc=syzkaller-bugs@googlegroups$(echo .)com \
--cc=yonghong.song@linux$(echo .)dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox