syzbot


WARNING: suspicious RCU usage in bpf_prog_array_copy_info

Status: fixed on 2018/02/12 17:26
Subsystems: perf
[Documentation on labels]
Fix commit: 0911287ce32b bpf: fix bpf_prog_array_copy_to_user() issues
First crash: 2359d, last: 2353d

Sample crash report:
audit: type=1400 audit(1517926321.754:9): avc:  denied  { prog_run } for  pid=4167 comm="syzkaller266120" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=bpf permissive=1

=============================
WARNING: suspicious RCU usage
4.15.0+ #11 Not tainted
-----------------------------
./include/linux/rcupdate.h:302 Illegal context switch in RCU read-side critical section!

other info that might help us debug this:


rcu_scheduler_active = 2, debug_locks = 1
3 locks held by syzkaller266120/4167:
 #0:  (&ctx->mutex){+.+.}, at: [<000000006c145b6b>] perf_event_ctx_lock_nested+0x21b/0x450 kernel/events/core.c:1253
 #1:  (bpf_event_mutex){+.+.}, at: [<000000009e69c1c4>] perf_event_query_prog_array+0x10e/0x280 kernel/trace/bpf_trace.c:876
 #2:  (rcu_read_lock){....}, at: [<00000000dfe676ad>] bpf_prog_array_copy_to_user+0x0/0x4d0 kernel/bpf/core.c:1568

stack backtrace:
CPU: 1 PID: 4167 Comm: syzkaller266120 Not tainted 4.15.0+ #11
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x194/0x257 lib/dump_stack.c:53
 lockdep_rcu_suspicious+0x123/0x170 kernel/locking/lockdep.c:4592
 rcu_preempt_sleep_check include/linux/rcupdate.h:301 [inline]
 ___might_sleep+0x385/0x470 kernel/sched/core.c:6079
 __might_sleep+0x95/0x190 kernel/sched/core.c:6067
 __might_fault+0xab/0x1d0 mm/memory.c:4558
 _copy_to_user+0x2c/0xc0 lib/usercopy.c:25
 copy_to_user include/linux/uaccess.h:155 [inline]
 bpf_prog_array_copy_to_user+0x217/0x4d0 kernel/bpf/core.c:1587
 bpf_prog_array_copy_info+0x17b/0x1c0 kernel/bpf/core.c:1685
 perf_event_query_prog_array+0x196/0x280 kernel/trace/bpf_trace.c:877
 _perf_ioctl kernel/events/core.c:4737 [inline]
 perf_ioctl+0x3e1/0x1480 kernel/events/core.c:4757
 vfs_ioctl fs/ioctl.c:46 [inline]
 do_vfs_ioctl+0x1b1/0x1520 fs/ioctl.c:686
 SYSC_ioctl fs/ioctl.c:701 [inline]
 SyS_ioctl+0x8f/0xc0 fs/ioctl.c:692
 entry_SYSCALL_64_fastpath+0x29/0xa0
RIP: 0033:0x43ffa9
RSP: 002b:00007ffc543f1578 EFLAGS: 00000217 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: ffffffffffffffff RCX: 000000000043ffa9
RDX: 0000000020e4e000 RSI: 00000000c008240a RDI: 0000000000000004
RBP: 00000000006ca018 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000217 R12: 00000000004018d0
R13: 0000000000401960 R14: 0000000000000000 R15: 0000000000000000
BUG: sleeping function called from invalid context at lib/usercopy.c:25
in_atomic(): 1, irqs_disabled(): 0, pid: 4167, name: syzkaller266120
3 locks held by syzkaller266120/4167:
 #0:  (&ctx->mutex){+.+.}, at: [<000000006c145b6b>] perf_event_ctx_lock_nested+0x21b/0x450 kernel/events/core.c:1253
 #1:  (bpf_event_mutex){+.+.}, at: [<000000009e69c1c4>] perf_event_query_prog_array+0x10e/0x280 kernel/trace/bpf_trace.c:876
 #2:  (rcu_read_lock){....}, at: [<00000000dfe676ad>] bpf_prog_array_copy_to_user+0x0/0x4d0 kernel/bpf/core.c:1568
CPU: 1 PID: 4167 Comm: syzkaller266120 Not tainted 4.15.0+ #11
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x194/0x257 lib/dump_stack.c:53
 ___might_sleep+0x2b2/0x470 kernel/sched/core.c:6114
 __might_sleep+0x95/0x190 kernel/sched/core.c:6067
 __might_fault+0xab/0x1d0 mm/memory.c:4558
 _copy_to_user+0x2c/0xc0 lib/usercopy.c:25
 copy_to_user include/linux/uaccess.h:155 [inline]
 bpf_prog_array_copy_to_user+0x217/0x4d0 kernel/bpf/core.c:1587
 bpf_prog_array_copy_info+0x17b/0x1c0 kernel/bpf/core.c:1685
 perf_event_query_prog_array+0x196/0x280 kernel/trace/bpf_trace.c:877
 _perf_ioctl kernel/events/core.c:4737 [inline]
 perf_ioctl+0x3e1/0x1480 kernel/events/core.c:4757
 vfs_ioctl fs/ioctl.c:46 [inline]
 do_vfs_ioctl+0x1b1/0x1520 fs/ioctl.c:686
 SYSC_ioctl fs/ioctl.c:701 [inline]
 SyS_ioctl+0x8f/0xc0 fs/ioctl.c:692
 entry_SYSCALL_64_fastpath+0x29/0xa0
RIP: 0033:0x43ffa9
RSP: 002b:00007ffc543f1578 EFLAGS: 00000217 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: ffffffffffffffff RCX: 000000000043ffa9
RDX: 0000000020e4e000 RSI: 00000000c008240a RDI: 0000000000000004
RBP: 00000000006ca018 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000217 R12: 00000000004018d0
R13: 0000000000401960 R14

Crashes (17842):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/02/06 14:13 bpf-next 617aebe6a97e 645ce5da .config console log report syz C ci-upstream-bpf-next-kasan-gce
2018/02/10 10:53 bpf-next 617aebe6a97e 2b6b214c .config console log report ci-upstream-bpf-next-kasan-gce
2018/02/07 05:39 bpf-next 617aebe6a97e 66c15deb .config console log report ci-upstream-bpf-next-kasan-gce
2018/02/07 05:38 bpf-next 617aebe6a97e 66c15deb .config console log report ci-upstream-bpf-next-kasan-gce
2018/02/07 05:38 bpf-next 617aebe6a97e 66c15deb .config console log report ci-upstream-bpf-next-kasan-gce
2018/02/07 05:38 bpf-next 617aebe6a97e 66c15deb .config console log report ci-upstream-bpf-next-kasan-gce
2018/02/07 05:37 bpf-next 617aebe6a97e 66c15deb .config console log report ci-upstream-bpf-next-kasan-gce
2018/02/07 05:36 bpf-next 617aebe6a97e 66c15deb .config console log report ci-upstream-bpf-next-kasan-gce
2018/02/07 05:35 bpf-next 617aebe6a97e 66c15deb .config console log report ci-upstream-bpf-next-kasan-gce
2018/02/07 05:35 bpf-next 617aebe6a97e 66c15deb .config console log report ci-upstream-bpf-next-kasan-gce
2018/02/07 05:35 bpf-next 617aebe6a97e 66c15deb .config console log report ci-upstream-bpf-next-kasan-gce
2018/02/07 05:34 bpf-next 617aebe6a97e 66c15deb .config console log report ci-upstream-bpf-next-kasan-gce
2018/02/07 05:32 bpf-next 617aebe6a97e 66c15deb .config console log report ci-upstream-bpf-next-kasan-gce
2018/02/07 05:32 bpf-next 617aebe6a97e 66c15deb .config console log report ci-upstream-bpf-next-kasan-gce
2018/02/07 05:32 bpf-next 617aebe6a97e 66c15deb .config console log report ci-upstream-bpf-next-kasan-gce
2018/02/07 05:32 bpf-next 617aebe6a97e 66c15deb .config console log report ci-upstream-bpf-next-kasan-gce
2018/02/07 05:31 bpf-next 617aebe6a97e 66c15deb .config console log report ci-upstream-bpf-next-kasan-gce
2018/02/07 05:28 bpf-next 617aebe6a97e 66c15deb .config console log report ci-upstream-bpf-next-kasan-gce
2018/02/07 05:28 bpf-next 617aebe6a97e 66c15deb .config console log report ci-upstream-bpf-next-kasan-gce
2018/02/07 05:28 bpf-next 617aebe6a97e 66c15deb .config console log report ci-upstream-bpf-next-kasan-gce
2018/02/07 05:27 bpf-next 617aebe6a97e 66c15deb .config console log report ci-upstream-bpf-next-kasan-gce
2018/02/07 05:26 bpf-next 617aebe6a97e 66c15deb .config console log report ci-upstream-bpf-next-kasan-gce
2018/02/07 05:26 bpf-next 617aebe6a97e 66c15deb .config console log report ci-upstream-bpf-next-kasan-gce
2018/02/07 05:24 bpf-next 617aebe6a97e 66c15deb .config console log report ci-upstream-bpf-next-kasan-gce
2018/02/07 05:24 bpf-next 617aebe6a97e 66c15deb .config console log report ci-upstream-bpf-next-kasan-gce
2018/02/07 05:23 bpf-next 617aebe6a97e 66c15deb .config console log report ci-upstream-bpf-next-kasan-gce
2018/02/07 05:21 bpf-next 617aebe6a97e 66c15deb .config console log report ci-upstream-bpf-next-kasan-gce
2018/02/07 05:21 bpf-next 617aebe6a97e 66c15deb .config console log report ci-upstream-bpf-next-kasan-gce
2018/02/07 05:21 bpf-next 617aebe6a97e 66c15deb .config console log report ci-upstream-bpf-next-kasan-gce
2018/02/07 05:20 bpf-next 617aebe6a97e 66c15deb .config console log report ci-upstream-bpf-next-kasan-gce
2018/02/07 05:19 bpf-next 617aebe6a97e 66c15deb .config console log report ci-upstream-bpf-next-kasan-gce
2018/02/07 05:18 bpf-next 617aebe6a97e 66c15deb .config console log report ci-upstream-bpf-next-kasan-gce
2018/02/07 05:17 bpf-next 617aebe6a97e 66c15deb .config console log report ci-upstream-bpf-next-kasan-gce
2018/02/07 05:17 bpf-next 617aebe6a97e 66c15deb .config console log report ci-upstream-bpf-next-kasan-gce
2018/02/07 05:17 bpf-next 617aebe6a97e 66c15deb .config console log report ci-upstream-bpf-next-kasan-gce
2018/02/07 05:16 bpf-next 617aebe6a97e 66c15deb .config console log report ci-upstream-bpf-next-kasan-gce
2018/02/07 05:14 bpf-next 617aebe6a97e 66c15deb .config console log report ci-upstream-bpf-next-kasan-gce
2018/02/07 05:14 bpf-next 617aebe6a97e 66c15deb .config console log report ci-upstream-bpf-next-kasan-gce
2018/02/07 05:11 bpf-next 617aebe6a97e 66c15deb .config console log report ci-upstream-bpf-next-kasan-gce
2018/02/07 05:11 bpf-next 617aebe6a97e 66c15deb .config console log report ci-upstream-bpf-next-kasan-gce
2018/02/07 05:08 bpf-next 617aebe6a97e 66c15deb .config console log report ci-upstream-bpf-next-kasan-gce
2018/02/06 14:06 bpf-next 617aebe6a97e 645ce5da .config console log report ci-upstream-bpf-next-kasan-gce
* Struck through repros no longer work on HEAD.