On Mon, Jul 17, 2017 at 09:30:02AM -0700, John Fastabend wrote:
>@@ -341,9 +368,11 @@ static int dev_map_update_elem(struct bpf_map *map, void
>*key, void *value,
> * Remembering the driver side flush operation will happen before the
> * net device is removed.
> */
>+ mutex_lock(&dev_map_list_mutex);
> old_dev = xchg(&dtab->netdev_map[i], dev);
> if (old_dev)
> call_rcu(&old_dev->rcu, __dev_map_entry_free);
>+ mutex_unlock(&dev_map_list_mutex);
>
> return 0;
> }
This function gets called under rcu critical section, where we can't grab
mutexes:
BUG: sleeping function called from invalid context at kernel/locking/mutex.c:747
in_atomic(): 1, irqs_disabled(): 0, pid: 16315, name: syz-executor1
1 lock held by syz-executor1/16315:
#0: (rcu_read_lock){......}, at: [<ffffffff8c363bc2>] map_delete_elem
kernel/bpf/syscall.c:577 [inline]
#0: (rcu_read_lock){......}, at: [<ffffffff8c363bc2>] SYSC_bpf
kernel/bpf/syscall.c:1427 [inline]
#0: (rcu_read_lock){......}, at: [<ffffffff8c363bc2>] SyS_bpf+0x1d32/0x4ba0
kernel/bpf/syscall.c:1388
Preemption disabled at:
[<ffffffff8c363bd1>] map_delete_elem kernel/bpf/syscall.c:582 [inline]
[<ffffffff8c363bd1>] SYSC_bpf kernel/bpf/syscall.c:1427 [inline]
[<ffffffff8c363bd1>] SyS_bpf+0x1d41/0x4ba0 kernel/bpf/syscall.c:1388
CPU: 2 PID: 16315 Comm: syz-executor1 Not tainted 4.13.0-rc2-next-20170727 #235
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.1-1ubuntu1
04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:16 [inline]
dump_stack+0x11d/0x1e5 lib/dump_stack.c:52
___might_sleep+0x3cc/0x520 kernel/sched/core.c:6001
__might_sleep+0x95/0x190 kernel/sched/core.c:5954
__mutex_lock_common kernel/locking/mutex.c:747 [inline]
__mutex_lock+0x146/0x19b0 kernel/locking/mutex.c:893
mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:908
dev_map_delete_elem+0x82/0x110 kernel/bpf/devmap.c:325
map_delete_elem kernel/bpf/syscall.c:585 [inline]
SYSC_bpf kernel/bpf/syscall.c:1427 [inline]
SyS_bpf+0x1deb/0x4ba0 kernel/bpf/syscall.c:1388
do_syscall_64+0x26a/0x800 arch/x86/entry/common.c:287
entry_SYSCALL64_slow_path+0x25/0x25
RIP: 0033:0x452309
RSP: 002b:00007f8d83d66c08 EFLAGS: 00000216 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 0000000000718000 RCX: 0000000000452309
RDX: 0000000000000010 RSI: 0000000020007000 RDI: 0000000000000003
RBP: 0000000000000270 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000216 R12: 00000000004b85e4
R13: 00000000ffffffff R14: 0000000000000003 R15: 0000000020007000
--
Thanks,
Sasha
