* Re: [PATCH 5.10 37/71] selftests/bpf: Add test for bpf_timer overwriting crash
[not found] <HE1PR0402MB3497CB13A12C4D15D20A1FCCF8139@HE1PR0402MB3497.eurprd04.prod.outlook.com>
@ 2022-03-21 12:46 ` gregkh
0 siblings, 0 replies; 2+ messages in thread
From: gregkh @ 2022-03-21 12:46 UTC (permalink / raw)
To: Geliang Tang
Cc: ast, linux-kernel, memxor, sashal, stable, Guoqing Jiang, Kai Liu
On Fri, Mar 18, 2022 at 02:42:49PM +0000, Geliang Tang wrote:
> Hi Greg,
>
> I got this bpf selftests build break today on the stable branch 5.10.106:
>
> =========================================================================
> CLNG-LLC [test_maps] test_tracepoint.o
> progs/timer_crash.c:8:19: error: field has incomplete type 'struct bpf_timer'
> struct bpf_timer timer;
> ^
> progs/timer_crash.c:8:9: note: forward declaration of 'struct bpf_timer'
> struct bpf_timer timer;
> ^
> progs/timer_crash.c:35:6: warning: implicit declaration of function 'bpf_get_current_task_btf' is invalid in C99 [-Wimplicit-function-declaration]
> if (bpf_get_current_task_btf()->tgid != pid)
> ^
> progs/timer_crash.c:35:34: error: member reference type 'int' is not a pointer
> if (bpf_get_current_task_btf()->tgid != pid)
> ~~~~~~~~~~~~~~~~~~~~~~~~~~ ^
> progs/timer_crash.c:49:3: warning: implicit declaration of function 'bpf_timer_cancel' is invalid in C99 [-Wimplicit-function-declaration]
> bpf_timer_cancel(&e->timer);
> ^
> 2 warnings and 2 errors generated.
> CLNG-LLC [test_maps] test_trace_ext_tracing.o
> llc: error: llc: <stdin>:1:1: error: expected top-level entity
> BPF obj compilation failed
> ^
> make: *** [Makefile:402: tools/testing/selftests/bpf/timer_crash.o] Error 1
> make: *** Waiting for unfinished jobs....
> CLNG-LLC [test_maps] test_trace_ext.o
> =========================================================================
>
> It is introduced by this commit, "selftests/bpf: Add test for bpf_timer
> overwriting crash". Since the commit "bpf: Introduce bpf timers." has not
> been merged into the stable branch yet.
>
> I am writing to you to report this bug.
>
Now reverted, thanks!
greg k-h
^ permalink raw reply [flat|nested] 2+ messages in thread
* [PATCH 5.10 00/71] 5.10.106-rc1 review
@ 2022-03-14 11:52 Greg Kroah-Hartman
2022-03-14 11:53 ` [PATCH 5.10 37/71] selftests/bpf: Add test for bpf_timer overwriting crash Greg Kroah-Hartman
0 siblings, 1 reply; 2+ messages in thread
From: Greg Kroah-Hartman @ 2022-03-14 11:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, slade
This is the start of the stable review cycle for the 5.10.106 release.
There are 71 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 16 Mar 2022 11:27:22 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.106-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Linux 5.10.106-rc1
David Howells <dhowells@redhat.com>
watch_queue: Fix filter limit check
Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
ARM: fix Thumb2 regression with Spectre BHB
Josh Triplett <josh@joshtriplett.org>
ext4: add check to prevent attempting to resize an fs with sparse_super2
Li Huafei <lihuafei1@huawei.com>
x86/traps: Mark do_int3() NOKPROBE_SYMBOL
Ross Philipson <ross.philipson@oracle.com>
x86/boot: Add setup_indirect support in early_memremap_is_setup_data()
Ross Philipson <ross.philipson@oracle.com>
x86/boot: Fix memremap of setup_indirect structures
David Howells <dhowells@redhat.com>
watch_queue: Make comment about setting ->defunct more accurate
David Howells <dhowells@redhat.com>
watch_queue: Fix lack of barrier/sync/lock between post and read
David Howells <dhowells@redhat.com>
watch_queue: Free the alloc bitmap when the watch_queue is torn down
David Howells <dhowells@redhat.com>
watch_queue: Fix the alloc bitmap size to reflect notes allocated
David Howells <dhowells@redhat.com>
watch_queue: Fix to always request a pow-of-2 pipe ring size
David Howells <dhowells@redhat.com>
watch_queue: Fix to release page in ->release()
David Howells <dhowells@redhat.com>
watch_queue, pipe: Free watchqueue state after clearing pipe ring
Michael S. Tsirkin <mst@redhat.com>
virtio: acknowledge all features before access
Michael S. Tsirkin <mst@redhat.com>
virtio: unexport virtio_finalize_features
Pali Rohár <pali@kernel.org>
arm64: dts: marvell: armada-37xx: Remap IO space to bus address 0x0
Emil Renner Berthing <kernel@esmil.dk>
riscv: Fix auipc+jalr relocation range checks
Rong Chen <rong.chen@amlogic.com>
mmc: meson: Fix usage of meson_mmc_post_req()
Robert Hancock <robert.hancock@calian.com>
net: macb: Fix lost RX packet wakeup race in NAPI receive
Dan Carpenter <dan.carpenter@oracle.com>
staging: gdm724x: fix use after free in gdm_lte_rx()
Hans de Goede <hdegoede@redhat.com>
staging: rtl8723bs: Fix access-point mode deadlock
Miklos Szeredi <mszeredi@redhat.com>
fuse: fix pipe buffer lifetime for direct_io
Randy Dunlap <rdunlap@infradead.org>
ARM: Spectre-BHB: provide empty stub for non-config
Mike Kravetz <mike.kravetz@oracle.com>
selftests/memfd: clean up mapping in mfd_fail_write
Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
selftest/vm: fix map_fixed_noreplace test failure
Sven Schnelle <svens@linux.ibm.com>
tracing: Ensure trace buffer is at least 4096 bytes large
Niels Dossche <dossche.niels@gmail.com>
ipv6: prevent a possible race condition with lifetimes
Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
Revert "xen-netback: Check for hotplug-status existence before watching"
Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
Revert "xen-netback: remove 'hotplug-status' once it has served its purpose"
Shreeya Patel <shreeya.patel@collabora.com>
gpio: Return EPROBE_DEFER if gc->to_irq is NULL
Vikash Chandola <vikash.chandola@linux.intel.com>
hwmon: (pmbus) Clear pmbus fault/warning bits after read
suresh kumar <suresh2514@gmail.com>
net-sysfs: add check for netdevice being present to speed_show
Jon Lin <jon.lin@rock-chips.com>
spi: rockchip: terminate dma transmission when slave abort
Jon Lin <jon.lin@rock-chips.com>
spi: rockchip: Fix error in getting num-cs property
Kumar Kartikeya Dwivedi <memxor@gmail.com>
selftests/bpf: Add test for bpf_timer overwriting crash
Jeremy Linton <jeremy.linton@arm.com>
net: bcmgenet: Don't claim WOL when its not available
Eric Dumazet <edumazet@google.com>
sctp: fix kernel-infoleak for SCTP sockets
Clément Léger <clement.leger@bootlin.com>
net: phy: DP83822: clear MISR2 register to disable interrupts
Miaoqian Lin <linmq006@gmail.com>
gianfar: ethtool: Fix refcount leak in gfar_get_ts_info
Mark Featherston <mark@embeddedTS.com>
gpio: ts4900: Do not set DAT and OE together
Guillaume Nault <gnault@redhat.com>
selftests: pmtu.sh: Kill tcpdump processes launched by subshell.
Pavel Skripkin <paskripkin@gmail.com>
NFC: port100: fix use-after-free in port100_send_complete
Roi Dayan <roid@nvidia.com>
net/mlx5e: Lag, Only handle events from highest priority multipath entry
Moshe Shemesh <moshe@nvidia.com>
net/mlx5: Fix a race on command flush flow
Mohammad Kabat <mohammadkab@nvidia.com>
net/mlx5: Fix size field in bufferx_reg struct
Duoming Zhou <duoming@zju.edu.cn>
ax25: Fix NULL pointer dereference in ax25_kill_by_device
Jiasheng Jiang <jiasheng@iscas.ac.cn>
net: ethernet: lpc_eth: Handle error for clk_enable
Jiasheng Jiang <jiasheng@iscas.ac.cn>
net: ethernet: ti: cpts: Handle error for clk_enable
Tung Nguyen <tung.q.nguyen@dektech.com.au>
tipc: fix incorrect order of state message data sanity check
Miaoqian Lin <linmq006@gmail.com>
ethernet: Fix error handling in xemaclite_of_probe
Jedrzej Jagielski <jedrzej.jagielski@intel.com>
ice: Fix curr_link_speed advertised speed
Anirudh Venkataramanan <anirudh.venkataramanan@intel.com>
ice: Rename a couple of variables
Anirudh Venkataramanan <anirudh.venkataramanan@intel.com>
ice: Remove unnecessary checker loop
Anirudh Venkataramanan <anirudh.venkataramanan@intel.com>
ice: Align macro names to the specification
Jacob Keller <jacob.e.keller@intel.com>
ice: stop disabling VFs due to PF error responses
Jacob Keller <jacob.e.keller@intel.com>
i40e: stop disabling VFs due to PF error responses
Joel Stanley <joel@jms.id.au>
ARM: dts: aspeed: Fix AST2600 quad spi group
Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
net: dsa: mt7530: fix incorrect test in mt753x_phylink_validate()
Jernej Skrabec <jernej.skrabec@gmail.com>
drm/sun4i: mixer: Fix P010 and P210 format numbers
Tom Rix <trix@redhat.com>
qed: return status of qed_iov_get_link
Steffen Klassert <steffen.klassert@secunet.com>
esp: Fix BEET mode inter address family tunneling on GSO
Jia-Ju Bai <baijiaju1990@gmail.com>
net: qlogic: check the return value of dma_alloc_coherent() in qed_vf_hw_prepare()
Jia-Ju Bai <baijiaju1990@gmail.com>
isdn: hfcpci: check the return value of dma_set_mask() in setup_hw()
Xie Yongji <xieyongji@bytedance.com>
virtio-blk: Don't use MAX_DISCARD_SEGMENTS if max_discard_seg is zero
Alexey Khoroshilov <khoroshilov@ispras.ru>
mISDN: Fix memory leak in dsp_pipeline_build()
Zhen Lei <thunder.leizhen@huawei.com>
mISDN: Remove obsolete PIPELINE_DEBUG debugging information
Tung Nguyen <tung.q.nguyen@dektech.com.au>
tipc: fix kernel panic when enabling bearer
Pali Rohár <pali@kernel.org>
arm64: dts: armada-3720-turris-mox: Add missing ethernet0 alias
Dmitry Torokhov <dmitry.torokhov@gmail.com>
HID: vivaldi: fix sysfs attributes leak
Taniya Das <tdas@codeaurora.org>
clk: qcom: gdsc: Add support to update GDSC transition delay
Maxime Ripard <maxime@cerno.tech>
ARM: boot: dts: bcm2711: Fix HVS register range
-------------
Diffstat:
Makefile | 4 +-
arch/arm/boot/dts/aspeed-g6-pinctrl.dtsi | 2 +-
arch/arm/boot/dts/bcm2711.dtsi | 1 +
arch/arm/include/asm/spectre.h | 6 ++
arch/arm/kernel/entry-armv.S | 4 +-
.../boot/dts/marvell/armada-3720-turris-mox.dts | 8 ++-
arch/arm64/boot/dts/marvell/armada-37xx.dtsi | 2 +-
arch/riscv/kernel/module.c | 21 ++++--
arch/x86/kernel/e820.c | 41 ++++++++----
arch/x86/kernel/kdebugfs.c | 37 ++++++++---
arch/x86/kernel/ksysfs.c | 77 +++++++++++++++++-----
arch/x86/kernel/setup.c | 34 ++++++++--
arch/x86/kernel/traps.c | 1 +
arch/x86/mm/ioremap.c | 57 ++++++++++++++--
drivers/block/virtio_blk.c | 10 ++-
drivers/clk/qcom/gdsc.c | 26 ++++++--
drivers/clk/qcom/gdsc.h | 8 ++-
drivers/gpio/gpio-ts4900.c | 24 +++++--
drivers/gpio/gpiolib.c | 10 +++
drivers/gpu/drm/sun4i/sun8i_mixer.h | 8 +--
drivers/hid/hid-vivaldi.c | 2 +-
drivers/hwmon/pmbus/pmbus_core.c | 5 ++
drivers/isdn/hardware/mISDN/hfcpci.c | 6 +-
drivers/isdn/mISDN/dsp_pipeline.c | 52 ++-------------
drivers/mmc/host/meson-gx-mmc.c | 15 +++--
drivers/net/dsa/mt7530.c | 2 +-
drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c | 7 ++
drivers/net/ethernet/cadence/macb_main.c | 25 ++++++-
drivers/net/ethernet/freescale/gianfar_ethtool.c | 1 +
drivers/net/ethernet/intel/i40e/i40e_debugfs.c | 6 +-
drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 57 ++--------------
drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h | 5 --
drivers/net/ethernet/intel/ice/ice_adminq_cmd.h | 10 +--
drivers/net/ethernet/intel/ice/ice_common.c | 13 ++--
drivers/net/ethernet/intel/ice/ice_ethtool.c | 70 +++++++++-----------
drivers/net/ethernet/intel/ice/ice_main.c | 12 ++--
drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c | 18 -----
drivers/net/ethernet/intel/ice/ice_virtchnl_pf.h | 3 -
drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 15 +++--
drivers/net/ethernet/mellanox/mlx5/core/lag_mp.c | 11 +++-
drivers/net/ethernet/nxp/lpc_eth.c | 5 +-
drivers/net/ethernet/qlogic/qed/qed_sriov.c | 18 +++--
drivers/net/ethernet/qlogic/qed/qed_vf.c | 7 ++
drivers/net/ethernet/ti/cpts.c | 4 +-
drivers/net/ethernet/xilinx/xilinx_emaclite.c | 4 +-
drivers/net/phy/dp83822.c | 2 +-
drivers/net/xen-netback/xenbus.c | 14 ++--
drivers/nfc/port100.c | 2 +
drivers/spi/spi-rockchip.c | 13 +++-
drivers/staging/gdm724x/gdm_lte.c | 5 +-
drivers/staging/rtl8723bs/core/rtw_mlme_ext.c | 7 +-
drivers/staging/rtl8723bs/core/rtw_recv.c | 10 ++-
drivers/staging/rtl8723bs/core/rtw_sta_mgt.c | 22 +++----
drivers/staging/rtl8723bs/core/rtw_xmit.c | 16 +++--
drivers/staging/rtl8723bs/hal/rtl8723bs_xmit.c | 2 +
drivers/virtio/virtio.c | 40 ++++++-----
fs/ext4/resize.c | 5 ++
fs/fuse/dev.c | 12 +++-
fs/fuse/file.c | 1 +
fs/fuse/fuse_i.h | 1 +
fs/pipe.c | 11 ++--
include/linux/mlx5/mlx5_ifc.h | 4 +-
include/linux/virtio.h | 1 -
include/linux/virtio_config.h | 3 +-
include/linux/watch_queue.h | 3 +-
kernel/trace/trace.c | 10 +--
kernel/watch_queue.c | 15 +++--
net/ax25/af_ax25.c | 7 ++
net/core/net-sysfs.c | 2 +-
net/ipv4/esp4_offload.c | 3 +
net/ipv6/addrconf.c | 2 +
net/ipv6/esp6_offload.c | 3 +
net/sctp/diag.c | 9 +--
net/tipc/bearer.c | 12 ++--
net/tipc/link.c | 9 +--
.../testing/selftests/bpf/prog_tests/timer_crash.c | 32 +++++++++
tools/testing/selftests/bpf/progs/timer_crash.c | 54 +++++++++++++++
tools/testing/selftests/memfd/memfd_test.c | 1 +
tools/testing/selftests/net/pmtu.sh | 7 +-
tools/testing/selftests/vm/map_fixed_noreplace.c | 49 ++++++++++----
80 files changed, 744 insertions(+), 399 deletions(-)
^ permalink raw reply [flat|nested] 2+ messages in thread* [PATCH 5.10 37/71] selftests/bpf: Add test for bpf_timer overwriting crash
2022-03-14 11:52 [PATCH 5.10 00/71] 5.10.106-rc1 review Greg Kroah-Hartman
@ 2022-03-14 11:53 ` Greg Kroah-Hartman
0 siblings, 0 replies; 2+ messages in thread
From: Greg Kroah-Hartman @ 2022-03-14 11:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Kumar Kartikeya Dwivedi,
Alexei Starovoitov, Sasha Levin
From: Kumar Kartikeya Dwivedi <memxor@gmail.com>
[ Upstream commit a7e75016a0753c24d6c995bc02501ae35368e333 ]
Add a test that validates that timer value is not overwritten when doing
a copy_map_value call in the kernel. Without the prior fix, this test
triggers a crash.
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://lore.kernel.org/bpf/20220209070324.1093182-3-memxor@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../selftests/bpf/prog_tests/timer_crash.c | 32 +++++++++++
.../testing/selftests/bpf/progs/timer_crash.c | 54 +++++++++++++++++++
2 files changed, 86 insertions(+)
create mode 100644 tools/testing/selftests/bpf/prog_tests/timer_crash.c
create mode 100644 tools/testing/selftests/bpf/progs/timer_crash.c
diff --git a/tools/testing/selftests/bpf/prog_tests/timer_crash.c b/tools/testing/selftests/bpf/prog_tests/timer_crash.c
new file mode 100644
index 000000000000..f74b82305da8
--- /dev/null
+++ b/tools/testing/selftests/bpf/prog_tests/timer_crash.c
@@ -0,0 +1,32 @@
+// SPDX-License-Identifier: GPL-2.0
+#include <test_progs.h>
+#include "timer_crash.skel.h"
+
+enum {
+ MODE_ARRAY,
+ MODE_HASH,
+};
+
+static void test_timer_crash_mode(int mode)
+{
+ struct timer_crash *skel;
+
+ skel = timer_crash__open_and_load();
+ if (!ASSERT_OK_PTR(skel, "timer_crash__open_and_load"))
+ return;
+ skel->bss->pid = getpid();
+ skel->bss->crash_map = mode;
+ if (!ASSERT_OK(timer_crash__attach(skel), "timer_crash__attach"))
+ goto end;
+ usleep(1);
+end:
+ timer_crash__destroy(skel);
+}
+
+void test_timer_crash(void)
+{
+ if (test__start_subtest("array"))
+ test_timer_crash_mode(MODE_ARRAY);
+ if (test__start_subtest("hash"))
+ test_timer_crash_mode(MODE_HASH);
+}
diff --git a/tools/testing/selftests/bpf/progs/timer_crash.c b/tools/testing/selftests/bpf/progs/timer_crash.c
new file mode 100644
index 000000000000..f8f7944e70da
--- /dev/null
+++ b/tools/testing/selftests/bpf/progs/timer_crash.c
@@ -0,0 +1,54 @@
+// SPDX-License-Identifier: GPL-2.0
+
+#include <vmlinux.h>
+#include <bpf/bpf_tracing.h>
+#include <bpf/bpf_helpers.h>
+
+struct map_elem {
+ struct bpf_timer timer;
+ struct bpf_spin_lock lock;
+};
+
+struct {
+ __uint(type, BPF_MAP_TYPE_ARRAY);
+ __uint(max_entries, 1);
+ __type(key, int);
+ __type(value, struct map_elem);
+} amap SEC(".maps");
+
+struct {
+ __uint(type, BPF_MAP_TYPE_HASH);
+ __uint(max_entries, 1);
+ __type(key, int);
+ __type(value, struct map_elem);
+} hmap SEC(".maps");
+
+int pid = 0;
+int crash_map = 0; /* 0 for amap, 1 for hmap */
+
+SEC("fentry/do_nanosleep")
+int sys_enter(void *ctx)
+{
+ struct map_elem *e, value = {};
+ void *map = crash_map ? (void *)&hmap : (void *)&amap;
+
+ if (bpf_get_current_task_btf()->tgid != pid)
+ return 0;
+
+ *(void **)&value = (void *)0xdeadcaf3;
+
+ bpf_map_update_elem(map, &(int){0}, &value, 0);
+ /* For array map, doing bpf_map_update_elem will do a
+ * check_and_free_timer_in_array, which will trigger the crash if timer
+ * pointer was overwritten, for hmap we need to use bpf_timer_cancel.
+ */
+ if (crash_map == 1) {
+ e = bpf_map_lookup_elem(map, &(int){0});
+ if (!e)
+ return 0;
+ bpf_timer_cancel(&e->timer);
+ }
+ return 0;
+}
+
+char _license[] SEC("license") = "GPL";
--
2.34.1
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2022-03-21 12:46 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
[not found] <HE1PR0402MB3497CB13A12C4D15D20A1FCCF8139@HE1PR0402MB3497.eurprd04.prod.outlook.com>
2022-03-21 12:46 ` [PATCH 5.10 37/71] selftests/bpf: Add test for bpf_timer overwriting crash gregkh
2022-03-14 11:52 [PATCH 5.10 00/71] 5.10.106-rc1 review Greg Kroah-Hartman
2022-03-14 11:53 ` [PATCH 5.10 37/71] selftests/bpf: Add test for bpf_timer overwriting crash Greg Kroah-Hartman
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®