search for: vhost_net_ioctl

Hi All, What's the role or value of the third argument in the vhost_net_ioctl function in /drivers/vhost/net.c . The function declaration is static long vhost_net_ioctl(struct file *f, unsigned int ioctl, unsigned long arg) As per my knowledge, *f represents the fd of vhost-net device, ioctl any device request like VHOST_NET_SET_BACKEND, But what's...

Hi All, What's the role or value of the third argument in the vhost_net_ioctl function in /drivers/vhost/net.c . The function declaration is static long vhost_net_ioctl(struct file *f, unsigned int ioctl, unsigned long arg) As per my knowledge, *f represents the fd of vhost-net device, ioctl any device request like VHOST_NET_SET_BACKEND, But what's...

...mm/slab.c:3553 [<0000000079ebab38>] kmalloc include/linux/slab.h:547 [inline] [<0000000079ebab38>] vhost_net_ubuf_alloc drivers/vhost/net.c:241 [inline] [<0000000079ebab38>] vhost_net_set_backend drivers/vhost/net.c:1534 [inline] [<0000000079ebab38>] vhost_net_ioctl+0xb43/0xc10 drivers/vhost/net.c:1716 [<000000009f6204a2>] vfs_ioctl fs/ioctl.c:46 [inline] [<000000009f6204a2>] file_ioctl fs/ioctl.c:509 [inline] [<000000009f6204a2>] do_vfs_ioctl+0x62a/0x810 fs/ioctl.c:696 [<00000000b45866de>] ksys_ioctl+0x86/0xb0 fs/...

...x280 mm/slab.c:3553 [<0000000079ebab38>] kmalloc include/linux/slab.h:547 [inline] [<0000000079ebab38>] vhost_net_ubuf_alloc drivers/vhost/net.c:241 [inline] [<0000000079ebab38>] vhost_net_set_backend drivers/vhost/net.c:1534 [inline] [<0000000079ebab38>] vhost_net_ioctl+0xb43/0xc10 drivers/vhost/net.c:1716 [<000000009f6204a2>] vfs_ioctl fs/ioctl.c:46 [inline] [<000000009f6204a2>] file_ioctl fs/ioctl.c:509 [inline] [<000000009f6204a2>] do_vfs_ioctl+0x62a/0x810 fs/ioctl.c:696 [<00000000b45866de>] ksys_ioctl+0x86/0xb0 fs/io...

...x280 mm/slab.c:3553 [<0000000079ebab38>] kmalloc include/linux/slab.h:547 [inline] [<0000000079ebab38>] vhost_net_ubuf_alloc drivers/vhost/net.c:241 [inline] [<0000000079ebab38>] vhost_net_set_backend drivers/vhost/net.c:1534 [inline] [<0000000079ebab38>] vhost_net_ioctl+0xb43/0xc10 drivers/vhost/net.c:1716 [<000000009f6204a2>] vfs_ioctl fs/ioctl.c:46 [inline] [<000000009f6204a2>] file_ioctl fs/ioctl.c:509 [inline] [<000000009f6204a2>] do_vfs_ioctl+0x62a/0x810 fs/ioctl.c:696 [<00000000b45866de>] ksys_ioctl+0x86/0xb0 fs/io...

...gt;] kmalloc include/linux/slab.h:547 [inline] >> ???? [<0000000079ebab38>] vhost_net_ubuf_alloc >> drivers/vhost/net.c:241 [inline] >> ???? [<0000000079ebab38>] vhost_net_set_backend >> drivers/vhost/net.c:1534 [inline] >> ???? [<0000000079ebab38>] vhost_net_ioctl+0xb43/0xc10 >> drivers/vhost/net.c:1716 >> ???? [<000000009f6204a2>] vfs_ioctl fs/ioctl.c:46 [inline] >> ???? [<000000009f6204a2>] file_ioctl fs/ioctl.c:509 [inline] >> ???? [<000000009f6204a2>] do_vfs_ioctl+0x62a/0x810 fs/ioctl.c:696 >> ???? [<00...

On Thu, Jun 13, 2019 at 2:07 PM Hillf Danton <hdanton at sina.com> wrote: > > > Hello Jason > > On Thu, 13 Jun 2019 17:10:39 +0800 Jason Wang wrote: > > > > This is basically a kfree(ubuf) after the second vhost_net_flush() in > > vhost_net_release(). > > > Fairly good catch. > > > Could you please post a formal patch? > > > I'd

Hello Jason On Thu, 13 Jun 2019 17:10:39 +0800 Jason Wang wrote: > > This is basically a kfree(ubuf) after the second vhost_net_flush() in > vhost_net_release(). > Fairly good catch. > Could you please post a formal patch? > I'd like very much to do that; but I wont, I am afraid, until I collect a Tested-by because of reproducer without a cutting edge. Thanks Hillf

Hello Jason On Thu, 13 Jun 2019 17:10:39 +0800 Jason Wang wrote: > > This is basically a kfree(ubuf) after the second vhost_net_flush() in > vhost_net_release(). > Fairly good catch. > Could you please post a formal patch? > I'd like very much to do that; but I wont, I am afraid, until I collect a Tested-by because of reproducer without a cutting edge. Thanks Hillf

...> [<0000000079ebab38>] kmalloc include/linux/slab.h:547 [inline] > [<0000000079ebab38>] vhost_net_ubuf_alloc drivers/vhost/net.c:241 [inline] > [<0000000079ebab38>] vhost_net_set_backend drivers/vhost/net.c:1534 [inline] > [<0000000079ebab38>] vhost_net_ioctl+0xb43/0xc10 drivers/vhost/net.c:1716 > [<000000009f6204a2>] vfs_ioctl fs/ioctl.c:46 [inline] > [<000000009f6204a2>] file_ioctl fs/ioctl.c:509 [inline] > [<000000009f6204a2>] do_vfs_ioctl+0x62a/0x810 fs/ioctl.c:696 > [<00000000b45866de>] ksys_i...

...> [<0000000079ebab38>] kmalloc include/linux/slab.h:547 [inline] > [<0000000079ebab38>] vhost_net_ubuf_alloc drivers/vhost/net.c:241 [inline] > [<0000000079ebab38>] vhost_net_set_backend drivers/vhost/net.c:1534 [inline] > [<0000000079ebab38>] vhost_net_ioctl+0xb43/0xc10 drivers/vhost/net.c:1716 > [<000000009f6204a2>] vfs_ioctl fs/ioctl.c:46 [inline] > [<000000009f6204a2>] file_ioctl fs/ioctl.c:509 [inline] > [<000000009f6204a2>] do_vfs_ioctl+0x62a/0x810 fs/ioctl.c:696 > [<00000000b45866de>] ksys_i...

...> [<0000000079ebab38>] kmalloc include/linux/slab.h:547 [inline] > [<0000000079ebab38>] vhost_net_ubuf_alloc drivers/vhost/net.c:241 [inline] > [<0000000079ebab38>] vhost_net_set_backend drivers/vhost/net.c:1534 [inline] > [<0000000079ebab38>] vhost_net_ioctl+0xb43/0xc10 drivers/vhost/net.c:1716 > [<000000009f6204a2>] vfs_ioctl fs/ioctl.c:46 [inline] > [<000000009f6204a2>] file_ioctl fs/ioctl.c:509 [inline] > [<000000009f6204a2>] do_vfs_ioctl+0x62a/0x810 fs/ioctl.c:696 > [<00000000b45866de>] ksys_i...

Hello Syzbot On Fri, 14 Jun 2019 02:26:02 +0800 syzbot wrote: > > Hello, > > syzbot has tested the proposed patch but the reproducer still triggered crash: > memory leak in vhost_net_ioctl > Oh sorry for my poor patch. > ANGE): hsr_slave_1: link becomes ready > 2019/06/13 18:24:57 executed programs: 18 > BUG: memory leak > unreferenced object 0xffff88811cbc6ac0 (size 64): > comm "syz-executor.0", pid 7196, jiffies 4294943804 (age 14.770s) > hex d...

Hello Syzbot On Fri, 14 Jun 2019 02:26:02 +0800 syzbot wrote: > > Hello, > > syzbot has tested the proposed patch but the reproducer still triggered crash: > memory leak in vhost_net_ioctl > Oh sorry for my poor patch. > ANGE): hsr_slave_1: link becomes ready > 2019/06/13 18:24:57 executed programs: 18 > BUG: memory leak > unreferenced object 0xffff88811cbc6ac0 (size 64): > comm "syz-executor.0", pid 7196, jiffies 4294943804 (age 14.770s) > hex d...

Hello, syzbot has tested the proposed patch but the reproducer still triggered crash: memory leak in batadv_tvlv_handler_register 484.626788][ T156] bond0 (unregistering): Releasing backup interface bond_slave_1 Warning: Permanently added '10.128.0.87' (ECDSA) to the list of known hosts. BUG: memory leak unreferenced object 0xffff88811d25c4c0 (size 64): comm

Hello Syzbot On Fri, 14 Jun 2019 11:04:03 +0800 syzbot wrote: > >Hello, > >syzbot has tested the proposed patch but the reproducer still triggered crash: >memory leak in batadv_tvlv_handler_register > It is not ubuf leak which is addressed in this thread. Good news. I will see this new leak soon. > 484.626788][ T156] bond0 (unregistering): Releasing backup interface

...VHOST_SET_VRING_BASE [vq=0000000088199421][vq->last_avail_idx=0][vq->avail_idx=0][s.index=0][s.num=0] [ 67.801018] [1917] vhost:vhost_vring_ioctl:1655: VHOST_SET_VRING_BASE [vq=00000000175f11ec][vq->last_avail_idx=0][vq->avail_idx=0][s.index=1][s.num=0] [ 67.801026] [1917] vhost_net:vhost_net_ioctl:1726: VHOST_NET_SET_BACKEND [ 67.801028] [1917] vhost_net:vhost_net_set_backend:1538: sock=0000000082d8d291 != oldsock=000000001ae027fd index=0 fd=39 vq=0000000088199421 [ 67.801032] [1917] vhost_net:vhost_net_set_backend:1573: sock=0000000082d8d291 [ 67.801033] [1917] vhost_net:vhost_net_ioc...

Hello Syzbot On Fri, 14 Jun 2019 11:04:03 +0800 syzbot wrote: > >Hello, > >syzbot has tested the proposed patch but the reproducer still triggered crash: >memory leak in batadv_tvlv_handler_register > > 484.626788][ T156] bond0 (unregistering): Releasing backup interface bond_slave_1 >Warning: Permanently added '10.128.0.87' (ECDSA) to the list of known hosts.

...06 M04 704 (LPAR) [ 55.951892] Call Trace: [ 55.951902] [<0000001ede114132>] show_stack+0x8a/0xd0 [ 55.951906] [<0000001edeb0672a>] dump_stack+0x8a/0xb8 [ 55.951915] [<000003ff803736a6>] vhost_vring_ioctl+0x6fe/0x858 [vhost] [ 55.951919] [<000003ff8042a608>] vhost_net_ioctl+0x510/0x570 [vhost_net] [ 55.951924] [<0000001ede3c4dd8>] do_vfs_ioctl+0x430/0x6f8 [ 55.951926] [<0000001ede3c5124>] ksys_ioctl+0x84/0xb0 [ 55.951927] [<0000001ede3c51ba>] __s390x_sys_ioctl+0x2a/0x38 [ 55.951931] [<0000001edeb27f72>] system_call+0x2a6/0x2c8...

...Call Trace: >> [ 55.951902] [<0000001ede114132>] show_stack+0x8a/0xd0 >> [ 55.951906] [<0000001edeb0672a>] dump_stack+0x8a/0xb8 >> [ 55.951915] [<000003ff803736a6>] vhost_vring_ioctl+0x6fe/0x858 [vhost] >> [ 55.951919] [<000003ff8042a608>] vhost_net_ioctl+0x510/0x570 [vhost_net] >> [ 55.951924] [<0000001ede3c4dd8>] do_vfs_ioctl+0x430/0x6f8 >> [ 55.951926] [<0000001ede3c5124>] ksys_ioctl+0x84/0xb0 >> [ 55.951927] [<0000001ede3c51ba>] __s390x_sys_ioctl+0x2a/0x38 >> [ 55.951931] [<0000001edeb27f7...