> syzbot and other bots reported that we have to enable
> user copy to/from skb->head. [1]
>
> We can prevent access to skb_shared_info, which is a nice
> improvement over standard kmem_cache.
>
> Layout of these kmem_cache objects is:
>
> < SKB_SMALL_HEAD_HEADROOM >< struct skb_shared_info >
>
> usercopy: Kernel memory overwrite attempt detected to SLUB object 'skbuff_small_head' (offset 32, size 20)!
> ------------[ cut here ]------------
> kernel BUG at mm/usercopy.c:102 !
[...]
LKFT also reported this problem on today's Linux next-20230209.
Link: https://lore.kernel.org/linux-next/CA+G9fYs-i-c2KTSA7Ai4ES_ZESY1ZnM=Zuo8P1j…
Reported-by: Linux Kernel Functional Testing <lkft(a)linaro.org>
>
> Fixes: bf9f1baa279f ("net: add dedicated kmem_cache for typical/small skb->head")
> Reported-by: syzbot <syzkaller(a)googlegroups.com>
> Signed-off-by: Eric Dumazet <edumazet(a)google.com>
Tested-by: Linux Kernel Functional Testing <lkft(a)linaro.org>
Thanks for providing a quick fix.
--
Linaro LKFT
https://lkft.linaro.org
Total jobs: 54
Total errors: 13 (24.07%)
LAVA errors: 0 (0.00%)
Test errors: 8 (14.81%)
Job errors: 0 (0.00%)
Infra errors: 5 (9.26%)
Canceled jobs: 0 (0.00%)
Device type: hi6220-hikey-r2
Total jobs: 7
Total errors: 3 (42.86%)
Error type: Test
Error count: 3 (42.86%)
Error: No match for error type 'Test', message 'tradefed - adb device lost[311A0E78003D2FFF]'
Count: 1 (14.29%)
IDs:
hikey-6220-r2-09:
6144179
Error: No match for error type 'Test', message 'tradefed - adb device lost[6EDCB009004013EF]'
Count: 1 (14.29%)
IDs:
hikey-6220-r2-08:
6144142
Error: No match for error type 'Test', message 'tradefed - adb device lost[8D6E5F00030E051]'
Count: 1 (14.29%)
IDs:
hikey-6220-r2-02:
6143960
Device type: x15
Total jobs: 3
Total errors: 1 (33.33%)
Error type: Test
Error count: 1 (33.33%)
Error: No match for error type 'Test', message 'lava-docker-test-shell timed out after 21585 seconds'
Count: 1 (33.33%)
IDs:
x15-04:
6143747
Device type: dragonboard-845c
Total jobs: 44
Total errors: 9 (20.45%)
Error type: Test
Error count: 4 (9.09%)
Error: No match for error type 'Test', message 'lava-docker-test-shell timed out after 586 seconds'
Count: 2 (4.55%)
IDs:
db845c-02:
6130508 6143198
Error: No match for error type 'Test', message 'lava-docker-test-shell timed out after 28785 seconds'
Count: 1 (2.27%)
IDs:
db845c-08:
6115709
Error: No match for error type 'Test', message 'lava-docker-test-shell timed out after 53986 seconds'
Count: 1 (2.27%)
IDs:
db845c-03:
6115707
Error type: Infrastructure
Error count: 5 (11.36%)
Error: Connection closed
Count: 5 (11.36%)
IDs:
db845c-02:
6143195
db845c-03:
6143196
db845c-09:
6131021 6143166
db845c-10:
6143184
Total jobs: 64
Total errors: 32 (50.00%)
LAVA errors: 0 (0.00%)
Test errors: 14 (21.88%)
Job errors: 5 (7.81%)
Infra errors: 13 (20.31%)
Canceled jobs: 0 (0.00%)
Device type: dragonboard-845c
Total jobs: 53
Total errors: 24 (45.28%)
Error type: Test
Error count: 7 (13.21%)
Error: No match for error type 'Test', message 'lava-docker-test-shell timed out after 585 seconds'
Count: 1 (1.89%)
IDs:
db845c-02:
6143768
Error: No match for error type 'Test', message 'lava-docker-test-shell timed out after 586 seconds'
Count: 2 (3.77%)
IDs:
db845c-03:
6143743
db845c-05:
6143232
Error: No match for error type 'Test', message 'lava-docker-test-shell timed out after 587 seconds'
Count: 2 (3.77%)
IDs:
db845c-08:
6115700 6115705
Error: No match for error type 'Test', message 'lava-docker-test-shell timed out after 277 seconds'
Count: 1 (1.89%)
IDs:
db845c-03:
6115698
Error: No match for error type 'Test', message 'lava-docker-test-shell timed out after 272 seconds'
Count: 1 (1.89%)
IDs:
db845c-03:
6115692
Error type: Job
Error count: 5 (9.43%)
Error: wait for prompt timed out
Count: 2 (3.77%)
IDs:
db845c-04:
6143738
db845c-05:
6143214
Error: No match for error type 'Job', message 'login-action timed out after 846 seconds'
Count: 1 (1.89%)
IDs:
db845c-01:
6143236
Error: No match for error type 'Job', message 'login-action timed out after 875 seconds'
Count: 1 (1.89%)
IDs:
db845c-08:
6143104
Error: No match for error type 'Job', message 'login-action timed out after 707 seconds'
Count: 1 (1.89%)
IDs:
db845c-02:
6115714
Error type: Infrastructure
Error count: 12 (22.64%)
Error: Connection closed
Count: 11 (20.75%)
IDs:
db845c-01:
6143141 6143349
db845c-02:
6115711
db845c-03:
6115694 6115696 6143103 6143113 6143157
db845c-04:
6142418
db845c-05:
6143101
db845c-10:
6115704
Error: fastboot-flash-action timed out
Count: 1 (1.89%)
IDs:
db845c-03:
6115697
Device type: hi6220-hikey-r2
Total jobs: 11
Total errors: 8 (72.73%)
Error type: Test
Error count: 7 (63.64%)
Error: No match for error type 'Test', message 'lava-docker-test-shell timed out after 586 seconds'
Count: 1 (9.09%)
IDs:
hikey-6220-r2-15:
6143357
Error: No match for error type 'Test', message 'tradefed - adb device lost[35FE0622003F362E]'
Count: 1 (9.09%)
IDs:
hikey-6220-r2-10:
6143353
Error: No match for error type 'Test', message 'lava-docker-test-shell timed out after 584 seconds'
Count: 1 (9.09%)
IDs:
hikey-6220-r2-14:
6143350
Error: No match for error type 'Test', message 'lava-docker-test-shell timed out after 585 seconds'
Count: 1 (9.09%)
IDs:
hikey-6220-r2-01:
6139022
Error: No match for error type 'Test', message 'tradefed - adb device lost[50D6538A01FE17F3]'
Count: 1 (9.09%)
IDs:
hikey-6220-r2-15:
6135900
Error: No match for error type 'Test', message 'tradefed - adb device lost[4766BBA4003D86F3]'
Count: 1 (9.09%)
IDs:
hikey-6220-r2-12:
6135608
Error: No match for error type 'Test', message 'tradefed - adb device lost[7C74A5EC003A6F99]'
Count: 1 (9.09%)
IDs:
hikey-6220-r2-06:
6134979
Error type: Infrastructure
Error count: 1 (9.09%)
Error: fastboot-flash-action timed out
Count: 1 (9.09%)
IDs:
hikey-6220-r2-02:
6143356
Following Build regressions warnings / errors noticed on Linux next-20230207.
Regressions found on x86_64:
- build/clang-15-lkftconfig-compat
- build/clang-nightly-lkftconfig
- build/clang-15-lkftconfig
- build/clang-15-lkftconfig-kcsan
- build/clang-lkftconfig
In file included from arch/x86/entry/vdso/vdso32/vgetcpu.c:2:
In file included from arch/x86/entry/vdso/vdso32/../vgetcpu.c:8:
In file included from include/linux/kernel.h:22:
In file included from include/linux/bitops.h:68:
In file included from arch/x86/include/asm/bitops.h:420:
arch/x86/include/asm/arch_hweight.h:49:15: error: invalid input size
for constraint 'D'
: REG_IN (w));
^
In file included from arch/x86/entry/vdso/vdso32/vgetcpu.c:2:
In file included from arch/x86/entry/vdso/vdso32/../vgetcpu.c:8:
In file included from include/linux/kernel.h:25:
In file included from include/linux/math.h:6:
arch/x86/include/asm/div64.h:85:34: error: invalid output size for
constraint '=a'
asm ("mulq %2; divq %3" : "=a" (q)
^
2 errors generated.
Reported-by: Linux Kernel Functional Testing <lkft(a)linaro.org>
Following config diff found.
+ CONFIG_COMPAT_WARN_32BIT_FILESYSTEM_ACCESS=y
Build details link,
https://qa-reports.linaro.org/lkft/linux-next-master/build/next-20230207/te…
# To install tuxmake on your system globally:
# sudo pip3 install -U tuxmake
#
# See https://docs.tuxmake.org/ for complete documentation.
# Original tuxmake command with fragments listed below.
tuxmake \
--runtime podman \
--target-arch x86_64 \
--toolchain clang-15 \
--kconfig defconfig \
--kconfig-add https://raw.githubusercontent.com/Linaro/meta-lkft/kirkstone/meta/recipes-k…
\
--kconfig-add https://raw.githubusercontent.com/Linaro/meta-lkft/kirkstone/meta/recipes-k…
\
--kconfig-add https://raw.githubusercontent.com/Linaro/meta-lkft/kirkstone/meta/recipes-k…
\
--kconfig-add https://raw.githubusercontent.com/Linaro/meta-lkft/kirkstone/meta/recipes-k…
\
--kconfig-add https://raw.githubusercontent.com/Linaro/meta-lkft/kirkstone/meta/recipes-k…
\
--kconfig-add CONFIG_IGB=y \
--kconfig-add CONFIG_UNWINDER_FRAME_POINTER=y LLVM=1 LLVM_IAS=1
--
Linaro LKFT
https://lkft.linaro.org