microsoft / microsoft/ebpf-for-windows

bsod in netebpfext when unloading ebpf programs

Open
#5,555 2 comments 0 reactions 1 assignee Claimed by @shankarseal View on GitHub
bug triaged
Dominant language
C
Stars
3.6k
Forks
311
Avg merge
6d 10h
Merged PRs (30d)
21

Description

### Describe the bug

One of the tests we run loads and unloads ebpf programs that use the netebpfext extension. On one occassion I saw a blue screen when I was trying to unload a bpf pogram. I have the dump and symbol file. This was on Release-v1.1.0 build of netebpfext.sys
This is the stack trace:
```
00 fffff805`8d0a04e9 : 00000000`0000000a 00000000`00000008 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
01 fffff805`8d09b7a8 : ffff858c`8e732b40 00000000`00000000 ffff8806`2fe9b240 00000000`00000000 : nt!KiBugCheckDispatch+0x69
02 fffff800`4092a64e : ffff8806`20581680 fffff805`1f7d58e5 ffff8806`0d6528a0 00000000`00000117 : nt!KiPageFault+0x468
03 (Inline Function) : --------`-------- --------`-------- --------`-------- --------`-------- : NetEbpfExt!RemoveEntryList+0x3 [D:\a\1\s\packages\Microsoft.Windows.WDK.x64.10.0.26100.6584\c\Include\10.0.26100.0\km\wdm.h @ 13520]
04 fffff805`1f7d5810 : ffff8806`0770a010 ffff8806`145e8060 ffff8806`2fe9b240 ffff8806`304c8990 : NetEbpfExt!net_ebpf_extension_sock_ops_flow_delete+0x4e [D:\a\1\s\netebpfext\net_ebpf_ext_sock_ops.c @ 600]
05 fffff805`1f7d53ee : ffff8806`2fe9b240 ffff8806`304c8990 ffff8806`313fd650 00000000`00000000 : NETIO!WfpNotifyFlowContextDelete+0x104
06 fffff805`1f7d517f : ffff8806`24ddad50 00000000`0000ff02 ffff8806`24ddad50 fffff805`8d58aa75 : NETIO!WfpProcessFlowDelete+0x21e
07 fffff805`2031a47d : ffff8806`24ddad50 00000000`00000000 ffff858c`8e732b10 ffff858c`8e732b28 : NETIO!KfdAleNotifyFlowDeletion+0x1f
08 fffff805`20318912 : fffff805`1f8cffbd badbadfa`badbadfa ffff8806`24ddad50 00000000`00000000 : tcpip!WfpAleFreeRemoteEndpoint+0x2d
09 fffff805`20319c9d : ffff8806`24ddadd0 ffff8806`24ddad50 00000000`00000000 00000000`00000000 : tcpip!WfpAleDereferenceEndpoint+0x102
0a fffff805`20319bd0 : ffff8806`24ddadd0 00000000`003a3fb8 00000000`00000030 00000000`00000000 : tcpip!WfpAlepDeleteEntryFromTable+0x8d
0b fffff805`203195b8 : ffff8806`25dc8ce0 00000000`00000400 00000000`00000000 ffff8806`25dc8ce0 : tcpip!WfpAlepFreeRemoteEndpointsForEndpointContext+0x450
0c fffff805`202d09bf : ffff8806`25000000 ffff8806`378801c0 ffff8806`25dc8ce0 ffff8806`25dc8ce0 : tcpip!WfpAlepEndpointCleanupWorkQueueRoutine+0x88
0d fffff805`20322cc1 : ffff8806`378801c0 ffff858c`8e732f10 00000000`61506e49 ffff8806`1ee99000 : tcpip!WfpAleEndpointTeardownHandler+0xdb
0e fffff805`20322b61 : 00000000`00000000 ffff8806`37880290 ffff8806`0d898850 ffff8806`378801c0 : tcpip!UdpCleanupEndpointWorkQueueRoutine+0x131
0f fffff805`202dad04 : ffff8806`0d961000 00000000`00000000 ffff8806`0d898850 ffff8806`0d961088 : tcpip!UdpCleanupEndpoint+0x29
10 fffff805`202daa38 : 00000000`0000c1db ffff8806`378801c0 00000000`00000000 00000000`00000005 : tcpip!UdpDereferenceEndpoint+0x34
11 fffff805`203072e2 : ffff8806`25dc8d60 ffff8806`378801c0 00000000`00000000 00000000`00000000 : tcpip!UdpCloseEndpointWorkQueueRoutine+0x358
12 fffff805`20306d45 : 00000000`00000001 ffff8806`0d6ada20 00000000`00000000 00000000`00000000 : tcpip!UdpCloseEndpoint+0x582
13 fffff805`8cc12614 : 00000000`00000000 fffff805`20306d30 ffff858c`00000000 00000000`00000001 : tcpip!UdpTlProviderCloseEndpointCalloutRoutine+0x15
14 fffff805`8cc1252d : fffff805`20306d30 ffff858c`8e733310 ffff8806`0df935b0 00000000`00000000 : nt!KeExpandKernelStackAndCalloutInternal+0xd4
15 fffff805`20374915 : ffff8806`3d50d598 00000000`00000001 00000000`00000000 ffff8806`3d50d3f0 : nt!KeExpandKernelStackAndCalloutEx+0x1d
16 fffff800`3ef7b632 : ffff8806`0df935b0 ffff858c`8e733449 ffff8806`3beca910 ffff8806`07832340 : tcpip!UdpTlProviderCloseEndpoint+0x75
17 fffff800`3ef7ba81 : ffff8806`3beca910 00000000`00000000 00000000`00000000 00000000`00000000 : afd!AfdTLCloseEndpoint+0x42
18 fffff800`3ef9e366 : ffff8806`3beca910 00000000`00000000 00000000`00000000 00000000`00000000 : afd!AfdDerefTLBaseEndpoint+0x21
19 fffff800`3ef8557f : 00000000`00000000 ffff8806`3becaa38 ffff8806`3beca910 00000000`00000000 : afd!AfdCloseTransportEndpoint+0xb6
1a fffff800`3ef84307 : 00000000`00000001 00000000`00000000 ffff8806`3d50d3f0 fffff805`8cc59d47 : afd!AfdCleanupCore+0x102f
1b fffff805`8cc3c2cb : ffff8806`0f0020a0 ffff8806`12d9a080 ffff8806`3d50d3f0 fffff805`8cc3da3a : afd!AfdDispatch+0xb7
1c fffff805`8d589d84 : 00000000`00000004 fffff805`8cc59b9c ffff8806`26e890c0 00000000`00000000 : nt!IopfCallDriver+0x5b
1d fffff805`8cc3c258 : ffff8806`3d50d3f0 ffff858c`8e7338b0 ffff858c`8e73388c 00000000`00000000 : nt!IovCallDriver+0x44
1e fffff805`8d21f615 : ffff8806`3d50d3f0 ffff858c`8e7338b0 ffff8806`12d9a080 ffff8806`12272e50 : nt!IofCallDriver+0x28
1f fffff805`8d2297dc : 00000000`00000001 00000000`00000001 ffff858c`8e7339f0 ffff8806`3a46adb0 : nt!IopCloseFile+0x3a5
20 fffff805`8d227ce9 : 00000000`00000000 ffff8806`129dbd50 00000000`00000000 00000000`00989680 : nt!ObCloseHandleTableEntry+0x63c
21 fffff805`8d09fb55 : ffff8806`26e89000 0000021c`3d108850 ffff8806`26e890c0 00000000`00000001 : nt!NtClose+0xe9
22 00007ff8`f8420564 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25
23 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ff8`f8420564
windbg> .open -a fffff8004092a64e

```
~Attaching kernel dump and symbol file~
Attaching the 360 MB archive failed.

I test this scenario several times each day and seen this only once in last one year.

### OS information

Windows 11 Enterprise 25H2

### Steps taken to reproduce bug

Loaded a sockops bpf program
Unloaded the program

### Expected behavior

The machine should not crash

### Actual outcome

Machine restarted with bug check

### Additional details

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.