linux-kernel - Re: Bug 4.1.16: self-detected stall in net/unix/?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 3 Feb 2016 02:43:14 +0100
From:	Hannes Frederic Sowa <hannes@...essinduktion.org>
To:	Philipp Hahn <pmhahn@...ahn.de>,
	Sasha Levin <sasha.levin@...cle.com>,
	Rainer Weikusat <rweikusat@...ileactivedefense.com>,
	Andrey Vagin <avagin@...nvz.org>,
	Aaron Conole <aconole@...heb.org>,
	"David S. Miller" <davem@...emloft.net>,
	linux-kernel@...r.kernel.org
Cc:	Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: Re: Bug 4.1.16: self-detected stall in net/unix/?

On 02.02.2016 17:25, Philipp Hahn wrote:
> Hi,
>
> we recently updated our kernel to 4.1.16 + patch for "unix: properly
> account for FDs passed over unix sockets" and have since then
> self-detected stalls triggered by the Samba daemon:
>
 > >
 > > [...]
 > >
>
> We have not yet been able to reproduce the hang, but going back to our
> previous kernel 4.1.12 makes the problem go away.

Can you remove the patch "unix: properly account for FDs passed over 
unix sockets" and see if the problem still happens?

I couldn't quickly see any problems with your added patch. I currently 
suspect a tight loop because of a SOCK_DEAD flag set but the socket not 
removed from unix_socket_table or the vfs. Hmmm...

The stack trace is rather unreliable, maybe something completely 
different happend. Do you happend to see better reports?

> Is this a known issue or do you have an idea where to look?
> What information should I collect next time it happens?
>
> (Can unix_diag.ko with `ss` help?)

Would be interesting if it is a conventional file based socket or 
autobounded one (sun_path[0] != '\0').

Thanks,
Hannes