linux-kernel - eventpoll __list_del_entry corruption (was: perf: use after free in perf_remove_from

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20140515181102.GH11096@twins.programming.kicks-ass.net>
Date:	Thu, 15 May 2014 20:11:02 +0200
From:	Peter Zijlstra <peterz@...radead.org>
To:	Sasha Levin <sasha.levin@...cle.com>
Cc:	Ingo Molnar <mingo@...nel.org>, acme@...stprotocols.net,
	LKML <linux-kernel@...r.kernel.org>,
	Thomas Gleixner <tglx@...utronix.de>,
	Dave Jones <davej@...hat.com>, edumazet@...gle.com,
	viro@...iv.linux.org.uk, jbaron@...mai.com
Subject: eventpoll __list_del_entry corruption (was: perf: use after free in
 perf_remove_from_context)

On Mon, May 12, 2014 at 11:42:33AM -0400, Sasha Levin wrote:
> Hi all,
> 
> While fuzzing with trinity inside a KVM tools guest running the latest -next
> kernel I've stumbled on the following spew. Maybe related to the very recent
> change in freeing on task exit?
> 

While fuzzing to reproduce; I hit this one, is it a known one or should
I go poke the right people about it?

---
[ 5823.689985] ------------[ cut here ]------------
[ 5823.690004] WARNING: CPU: 3 PID: 2508 at /usr/src/linux-2.6/lib/list_debug.c:59 __list_del_entry+0xa1/0xd0()
[ 5823.690004] list_del corruption. prev->next should be ffff880131111de0, but was 6b6b6b6b6b6b6b6b
[ 5823.690004] Modules linked in:
[ 5823.690004] CPU: 3 PID: 2508 Comm: trinity-main Not tainted 3.15.0-rc5-01700-g505011124ad0-dirty #1072
[ 5823.690004] Hardware name: Supermicro X8DTN/X8DTN, BIOS 4.6.3 01/08/2010
[ 5823.690004]  0000000000000009 ffff880432709ca8 ffffffff81681aa2 ffff880432709cf0
[ 5823.690004]  ffff880432709ce0 ffffffff8109807c ffff880131111de0 ffff880131111dc8
[ 5823.690004]  0000000000000286 ffff8800b9dd5618 ffff88023699b720 ffff880432709d40
[ 5823.690004] Call Trace:
[ 5823.690004]  [<ffffffff81681aa2>] dump_stack+0x4e/0x7a
[ 5823.690004]  [<ffffffff8109807c>] warn_slowpath_common+0x8c/0xc0
[ 5823.690004]  [<ffffffff8109816c>] warn_slowpath_fmt+0x4c/0x50
[ 5823.690004]  [<ffffffff810ec8bf>] ? do_raw_spin_lock+0x13f/0x160
[ 5823.690004]  [<ffffffff8138c661>] __list_del_entry+0xa1/0xd0
[ 5823.690004]  [<ffffffff8138c69d>] list_del+0xd/0x30
[ 5823.690004]  [<ffffffff810dfa71>] remove_wait_queue+0x31/0x50
[ 5823.690004]  [<ffffffff812152aa>] ep_unregister_pollwait.isra.9+0x6a/0xb0
[ 5823.690004]  [<ffffffff81215268>] ? ep_unregister_pollwait.isra.9+0x28/0xb0
[ 5823.690004]  [<ffffffff8121531f>] ep_remove+0x2f/0xe0
[ 5823.690004]  [<ffffffff81215705>] eventpoll_release_file+0x65/0xa0
[ 5823.690004]  [<ffffffff811cf259>] __fput+0x1d9/0x1e0
[ 5823.690004]  [<ffffffff811cf2ae>] ____fput+0xe/0x10
[ 5823.690004]  [<ffffffff810b91f4>] task_work_run+0xc4/0xe0
[ 5823.690004]  [<ffffffff8109a544>] do_exit+0x2d4/0xa90
[ 5823.690004]  [<ffffffff813825c4>] ? lockdep_sys_exit_thunk+0x35/0x67
[ 5823.690004]  [<ffffffff8109ae2c>] do_group_exit+0x4c/0xc0
[ 5823.690004]  [<ffffffff8109aeb7>] SyS_exit_group+0x17/0x20
[ 5823.690004]  [<ffffffff8168a2c2>] system_call_fastpath+0x16/0x1b
[ 5823.690004] ---[ end trace 515b7fa3169c0906 ]---

Content of type "application/pgp-signature" skipped