linux-kernel - [BUG] crash in pick_next_task

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20150812133323.GA16462@krava.brq.redhat.com>
Date:	Wed, 12 Aug 2015 15:33:23 +0200
From:	Jiri Olsa <jolsa@...hat.com>
To:	Peter Zijlstra <peterz@...radead.org>,
	Ingo Molnar <mingo@...hat.com>
Cc:	linux-kernel@...r.kernel.org, Rik van Riel <riel@...hat.com>
Subject: [BUG] crash in pick_next_task_fair

hi,
we see crashes on older kernel (2.6.32 based) in  pick_next_task_fair:

...
#8 [ffff8819335efa20] page_fault at ffffffff8152d375
    [exception RIP: rb_next+1]
    RIP: ffffffff81292ae1  RSP: ffff8819335efad8  RFLAGS: 00010046
    RAX: 0000000000000000  RBX: ffff8810b8a96928  RCX: 0000000000000000
    RDX: 0000000000000000  RSI: ffff880ff7602ae0  RDI: 0000000000000010
    RBP: ffff8819335efb28   R8: 0000000000000000   R9: 0000000000000000
    R10: 0000000000000000  R11: 0000000000000000  R12: 0000000000000000
    R13: 0000000000000000  R14: 0000000000000000  R15: 0000000000000000
    ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018
#9 [ffff8819335efae0] pick_next_task_fair at ffffffff8106c511
#10 [ffff8819335efb30] schedule at ffffffff81529746
#11 [ffff8819335efc00] futex_wait_queue_me at ffffffff810b226a
#12 [ffff8819335efc40] futex_wait at ffffffff810b33a0
#13 [ffff8819335efdb0] do_futex at ffffffff810b4c91
#14 [ffff8819335efef0] sys_futex at ffffffff810b56cb
#15 [ffff8819335eff80] system_call_fastpath at ffffffff8100b072
...

  - pick_next_task_fair calls pick_next_entity
  - pick_next_entity calls __pick_first_entity and gets NULL from cfs_rq->rb_leftmost
  - cfs_rq->skip is NULL so it gets through (cfs_rq->skip == se) condition
    and calls __pick_next_entity(se) which fails on rb_next(&se->run_node)

it seems that upstream could fail also via:
  - pick_next_task_fair calls pick_next_entity with curr == NULL (simple case)
  - __pick_first_entity calls __pick_first_entity and gets NULL from cfs_rq->rb_leftmost
  - pick_next_entity returns NULL
  - pick_next_task_fair calls set_next_entity with se = NULL
  - set_next_entity fails on se->on_rq

would attached patch make sense or do I miss some rb_leftmost rules/behaviour?

thanks,
jirka


---
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index d113c3ba8bc4..72b4d386086e 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -538,7 +538,7 @@ static void __dequeue_entity(struct cfs_rq *cfs_rq, struct sched_entity *se)
 
 struct sched_entity *__pick_first_entity(struct cfs_rq *cfs_rq)
 {
-	struct rb_node *left = cfs_rq->rb_leftmost;
+	struct rb_node *left = cfs_rq->rb_leftmost ? : rb_first(&cfs_rq->tasks_timeline);
 
 	if (!left)
 		return NULL;
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/