Message-ID: <CACT4Y+bq71x0=h2MPfXD=DY+d0EkU0GWZdCCVNpZ0CtNYVAiHQ@mail.gmail.com>
Date:	Mon, 12 Oct 2015 10:40:26 +0200
From:	Dmitry Vyukov <dvyukov@...gle.com>
To:	dhowells@...hat.com, james.l.morris@...cle.com, serge@...lyn.com,
	keyrings@...r.kernel.org, linux-security-module@...r.kernel.org,
	LKML <linux-kernel@...r.kernel.org>
Cc:	syzkaller@...glegroups.com, Kostya Serebryany <kcc@...gle.com>,
	Alexander Potapenko <glider@...gle.com>,
	Andrey Konovalov <andreyknvl@...gle.com>,
	Sasha Levin <sasha.levin@...cle.com>,
	Julien Tinnes <jln@...gle.com>, Kees Cook <keescook@...gle.com>
Subject: GPF in keyring_destroy

Hello,

The following program crashes kernel:

// autogenerated by syzkaller (http://github.com/google/syzkaller)
#include <syscall.h>
#include <string.h>
#include <stdint.h>

int main()
{
        long r0 = syscall(SYS_mmap, 0x20001000ul, 0x1000ul, 0x3ul,
0x32ul, 0xfffffffffffffffful, 0x0ul);
        long r1 = syscall(SYS_mmap, 0x20000000ul, 0x1000ul, 0x3ul,
0x32ul, 0xfffffffffffffffful, 0x0ul);
        *(uint64_t*)0x20000131 = 0x947;
        *(uint64_t*)0x20000139 = 0xa9be;
        *(uint64_t*)0x20000141 = 0x4;
        *(uint64_t*)0x20000149 = 0xfffffffffffffff8;
        *(uint64_t*)0x20000151 = 0x3;
        *(uint64_t*)0x20000159 = 0x1;
        *(uint64_t*)0x20000161 = 0x7;
        *(uint64_t*)0x20000169 = 0x3b;
        long r11 = syscall(SYS_mmap, 0x20002000ul, 0x1000ul, 0x3ul,
0x32ul, 0xfffffffffffffffful, 0x0ul);
        memcpy((void*)0x20002000,
"\x5d\x27\x7b\x65\x63\x72\x79\x70\x74\x66\x73\x5c\x73\x65\x6c\x69\x6e\x75\x78\x6e\x66\x73\x00",
23);
        memcpy((void*)0x20001ff4,
"\x23\x73\x65\x6c\x69\x6e\x75\x78\x2c\x62\x64\x65\x76\x72\x61\x6d\x66\x73\xe6\x68\x66\x73\x70\x6c\x75\x73\x7b\x2c\x28\x72\x6f\x6f\x74\x66\x73\x00",
36);
        memcpy((void*)0x20002000, "\x6b\x65\x79\x72\x69\x6e\x67\x00", 8);
        long r16 = syscall(SYS_request_key, 0x20002000ul,
0x20001ff4ul, 0x20002000ul, 0xfffffffffffffffbul, 0, 0);
        memcpy((void*)0x20002000,
"\x5d\x27\x7b\x65\x63\x72\x79\x70\x74\x66\x73\x5c\x73\x65\x6c\x69\x6e\x75\x78\x6e\x66\x73\x00",
23);
        memcpy((void*)0x20001ff4,
"\x23\x73\x65\x6c\x69\x6e\x75\x78\x2c\x62\x64\x65\x76\x72\x61\x6d\x66\x73\xe6\x68\x66\x73\x70\x6c\x75\x73\x7b\x2c\x28\x72\x6f\x6f\x74\x66\x73\x00",
36);
        memcpy((void*)0x20002000, "\x6b\x65\x79\x72\x69\x6e\x67\x00", 8);
        long r20 = syscall(SYS_request_key, 0x20002000ul,
0x20001ff4ul, 0x20002000ul, 0xfffffffffffffffbul, 0, 0);
        memcpy((void*)0x20002000,
"\x5d\x27\x7b\x65\x63\x72\x79\x70\x74\x66\x73\x5c\x73\x65\x6c\x69\x6e\x75\x78\x6e\x66\x73\x00",
23);
        memcpy((void*)0x20001ff4,
"\x23\x73\x65\x6c\x69\x6e\x75\x78\x2c\x62\x64\x65\x76\x72\x61\x6d\x66\x73\xe6\x68\x66\x73\x70\x6c\x75\x73\x7b\x2c\x28\x72\x6f\x6f\x74\x66\x73\x00",
36);
        memcpy((void*)0x20002000, "\x6b\x65\x79\x72\x69\x6e\x67\x00", 8);
        long r24 = syscall(SYS_request_key, 0x20002000ul,
0x20001ff4ul, 0x20002000ul, 0xfffffffffffffffbul, 0, 0);
        return 0;
}

To reproduce run the program several times, then wait a minute, run
again, repeat until crashes (the crash happens in a background thread
during deferred garbage collection).

Found with syzkaller fuzzer.

On commit c6fa8e6de3dc420cba092bf155b2ed25bcd537f7
(git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git)


BUG: unable to handle kernel paging request at 00000000ffffff8a
IP: [<     inline     >] list_del include/linux/list.h:107
IP: [<ffffffff81291add>] keyring_destroy+0x3d/0x80 security/keys/keyring.c:392
PGD 0
Oops: 0002 [#1] SMP KASAN
Modules linked in:
CPU: 2 PID: 505 Comm: kworker/2:1 Not tainted 4.3.0-rc4+ #47
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
Workqueue: events key_garbage_collector
task: ffff88006dd93400 ti: ffff88006dd68000 task.ti: ffff88006dd68000
RIP: 0010:[<ffffffff81291add>]  [<ffffffff81291add>] keyring_destroy+0x3d/0x80
RSP: 0018:ffff88006dd6fda8  EFLAGS: 00010213
RAX: 00000000ffffff82 RBX: ffff88006d73bc00 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffff88006dd93400 RDI: ffffffff821077a0
RBP: ffff88006dd6fdb0 R08: ffff88006dd68000 R09: ffff88006dd93d40
R10: 000000000000072c R11: 0000000000000001 R12: ffff88006d73bc00
R13: 7fffffffffffffff R14: ffff88006dd70000 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff88006e800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: 00000000ffffff8a CR3: 000000006cda6000 CR4: 00000000000006e0
Stack:
 ffff88006d73bc08 ffff88006dd6fdd0 ffffffff81290131 0000000000000000
 0000000056177c32 ffff88006dd6fe18 ffffffff81290391 ffff88006e626d28
 0000000000000000 ffffffff81e812a0 ffff88006e746080 ffff88006e81d8c0
Call Trace:
 [<ffffffff81290131>] key_gc_unused_keys.constprop.1+0xa1/0xf0
security/keys/gc.c:139
 [<ffffffff81290391>] key_garbage_collector+0x1a1/0x360 security/keys/gc.c:294
 [<ffffffff8106630e>] process_one_work+0x13e/0x3c0 kernel/workqueue.c:2030
 [<ffffffff810666a5>] worker_thread+0x115/0x450 kernel/workqueue.c:2162
 [<     inline     >] ? context_switch kernel/sched/core.c:2651
 [<ffffffff81838e21>] ? __schedule+0x311/0x7e0 kernel/sched/core.c:3115
 [<ffffffff81066590>] ? process_one_work+0x3c0/0x3c0
kernel/workqueue.c:1973 (discriminator 1)
 [<ffffffff8106b4d4>] kthread+0xc4/0xe0 kernel/kthread.c:209
 [<ffffffff8106b410>] ? kthread_park+0x50/0x50 kernel/kthread.c:448
 [<ffffffff8183c9af>] ret_from_fork+0x3f/0x70 arch/x86/entry/entry_64.S:472
 [<ffffffff8106b410>] ? kthread_park+0x50/0x50 kernel/kthread.c:448
Code: 48 c7 c7 a0 77 10 82 e8 f2 a8 5a 00 48 8b 83 98 00 00 00 48 85
c0 74 36 48 8d 93 98 00 00 00 48 39 d0 74 2a 48 8b 93 a0 00 00 00 <48>
89 50 08 48 89 02 48 b8 00 01 00 00 00 00 ad de 48 89 83 98
RIP  [<     inline     >] list_del include/linux/list.h:107
RIP  [<ffffffff81291add>] keyring_destroy+0x3d/0x80 security/keys/keyring.c:392
 RSP <ffff88006dd6fda8>
CR2: 00000000ffffff8a
---[ end trace 92e3ff9d26bc918d ]---
BUG: unable to handle kernel paging request at ffffffffffffffd8
IP: [<ffffffff8106bbcb>] kthread_data+0xb/0x20 kernel/kthread.c:136
PGD 1e11067 PUD 1e13067 PMD 0
Oops: 0000 [#2] SMP KASAN
Modules linked in:
CPU: 2 PID: 505 Comm: kworker/2:1 Tainted: G      D         4.3.0-rc4+ #47
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
task: ffff88006dd93400 ti: ffff88006dd68000 task.ti: ffff88006dd68000
RIP: 0010:[<ffffffff8106bbcb>]  [<ffffffff8106bbcb>] kthread_data+0xb/0x20
RSP: 0018:ffff88006dd6fac8  EFLAGS: 00010002
RAX: 0000000000000000 RBX: 0000000000000002 RCX: 0000000000000002
RDX: ffff88003e810000 RSI: 0000000000000002 RDI: ffff88006dd93400
RBP: ffff88006dd6fac8 R08: 0000001d99efcfc6 R09: 0000000000000001
R10: ffff88003ded5f80 R11: 000000000000001a R12: ffff88006dd93400
R13: 000000000001e0c0 R14: 0000000000000002 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff88006e800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: 0000000000000028 CR3: 000000006cda6000 CR4: 00000000000006e0
Stack:
 ffff88006dd6fae0 ffffffff81066e8c ffff88006e81e0c0 ffff88006dd6fb28
 ffffffff81839041 ffff88006d6b97b0 ffff88006dd93400 ffff88006dd70000
 ffff88006dd93820 0000000000000046 ffff88006dd93400 ffff88003eaf0000
Call Trace:
 [<ffffffff81066e8c>] wq_worker_sleeping+0xc/0x80 kernel/workqueue.c:847
 [<ffffffff81839041>] __schedule+0x531/0x7e0 kernel/sched/core.c:3094
 [<ffffffff8183931e>] schedule+0x2e/0x70 kernel/sched/core.c:3144
(discriminator 1)
 [<ffffffff810529b3>] do_exit+0x693/0xb50 kernel/exit.c:824
 [<ffffffff81007564>] oops_end+0x84/0xc0 arch/x86/kernel/dumpstack.c:250
 [<ffffffff810443c4>] no_context+0x104/0x350 arch/x86/mm/fault.c:728
 [<     inline     >] ? context_switch kernel/sched/core.c:2651
 [<ffffffff81838e21>] ? __schedule+0x311/0x7e0 kernel/sched/core.c:3115
 [<ffffffff8104470e>] __bad_area_nosemaphore+0xfe/0x200 arch/x86/mm/fault.c:808
 [<ffffffff8104481e>] bad_area_nosemaphore+0xe/0x10 arch/x86/mm/fault.c:815
 [<ffffffff8104489c>] __do_page_fault+0x7c/0x3e0 arch/x86/mm/fault.c:1180
 [<ffffffff81085480>] ? __wake_up_common+0x50/0x80 kernel/sched/wait.c:73
 [<ffffffff81044c0c>] do_page_fault+0xc/0x10 arch/x86/mm/fault.c:1301
 [<ffffffff8183e422>] page_fault+0x22/0x30 arch/x86/entry/entry_64.S:979
 [<     inline     >] ? list_del include/linux/list.h:107
 [<ffffffff81291add>] ? keyring_destroy+0x3d/0x80 security/keys/keyring.c:392
 [<ffffffff81291abe>] ? keyring_destroy+0x1e/0x80 security/keys/keyring.c:388
 [<ffffffff81290131>] key_gc_unused_keys.constprop.1+0xa1/0xf0
security/keys/gc.c:139
 [<ffffffff81290391>] key_garbage_collector+0x1a1/0x360 security/keys/gc.c:294
 [<ffffffff8106630e>] process_one_work+0x13e/0x3c0 kernel/workqueue.c:2030
 [<ffffffff810666a5>] worker_thread+0x115/0x450 kernel/workqueue.c:2162
 [<     inline     >] ? context_switch kernel/sched/core.c:2651
 [<ffffffff81838e21>] ? __schedule+0x311/0x7e0 kernel/sched/core.c:3115
 [<ffffffff81066590>] ? process_one_work+0x3c0/0x3c0
kernel/workqueue.c:1973 (discriminator 1)
 [<ffffffff8106b4d4>] kthread+0xc4/0xe0 kernel/kthread.c:209
 [<ffffffff8106b410>] ? kthread_park+0x50/0x50 kernel/kthread.c:448
 [<ffffffff8183c9af>] ret_from_fork+0x3f/0x70 arch/x86/entry/entry_64.S:472
 [<ffffffff8106b410>] ? kthread_park+0x50/0x50 kernel/kthread.c:448
Code: 00 00 48 8d 04 c5 48 86 a0 81 48 89 e5 48 29 f0 48 89 c6 e8 48
fa ff ff 5d c3 66 0f 1f 44 00 00 55 48 8b 87 d0 04 00 00 48 89 e5 <48>
8b 40 d8 5d c3 66 66 66 66 66 66 2e 0f 1f 84 00 00 00 00 00
RIP  [<ffffffff8106bbcb>] kthread_data+0xb/0x20 kernel/kthread.c:136
 RSP <ffff88006dd6fac8>
CR2: ffffffffffffffd8
---[ end trace 92e3ff9d26bc918e ]---
Fixing recursive fault but reboot is needed!
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Powered by blists - more mailing lists