| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <CACT4Y+aYmci-yfciHLyp9yUj=6x4P3C+cU4D5eJJCUoamLvo2A@mail.gmail.com>
Date: Tue, 1 Mar 2016 12:29:50 +0100
From: Dmitry Vyukov <dvyukov@...gle.com>
To: Alexander Viro <viro@...iv.linux.org.uk>,
"linux-fsdevel@...r.kernel.org" <linux-fsdevel@...r.kernel.org>,
LKML <linux-kernel@...r.kernel.org>,
Andrea Arcangeli <aarcange@...hat.com>,
Pavel Emelyanov <xemul@...allels.com>,
Andrew Morton <akpm@...ux-foundation.org>,
Linus Torvalds <torvalds@...ux-foundation.org>
Cc: syzkaller <syzkaller@...glegroups.com>,
Kostya Serebryany <kcc@...gle.com>,
Alexander Potapenko <glider@...gle.com>,
Sasha Levin <sasha.levin@...cle.com>
Subject: fs: uninterruptible hang in handle_userfault
Hello,
The following program creates an unkillable process in D state:
// autogenerated by syzkaller (http://github.com/google/syzkaller)
#include <pthread.h>
#include <stdint.h>
#include <string.h>
#include <sys/syscall.h>
#include <unistd.h>
#ifndef SYS_userfaultfd
#define SYS_userfaultfd 323
#endif
long r[38];
int main()
{
memset(r, -1, sizeof(r));
r[0] = syscall(SYS_mmap, 0x20000000ul, 0xc40000ul, 0x3ul, 0x32ul,
0xfffffffffffffffful, 0x0ul);
r[1] = syscall(SYS_userfaultfd, 0x800ul, 0, 0, 0, 0, 0);
*(uint64_t*)0x20c32000 = (uint64_t)0xaa;
*(uint64_t*)0x20c32008 = (uint64_t)0x0;
*(uint64_t*)0x20c32010 = (uint64_t)0x0;
r[5] = syscall(SYS_ioctl, r[1], 0xc018aa3ful, 0x20c32000ul, 0, 0, 0);
r[6] = syscall(SYS_munmap, 0x20879000ul, 0x3000ul, 0, 0, 0, 0);
r[7] =
syscall(SYS_sigaltstack, 0x208e1000ul, 0x2087affeul, 0, 0, 0, 0);
r[8] = syscall(SYS_socketpair, 0x1ul, 0xaul, 0x7ffffffful,
0x201d7ffcul, 0, 0);
if (r[8] != -1)
r[9] = *(uint32_t*)0x201d7ffc;
if (r[8] != -1)
r[10] = *(uint32_t*)0x201d8000;
r[11] = syscall(SYS_getsockopt, r[10], 0x1ul, 0xdul, 0x2087a000ul,
0x2087a000ul, 0);
*(uint64_t*)0x20c2c9d2 = (uint64_t)0x200cb000;
*(uint64_t*)0x20c2c9da = (uint64_t)0x800000;
*(uint64_t*)0x20c2c9e2 = (uint64_t)0x1;
*(uint64_t*)0x20c2c9ea = (uint64_t)0x0;
r[16] = syscall(SYS_ioctl, r[1], 0xc020aa00ul, 0x20c2c9d2ul, 0, 0, 0);
*(uint64_t*)0x20c35000 = (uint64_t)0x2028b000;
*(uint64_t*)0x20c35008 = (uint64_t)0x81;
*(uint64_t*)0x20c35010 = (uint64_t)0x201de000;
r[20] =
syscall(SYS_set_robust_list, 0x20c35000ul, 0x18ul, 0, 0, 0, 0);
memcpy((void*)0x2087bffa, "\x2e\x2f\x62\x75\x73\x00", 6);
memcpy((void*)0x2087b000, "\x2e\x2f\x62\x75\x73\x00", 6);
r[23] = syscall(SYS_linkat, r[10], 0x2087bffaul, r[9], 0x2087b000ul,
0x1400ul, 0);
r[24] = syscall(SYS_pipe2, 0x201d77ceul, 0x800ul, 0, 0, 0, 0);
if (r[24] != -1)
r[25] = *(uint32_t*)0x201d77ce;
if (r[24] != -1)
r[26] = *(uint32_t*)0x201d77d2;
*(uint64_t*)0x2087bff9 = (uint64_t)0x20bff000;
*(uint64_t*)0x2087c001 = (uint64_t)0x1000;
r[29] = syscall(SYS_ioctl, r[9], 0x8010aa02ul, 0x2087bff9ul, 0, 0, 0);
r[30] = syscall(SYS_fstat, r[26], 0x2037463bul, 0, 0, 0, 0);
memcpy((void*)0x20693fed, "\x73\x65\x6c\x69\x6e\x75\x78\x2c\x65\x6d"
"\x30\x09\x70\x70\x70\x30\x2f\x29\x00",
19);
r[32] = syscall(SYS_fgetxattr, r[25], 0x20693fedul, 0x20c366c0ul,
0x7dul, 0, 0);
r[33] = syscall(SYS_dup3, r[26], r[1], 0x80000ul, 0, 0, 0);
*(uint64_t*)0x2087bff5 = (uint64_t)0xaa;
*(uint64_t*)0x2087bffd = (uint64_t)0x0;
*(uint64_t*)0x2087c005 = (uint64_t)0x0;
r[37] =
syscall(SYS_ioctl, r[26], 0xc018aa3ful, 0x2087bff5ul, 0, 0, 0);
return 0;
}
The hang stack is:
[<ffffffff818bc380>] handle_userfault+0x680/0xe50 fs/userfaultfd.c:357
[<ffffffff8179249d>] do_huge_pmd_anonymous_page+0x7bd/0xd90 mm/huge_memory.c:904
[< inline >] create_huge_pmd mm/memory.c:3252
[< inline >] __handle_mm_fault mm/memory.c:3371
[<ffffffff816fb47d>] handle_mm_fault+0x30fd/0x4a10 mm/memory.c:3457
[<ffffffff812834c6>] __do_page_fault+0x376/0x960 arch/x86/mm/fault.c:1245
[<ffffffff81283c14>] trace_do_page_fault+0xf4/0x4f0 arch/x86/mm/fault.c:1338
[<ffffffff81274da4>] do_async_page_fault+0x14/0xd0 arch/x86/kernel/kvm.c:264
[<ffffffff866a5578>] async_page_fault+0x28/0x30 arch/x86/entry/entry_64.S:986
[<ffffffff81352874>] mm_release+0x2e4/0x410 kernel/fork.c:864
[< inline >] exit_mm kernel/exit.c:391
[<ffffffff813635df>] do_exit+0x42f/0x2d20 kernel/exit.c:735
[<ffffffff81366048>] do_group_exit+0x108/0x330 kernel/exit.c:878
[<ffffffff81389598>] get_signal+0x628/0x1560 kernel/signal.c:2307
[<ffffffff811a4db3>] do_signal+0x83/0x1c90 arch/x86/kernel/signal.c:712
[<ffffffff81006685>] exit_to_usermode_loop+0x1a5/0x210
arch/x86/entry/common.c:247
[<ffffffff810082cc>] prepare_exit_to_usermode+0x10c/0x130
arch/x86/entry/common.c:282
[<ffffffff866a3d74>] retint_user+0x8/0x23 arch/x86/entry/entry_64.S:559
[<ffffffffffffffff>] 0xffffffffffffffff
strace output:
mmap(0x20000000, 12845056, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
syscall_323(0x800, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0) = 0x3
ioctl(3, 0xc018aa3f, 0x20c32000) = 0
munmap(0x20879000, 12288) = 0
sigaltstack({ss_sp=0, ss_flags=0, ss_size=0}, ) = ?
socketpair(PF_FILE, SOCK_PACKET, 2147483647, 0x201d7ffc) = -1
EPROTONOSUPPORT (Protocol not supported)
getsockopt(-1, SOL_SOCKET, SO_LINGER, 0x2087a000, 0x2087a000) = -1
EBADF (Bad file descriptor)
ioctl(3, 0xc020aa00, 0x20c2c9d2) = 0
set_robust_list(0x20c35000, 0x18) = 0
--- SIGSEGV (Segmentation fault) @ 0 (0) ---
On commit fc77dbd34c5c99bce46d40a2491937c3bcbd10af (4.5-rc6).
Powered by blists - more mailing lists