linux-kernel - 4.10rc1 ipc locking bug.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20161230024710.7m6ewq3ewoprxqyf@codemonkey.org.uk>
Date:   Thu, 29 Dec 2016 21:47:10 -0500
From:   Dave Jones <davej@...emonkey.org.uk>
To:     Davidlohr Bueso <dave@...olabs.net>
Cc:     Linux Kernel <linux-kernel@...r.kernel.org>
Subject: 4.10rc1 ipc locking bug.

This is a new one for me..

=====================================
[ BUG: bad unlock balance detected! ]
4.10.0-rc1-think+ #8 Not tainted
-------------------------------------
trinity-c47/31138 is trying to release lock (
[CONT START] &(&new->lock)->rlock
[CONT START] ) at:
[<ffffffff8136627f>] SYSC_semtimedop+0x97f/0x11d0
but there are no more locks to release!
\x0aother info that might help us debug this:
2 locks held by trinity-c47/31138:
 #0: 
[CONT START]  (
[CONT START] rcu_read_lock
[CONT START] ){......}
[CONT START] , at: [<ffffffff813660c3>] SYSC_semtimedop+0x7c3/0x11d0
 #1: 
[CONT START]  (
[CONT START] &(&sma->sem_base[i].lock)->rlock
[CONT START] ){......}
[CONT START] , at: [<ffffffff813662ce>] SYSC_semtimedop+0x9ce/0x11d0
\x0astack backtrace:
CPU: 0 PID: 31138 Comm: trinity-c47 Not tainted 4.10.0-rc1-think+ #8 
Call Trace:
 dump_stack+0x4f/0x73
 ? SYSC_semtimedop+0x97f/0x11d0
 print_unlock_imbalance_bug+0xd8/0xe0
 ? SYSC_semtimedop+0x97f/0x11d0
 lock_release+0x391/0x5d0
 ? get_lock_stats+0x19/0x50
 _raw_spin_unlock+0x1f/0x50
 SYSC_semtimedop+0x97f/0x11d0
 ? SYSC_semtimedop+0x7c3/0x11d0
 ? ring_buffer_lock_reserve+0x156/0x430
 ? do_syscall_64+0x61/0x170
 ? SyS_semtimedop+0x10/0x10
 ? ring_buffer_unlock_commit+0x26/0xd0
 ? trace_function+0xb8/0xf0
 ? SyS_semtimedop+0x10/0x10
 ? do_syscall_64+0x61/0x170
 ? function_trace_call+0x13c/0x190
 ? 0xffffffffa0240077
 ? __context_tracking_exit.part.5+0x82/0x150
 ? SyS_semop+0x5/0x20
 ? __this_cpu_preempt_check+0x13/0x20
 SyS_semop+0x10/0x20
 do_syscall_64+0x61/0x170
 entry_SYSCALL64_slow_path+0x25/0x25
RIP: 0033:0x7f9e94cfc119
RSP: 002b:00007fffc355d498 EFLAGS: 00000246
[CONT START]  ORIG_RAX: 0000000000000041
RAX: ffffffffffffffda RBX: 0000000000000041 RCX: 00007f9e94cfc119
RDX: 0000000000000001 RSI: 0000000000000001 RDI: 0000000000000000
RBP: 00007f9e95281000 R08: 00000000000000b9 R09: a5a5a5a5a5a5a5a5
R10: ffffefff00000000 R11: 0000000000000246 R12: 0000000000000002
R13: 00007f9e95281048 R14: 00007f9e953d1ad8 R15: 00007f9e95281000