linux-kernel - [lkp-robot] [prlimit,security,selinux] e835a28ee6: kernel_BUG_at

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <20170228020742.GE12307@yexl-desktop>
Date:   Tue, 28 Feb 2017 10:07:42 +0800
From:   kernel test robot <xiaolong.ye@...el.com>
To:     Stephen Smalley <sds@...ho.nsa.gov>
Cc:     James Morris <james.l.morris@...cle.com>,
        LKML <linux-kernel@...r.kernel.org>,
        linux-security-module@...r.kernel.org, lkp@...org
Subject: [lkp-robot] [prlimit,security,selinux]  e835a28ee6:
 kernel_BUG_at_security/selinux/avc.c


FYI, we noticed the following commit:

commit: e835a28ee6bb15b8da506e0d59142501f6685cc3 ("prlimit,security,selinux: add a security hook for prlimit")
https://git.kernel.org/cgit/linux/kernel/git/jmorris/linux-security.git next-queue

in testcase: trinity
with following parameters:

	runtime: 300s

test-description: Trinity is a linux system call fuzz tester.
test-url: http://codemonkey.org.uk/projects/trinity/


on test machine: qemu-system-x86_64 -enable-kvm -m 320M

caused below changes (please refer to attached dmesg/kmsg for entire log/backtrace):


+-------------------------------------------------+------------+------------+
|                                                 | 437f6671e5 | e835a28ee6 |
+-------------------------------------------------+------------+------------+
| boot_successes                                  | 50         | 45         |
| boot_failures                                   | 21         | 34         |
| invoked_oom-killer:gfp_mask=0x                  | 21         | 25         |
| Mem-Info                                        | 21         | 25         |
| BUG:kernel_reboot-without-warning_in_test_stage | 0          | 2          |
| kernel_BUG_at_security/selinux/avc.c            | 0          | 8          |
| invalid_opcode:#[##]SMP                         | 0          | 8          |
| Kernel_panic-not_syncing:Fatal_exception        | 0          | 8          |
+-------------------------------------------------+------------+------------+



[   23.834957] kernel BUG at security/selinux/avc.c:1108!
[   23.836371] invalid opcode: 0000 [#1] SMP
[   23.837488] Modules linked in:
[   23.838513] CPU: 0 PID: 1072 Comm: trinity-c2 Not tainted 4.10.0-rc3-00117-ge835a28 #3
[   23.840597] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.9.3-20161025_171302-gandalf 04/01/2014
[   23.842987] task: ffff880019adc900 task.stack: ffffc90000390000
[   23.844318] RIP: 0010:avc_has_perm_noaudit+0x4/0x10
[   23.845597] RSP: 0018:ffffc90000393db0 EFLAGS: 00010246
[   23.846831] RAX: ffff8800098af220 RBX: ffffffff81ef6c00 RCX: 0000000000000000
[   23.848302] RDX: 0000000000000002 RSI: 0000000000000001 RDI: 0000000000000001
[   23.849775] RBP: ffffc90000393db0 R08: 0000000000000000 R09: 000000009a9a9a9a
[   23.851255] R10: 0000000000000000 R11: 0000000000000296 R12: 0000000000000000
[   23.852736] R13: ffff880019aa59c0 R14: ffff880019aa5600 R15: 0000000000000000
[   23.854226] FS:  0000000000000000(0000) GS:ffff88000be00000(0063) knlGS:00000000095f0840
[   23.868328] CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
[   23.869642] CR2: 00000000f703c054 CR3: 0000000000045000 CR4: 00000000000006f0
[   23.871138] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   23.872657] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
[   23.874163] Call Trace:
[   23.875063]  avc_has_perm+0x14e/0x190
[   23.876113]  ? file_has_perm+0x79/0xa0
[   23.877209]  ? __mutex_lock_slowpath+0x23c/0x2f0
[   23.878414]  ? kernfs_dop_revalidate+0xa1/0xb0
[   23.879599]  selinux_task_prlimit+0x3c/0x40
[   23.893781]  security_task_prlimit+0x43/0x60
[   23.895046]  SyS_prlimit64+0xeb/0x260
[   23.896157]  ? syscall_trace_enter+0x26d/0x2c0
[   23.897331]  ? do_mprotect_pkey+0xe4/0x300
[   23.898458]  do_fast_syscall_32+0xab/0x250
[   23.899585]  entry_SYSENTER_compat+0x4c/0x5b
[   23.900739] RIP: 0023:0xf770bc99
[   23.901767] RSP: 002b:00000000ffcb53bc EFLAGS: 00000296 ORIG_RAX: 0000000000000154
[   23.903861] RAX: ffffffffffffffda RBX: 0000000000000382 RCX: 00000000ffffc000
[   23.905370] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000c8c8c8c8
[   23.919923] RBP: 000000009a9a9a9a R08: 0000000000000000 R09: 0000000000000000
[   23.947402] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
[   23.948940] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[   23.950511] Code: 00 89 04 24 e8 6e fc ff ff 31 c0 48 83 c4 20 5b 41 5c 41 5d 5d c3 b8 f3 ff ff ff eb ee 66 2e 0f 1f 84 00 00 00 00 00 55 48 89 e5 <0f> 0b 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 55 48 89 e5 
[   23.954683] RIP: avc_has_perm_noaudit+0x4/0x10 RSP: ffffc90000393db0
[   23.956224] ---[ end trace 81029cdc303a3c07 ]---


To reproduce:

        git clone git://git.kernel.org/pub/scm/linux/kernel/git/wfg/lkp-tests.git
        cd lkp-tests
        bin/lkp qemu -k <bzImage> job-script  # job-script is attached in this email



Thanks,
Xiaolong

View attachment "config-4.10.0-rc3-00117-ge835a28" of type "text/plain" (155593 bytes)

View attachment "job-script" of type "text/plain" (3591 bytes)

Download attachment "dmesg.xz" of type "application/octet-stream" (11448 bytes)