linux-kernel - Re: kmemleak splat on copy

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Tue, 16 May 2017 08:28:07 +0200
From:   Michal Hocko <mhocko@...nel.org>
To:     "Luis R. Rodriguez" <mcgrof@...nel.org>
Cc:     Andy Lutomirski <luto@...capital.net>,
        Andrew Morton <akpm@...ux-foundation.org>,
        Ingo Molnar <mingo@...nel.org>,
        Andy Lutomirski <luto@...nel.org>,
        Kees Cook <keescook@...omium.org>,
        "Eric W. Biederman" <ebiederm@...ssion.com>,
        Mateusz Guzik <mguzik@...hat.com>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        Catalin Marinas <catalin.marinas@....com>
Subject: Re: kmemleak splat on copy_process()

Let's CC Catalin

this smells like a kmemleak bug to me.

On Mon 15-05-17 23:53:18, Luis R. Rodriguez wrote:
> On Fri, Feb 17, 2017 at 11:32:34AM -0800, Andy Lutomirski wrote:
> > On Fri, Feb 17, 2017 at 9:23 AM, Luis R. Rodriguez <mcgrof@...nel.org> wrote:
> > > On Fri, Feb 17, 2017 at 9:07 AM, Andy Lutomirski <luto@...capital.net> wrote:
> > >> But maybe
> > >> there really is a race in which a kmemleak check right in the middle
> > >> of duplicating the task struct really can't see the stack pointer.
> > >
> > > Funny, but it was actually using kmemleak how I can easily reproduce:
> > >
> > > To reproduce the kmemleak splat:
> > >
> > > echo clear >  /sys/kernel/debug/kmemleak
> > > echo scan >  /sys/kernel/debug/kmemleak
> > > cat /sys/kernel/debug/kmemleak
> > 
> > Worked fine for me.  Maybe your config is special?
> 
> I don't think my config is special at all, here it is its just
> what I use for my qemu kvm guest image:
> 
> http://drvbp1.linux-foundation.org/~mcgrof/2017/05/15/configs/piggy-x86_64_qemu_fork_kmemleak.config
> 
> Another new kernel (next-20170515 based now on v4.12-rc1) and yet the same
> kmemleeak can be triggered easily, although this time I need to hit "scan"
> quite a bit more -- try using scan 6 times in a row or so.
> 
> echo clear >  /sys/kernel/debug/kmemleak
> echo scan >  /sys/kernel/debug/kmemleak
> echo scan >  /sys/kernel/debug/kmemleak
> echo scan >  /sys/kernel/debug/kmemleak
> echo scan >  /sys/kernel/debug/kmemleak
> echo scan >  /sys/kernel/debug/kmemleak
> cat /sys/kernel/debug/kmemleak
> 
> root@...gy:~# cat /sys/kernel/debug/kmemleak
> unreferenced object 0xffffa07500d4c000 (size 16384):
>   comm "bash", pid 1349, jiffies 4294895999 (age 263.204s)
>   hex dump (first 32 bytes):
>     9d 6e ac 57 00 00 00 00 00 00 00 00 00 00 00 00  .n.W............
>     00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
>   backtrace:
>     [<ffffffffa5464cca>] kmemleak_alloc+0x4a/0xa0
>     [<ffffffffa4fdfe6c>] __vmalloc_node_range+0x20c/0x2b0
>     [<ffffffffa4e7d1a2>] copy_process.part.37+0x5c2/0x1af0
>     [<ffffffffa4e7e89f>] _do_fork+0xcf/0x390
>     [<ffffffffa4e7ec09>] SyS_clone+0x19/0x20
>     [<ffffffffa4e03b0b>] do_syscall_64+0x5b/0xc0
>     [<ffffffffa547072b>] return_from_SYSCALL_64+0x0/0x6a
>     [<ffffffffffffffff>] 0xffffffffffffffff
> unreferenced object 0xffffa07500c30000 (size 16384):
>   comm "bash", pid 1394, jiffies 4294940106 (age 86.780s)
>   hex dump (first 32 bytes):
>     9d 6e ac 57 00 00 00 00 00 00 00 00 00 00 00 00  .n.W............
>     00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
>   backtrace:
>     [<ffffffffa5464cca>] kmemleak_alloc+0x4a/0xa0
>     [<ffffffffa4fdfe6c>] __vmalloc_node_range+0x20c/0x2b0
>     [<ffffffffa4e7d1a2>] copy_process.part.37+0x5c2/0x1af0
>     [<ffffffffa4e7e89f>] _do_fork+0xcf/0x390
>     [<ffffffffa4e7ec09>] SyS_clone+0x19/0x20
>     [<ffffffffa4e03b0b>] do_syscall_64+0x5b/0xc0
>     [<ffffffffa547072b>] return_from_SYSCALL_64+0x0/0x6a
>     [<ffffffffffffffff>] 0xffffffffffffffff
> unreferenced object 0xffffa07500c98000 (size 16384):
>   comm "bash", pid 1368, jiffies 4294956480 (age 21.284s)
>   hex dump (first 32 bytes):
>     9d 6e ac 57 00 00 00 00 00 00 00 00 fe 01 00 00  .n.W............
>     c0 f4 9d 44 2f e8 ff ff 00 de ac 44 2f e8 ff ff  ...D/......D/...
>   backtrace:  
>     [<ffffffffa5464cca>] kmemleak_alloc+0x4a/0xa0
>     [<ffffffffa4fdfe6c>] __vmalloc_node_range+0x20c/0x2b0
>     [<ffffffffa4e7d1a2>] copy_process.part.37+0x5c2/0x1af0
>     [<ffffffffa4e7e89f>] _do_fork+0xcf/0x390
>     [<ffffffffa4e7ec09>] SyS_clone+0x19/0x20
>     [<ffffffffa4e03b0b>] do_syscall_64+0x5b/0xc0
>     [<ffffffffa547072b>] return_from_SYSCALL_64+0x0/0x6a
>     [<ffffffffffffffff>] 0xffffffffffffffff
> 
> I confirm that stack is allocated and that a respective tsk->stack_vm_area gets
> assigned. So neither of these BUG() triggers, for instance but yet the kmemleak
> does:
> 
> diff --git a/kernel/fork.c b/kernel/fork.c
> index 657373b2ddd2..9bd7ccd55b89 100644
> --- a/kernel/fork.c
> +++ b/kernel/fork.c
> @@ -230,8 +230,12 @@ static unsigned long *alloc_thread_stack_node(struct task_struct *tsk, int node)
>  	 * free_thread_stack() can be called in interrupt context,
>  	 * so cache the vm_struct.
>  	 */
> -	if (stack)
> +	if (stack) {
>  		tsk->stack_vm_area = find_vm_area(stack);
> +		if (!tsk->stack_vm_area)
> +			BUG();
> +	} else
> +		BUG();
>  	return stack;
>  #else
>  	struct page *page = alloc_pages_node(node, THREADINFO_GFP,
> 
> 
> 
>   Luis

-- 
Michal Hocko
SUSE Labs