linux-kernel - Re: [PATCH] rcu: fix crash when reading rcudata debugfs node

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Thu, 29 Jun 2017 10:06:56 -0700
From:   "Paul E. McKenney" <paulmck@...ux.vnet.ibm.com>
To:     Leon Yang <leon.gh.yang@...il.com>
Cc:     linux-kernel@...r.kernel.org
Subject: Re: [PATCH] rcu: fix crash when reading rcudata debugfs node

On Thu, Jun 29, 2017 at 11:25:08AM -0500, Leon Yang wrote:
> With CONFIG_RCU_TRACE=y set, reading the rcu/<rcu_flavor>/rcudata file
> in debugfs will leads to a segmentation fault.
> 
> dmesg reports general protection fault with the following message:
> 
> task: ffffa0e715959d00 task.stack: ffffc117c7390000
> RIP: 0010:show_rcudata+0x4e/0x1e0
> RSP: 0018:ffffc117c7393d50 EFLAGS: 00010282
> RAX: ffffa0e8d7212098 RBX: ffffa0e8d721cd00 RCX: ffffa0e8d7200000
> RDX: 0000000000000000 RSI: 0000000000000e6c RDI: 0000000000000000
> RBP: ffffc117c7393d90 R08: 0000000000000000 R09: 0000000000000fff
> R10: ffffa0e8bf464000 R11: ffffa0e715959d00 R12: ffffa0e81ecf4100
> R13: ffffa0e8c51fcd00 R14: ffffa0e8d721cd00 R15: ffffa0e81ecf4100
> FS:  00007fea5a064700(0000) GS:ffffa0e8d7440000(0000) knlGS:0000000000000000
> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00007fea5a041008 CR3: 00000006035f1000 CR4: 00000000000406e0
> Call Trace:
>  seq_read+0x9e/0x440
>  ? lru_cache_add_active_or_unevictable+0x36/0xb0
>  full_proxy_read+0x54/0x90
>  __vfs_read+0x37/0x150
>  ? security_file_permission+0x9b/0xc0
>  vfs_read+0x93/0x130
>  SyS_read+0x55/0xc0
>  entry_SYSCALL_64_fastpath+0x1e/0xa9
> RIP: 0033:0x7fea59b89230
> RSP: 002b:00007ffca86f0418 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
> RAX: ffffffffffffffda RBX: 00007fea59e56b20 RCX: 00007fea59b89230
> RDX: 0000000000020000 RSI: 00007fea5a042000 RDI: 0000000000000003
> RBP: 0000000000021010 R08: ffffffffffffffff R09: 0000000000000000
> R10: 000000000000037b R11: 0000000000000246 R12: 0000000000022000
> R13: 00007fea59e56b78 R14: 0000000000001000 R15: 0000000000020000
> Code: f3 48 83 ec 18 48 63 8e 70 01 00 00 48 8b 86 c8 00 00 00 44 0f
> b6 46 1a 48 8b 76 10 48 83 c0 18 48 89 ca 48 8b 0c cd e0 f3 54 90 <48>
> 39 34 01 0f b6 73 18 89 d0 40 0f 94 c7 48 0f a3 05 5c 0f e8
> 
> In print_one_rcu_data(), the argument rdp is already a per_cpu pointer
> (see r_start():66). Therefore, calling per_cpu() on
> rdp->dynticks->rcu_qs_ctr will dereference invalid memory address.
> Since rdp->dynticks points to the per_cpu struct rcu_dynticks, using
> rdp->dynticks->rcu_qs_ctr directly will fix this problem.
> 
> Fixes: 9577df9a3122af08fff84b8a1a60dccf524a3891 ("rcu: Pull rcu_qs_ctr
> into rcu_dynticks structure")
> Signed-off-by: Leon Yang <leon.gh.yang@...il.com>

Good catch!

However, I have removed RCU's debugfs functionality because I have
since added event tracing.  It has been some years since I have used
RCU's debugfs.  Which might explain its bugginess.

If you tell me what you were wanting to use the debugfs for, I would be
happy to tell you how to some reasonable facsimile of that information
from event tracing.

							Thanx, Paul

> ---
> --- kernel/rcu/tree_trace.c.orig
> +++ kernel/rcu/tree_trace.c
> @@ -121,7 +121,7 @@ static void print_one_rcu_data(struct se
>     cpu_is_offline(rdp->cpu) ? '!' : ' ',
>     ulong2long(rdp->completed), ulong2long(rdp->gpnum),
>     rdp->cpu_no_qs.b.norm,
> -   rdp->rcu_qs_ctr_snap == per_cpu(rdp->dynticks->rcu_qs_ctr, rdp->cpu),
> +   rdp->rcu_qs_ctr_snap == rdp->dynticks->rcu_qs_ctr,
>     rdp->core_needs_qs);
>   seq_printf(m, " dt=%d/%llx/%d df=%lu",
>     rcu_dynticks_snap(rdp->dynticks),
>